npm - @wildo-ai/platform-core-shared - Versions diffs - 1.1.10 → 1.1.12 - Mend

@wildo-ai/platform-core-shared 1.1.10 → 1.1.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (142) hide show

package/dist/esm/runtime/application-backend-env.contracts.d.ts CHANGED Viewed

@@ -12,8 +12,22 @@ export declare enum ApplicationBackendBootstrapEnvKey {
     PLATFORM_ENVIRONMENT_ID = "PLATFORM_ENVIRONMENT_ID",
     /** Deployment topology authority (`local` or `remote`), distinct from APPLICATION_ENV behavior mode and from the environment id. */
     DEPLOYMENT_LOCATION_TYPE = "DEPLOYMENT_LOCATION_TYPE",
+    /**
+     * The environment's service profile (`EnvironmentServiceProfile` in `@wildo-ai/platform-config-lib`, #2303): which
+     * optional backing services (ClamAV, immudb, mongot) it runs. Emitted only when the environment declares a profile
+     * other than `full`; absence means `full`. The application's boot reads it to REFUSE a capability whose service the
+     * profile omits, naming the profile, instead of letting the capability look enabled and do nothing.
+     */
+    ENVIRONMENT_SERVICE_PROFILE = "ENVIRONMENT_SERVICE_PROFILE",
     PLATFORM_APPLICATION_PRIMARY_SECRET = "PLATFORM_APPLICATION_PRIMARY_SECRET",
     PLATFORM_APPS_MANAGER_URL = "PLATFORM_APPS_MANAGER_URL",
+    /**
+     * The public keys (current, then next) every answer from apps-manager is verified against (#2921), as a one-line JWKS
+     * built by `buildRuntimeResponseVerificationKeySet`. Required: a runtime refuses to boot without it and refuses any
+     * unsigned or mis-signed answer. Public material, so not sensitive. Carried by every application runtime: backend,
+     * minions, workers and the development companion.
+     */
+    PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS = "PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS",
     APPLICATION_ENV = "APPLICATION_ENV"
 }
 export declare enum ApplicationBackendPlatformUrlEnvKey {
@@ -207,11 +221,11 @@ export declare const ApplicationBackendBootstrapEnvKeys: typeof ApplicationBacke
 export declare const ApplicationBackendPlatformUrlEnvKeys: typeof ApplicationBackendPlatformUrlEnvKey;
 export declare const ApplicationBackendRuntimeEnvKeys: typeof ApplicationBackendRuntimeEnvKey;
 export declare const ApplicationBackendDataEnvKeys: typeof ApplicationBackendDataEnvKey;
-export declare const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST: readonly [ApplicationBackendBootstrapEnvKey.APPLICATION_ID, ApplicationBackendBootstrapEnvKey.SERVICE_NAME, ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE, ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationBackendBootstrapEnvKey.APPLICATION_ENV];
+export declare const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST: readonly [ApplicationBackendBootstrapEnvKey.APPLICATION_ID, ApplicationBackendBootstrapEnvKey.SERVICE_NAME, ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE, ApplicationBackendBootstrapEnvKey.ENVIRONMENT_SERVICE_PROFILE, ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS, ApplicationBackendBootstrapEnvKey.APPLICATION_ENV];
 export declare const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST: readonly [ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL, ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL];
 export declare const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST: readonly [ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME];
 export declare const APPLICATION_BACKEND_DATA_ENV_KEY_LIST: readonly [ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER, ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT, ApplicationBackendDataEnvKey.MONGODB_HOST, ApplicationBackendDataEnvKey.MONGODB_DATABASE, ApplicationBackendDataEnvKey.MONGODB_PROTOCOL, ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION, ApplicationBackendDataEnvKey.MONGODB_TLS, ApplicationBackendDataEnvKey.MONGODB_REPLICA_SET, ApplicationBackendDataEnvKey.POSTGRESQL_HOST, ApplicationBackendDataEnvKey.POSTGRESQL_PORT, ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE, ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE, ApplicationBackendDataEnvKey.REDIS_HOST, ApplicationBackendDataEnvKey.REDIS_PORT, ApplicationBackendDataEnvKey.REDIS_DATABASE, ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX, ApplicationBackendDataEnvKey.RABBITMQ_HOST, ApplicationBackendDataEnvKey.RABBITMQ_PORT, ApplicationBackendDataEnvKey.RABBITMQ_VHOST, ApplicationBackendDataEnvKey.STORAGE_PROVIDER, ApplicationBackendDataEnvKey.STORAGE_ENDPOINT, ApplicationBackendDataEnvKey.STORAGE_PORT, ApplicationBackendDataEnvKey.STORAGE_USE_SSL, ApplicationBackendDataEnvKey.STORAGE_BUCKET, ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX, ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR, ApplicationBackendDataEnvKey.CLAMAV_HOST, ApplicationBackendDataEnvKey.CLAMAV_PORT, ApplicationBackendDataEnvKey.YARA_ENABLED, ApplicationBackendDataEnvKey.YARA_HOST, ApplicationBackendDataEnvKey.YARA_PORT];
-export declare const APPLICATION_BACKEND_ENV_KEY_LIST: readonly [ApplicationBackendBootstrapEnvKey.APPLICATION_ID, ApplicationBackendBootstrapEnvKey.SERVICE_NAME, ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE, ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationBackendBootstrapEnvKey.APPLICATION_ENV, ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL, ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME, ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER, ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT, ApplicationBackendDataEnvKey.MONGODB_HOST, ApplicationBackendDataEnvKey.MONGODB_DATABASE, ApplicationBackendDataEnvKey.MONGODB_PROTOCOL, ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION, ApplicationBackendDataEnvKey.MONGODB_TLS, ApplicationBackendDataEnvKey.MONGODB_REPLICA_SET, ApplicationBackendDataEnvKey.POSTGRESQL_HOST, ApplicationBackendDataEnvKey.POSTGRESQL_PORT, ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE, ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE, ApplicationBackendDataEnvKey.REDIS_HOST, ApplicationBackendDataEnvKey.REDIS_PORT, ApplicationBackendDataEnvKey.REDIS_DATABASE, ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX, ApplicationBackendDataEnvKey.RABBITMQ_HOST, ApplicationBackendDataEnvKey.RABBITMQ_PORT, ApplicationBackendDataEnvKey.RABBITMQ_VHOST, ApplicationBackendDataEnvKey.STORAGE_PROVIDER, ApplicationBackendDataEnvKey.STORAGE_ENDPOINT, ApplicationBackendDataEnvKey.STORAGE_PORT, ApplicationBackendDataEnvKey.STORAGE_USE_SSL, ApplicationBackendDataEnvKey.STORAGE_BUCKET, ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX, ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR, ApplicationBackendDataEnvKey.CLAMAV_HOST, ApplicationBackendDataEnvKey.CLAMAV_PORT, ApplicationBackendDataEnvKey.YARA_ENABLED, ApplicationBackendDataEnvKey.YARA_HOST, ApplicationBackendDataEnvKey.YARA_PORT];
+export declare const APPLICATION_BACKEND_ENV_KEY_LIST: readonly [ApplicationBackendBootstrapEnvKey.APPLICATION_ID, ApplicationBackendBootstrapEnvKey.SERVICE_NAME, ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE, ApplicationBackendBootstrapEnvKey.ENVIRONMENT_SERVICE_PROFILE, ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS, ApplicationBackendBootstrapEnvKey.APPLICATION_ENV, ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL, ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME, ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER, ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT, ApplicationBackendDataEnvKey.MONGODB_HOST, ApplicationBackendDataEnvKey.MONGODB_DATABASE, ApplicationBackendDataEnvKey.MONGODB_PROTOCOL, ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION, ApplicationBackendDataEnvKey.MONGODB_TLS, ApplicationBackendDataEnvKey.MONGODB_REPLICA_SET, ApplicationBackendDataEnvKey.POSTGRESQL_HOST, ApplicationBackendDataEnvKey.POSTGRESQL_PORT, ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE, ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE, ApplicationBackendDataEnvKey.REDIS_HOST, ApplicationBackendDataEnvKey.REDIS_PORT, ApplicationBackendDataEnvKey.REDIS_DATABASE, ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX, ApplicationBackendDataEnvKey.RABBITMQ_HOST, ApplicationBackendDataEnvKey.RABBITMQ_PORT, ApplicationBackendDataEnvKey.RABBITMQ_VHOST, ApplicationBackendDataEnvKey.STORAGE_PROVIDER, ApplicationBackendDataEnvKey.STORAGE_ENDPOINT, ApplicationBackendDataEnvKey.STORAGE_PORT, ApplicationBackendDataEnvKey.STORAGE_USE_SSL, ApplicationBackendDataEnvKey.STORAGE_BUCKET, ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX, ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR, ApplicationBackendDataEnvKey.CLAMAV_HOST, ApplicationBackendDataEnvKey.CLAMAV_PORT, ApplicationBackendDataEnvKey.YARA_ENABLED, ApplicationBackendDataEnvKey.YARA_HOST, ApplicationBackendDataEnvKey.YARA_PORT];
 /**
  * Keys that must always be treated as secrets when this app-backend env surface
  * is materialized into logs, CI artifacts, or deployment manifests.

package/dist/esm/runtime/application-backend-env.contracts.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-backend-env.contracts.d.ts","sourceRoot":"","sources":["~~../../../../~~src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oBAAY,iCAAiC;IAC3C,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,uBAAuB,4BAA4B;IACnD,oIAAoI;IACpI,wBAAwB,6BAA6B;IACrD,mCAAmC,wCAAwC;IAC3E,yBAAyB,8BAA8B;IACvD,eAAe,oBAAoB;CACpC;AAED,oBAAY,mCAAmC;IAC7C,qCAAqC,0CAA0C;IAC/E,4BAA4B,iCAAiC;CAC9D;AAED,oBAAY,+BAA+B;IACzC,6BAA6B,kCAAkC;IAC/D,8IAA8I;IAC9I,gCAAgC,qCAAqC;IACrE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,oBAAY,4BAA4B;IACtC;;;;;;;;;;;;;OAaG;IACH,wBAAwB,6BAA6B;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,kBAAkB,uBAAuB;IACzC,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,yBAAyB,8BAA8B;IACvD;;;;;;;;;;;;OAYG;IACH,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;;;OAOG;IACH,eAAe,oBAAoB;IACnC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAC3C,UAAU,eAAe;IACzB,UAAU,eAAe;IACzB;;;;OAIG;IACH,cAAc,mBAAmB;IACjC;;;;;;;;;;;;OAYG;IACH,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,qBAAqB;IACrC,YAAY,iBAAiB;IAC7B,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC;;;;;;;;;;;OAWG;IACH,qBAAqB,0BAA0B;~~IAc~~/C,sBAAsB,2BAA2B;IACjD,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,kCAAkC,0CAAoC,CAAC;AACpF,eAAO,MAAM,oCAAoC,4CAAsC,CAAC;AACxF,eAAO,MAAM,gCAAgC,wCAAkC,CAAC;AAChF,eAAO,MAAM,6BAA6B,qCAA+B,CAAC;AAE1E,eAAO,MAAM,0CAA0C,~~2ZAQ7C~~,CAAC;AAEX,eAAO,MAAM,6CAA6C,wJAGhD,CAAC;AAEX,eAAO,MAAM,wCAAwC,4IAG3C,CAAC;AAEX,eAAO,MAAM,qCAAqC,+5CAgCxC,CAAC;AAEX,eAAO,MAAM,gCAAgC,~~6jEAKnC~~,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,sCAAsC,~~aAKjD~~,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAClC,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAC3D,eAAO,MAAM,2BAA2B,SAAS,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOpE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD"}
1	+ {"version":3,"file":"application-backend-env.contracts.d.ts","sourceRoot":"","sources":["../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oBAAY,iCAAiC;IAC3C,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,uBAAuB,4BAA4B;IACnD,oIAAoI;IACpI,wBAAwB,6BAA6B;IACrD;;;;;OAKG;IACH,2BAA2B,gCAAgC;IAC3D,mCAAmC,wCAAwC;IAC3E,yBAAyB,8BAA8B;IACvD;;;;;OAKG;IACH,gDAAgD,qDAAqD;IACrG,eAAe,oBAAoB;CACpC;AAED,oBAAY,mCAAmC;IAC7C,qCAAqC,0CAA0C;IAC/E,4BAA4B,iCAAiC;CAC9D;AAED,oBAAY,+BAA+B;IACzC,6BAA6B,kCAAkC;IAC/D,8IAA8I;IAC9I,gCAAgC,qCAAqC;IACrE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,oBAAY,4BAA4B;IACtC;;;;;;;;;;;;;OAaG;IACH,wBAAwB,6BAA6B;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,kBAAkB,uBAAuB;IACzC,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,yBAAyB,8BAA8B;IACvD;;;;;;;;;;;;OAYG;IACH,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;;;OAOG;IACH,eAAe,oBAAoB;IACnC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAC3C,UAAU,eAAe;IACzB,UAAU,eAAe;IACzB;;;;OAIG;IACH,cAAc,mBAAmB;IACjC;;;;;;;;;;;;OAYG;IACH,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,qBAAqB;IACrC,YAAY,iBAAiB;IAC7B,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC;;;;;;;;;;;OAWG;IACH,qBAAqB,0BAA0B;IAa/C,sBAAsB,2BAA2B;IACjD,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,kCAAkC,0CAAoC,CAAC;AACpF,eAAO,MAAM,oCAAoC,4CAAsC,CAAC;AACxF,eAAO,MAAM,gCAAgC,wCAAkC,CAAC;AAChF,eAAO,MAAM,6BAA6B,qCAA+B,CAAC;AAE1E,eAAO,MAAM,0CAA0C,8iBAU7C,CAAC;AAEX,eAAO,MAAM,6CAA6C,wJAGhD,CAAC;AAEX,eAAO,MAAM,wCAAwC,4IAG3C,CAAC;AAEX,eAAO,MAAM,qCAAqC,+5CAgCxC,CAAC;AAEX,eAAO,MAAM,gCAAgC,gtEAKnC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,sCAAsC,aASjD,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAClC,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAC3D,eAAO,MAAM,2BAA2B,SAAS,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOpE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD"}

package/dist/esm/runtime/application-backend-env.contracts.js CHANGED Viewed

@@ -13,8 +13,22 @@ export var ApplicationBackendBootstrapEnvKey;
     ApplicationBackendBootstrapEnvKey["PLATFORM_ENVIRONMENT_ID"] = "PLATFORM_ENVIRONMENT_ID";
     /** Deployment topology authority (`local` or `remote`), distinct from APPLICATION_ENV behavior mode and from the environment id. */
     ApplicationBackendBootstrapEnvKey["DEPLOYMENT_LOCATION_TYPE"] = "DEPLOYMENT_LOCATION_TYPE";
+    /**
+     * The environment's service profile (`EnvironmentServiceProfile` in `@wildo-ai/platform-config-lib`, #2303): which
+     * optional backing services (ClamAV, immudb, mongot) it runs. Emitted only when the environment declares a profile
+     * other than `full`; absence means `full`. The application's boot reads it to REFUSE a capability whose service the
+     * profile omits, naming the profile, instead of letting the capability look enabled and do nothing.
+     */
+    ApplicationBackendBootstrapEnvKey["ENVIRONMENT_SERVICE_PROFILE"] = "ENVIRONMENT_SERVICE_PROFILE";
     ApplicationBackendBootstrapEnvKey["PLATFORM_APPLICATION_PRIMARY_SECRET"] = "PLATFORM_APPLICATION_PRIMARY_SECRET";
     ApplicationBackendBootstrapEnvKey["PLATFORM_APPS_MANAGER_URL"] = "PLATFORM_APPS_MANAGER_URL";
+    /**
+     * The public keys (current, then next) every answer from apps-manager is verified against (#2921), as a one-line JWKS
+     * built by `buildRuntimeResponseVerificationKeySet`. Required: a runtime refuses to boot without it and refuses any
+     * unsigned or mis-signed answer. Public material, so not sensitive. Carried by every application runtime: backend,
+     * minions, workers and the development companion.
+     */
+    ApplicationBackendBootstrapEnvKey["PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS"] = "PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS";
     ApplicationBackendBootstrapEnvKey["APPLICATION_ENV"] = "APPLICATION_ENV";
 })(ApplicationBackendBootstrapEnvKey || (ApplicationBackendBootstrapEnvKey = {}));
 export var ApplicationBackendPlatformUrlEnvKey;
@@ -208,7 +222,6 @@ export var ApplicationBackendDataEnvKey;
     // Re-adding them would not merely restore a variable: this enum is the DECLARED
     // app-backend env surface, so a key here is an invitation for a builder to fill
     // it. `assertNoStorageSecretInGeneratedEnv` fails the build if one ever does.
-    // See `.claude/plans/object-storage-root-credential-distribution.md`.
     ApplicationBackendDataEnvKey["STORAGE_LOCAL_BASE_DIR"] = "STORAGE_LOCAL_BASE_DIR";
     ApplicationBackendDataEnvKey["CLAMAV_HOST"] = "CLAMAV_HOST";
     ApplicationBackendDataEnvKey["CLAMAV_PORT"] = "CLAMAV_PORT";
@@ -229,8 +242,10 @@ export const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST = [
     ApplicationBackendBootstrapEnvKey.SERVICE_NAME,
     ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,
     ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE,
+    ApplicationBackendBootstrapEnvKey.ENVIRONMENT_SERVICE_PROFILE,
     ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,
     ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,
+    ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS,
     ApplicationBackendBootstrapEnvKey.APPLICATION_ENV,
 ];
 export const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST = [
@@ -286,6 +301,10 @@ export const APPLICATION_BACKEND_ENV_KEY_LIST = [
  */
 export const APPLICATION_BACKEND_SENSITIVE_ENV_KEYS = new Set([
     ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,
+    // The application's own operator-door secret (#586): a framework-managed material (`application.adminSecret`) that
+    // gates the data-seeding, external-data and approval-seal admin doors. It was missing here, so nothing classified it
+    // as a secret; it is also what a coding agent spawned by this backend must never inherit (#3018).
+    ApplicationBackendRuntimeEnvKey.APPLICATION_ADMIN_SECRET,
     // The storage pair is gone rather than listed: an app-tier env no longer
     // carries an object-storage credential at all, so there is nothing here to
     // mark sensitive. See the note on the enum above.

package/dist/esm/runtime/application-backend-env.contracts.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-backend-env.contracts.js","sourceRoot":"","sources":["../../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAN,IAAY,iCASX;AATD,WAAY,iCAAiC;IAC3C,sEAAiC,CAAA;IACjC,kEAA6B,CAAA;IAC7B,wFAAmD,CAAA;IACnD,oIAAoI;IACpI,0FAAqD,CAAA;IACrD,gHAA2E,CAAA;IAC3E,4FAAuD,CAAA;IACvD,wEAAmC,CAAA;AACrC,CAAC,EATW,iCAAiC,KAAjC,iCAAiC,QAS5C;AAED,MAAM,CAAN,IAAY,mCAGX;AAHD,WAAY,mCAAmC;IAC7C,sHAA+E,CAAA;IAC/E,oGAA6D,CAAA;AAC/D,CAAC,EAHW,mCAAmC,KAAnC,mCAAmC,QAG9C;AAED,MAAM,CAAN,IAAY,+BA4BX;AA5BD,WAAY,+BAA+B;IACzC,kGAA+D,CAAA;IAC/D,8IAA8I;IAC9I,wGAAqE,CAAA;IACrE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,wFAAqD,CAAA;AACvD,CAAC,EA5BW,+BAA+B,KAA/B,+BAA+B,QA4B1C;AAED,MAAM,CAAN,IAAY,4BAkKX;AAlKD,WAAY,4BAA4B;IACtC;;;;;;;;;;;;;OAaG;IACH,qFAAqD,CAAA;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,yEAAyC,CAAA;IACzC,6DAA6B,CAAA;IAC7B,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,uFAAuD,CAAA;IACvD;;;;;;;;;;;;OAYG;IACH,2DAA2B,CAAA;IAC3B;;;OAGG;IACH,2EAA2C,CAAA;IAC3C;;;;;;;OAOG;IACH,mEAAmC,CAAA;IACnC,mEAAmC,CAAA;IACnC,2EAA2C,CAAA;IAC3C,2EAA2C,CAAA;IAC3C,yDAAyB,CAAA;IACzB,yDAAyB,CAAA;IACzB;;;;OAIG;IACH,iEAAiC,CAAA;IACjC;;;;;;;;;;;;OAYG;IACH,qEAAqC,CAAA;IACrC,+DAA+B,CAAA;IAC/B,+DAA+B,CAAA;IAC/B;;;;;;;;OAQG;IACH,iEAAiC,CAAA;IACjC,qEAAqC,CAAA;IACrC;;;;;;;;;;;;;;OAcG;IACH,qEAAqC,CAAA;IACrC,6DAA6B,CAAA;IAC7B,mEAAmC,CAAA;IACnC,iEAAiC,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,+EAA+C,CAAA;IAC/C,8EAA8E;IAC9E,2CAA2C;IAC3C,EAAE;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,mEAAmE;IACnE,EAAE;IACF,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,sEAAsE;IACtE,iFAAiD,CAAA;IACjD,2DAA2B,CAAA;IAC3B,2DAA2B,CAAA;IAC3B,6DAA6B,CAAA;IAC7B,uDAAuB,CAAA;IACvB,uDAAuB,CAAA;AACzB,CAAC,EAlKW,4BAA4B,KAA5B,4BAA4B,QAkKvC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,iCAAiC,CAAC;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,mCAAmC,CAAC;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAC;AAChF,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC;AAE1E,MAAM,CAAC,MAAM,0CAA0C,GAAG;IACxD,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,YAAY;IAC9C,iCAAiC,CAAC,uBAAuB;IACzD,iCAAiC,CAAC,wBAAwB;IAC1D,iCAAiC,CAAC,mCAAmC;IACrE,iCAAiC,CAAC,yBAAyB;IAC3D,iCAAiC,CAAC,eAAe;CACzC,CAAC;AAEX,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D,mCAAmC,CAAC,qCAAqC;IACzE,mCAAmC,CAAC,4BAA4B;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,+BAA+B,CAAC,6BAA6B;IAC7D,+BAA+B,CAAC,gCAAgC;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,4BAA4B,CAAC,wBAAwB;IACrD,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,yBAAyB;IACtD,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,qBAAqB;IAClD,4BAA4B,CAAC,sBAAsB;IACnD,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,SAAS;IACtC,4BAA4B,CAAC,SAAS;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,GAAG,0CAA0C;IAC7C,GAAG,6CAA6C;IAChD,GAAG,wCAAwC;IAC3C,GAAG,qCAAqC;CAChC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAS;IACpE,iCAAiC,CAAC,mCAAmC;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,kDAAkD;CACnD,CAAC,CAAC;AAKH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,UAAU;SACd,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,uCAAuC;SAC9E,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,qCAAqC;SACpE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,mBAAmB;SACvC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,aAAa;SACnC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,GAAG,2BAA2B,GAAG,yBAAyB,CAAC,UAAU,CAAC,GAAG,2BAA2B,EAAE,CAAC;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,OAAO,GAAG;SACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,mCAAmC;SAC1E,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,+CAA+C;SAC3E,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,gCAAgC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAY;IACtF,OAAO,UAAU,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC","sourcesContent":["/*\n Shared environment contract for application backend processes.\n \n This is the canonical vocabulary for the app-backend `.env` surface emitted\n * by the CLI and parsed by backend runtimes. Keep the keys here purely\n * declarative: they describe names and ownership, not executor-specific\n * behavior.\n /\n\nexport enum ApplicationBackendBootstrapEnvKey {\n APPLICATION_ID = 'APPLICATION_ID',\n SERVICE_NAME = 'SERVICE_NAME',\n PLATFORM_ENVIRONMENT_ID = 'PLATFORM_ENVIRONMENT_ID',\n /* Deployment topology authority (`local` or `remote`), distinct from APPLICATION_ENV behavior mode and from the environment id. /\n DEPLOYMENT_LOCATION_TYPE = 'DEPLOYMENT_LOCATION_TYPE',\n PLATFORM_APPLICATION_PRIMARY_SECRET = 'PLATFORM_APPLICATION_PRIMARY_SECRET',\n PLATFORM_APPS_MANAGER_URL = 'PLATFORM_APPS_MANAGER_URL',\n APPLICATION_ENV = 'APPLICATION_ENV',\n}\n\nexport enum ApplicationBackendPlatformUrlEnvKey {\n PLATFORM_CRONTABS_BATCHES_MANAGER_URL = 'PLATFORM_CRONTABS_BATCHES_MANAGER_URL',\n PLATFORM_MODULE_REGISTRY_URL = 'PLATFORM_MODULE_REGISTRY_URL',\n}\n\nexport enum ApplicationBackendRuntimeEnvKey {\n APPLICATION_RUNTIME_ENDPOINTS = 'APPLICATION_RUNTIME_ENDPOINTS',\n /* Explicit app-owned filesystem handoff shared by a local backend and its companion. Absence means no filesystem transport is authorized. /\n APPLICATION_RUNTIME_SIGNALS_HOME = 'APPLICATION_RUNTIME_SIGNALS_HOME',\n /\n Secret gating the application's OPERATOR doors — the data-seeding admin surface and the\n * external-data admin surface, both root-mounted under `/internal/admin/...`.\n \n ## Why this key is declared here, and why the engine has its own copies\n \n The two consumers read `process.env` DIRECTLY, from\n * `data-seeding-admin.backend.contracts.ts` and `external-data-admin.backend.contracts.ts`, which\n * each declare the literal so that surface stays self-contained to `saas-backend-lib`. This is the\n * PRODUCER's copy: the CLI must know the name to emit it, and `saas-backend-lib` is not a\n * dependency of the CLI. Three copies of one string, cross-referenced, and pinned together by\n * `application-admin-secret-env-key.test.ts` — the same treatment the Node-version copies get,\n * for the same reason: no import can span these packages.\n \n ## Why it exists at all (#586)\n \n It did not, and neither door could be opened in any deployment the framework generates. The key\n * appeared in the two engine controllers that READ it and in shipped skill prose telling an\n * operator to author it in `secrets.json` — which nothing read. `providerEnv` could not carry it\n * either: `filterProviderEnvToScope` admits a key only when some scoped provider's secrets\n * contract declares its env-var name, and no provider declares this one, so it was dropped with a\n * warning. Measured 2026-09-10: zero writers, zero templates.\n /\n APPLICATION_ADMIN_SECRET = 'APPLICATION_ADMIN_SECRET',\n}\n\nexport enum ApplicationBackendDataEnvKey {\n /\n Which persistence adapter the application's resources use.\n \n DECLARED, not derived. Until this existed the config loader hard-coded MONGODB, so no\n * environment, secret or bootstrap value could select PostgreSQL — the adapter was reachable only\n * by a test that reached into the config object directly, which is why no application had ever\n * booted on it. Deriving it instead (\"PostgreSQL keys are present, so use PostgreSQL\") was\n * rejected: which store an application persists to is a deployment decision that must be legible\n * in one place, not an emergent property of which variables happen to be set.\n \n Absent means MONGODB, so every existing deployment is unaffected. That default is for processes\n * nothing configures; an APPLICATION backend never reaches it — the CLI writes the adapter resolved\n * from `applicationDatabase` for both engines (#1571: an absent `applicationDatabase` is PostgreSQL).\n /\n DATABASE_DEFAULT_ADAPTER = 'DATABASE_DEFAULT_ADAPTER',\n /\n The format NEW resource identifiers are minted in — `object-id` or `uuid`.\n \n DECLARED, and specifically NOT derived from {@link DATABASE_DEFAULT_ADAPTER}. The engine used to\n * derive it (MongoDB implied `OBJECT_ID`, PostgreSQL implied `UUID`), which made an application's\n * identity format a side effect of where its rows happen to live: moving a resource between\n * adapters silently changed the shape of every id it minted AND made every id it had already\n * minted fail `validateForResource`. Identity reaches URLs, exports, external references and\n * integrations, so it is an application-level decision that must outlive a storage decision.\n \n It needed an env key for the same reason the adapter did. The loader hard-coded\n * `ResourceIdFormat.OBJECT_ID`, so the value was legible nowhere and changeable by nobody: an\n * application could select PostgreSQL and still had no supported way to STATE its identity format,\n * which left the engine's \"declared, never derived\" rule true in the schema and unreachable in\n * practice.\n \n Absent means `OBJECT_ID` — what every existing application already mints — so no deployment\n * changes behaviour by adding this key to the contract.\n \n One deployment constraint travels with it: on PostgreSQL the `_id` COLUMN must be able to hold\n * the declared format. DDL rendered from the schema plan types it `text`, which is correct for\n * either member; a hand-written `_id uuid` column restricts the application to `UUID` and rejects\n * an `OBJECT_ID` outright.\n /\n RESOURCE_ID_FORMAT = 'RESOURCE_ID_FORMAT',\n MONGODB_HOST = 'MONGODB_HOST',\n MONGODB_DATABASE = 'MONGODB_DATABASE',\n MONGODB_PROTOCOL = 'MONGODB_PROTOCOL',\n MONGODB_DIRECT_CONNECTION = 'MONGODB_DIRECT_CONNECTION',\n /\n Whether the backend's MongoDB connection uses TLS (`'true'` / `'false'`), when the address it was given STATES\n * it (#2000). Absent means the protocol's default: on for `mongodb+srv`, off for `mongodb`.\n \n It exists because a `mongodb://` seed list for a server that requires TLS — an Atlas cluster with no SRV address,\n * whose `mongoURIWithOptions` carries `ssl=true` — was reduced to host, database and protocol, and the backend then\n * opened it without TLS, which Atlas refuses. Written by the CLI from an authored `externalEndpoints.mongodb`\n * connection URL, read by the backend config loader into `database.mongodb.options.tls`.\n \n spec-cite: MongoDB Manual, Connection String Options (https://www.mongodb.com/docs/manual/reference/connection-string-options/),\n * fetched 2026-09-29 — \"The `ssl` option is equivalent to the `tls` option\"; `tls` `true` is the \"Default for SRV\n * Connection Format\", `false` the \"Default for Standard Connection String Format\".\n /\n MONGODB_TLS = 'MONGODB_TLS',\n /\n The replica set a `mongodb://` seed list in `MONGODB_HOST` belongs to (#2000), from the authored connection URL's\n * `replicaSet` option. Absent for an SRV address, whose DNS record carries it.\n /\n MONGODB_REPLICA_SET = 'MONGODB_REPLICA_SET',\n /\n PostgreSQL TOPOLOGY only — host, port, database, ssl.\n \n CREDENTIALS are deliberately NOT here. They arrive through\n * `secrets.database.postgresql`, exactly as MongoDB's do: env carries where the database is,\n * secrets carry who may open it. Putting a password in an env contract would make it readable\n * from every process listing and every container inspect.\n /\n POSTGRESQL_HOST = 'POSTGRESQL_HOST',\n POSTGRESQL_PORT = 'POSTGRESQL_PORT',\n POSTGRESQL_DATABASE = 'POSTGRESQL_DATABASE',\n POSTGRESQL_SSL_MODE = 'POSTGRESQL_SSL_MODE',\n REDIS_HOST = 'REDIS_HOST',\n REDIS_PORT = 'REDIS_PORT',\n /\n Optional Redis logical database index (0–15). Emitted only when the\n * author sets `backingServices.redis.database` in `wildo.infra.<env>.config.ts`.\n * Consumers default to DB 0 when this var is missing.\n /\n REDIS_DATABASE = 'REDIS_DATABASE',\n /\n Canonical app-level Redis key namespace. Emitted only when the author\n * sets `dataServices.redis.keyPrefix` in `wildo.saas.config.ts` (Slice 3.6).\n * `RedisService` uses this as the `appPrefix` for all keys it writes — every\n * key becomes `${REDIS_KEY_PREFIX}org:${orgId}:${key}` or\n * `${REDIS_KEY_PREFIX}global:${key}`. When unset, the app-level prefix\n * stays empty (multi-tenant isolation falls back to the\n * `org:`/`global:` segment alone).\n \n REPLACE semantics: this supersedes the legacy\n * `secrets.database.redis.username`-derived prefix (Slice 3.6 audit\n * decision — single source of truth = `wildo.saas.config.dataServices`).\n /\n REDIS_KEY_PREFIX = 'REDIS_KEY_PREFIX',\n RABBITMQ_HOST = 'RABBITMQ_HOST',\n RABBITMQ_PORT = 'RABBITMQ_PORT',\n /\n Optional RabbitMQ virtual host. Emitted only when the author sets\n * `backingServices.rabbitmq.vhost` in `wildo.infra.<env>.config.ts`.\n * Consumers default to `/` (the RabbitMQ root vhost) when missing.\n \n Note (Slice 3.6 audit): the symmetric saas-side field\n * `dataServices.rabbitmq.vhost` was DELETED. Vhost is an\n * infra/topology concern with a single authoring seam (infra config).\n /\n RABBITMQ_VHOST = 'RABBITMQ_VHOST',\n STORAGE_PROVIDER = 'STORAGE_PROVIDER',\n /\n S3-compatible endpoint hostname (NOT a URL). The variable name\n * pre-dates the convention pin and is intentionally kept stable for\n * backward compatibility with deployed manifests, but the value is\n * always a bare host (`minio`, `s3.amazonaws.com`, `127.0.0.1`) — the\n * `STORAGE_PORT` and `STORAGE_USE_SSL` siblings are what compose the\n * full `https?://host:port` URL at the SDK initialization site.\n \n Slice 3.2 audit (L-4): authoring an explicit URL here (`http://...`)\n * silently breaks the `host:port` contract downstream because the SDK\n * concatenates the parts naively. If a future migration wants to flip\n * the contract to a URL, rename the env key (`STORAGE_URL`) rather\n * than overloading this one — the rename surfaces the breaking change\n * to operators.\n /\n STORAGE_ENDPOINT = 'STORAGE_ENDPOINT',\n STORAGE_PORT = 'STORAGE_PORT',\n STORAGE_USE_SSL = 'STORAGE_USE_SSL',\n STORAGE_BUCKET = 'STORAGE_BUCKET',\n /\n Optional app-level object-key namespace prefix prepended to every\n * application file path produced by `WildoManagedStorageProvider`\n * (Slice 3.6). Final key shape becomes\n * `${STORAGE_BUCKET_PREFIX}/applications/${applicationId}/files/${fileId}`\n * (extra segment above the existing `applicationId`-based namespace).\n \n Emitted only when the author sets `dataServices.s3.bucketPrefix` in\n * `wildo.saas.config.ts`. The actual MinIO bucket name (`STORAGE_BUCKET`)\n * remains infra-controlled and is unaffected by this prefix — N apps\n * can share one bucket while keeping their object trees disjoint.\n /\n STORAGE_BUCKET_PREFIX = 'STORAGE_BUCKET_PREFIX',\n // ⚠️ `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are deliberately ABSENT from\n // this contract, and must not be re-added.\n //\n // They carried the object store's ROOT credential — the same pair the MinIO\n // container itself is created with — into every application, minion and worker\n // environment. An application now obtains short-lived, prefix-confined session\n // credentials from apps-manager instead (`createStsStorageCredentialResolver`),\n // so there is no application-tier storage credential to name here.\n //\n // Re-adding them would not merely restore a variable: this enum is the DECLARED\n // app-backend env surface, so a key here is an invitation for a builder to fill\n // it. `assertNoStorageSecretInGeneratedEnv` fails the build if one ever does.\n // See `.claude/plans/object-storage-root-credential-distribution.md`.\n STORAGE_LOCAL_BASE_DIR = 'STORAGE_LOCAL_BASE_DIR',\n CLAMAV_HOST = 'CLAMAV_HOST',\n CLAMAV_PORT = 'CLAMAV_PORT',\n YARA_ENABLED = 'YARA_ENABLED',\n YARA_HOST = 'YARA_HOST',\n YARA_PORT = 'YARA_PORT',\n}\n\n/\n Keep the plural `Keys` aliases so current consumers keep reading naturally,\n while the actual source of truth is the scoped enum definition above.\n /\nexport const ApplicationBackendBootstrapEnvKeys = ApplicationBackendBootstrapEnvKey;\nexport const ApplicationBackendPlatformUrlEnvKeys = ApplicationBackendPlatformUrlEnvKey;\nexport const ApplicationBackendRuntimeEnvKeys = ApplicationBackendRuntimeEnvKey;\nexport const ApplicationBackendDataEnvKeys = ApplicationBackendDataEnvKey;\n\nexport const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST = [\n ApplicationBackendBootstrapEnvKey.APPLICATION_ID,\n ApplicationBackendBootstrapEnvKey.SERVICE_NAME,\n ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,\n ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE,\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,\n ApplicationBackendBootstrapEnvKey.APPLICATION_ENV,\n] as const;\n\nexport const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST = [\n ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL,\n ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL,\n] as const;\n\nexport const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST = [\n ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,\n ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME,\n] as const;\n\nexport const APPLICATION_BACKEND_DATA_ENV_KEY_LIST = [\n ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER,\n ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT,\n ApplicationBackendDataEnvKey.MONGODB_HOST,\n ApplicationBackendDataEnvKey.MONGODB_DATABASE,\n ApplicationBackendDataEnvKey.MONGODB_PROTOCOL,\n ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION,\n ApplicationBackendDataEnvKey.MONGODB_TLS,\n ApplicationBackendDataEnvKey.MONGODB_REPLICA_SET,\n ApplicationBackendDataEnvKey.POSTGRESQL_HOST,\n ApplicationBackendDataEnvKey.POSTGRESQL_PORT,\n ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE,\n ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE,\n ApplicationBackendDataEnvKey.REDIS_HOST,\n ApplicationBackendDataEnvKey.REDIS_PORT,\n ApplicationBackendDataEnvKey.REDIS_DATABASE,\n ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX,\n ApplicationBackendDataEnvKey.RABBITMQ_HOST,\n ApplicationBackendDataEnvKey.RABBITMQ_PORT,\n ApplicationBackendDataEnvKey.RABBITMQ_VHOST,\n ApplicationBackendDataEnvKey.STORAGE_PROVIDER,\n ApplicationBackendDataEnvKey.STORAGE_ENDPOINT,\n ApplicationBackendDataEnvKey.STORAGE_PORT,\n ApplicationBackendDataEnvKey.STORAGE_USE_SSL,\n ApplicationBackendDataEnvKey.STORAGE_BUCKET,\n ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX,\n ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR,\n ApplicationBackendDataEnvKey.CLAMAV_HOST,\n ApplicationBackendDataEnvKey.CLAMAV_PORT,\n ApplicationBackendDataEnvKey.YARA_ENABLED,\n ApplicationBackendDataEnvKey.YARA_HOST,\n ApplicationBackendDataEnvKey.YARA_PORT,\n] as const;\n\nexport const APPLICATION_BACKEND_ENV_KEY_LIST = [\n ...APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_DATA_ENV_KEY_LIST,\n] as const;\n\n/\n Keys that must always be treated as secrets when this app-backend env surface\n * is materialized into logs, CI artifacts, or deployment manifests.\n /\nexport const APPLICATION_BACKEND_SENSITIVE_ENV_KEYS = new Set<string>([\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n // The storage pair is gone rather than listed: an app-tier env no longer\n // carries an object-storage credential at all, so there is nothing here to\n // mark sensitive. See the note on the enum above.\n]);\n\nexport type ApplicationBackendEnvKey =\n typeof APPLICATION_BACKEND_ENV_KEY_LIST[number];\n\n/\n ────────────────────────────────────────────────────────────────────────\n * Backend → worker dispatch contract (G-8 / MW4)\n * ────────────────────────────────────────────────────────────────────────\n * A declared worker's HTTP base URL is injected into the app-backend env at\n * deploy time as `WILDO_WORKER_<NAME>_URL`. The `<NAME>` segment is DYNAMIC\n * (one per declared worker), so — unlike the static enums above — the key is a\n * HELPER, not a fixed member. Both the CLI EMIT side\n * (`PlatformEnvVarsBuilder.buildApplicationBackendEnv`) and the backend READ\n * side (`WorkerRemoteClientFactoryBackendService`) MUST derive the key + URL\n * through these single helpers so the two can never drift.\n /\nexport const WILDO_WORKER_URL_ENV_PREFIX = 'WILDO_WORKER_';\nexport const WILDO_WORKER_URL_ENV_SUFFIX = '_URL';\n\n/\n Normalize a worker identifier (the `wildo.saas.config.ts` bucket key —\n * camelCase or kebab-case, e.g. `myNodeWorker` / `my-node-worker`) into the\n * UPPER_SNAKE segment embedded inside `WILDO_WORKER_<NAME>_URL`. Both\n * `myNodeWorker` and `my-node-worker` normalize to `MY_NODE_WORKER`, so the env\n * key is stable regardless of the authoring style.\n /\nexport function normalizeWorkerEnvSegment(workerName: string): string {\n return workerName\n .replace(/([a-z0-9])([A-Z])/g, '$1_$2') // camelCase word boundary → underscore\n .replace(/[^A-Za-z0-9]+/g, '_') // kebab / space / other → underscore\n .replace(/_+/g, '_') // collapse repeats\n .replace(/^_\|_$/g, '') // trim edges\n .toUpperCase();\n}\n\n/\n The `WILDO_WORKER_<NAME>_URL` env-var name for a declared worker. The single\n * source of truth for both emit (CLI) and read (backend factory).\n \n @example wildoWorkerUrlEnvKey('myNodeWorker') // 'WILDO_WORKER_MY_NODE_WORKER_URL'\n /\nexport function wildoWorkerUrlEnvKey(workerName: string): string {\n return `${WILDO_WORKER_URL_ENV_PREFIX}${normalizeWorkerEnvSegment(workerName)}${WILDO_WORKER_URL_ENV_SUFFIX}`;\n}\n\n/\n Normalize a service key (the `wildo.saas.config.ts` `minions`/`workers` bucket\n * key — authored camelCase or kebab, e.g. `marketingScrapper` / `my-rust-worker`)\n * into an RFC1123-valid DNS label segment: lowercase, `[a-z0-9-]` only, no\n * leading/trailing hyphen. `marketingScrapper` → `marketing-scrapper`,\n * `myNodeWorker` → `my-node-worker`.\n \n This is the DNS-NAME axis of a background runtime — the segment embedded in the\n * k8s object/Service name, the built container image ref, the compose service name,\n * and the worker dispatch URL host. It is DISTINCT from the IDENTITY axis (the raw\n * bucket key), which apps-manager keys on (`appConfig.workers[key]` /\n * `appConfig.minions[key]`) and which the worker stamps as `APP_OWNED_SERVICE_NAME`\n * / both runtimes carry as the `wildo.ai/owned-service-name` pod label — the\n * identity axis MUST stay raw and is NEVER passed through this helper. The\n * env-key axis (`WILDO_WORKER_<NAME>_URL`) has its own normalization,\n * {@link normalizeWorkerEnvSegment}, because an env-var name is UPPER_SNAKE, not a\n * DNS label.\n \n This helper does NOT truncate — a name too long for a DNS label (63 chars) is\n * REJECTED at authoring, not silently shortened (truncation risks colliding with\n * a sibling key). Returns `''` for all-symbol input. The authoring-time guard in\n * `define-saas-config.ts` fails fast on keys that normalize to empty, collide with\n * a sibling after normalization, or whose full `{slug}-{kind}-{name}` deploy name\n * exceeds 63 chars — so an empty / duplicate / over-long DNS name can never reach\n * the render.\n /\nexport function normalizeServiceKeyToDnsName(key: string): string {\n return key\n .replace(/([a-z0-9])([A-Z])/g, '$1-$2') // camelCase word boundary → hyphen\n .toLowerCase()\n .replace(/[^a-z0-9]+/g, '-') // any non-DNS char (kebab already ok) → hyphen\n .replace(/^-+\|-+$/g, ''); // trim leading/trailing hyphens\n}\n\n/\n The k8s Service (and same-network compose service) name for a per-app worker:\n * `{appSlug}-worker-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Coherent-by-construction\n * with the CLI k8s render (`renderWorkerForTarget`), the compose render\n * (`deriveAppRuntimeServiceName`), the CI image build (`syncCicd`), and the worker\n * dispatch URL host ({@link buildWorkerInternalUrl}) — EVERY DNS-name site derives\n * the name through THIS helper (rather than inlining `{appSlug}-worker-{key}`), so\n * the backend calls the exact Service the render deploys and CI builds the exact\n * image ref the deploy pulls.\n \n `workerName` is the saas-config bucket key (NOT the per-folder `config.name`) —\n * passed raw; the normalization happens inside. The raw key remains the worker's\n * IDENTITY (apps-manager lookup + `APP_OWNED_SERVICE_NAME`), a separate axis that\n * is never derived from this function.\n /\nexport function buildWorkerServiceName(appSlug: string, workerName: string): string {\n return `${appSlug}-worker-${normalizeServiceKeyToDnsName(workerName)}`;\n}\n\n/\n The k8s Deployment (and same-network compose service) name for a per-app minion:\n * `{appSlug}-minion-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Symmetric with\n * {@link buildWorkerServiceName} — minions have no inbound Service / dispatch URL,\n * but the k8s render, the compose render, and the CI image build all need the\n * deploy name, and it must be RFC1123-valid for the same reasons. `minionName` is\n * the saas-config bucket key; the raw key stays the minion's IDENTITY (the\n * `wildo.ai/owned-service-name` pod label), never derived from here.\n /\nexport function buildMinionServiceName(appSlug: string, minionName: string): string {\n return `${appSlug}-minion-${normalizeServiceKeyToDnsName(minionName)}`;\n}\n\n/\n The in-cluster base URL the app-backend uses to reach a per-app worker\n * (`http://{appSlug}-worker-{workerName}:{port}`). The backend + its workers\n * deploy into the SAME namespace (per-app deploy), so the short Service name\n * resolves without a namespace qualifier. `port` is the worker's authored\n * `http.port` (schema default 8080).\n /\nexport function buildWorkerInternalUrl(appSlug: string, workerName: string, port: number): string {\n return `http://${buildWorkerServiceName(appSlug, workerName)}:${port}`;\n}\n\n/\n The base URL the app-backend uses to reach a per-app worker in LOCAL development.\n \n There is no k8s Service locally, so there is no name to resolve — the worker is a supervised\n * process listening on its authored `http.port` on the loopback interface, which is the same\n * convention every other local runtime address in this repository uses.\n \n ## Why this exists at all (#426)\n \n `buildApplicationWorkerDispatchUrls` used to return `undefined` for anything but REMOTE, on the\n * reasoning that \"local dev has no k8s Services, and worker dispatch is a k8s-deploy concern\". The\n * first half is still true and the second no longer is: local dev now STARTS the worker, so the\n * only thing missing was an address. Without one, `WorkerRemoteClientFactory.client()` fails closed\n * on the absent `WILDO_WORKER_<NAME>_URL` — which is why the whole backend-to-worker chain had\n * never been exercised by anyone, in a test or in the dev stack.\n \n Declared here, beside its in-cluster sibling and the env-key helper both sides derive, so the\n * emit side and the read side cannot drift apart for either deployment shape.\n */\nexport function buildWorkerLocalUrl(port: number): string {\n return `http://localhost:${port}`;\n}\n"]}
1	+ {"version":3,"file":"application-backend-env.contracts.js","sourceRoot":"","sources":["../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAN,IAAY,iCAuBX;AAvBD,WAAY,iCAAiC;IAC3C,sEAAiC,CAAA;IACjC,kEAA6B,CAAA;IAC7B,wFAAmD,CAAA;IACnD,oIAAoI;IACpI,0FAAqD,CAAA;IACrD;;;;;OAKG;IACH,gGAA2D,CAAA;IAC3D,gHAA2E,CAAA;IAC3E,4FAAuD,CAAA;IACvD;;;;;OAKG;IACH,0IAAqG,CAAA;IACrG,wEAAmC,CAAA;AACrC,CAAC,EAvBW,iCAAiC,KAAjC,iCAAiC,QAuB5C;AAED,MAAM,CAAN,IAAY,mCAGX;AAHD,WAAY,mCAAmC;IAC7C,sHAA+E,CAAA;IAC/E,oGAA6D,CAAA;AAC/D,CAAC,EAHW,mCAAmC,KAAnC,mCAAmC,QAG9C;AAED,MAAM,CAAN,IAAY,+BA4BX;AA5BD,WAAY,+BAA+B;IACzC,kGAA+D,CAAA;IAC/D,8IAA8I;IAC9I,wGAAqE,CAAA;IACrE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,wFAAqD,CAAA;AACvD,CAAC,EA5BW,+BAA+B,KAA/B,+BAA+B,QA4B1C;AAED,MAAM,CAAN,IAAY,4BAiKX;AAjKD,WAAY,4BAA4B;IACtC;;;;;;;;;;;;;OAaG;IACH,qFAAqD,CAAA;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,yEAAyC,CAAA;IACzC,6DAA6B,CAAA;IAC7B,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,uFAAuD,CAAA;IACvD;;;;;;;;;;;;OAYG;IACH,2DAA2B,CAAA;IAC3B;;;OAGG;IACH,2EAA2C,CAAA;IAC3C;;;;;;;OAOG;IACH,mEAAmC,CAAA;IACnC,mEAAmC,CAAA;IACnC,2EAA2C,CAAA;IAC3C,2EAA2C,CAAA;IAC3C,yDAAyB,CAAA;IACzB,yDAAyB,CAAA;IACzB;;;;OAIG;IACH,iEAAiC,CAAA;IACjC;;;;;;;;;;;;OAYG;IACH,qEAAqC,CAAA;IACrC,+DAA+B,CAAA;IAC/B,+DAA+B,CAAA;IAC/B;;;;;;;;OAQG;IACH,iEAAiC,CAAA;IACjC,qEAAqC,CAAA;IACrC;;;;;;;;;;;;;;OAcG;IACH,qEAAqC,CAAA;IACrC,6DAA6B,CAAA;IAC7B,mEAAmC,CAAA;IACnC,iEAAiC,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,+EAA+C,CAAA;IAC/C,8EAA8E;IAC9E,2CAA2C;IAC3C,EAAE;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,mEAAmE;IACnE,EAAE;IACF,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,iFAAiD,CAAA;IACjD,2DAA2B,CAAA;IAC3B,2DAA2B,CAAA;IAC3B,6DAA6B,CAAA;IAC7B,uDAAuB,CAAA;IACvB,uDAAuB,CAAA;AACzB,CAAC,EAjKW,4BAA4B,KAA5B,4BAA4B,QAiKvC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,iCAAiC,CAAC;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,mCAAmC,CAAC;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAC;AAChF,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC;AAE1E,MAAM,CAAC,MAAM,0CAA0C,GAAG;IACxD,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,YAAY;IAC9C,iCAAiC,CAAC,uBAAuB;IACzD,iCAAiC,CAAC,wBAAwB;IAC1D,iCAAiC,CAAC,2BAA2B;IAC7D,iCAAiC,CAAC,mCAAmC;IACrE,iCAAiC,CAAC,yBAAyB;IAC3D,iCAAiC,CAAC,gDAAgD;IAClF,iCAAiC,CAAC,eAAe;CACzC,CAAC;AAEX,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D,mCAAmC,CAAC,qCAAqC;IACzE,mCAAmC,CAAC,4BAA4B;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,+BAA+B,CAAC,6BAA6B;IAC7D,+BAA+B,CAAC,gCAAgC;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,4BAA4B,CAAC,wBAAwB;IACrD,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,yBAAyB;IACtD,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,qBAAqB;IAClD,4BAA4B,CAAC,sBAAsB;IACnD,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,SAAS;IACtC,4BAA4B,CAAC,SAAS;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,GAAG,0CAA0C;IAC7C,GAAG,6CAA6C;IAChD,GAAG,wCAAwC;IAC3C,GAAG,qCAAqC;CAChC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAS;IACpE,iCAAiC,CAAC,mCAAmC;IACrE,mHAAmH;IACnH,qHAAqH;IACrH,kGAAkG;IAClG,+BAA+B,CAAC,wBAAwB;IACxD,yEAAyE;IACzE,2EAA2E;IAC3E,kDAAkD;CACnD,CAAC,CAAC;AAKH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,UAAU;SACd,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,uCAAuC;SAC9E,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,qCAAqC;SACpE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,mBAAmB;SACvC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,aAAa;SACnC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,GAAG,2BAA2B,GAAG,yBAAyB,CAAC,UAAU,CAAC,GAAG,2BAA2B,EAAE,CAAC;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,OAAO,GAAG;SACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,mCAAmC;SAC1E,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,+CAA+C;SAC3E,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,gCAAgC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAY;IACtF,OAAO,UAAU,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC","sourcesContent":["/*\n Shared environment contract for application backend processes.\n \n This is the canonical vocabulary for the app-backend `.env` surface emitted\n * by the CLI and parsed by backend runtimes. Keep the keys here purely\n * declarative: they describe names and ownership, not executor-specific\n * behavior.\n /\n\nexport enum ApplicationBackendBootstrapEnvKey {\n APPLICATION_ID = 'APPLICATION_ID',\n SERVICE_NAME = 'SERVICE_NAME',\n PLATFORM_ENVIRONMENT_ID = 'PLATFORM_ENVIRONMENT_ID',\n /* Deployment topology authority (`local` or `remote`), distinct from APPLICATION_ENV behavior mode and from the environment id. /\n DEPLOYMENT_LOCATION_TYPE = 'DEPLOYMENT_LOCATION_TYPE',\n /\n The environment's service profile (`EnvironmentServiceProfile` in `@wildo-ai/platform-config-lib`, #2303): which\n * optional backing services (ClamAV, immudb, mongot) it runs. Emitted only when the environment declares a profile\n * other than `full`; absence means `full`. The application's boot reads it to REFUSE a capability whose service the\n * profile omits, naming the profile, instead of letting the capability look enabled and do nothing.\n /\n ENVIRONMENT_SERVICE_PROFILE = 'ENVIRONMENT_SERVICE_PROFILE',\n PLATFORM_APPLICATION_PRIMARY_SECRET = 'PLATFORM_APPLICATION_PRIMARY_SECRET',\n PLATFORM_APPS_MANAGER_URL = 'PLATFORM_APPS_MANAGER_URL',\n /\n The public keys (current, then next) every answer from apps-manager is verified against (#2921), as a one-line JWKS\n * built by `buildRuntimeResponseVerificationKeySet`. Required: a runtime refuses to boot without it and refuses any\n * unsigned or mis-signed answer. Public material, so not sensitive. Carried by every application runtime: backend,\n * minions, workers and the development companion.\n /\n PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS = 'PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS',\n APPLICATION_ENV = 'APPLICATION_ENV',\n}\n\nexport enum ApplicationBackendPlatformUrlEnvKey {\n PLATFORM_CRONTABS_BATCHES_MANAGER_URL = 'PLATFORM_CRONTABS_BATCHES_MANAGER_URL',\n PLATFORM_MODULE_REGISTRY_URL = 'PLATFORM_MODULE_REGISTRY_URL',\n}\n\nexport enum ApplicationBackendRuntimeEnvKey {\n APPLICATION_RUNTIME_ENDPOINTS = 'APPLICATION_RUNTIME_ENDPOINTS',\n /* Explicit app-owned filesystem handoff shared by a local backend and its companion. Absence means no filesystem transport is authorized. /\n APPLICATION_RUNTIME_SIGNALS_HOME = 'APPLICATION_RUNTIME_SIGNALS_HOME',\n /\n Secret gating the application's OPERATOR doors — the data-seeding admin surface and the\n * external-data admin surface, both root-mounted under `/internal/admin/...`.\n \n ## Why this key is declared here, and why the engine has its own copies\n \n The two consumers read `process.env` DIRECTLY, from\n * `data-seeding-admin.backend.contracts.ts` and `external-data-admin.backend.contracts.ts`, which\n * each declare the literal so that surface stays self-contained to `saas-backend-lib`. This is the\n * PRODUCER's copy: the CLI must know the name to emit it, and `saas-backend-lib` is not a\n * dependency of the CLI. Three copies of one string, cross-referenced, and pinned together by\n * `application-admin-secret-env-key.test.ts` — the same treatment the Node-version copies get,\n * for the same reason: no import can span these packages.\n \n ## Why it exists at all (#586)\n \n It did not, and neither door could be opened in any deployment the framework generates. The key\n * appeared in the two engine controllers that READ it and in shipped skill prose telling an\n * operator to author it in `secrets.json` — which nothing read. `providerEnv` could not carry it\n * either: `filterProviderEnvToScope` admits a key only when some scoped provider's secrets\n * contract declares its env-var name, and no provider declares this one, so it was dropped with a\n * warning. Measured 2026-09-10: zero writers, zero templates.\n /\n APPLICATION_ADMIN_SECRET = 'APPLICATION_ADMIN_SECRET',\n}\n\nexport enum ApplicationBackendDataEnvKey {\n /\n Which persistence adapter the application's resources use.\n \n DECLARED, not derived. Until this existed the config loader hard-coded MONGODB, so no\n * environment, secret or bootstrap value could select PostgreSQL — the adapter was reachable only\n * by a test that reached into the config object directly, which is why no application had ever\n * booted on it. Deriving it instead (\"PostgreSQL keys are present, so use PostgreSQL\") was\n * rejected: which store an application persists to is a deployment decision that must be legible\n * in one place, not an emergent property of which variables happen to be set.\n \n Absent means MONGODB, so every existing deployment is unaffected. That default is for processes\n * nothing configures; an APPLICATION backend never reaches it — the CLI writes the adapter resolved\n * from `applicationDatabase` for both engines (#1571: an absent `applicationDatabase` is PostgreSQL).\n /\n DATABASE_DEFAULT_ADAPTER = 'DATABASE_DEFAULT_ADAPTER',\n /\n The format NEW resource identifiers are minted in — `object-id` or `uuid`.\n \n DECLARED, and specifically NOT derived from {@link DATABASE_DEFAULT_ADAPTER}. The engine used to\n * derive it (MongoDB implied `OBJECT_ID`, PostgreSQL implied `UUID`), which made an application's\n * identity format a side effect of where its rows happen to live: moving a resource between\n * adapters silently changed the shape of every id it minted AND made every id it had already\n * minted fail `validateForResource`. Identity reaches URLs, exports, external references and\n * integrations, so it is an application-level decision that must outlive a storage decision.\n \n It needed an env key for the same reason the adapter did. The loader hard-coded\n * `ResourceIdFormat.OBJECT_ID`, so the value was legible nowhere and changeable by nobody: an\n * application could select PostgreSQL and still had no supported way to STATE its identity format,\n * which left the engine's \"declared, never derived\" rule true in the schema and unreachable in\n * practice.\n \n Absent means `OBJECT_ID` — what every existing application already mints — so no deployment\n * changes behaviour by adding this key to the contract.\n \n One deployment constraint travels with it: on PostgreSQL the `_id` COLUMN must be able to hold\n * the declared format. DDL rendered from the schema plan types it `text`, which is correct for\n * either member; a hand-written `_id uuid` column restricts the application to `UUID` and rejects\n * an `OBJECT_ID` outright.\n /\n RESOURCE_ID_FORMAT = 'RESOURCE_ID_FORMAT',\n MONGODB_HOST = 'MONGODB_HOST',\n MONGODB_DATABASE = 'MONGODB_DATABASE',\n MONGODB_PROTOCOL = 'MONGODB_PROTOCOL',\n MONGODB_DIRECT_CONNECTION = 'MONGODB_DIRECT_CONNECTION',\n /\n Whether the backend's MongoDB connection uses TLS (`'true'` / `'false'`), when the address it was given STATES\n * it (#2000). Absent means the protocol's default: on for `mongodb+srv`, off for `mongodb`.\n \n It exists because a `mongodb://` seed list for a server that requires TLS — an Atlas cluster with no SRV address,\n * whose `mongoURIWithOptions` carries `ssl=true` — was reduced to host, database and protocol, and the backend then\n * opened it without TLS, which Atlas refuses. Written by the CLI from an authored `externalEndpoints.mongodb`\n * connection URL, read by the backend config loader into `database.mongodb.options.tls`.\n \n spec-cite: MongoDB Manual, Connection String Options (https://www.mongodb.com/docs/manual/reference/connection-string-options/),\n * fetched 2026-09-29 — \"The `ssl` option is equivalent to the `tls` option\"; `tls` `true` is the \"Default for SRV\n * Connection Format\", `false` the \"Default for Standard Connection String Format\".\n /\n MONGODB_TLS = 'MONGODB_TLS',\n /\n The replica set a `mongodb://` seed list in `MONGODB_HOST` belongs to (#2000), from the authored connection URL's\n * `replicaSet` option. Absent for an SRV address, whose DNS record carries it.\n /\n MONGODB_REPLICA_SET = 'MONGODB_REPLICA_SET',\n /\n PostgreSQL TOPOLOGY only — host, port, database, ssl.\n \n CREDENTIALS are deliberately NOT here. They arrive through\n * `secrets.database.postgresql`, exactly as MongoDB's do: env carries where the database is,\n * secrets carry who may open it. Putting a password in an env contract would make it readable\n * from every process listing and every container inspect.\n /\n POSTGRESQL_HOST = 'POSTGRESQL_HOST',\n POSTGRESQL_PORT = 'POSTGRESQL_PORT',\n POSTGRESQL_DATABASE = 'POSTGRESQL_DATABASE',\n POSTGRESQL_SSL_MODE = 'POSTGRESQL_SSL_MODE',\n REDIS_HOST = 'REDIS_HOST',\n REDIS_PORT = 'REDIS_PORT',\n /\n Optional Redis logical database index (0–15). Emitted only when the\n * author sets `backingServices.redis.database` in `wildo.infra.<env>.config.ts`.\n * Consumers default to DB 0 when this var is missing.\n /\n REDIS_DATABASE = 'REDIS_DATABASE',\n /\n Canonical app-level Redis key namespace. Emitted only when the author\n * sets `dataServices.redis.keyPrefix` in `wildo.saas.config.ts` (Slice 3.6).\n * `RedisService` uses this as the `appPrefix` for all keys it writes — every\n * key becomes `${REDIS_KEY_PREFIX}org:${orgId}:${key}` or\n * `${REDIS_KEY_PREFIX}global:${key}`. When unset, the app-level prefix\n * stays empty (multi-tenant isolation falls back to the\n * `org:`/`global:` segment alone).\n \n REPLACE semantics: this supersedes the legacy\n * `secrets.database.redis.username`-derived prefix (Slice 3.6 audit\n * decision — single source of truth = `wildo.saas.config.dataServices`).\n /\n REDIS_KEY_PREFIX = 'REDIS_KEY_PREFIX',\n RABBITMQ_HOST = 'RABBITMQ_HOST',\n RABBITMQ_PORT = 'RABBITMQ_PORT',\n /\n Optional RabbitMQ virtual host. Emitted only when the author sets\n * `backingServices.rabbitmq.vhost` in `wildo.infra.<env>.config.ts`.\n * Consumers default to `/` (the RabbitMQ root vhost) when missing.\n \n Note (Slice 3.6 audit): the symmetric saas-side field\n * `dataServices.rabbitmq.vhost` was DELETED. Vhost is an\n * infra/topology concern with a single authoring seam (infra config).\n /\n RABBITMQ_VHOST = 'RABBITMQ_VHOST',\n STORAGE_PROVIDER = 'STORAGE_PROVIDER',\n /\n S3-compatible endpoint hostname (NOT a URL). The variable name\n * pre-dates the convention pin and is intentionally kept stable for\n * backward compatibility with deployed manifests, but the value is\n * always a bare host (`minio`, `s3.amazonaws.com`, `127.0.0.1`) — the\n * `STORAGE_PORT` and `STORAGE_USE_SSL` siblings are what compose the\n * full `https?://host:port` URL at the SDK initialization site.\n \n Slice 3.2 audit (L-4): authoring an explicit URL here (`http://...`)\n * silently breaks the `host:port` contract downstream because the SDK\n * concatenates the parts naively. If a future migration wants to flip\n * the contract to a URL, rename the env key (`STORAGE_URL`) rather\n * than overloading this one — the rename surfaces the breaking change\n * to operators.\n /\n STORAGE_ENDPOINT = 'STORAGE_ENDPOINT',\n STORAGE_PORT = 'STORAGE_PORT',\n STORAGE_USE_SSL = 'STORAGE_USE_SSL',\n STORAGE_BUCKET = 'STORAGE_BUCKET',\n /\n Optional app-level object-key namespace prefix prepended to every\n * application file path produced by `WildoManagedStorageProvider`\n * (Slice 3.6). Final key shape becomes\n * `${STORAGE_BUCKET_PREFIX}/applications/${applicationId}/files/${fileId}`\n * (extra segment above the existing `applicationId`-based namespace).\n \n Emitted only when the author sets `dataServices.s3.bucketPrefix` in\n * `wildo.saas.config.ts`. The actual MinIO bucket name (`STORAGE_BUCKET`)\n * remains infra-controlled and is unaffected by this prefix — N apps\n * can share one bucket while keeping their object trees disjoint.\n /\n STORAGE_BUCKET_PREFIX = 'STORAGE_BUCKET_PREFIX',\n // ⚠️ `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are deliberately ABSENT from\n // this contract, and must not be re-added.\n //\n // They carried the object store's ROOT credential — the same pair the MinIO\n // container itself is created with — into every application, minion and worker\n // environment. An application now obtains short-lived, prefix-confined session\n // credentials from apps-manager instead (`createStsStorageCredentialResolver`),\n // so there is no application-tier storage credential to name here.\n //\n // Re-adding them would not merely restore a variable: this enum is the DECLARED\n // app-backend env surface, so a key here is an invitation for a builder to fill\n // it. `assertNoStorageSecretInGeneratedEnv` fails the build if one ever does.\n STORAGE_LOCAL_BASE_DIR = 'STORAGE_LOCAL_BASE_DIR',\n CLAMAV_HOST = 'CLAMAV_HOST',\n CLAMAV_PORT = 'CLAMAV_PORT',\n YARA_ENABLED = 'YARA_ENABLED',\n YARA_HOST = 'YARA_HOST',\n YARA_PORT = 'YARA_PORT',\n}\n\n/\n Keep the plural `Keys` aliases so current consumers keep reading naturally,\n while the actual source of truth is the scoped enum definition above.\n /\nexport const ApplicationBackendBootstrapEnvKeys = ApplicationBackendBootstrapEnvKey;\nexport const ApplicationBackendPlatformUrlEnvKeys = ApplicationBackendPlatformUrlEnvKey;\nexport const ApplicationBackendRuntimeEnvKeys = ApplicationBackendRuntimeEnvKey;\nexport const ApplicationBackendDataEnvKeys = ApplicationBackendDataEnvKey;\n\nexport const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST = [\n ApplicationBackendBootstrapEnvKey.APPLICATION_ID,\n ApplicationBackendBootstrapEnvKey.SERVICE_NAME,\n ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,\n ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE,\n ApplicationBackendBootstrapEnvKey.ENVIRONMENT_SERVICE_PROFILE,\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS,\n ApplicationBackendBootstrapEnvKey.APPLICATION_ENV,\n] as const;\n\nexport const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST = [\n ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL,\n ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL,\n] as const;\n\nexport const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST = [\n ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,\n ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME,\n] as const;\n\nexport const APPLICATION_BACKEND_DATA_ENV_KEY_LIST = [\n ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER,\n ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT,\n ApplicationBackendDataEnvKey.MONGODB_HOST,\n ApplicationBackendDataEnvKey.MONGODB_DATABASE,\n ApplicationBackendDataEnvKey.MONGODB_PROTOCOL,\n ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION,\n ApplicationBackendDataEnvKey.MONGODB_TLS,\n ApplicationBackendDataEnvKey.MONGODB_REPLICA_SET,\n ApplicationBackendDataEnvKey.POSTGRESQL_HOST,\n ApplicationBackendDataEnvKey.POSTGRESQL_PORT,\n ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE,\n ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE,\n ApplicationBackendDataEnvKey.REDIS_HOST,\n ApplicationBackendDataEnvKey.REDIS_PORT,\n ApplicationBackendDataEnvKey.REDIS_DATABASE,\n ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX,\n ApplicationBackendDataEnvKey.RABBITMQ_HOST,\n ApplicationBackendDataEnvKey.RABBITMQ_PORT,\n ApplicationBackendDataEnvKey.RABBITMQ_VHOST,\n ApplicationBackendDataEnvKey.STORAGE_PROVIDER,\n ApplicationBackendDataEnvKey.STORAGE_ENDPOINT,\n ApplicationBackendDataEnvKey.STORAGE_PORT,\n ApplicationBackendDataEnvKey.STORAGE_USE_SSL,\n ApplicationBackendDataEnvKey.STORAGE_BUCKET,\n ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX,\n ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR,\n ApplicationBackendDataEnvKey.CLAMAV_HOST,\n ApplicationBackendDataEnvKey.CLAMAV_PORT,\n ApplicationBackendDataEnvKey.YARA_ENABLED,\n ApplicationBackendDataEnvKey.YARA_HOST,\n ApplicationBackendDataEnvKey.YARA_PORT,\n] as const;\n\nexport const APPLICATION_BACKEND_ENV_KEY_LIST = [\n ...APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST,\n ...APPLICATION_BACKEND_DATA_ENV_KEY_LIST,\n] as const;\n\n/\n Keys that must always be treated as secrets when this app-backend env surface\n * is materialized into logs, CI artifacts, or deployment manifests.\n /\nexport const APPLICATION_BACKEND_SENSITIVE_ENV_KEYS = new Set<string>([\n ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n // The application's own operator-door secret (#586): a framework-managed material (`application.adminSecret`) that\n // gates the data-seeding, external-data and approval-seal admin doors. It was missing here, so nothing classified it\n // as a secret; it is also what a coding agent spawned by this backend must never inherit (#3018).\n ApplicationBackendRuntimeEnvKey.APPLICATION_ADMIN_SECRET,\n // The storage pair is gone rather than listed: an app-tier env no longer\n // carries an object-storage credential at all, so there is nothing here to\n // mark sensitive. See the note on the enum above.\n]);\n\nexport type ApplicationBackendEnvKey =\n typeof APPLICATION_BACKEND_ENV_KEY_LIST[number];\n\n/\n ────────────────────────────────────────────────────────────────────────\n * Backend → worker dispatch contract (G-8 / MW4)\n * ────────────────────────────────────────────────────────────────────────\n * A declared worker's HTTP base URL is injected into the app-backend env at\n * deploy time as `WILDO_WORKER_<NAME>_URL`. The `<NAME>` segment is DYNAMIC\n * (one per declared worker), so — unlike the static enums above — the key is a\n * HELPER, not a fixed member. Both the CLI EMIT side\n * (`PlatformEnvVarsBuilder.buildApplicationBackendEnv`) and the backend READ\n * side (`WorkerRemoteClientFactoryBackendService`) MUST derive the key + URL\n * through these single helpers so the two can never drift.\n /\nexport const WILDO_WORKER_URL_ENV_PREFIX = 'WILDO_WORKER_';\nexport const WILDO_WORKER_URL_ENV_SUFFIX = '_URL';\n\n/\n Normalize a worker identifier (the `wildo.saas.config.ts` bucket key —\n * camelCase or kebab-case, e.g. `myNodeWorker` / `my-node-worker`) into the\n * UPPER_SNAKE segment embedded inside `WILDO_WORKER_<NAME>_URL`. Both\n * `myNodeWorker` and `my-node-worker` normalize to `MY_NODE_WORKER`, so the env\n * key is stable regardless of the authoring style.\n /\nexport function normalizeWorkerEnvSegment(workerName: string): string {\n return workerName\n .replace(/([a-z0-9])([A-Z])/g, '$1_$2') // camelCase word boundary → underscore\n .replace(/[^A-Za-z0-9]+/g, '_') // kebab / space / other → underscore\n .replace(/_+/g, '_') // collapse repeats\n .replace(/^_\|_$/g, '') // trim edges\n .toUpperCase();\n}\n\n/\n The `WILDO_WORKER_<NAME>_URL` env-var name for a declared worker. The single\n * source of truth for both emit (CLI) and read (backend factory).\n \n @example wildoWorkerUrlEnvKey('myNodeWorker') // 'WILDO_WORKER_MY_NODE_WORKER_URL'\n /\nexport function wildoWorkerUrlEnvKey(workerName: string): string {\n return `${WILDO_WORKER_URL_ENV_PREFIX}${normalizeWorkerEnvSegment(workerName)}${WILDO_WORKER_URL_ENV_SUFFIX}`;\n}\n\n/\n Normalize a service key (the `wildo.saas.config.ts` `minions`/`workers` bucket\n * key — authored camelCase or kebab, e.g. `marketingScrapper` / `my-rust-worker`)\n * into an RFC1123-valid DNS label segment: lowercase, `[a-z0-9-]` only, no\n * leading/trailing hyphen. `marketingScrapper` → `marketing-scrapper`,\n * `myNodeWorker` → `my-node-worker`.\n \n This is the DNS-NAME axis of a background runtime — the segment embedded in the\n * k8s object/Service name, the built container image ref, the compose service name,\n * and the worker dispatch URL host. It is DISTINCT from the IDENTITY axis (the raw\n * bucket key), which apps-manager keys on (`appConfig.workers[key]` /\n * `appConfig.minions[key]`) and which the worker stamps as `APP_OWNED_SERVICE_NAME`\n * / both runtimes carry as the `wildo.ai/owned-service-name` pod label — the\n * identity axis MUST stay raw and is NEVER passed through this helper. The\n * env-key axis (`WILDO_WORKER_<NAME>_URL`) has its own normalization,\n * {@link normalizeWorkerEnvSegment}, because an env-var name is UPPER_SNAKE, not a\n * DNS label.\n \n This helper does NOT truncate — a name too long for a DNS label (63 chars) is\n * REJECTED at authoring, not silently shortened (truncation risks colliding with\n * a sibling key). Returns `''` for all-symbol input. The authoring-time guard in\n * `define-saas-config.ts` fails fast on keys that normalize to empty, collide with\n * a sibling after normalization, or whose full `{slug}-{kind}-{name}` deploy name\n * exceeds 63 chars — so an empty / duplicate / over-long DNS name can never reach\n * the render.\n /\nexport function normalizeServiceKeyToDnsName(key: string): string {\n return key\n .replace(/([a-z0-9])([A-Z])/g, '$1-$2') // camelCase word boundary → hyphen\n .toLowerCase()\n .replace(/[^a-z0-9]+/g, '-') // any non-DNS char (kebab already ok) → hyphen\n .replace(/^-+\|-+$/g, ''); // trim leading/trailing hyphens\n}\n\n/\n The k8s Service (and same-network compose service) name for a per-app worker:\n * `{appSlug}-worker-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Coherent-by-construction\n * with the CLI k8s render (`renderWorkerForTarget`), the compose render\n * (`deriveAppRuntimeServiceName`), the CI image build (`syncCicd`), and the worker\n * dispatch URL host ({@link buildWorkerInternalUrl}) — EVERY DNS-name site derives\n * the name through THIS helper (rather than inlining `{appSlug}-worker-{key}`), so\n * the backend calls the exact Service the render deploys and CI builds the exact\n * image ref the deploy pulls.\n \n `workerName` is the saas-config bucket key (NOT the per-folder `config.name`) —\n * passed raw; the normalization happens inside. The raw key remains the worker's\n * IDENTITY (apps-manager lookup + `APP_OWNED_SERVICE_NAME`), a separate axis that\n * is never derived from this function.\n /\nexport function buildWorkerServiceName(appSlug: string, workerName: string): string {\n return `${appSlug}-worker-${normalizeServiceKeyToDnsName(workerName)}`;\n}\n\n/\n The k8s Deployment (and same-network compose service) name for a per-app minion:\n * `{appSlug}-minion-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Symmetric with\n * {@link buildWorkerServiceName} — minions have no inbound Service / dispatch URL,\n * but the k8s render, the compose render, and the CI image build all need the\n * deploy name, and it must be RFC1123-valid for the same reasons. `minionName` is\n * the saas-config bucket key; the raw key stays the minion's IDENTITY (the\n * `wildo.ai/owned-service-name` pod label), never derived from here.\n /\nexport function buildMinionServiceName(appSlug: string, minionName: string): string {\n return `${appSlug}-minion-${normalizeServiceKeyToDnsName(minionName)}`;\n}\n\n/\n The in-cluster base URL the app-backend uses to reach a per-app worker\n * (`http://{appSlug}-worker-{workerName}:{port}`). The backend + its workers\n * deploy into the SAME namespace (per-app deploy), so the short Service name\n * resolves without a namespace qualifier. `port` is the worker's authored\n * `http.port` (schema default 8080).\n /\nexport function buildWorkerInternalUrl(appSlug: string, workerName: string, port: number): string {\n return `http://${buildWorkerServiceName(appSlug, workerName)}:${port}`;\n}\n\n/\n The base URL the app-backend uses to reach a per-app worker in LOCAL development.\n \n There is no k8s Service locally, so there is no name to resolve — the worker is a supervised\n * process listening on its authored `http.port` on the loopback interface, which is the same\n * convention every other local runtime address in this repository uses.\n \n ## Why this exists at all (#426)\n \n `buildApplicationWorkerDispatchUrls` used to return `undefined` for anything but REMOTE, on the\n * reasoning that \"local dev has no k8s Services, and worker dispatch is a k8s-deploy concern\". The\n * first half is still true and the second no longer is: local dev now STARTS the worker, so the\n * only thing missing was an address. Without one, `WorkerRemoteClientFactory.client()` fails closed\n * on the absent `WILDO_WORKER_<NAME>_URL` — which is why the whole backend-to-worker chain had\n * never been exercised by anyone, in a test or in the dev stack.\n \n Declared here, beside its in-cluster sibling and the env-key helper both sides derive, so the\n * emit side and the read side cannot drift apart for either deployment shape.\n */\nexport function buildWorkerLocalUrl(port: number): string {\n return `http://localhost:${port}`;\n}\n"]}

package/dist/esm/runtime/application-worker-env.contracts.d.ts CHANGED Viewed

@@ -41,10 +41,20 @@ export declare enum ApplicationWorkerBootstrapEnvKey {
     PLATFORM_ENVIRONMENT_ID = "PLATFORM_ENVIRONMENT_ID",
     PLATFORM_APPLICATION_PRIMARY_SECRET = "PLATFORM_APPLICATION_PRIMARY_SECRET",
     PLATFORM_APPS_MANAGER_URL = "PLATFORM_APPS_MANAGER_URL",
+    /** The apps-manager response verification keys (#2921); see `ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS`. The Node worker verifies its bootstrap against them; a worker in another language must do the same (the Rust template does not yet, #2948). */
+    PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS = "PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS",
     APPLICATION_ENV = "APPLICATION_ENV"
 }
 export declare enum ApplicationWorkerRuntimeEnvKey {
-    APPLICATION_RUNTIME_ENDPOINTS = "APPLICATION_RUNTIME_ENDPOINTS"
+    APPLICATION_RUNTIME_ENDPOINTS = "APPLICATION_RUNTIME_ENDPOINTS",
+    /**
+     * The application's local runtime-signals home, where a node worker records how its start ended (#3288): `started`
+     * once it listens, `failed` with the classified cause (a held port carries the port). The same variable, and the same
+     * record, as the backend's `ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME`: the dev supervisor
+     * (`wildo-dev-runtime serve`) reads it to name a process holding the worker's port. Emitted for a LOCAL deployment
+     * only; absent, nothing is written.
+     */
+    APPLICATION_RUNTIME_SIGNALS_HOME = "APPLICATION_RUNTIME_SIGNALS_HOME"
 }
 /**
  * The worker's inbound HTTP-surface descriptor, projected from the authored
@@ -73,10 +83,10 @@ export declare enum ApplicationWorkerHttpSurfaceEnvKey {
 export declare const ApplicationWorkerBootstrapEnvKeys: typeof ApplicationWorkerBootstrapEnvKey;
 export declare const ApplicationWorkerRuntimeEnvKeys: typeof ApplicationWorkerRuntimeEnvKey;
 export declare const ApplicationWorkerHttpSurfaceEnvKeys: typeof ApplicationWorkerHttpSurfaceEnvKey;
-export declare const APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST: readonly [ApplicationWorkerBootstrapEnvKey.APPLICATION_ID, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_KIND, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationWorkerBootstrapEnvKey.APPLICATION_ENV];
-export declare const APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST: readonly [ApplicationWorkerRuntimeEnvKey];
+export declare const APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST: readonly [ApplicationWorkerBootstrapEnvKey.APPLICATION_ID, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_KIND, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS, ApplicationWorkerBootstrapEnvKey.APPLICATION_ENV];
+export declare const APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST: readonly [ApplicationWorkerRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS, ApplicationWorkerRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME];
 export declare const APPLICATION_WORKER_HTTP_SURFACE_ENV_KEY_LIST: readonly [ApplicationWorkerHttpSurfaceEnvKey.WORKER_HTTP_PORT, ApplicationWorkerHttpSurfaceEnvKey.WORKER_HEALTH_PATH, ApplicationWorkerHttpSurfaceEnvKey.WORKER_READY_PATH, ApplicationWorkerHttpSurfaceEnvKey.WORKER_METRICS_PATH];
-export declare const APPLICATION_WORKER_ENV_KEY_LIST: readonly [ApplicationWorkerBootstrapEnvKey.APPLICATION_ID, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_KIND, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationWorkerBootstrapEnvKey.APPLICATION_ENV, ApplicationWorkerRuntimeEnvKey, ApplicationWorkerHttpSurfaceEnvKey.WORKER_HTTP_PORT, ApplicationWorkerHttpSurfaceEnvKey.WORKER_HEALTH_PATH, ApplicationWorkerHttpSurfaceEnvKey.WORKER_READY_PATH, ApplicationWorkerHttpSurfaceEnvKey.WORKER_METRICS_PATH];
+export declare const APPLICATION_WORKER_ENV_KEY_LIST: readonly [ApplicationWorkerBootstrapEnvKey.APPLICATION_ID, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_KIND, ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.SERVICE_NAME, ApplicationWorkerBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS, ApplicationWorkerBootstrapEnvKey.APPLICATION_ENV, ApplicationWorkerRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS, ApplicationWorkerRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME, ApplicationWorkerHttpSurfaceEnvKey.WORKER_HTTP_PORT, ApplicationWorkerHttpSurfaceEnvKey.WORKER_HEALTH_PATH, ApplicationWorkerHttpSurfaceEnvKey.WORKER_READY_PATH, ApplicationWorkerHttpSurfaceEnvKey.WORKER_METRICS_PATH];
 export declare const APPLICATION_WORKER_SENSITIVE_ENV_KEYS: Set<string>;
 export type ApplicationWorkerEnvKey = typeof APPLICATION_WORKER_ENV_KEY_LIST[number];
 //# sourceMappingURL=application-worker-env.contracts.d.ts.map

package/dist/esm/runtime/application-worker-env.contracts.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-worker-env.contracts.d.ts","sourceRoot":"","sources":["~~../../../../~~src/runtime/application-worker-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,gCAAgC;IAC1C,cAAc,mBAAmB;IACjC,uFAAuF;IACvF,sBAAsB,2BAA2B;IACjD;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD,wHAAwH;IACxH,YAAY,iBAAiB;IAC7B,uBAAuB,4BAA4B;IACnD,mCAAmC,wCAAwC;IAC3E,yBAAyB,8BAA8B;IACvD,eAAe,oBAAoB;CACpC;AAED,oBAAY,8BAA8B;IACxC,6BAA6B,kCAAkC;~~CAChE~~;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,kCAAkC;IAC5C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;CAC5C;AAED,eAAO,MAAM,iCAAiC,yCAAmC,CAAC;AAClF,eAAO,MAAM,+BAA+B,uCAAiC,CAAC;AAC9E,eAAO,MAAM,mCAAmC,2CAAqC,CAAC;AAEtF,eAAO,MAAM,yCAAyC,~~2cAS5C~~,CAAC;AAEX,eAAO,MAAM,uCAAuC,~~2CAE1C~~,CAAC;AAEX,eAAO,MAAM,4CAA4C,qOAK/C,CAAC;AAEX,eAAO,MAAM,+BAA+B,~~qsBAIlC~~,CAAC;AAEX,eAAO,MAAM,qCAAqC,aAEhD,CAAC;AAEH,MAAM,MAAM,uBAAuB,GACjC,OAAO,+BAA+B,CAAC,MAAM,CAAC,CAAC"}
1	+ {"version":3,"file":"application-worker-env.contracts.d.ts","sourceRoot":"","sources":["../../../src/runtime/application-worker-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,oBAAY,gCAAgC;IAC1C,cAAc,mBAAmB;IACjC,uFAAuF;IACvF,sBAAsB,2BAA2B;IACjD;;;OAGG;IACH,sBAAsB,2BAA2B;IACjD,wHAAwH;IACxH,YAAY,iBAAiB;IAC7B,uBAAuB,4BAA4B;IACnD,mCAAmC,wCAAwC;IAC3E,yBAAyB,8BAA8B;IACvD,iSAAiS;IACjS,gDAAgD,qDAAqD;IACrG,eAAe,oBAAoB;CACpC;AAED,oBAAY,8BAA8B;IACxC,6BAA6B,kCAAkC;IAC/D;;;;;;OAMG;IACH,gCAAgC,qCAAqC;CACtE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,kCAAkC;IAC5C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;CAC5C;AAED,eAAO,MAAM,iCAAiC,yCAAmC,CAAC;AAClF,eAAO,MAAM,+BAA+B,uCAAiC,CAAC;AAC9E,eAAO,MAAM,mCAAmC,2CAAqC,CAAC;AAEtF,eAAO,MAAM,yCAAyC,8hBAU5C,CAAC;AAEX,eAAO,MAAM,uCAAuC,0IAG1C,CAAC;AAEX,eAAO,MAAM,4CAA4C,qOAK/C,CAAC;AAEX,eAAO,MAAM,+BAA+B,u3BAIlC,CAAC;AAEX,eAAO,MAAM,qCAAqC,aAEhD,CAAC;AAEH,MAAM,MAAM,uBAAuB,GACjC,OAAO,+BAA+B,CAAC,MAAM,CAAC,CAAC"}

package/dist/esm/runtime/application-worker-env.contracts.js CHANGED Viewed

@@ -42,11 +42,21 @@ export var ApplicationWorkerBootstrapEnvKey;
     ApplicationWorkerBootstrapEnvKey["PLATFORM_ENVIRONMENT_ID"] = "PLATFORM_ENVIRONMENT_ID";
     ApplicationWorkerBootstrapEnvKey["PLATFORM_APPLICATION_PRIMARY_SECRET"] = "PLATFORM_APPLICATION_PRIMARY_SECRET";
     ApplicationWorkerBootstrapEnvKey["PLATFORM_APPS_MANAGER_URL"] = "PLATFORM_APPS_MANAGER_URL";
+    /** The apps-manager response verification keys (#2921); see `ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS`. The Node worker verifies its bootstrap against them; a worker in another language must do the same (the Rust template does not yet, #2948). */
+    ApplicationWorkerBootstrapEnvKey["PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS"] = "PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS";
     ApplicationWorkerBootstrapEnvKey["APPLICATION_ENV"] = "APPLICATION_ENV";
 })(ApplicationWorkerBootstrapEnvKey || (ApplicationWorkerBootstrapEnvKey = {}));
 export var ApplicationWorkerRuntimeEnvKey;
 (function (ApplicationWorkerRuntimeEnvKey) {
     ApplicationWorkerRuntimeEnvKey["APPLICATION_RUNTIME_ENDPOINTS"] = "APPLICATION_RUNTIME_ENDPOINTS";
+    /**
+     * The application's local runtime-signals home, where a node worker records how its start ended (#3288): `started`
+     * once it listens, `failed` with the classified cause (a held port carries the port). The same variable, and the same
+     * record, as the backend's `ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME`: the dev supervisor
+     * (`wildo-dev-runtime serve`) reads it to name a process holding the worker's port. Emitted for a LOCAL deployment
+     * only; absent, nothing is written.
+     */
+    ApplicationWorkerRuntimeEnvKey["APPLICATION_RUNTIME_SIGNALS_HOME"] = "APPLICATION_RUNTIME_SIGNALS_HOME";
 })(ApplicationWorkerRuntimeEnvKey || (ApplicationWorkerRuntimeEnvKey = {}));
 /**
  * The worker's inbound HTTP-surface descriptor, projected from the authored
@@ -84,10 +94,12 @@ export const APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST = [
     ApplicationWorkerBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,
     ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,
     ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,
+    ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS,
     ApplicationWorkerBootstrapEnvKey.APPLICATION_ENV,
 ];
 export const APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST = [
     ApplicationWorkerRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,
+    ApplicationWorkerRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME,
 ];
 export const APPLICATION_WORKER_HTTP_SURFACE_ENV_KEY_LIST = [
     ApplicationWorkerHttpSurfaceEnvKey.WORKER_HTTP_PORT,

package/dist/esm/runtime/application-worker-env.contracts.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-worker-env.contracts.js","sourceRoot":"","sources":["~~../../../../~~src/runtime/application-worker-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,~~gCAeX~~;~~AAfD~~,WAAY,gCAAgC;IAC1C,qEAAiC,CAAA;IACjC,uFAAuF;IACvF,qFAAiD,CAAA;IACjD;;;OAGG;IACH,qFAAiD,CAAA;IACjD,wHAAwH;IACxH,iEAA6B,CAAA;IAC7B,uFAAmD,CAAA;IACnD,+GAA2E,CAAA;IAC3E,2FAAuD,CAAA;IACvD,uEAAmC,CAAA;AACrC,CAAC,~~EAfW~~,gCAAgC,KAAhC,gCAAgC,~~QAe3C~~;AAED,MAAM,CAAN,IAAY,~~8BAEX~~;~~AAFD~~,WAAY,8BAA8B;IACxC,iGAA+D,CAAA;~~AACjE~~,CAAC,~~EAFW~~,8BAA8B,KAA9B,8BAA8B,~~QAEzC~~;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAC5C,2EAAqC,CAAA;IACrC,+EAAyC,CAAA;IACzC,6EAAuC,CAAA;IACvC,iFAA2C,CAAA;AAC7C,CAAC,EALW,kCAAkC,KAAlC,kCAAkC,QAK7C;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,gCAAgC,CAAC;AAClF,MAAM,CAAC,MAAM,+BAA+B,GAAG,8BAA8B,CAAC;AAC9E,MAAM,CAAC,MAAM,mCAAmC,GAAG,kCAAkC,CAAC;AAEtF,MAAM,CAAC,MAAM,yCAAyC,GAAG;IACvD,gCAAgC,CAAC,cAAc;IAC/C,gCAAgC,CAAC,sBAAsB;IACvD,gCAAgC,CAAC,sBAAsB;IACvD,gCAAgC,CAAC,YAAY;IAC7C,gCAAgC,CAAC,uBAAuB;IACxD,gCAAgC,CAAC,mCAAmC;IACpE,gCAAgC,CAAC,yBAAyB;IAC1D,gCAAgC,CAAC,eAAe;CACxC,CAAC;AAEX,MAAM,CAAC,MAAM,uCAAuC,GAAG;IACrD,8BAA8B,CAAC,6BAA6B;~~CACpD~~,CAAC;AAEX,MAAM,CAAC,MAAM,4CAA4C,GAAG;IAC1D,kCAAkC,CAAC,gBAAgB;IACnD,kCAAkC,CAAC,kBAAkB;IACrD,kCAAkC,CAAC,iBAAiB;IACpD,kCAAkC,CAAC,mBAAmB;CAC9C,CAAC;AAEX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,GAAG,yCAAyC;IAC5C,GAAG,uCAAuC;IAC1C,GAAG,4CAA4C;CACvC,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,GAAG,CAAS;IACnE,gCAAgC,CAAC,mCAAmC;CACrE,CAAC,CAAC","sourcesContent":["/*\n Shared environment contract for application worker processes.\n \n This surface is intentionally smaller than the backend contract:\n * workers are language-agnostic subprocesses, so they receive only the\n * bootstrap identity, worker identity, optional runtime topology hints,\n * and provider/config secrets that are safe to deliver via env.\n /\n\n/\n Bootstrap-identity env contract for application worker processes.\n \n The worker IDENTITY is carried by the canonical background-runtime pair\n * `APP_OWNED_SERVICE_KIND` + `APP_OWNED_SERVICE_NAME` — the SAME vocabulary the\n * `BackgroundRuntimeType` model (`@wildo-ai/saas-models`) declares apps-manager\n * injects, that the k8s worker AND minion Deployment templates stamp, and that\n * the reference Rust worker reads at boot. The worker forwards\n * `APP_OWNED_SERVICE_NAME` as the `/apps-to-manager/workers/{name}/bootstrap`\n * path segment, which apps-manager keys on `appConfig.workers[name]` — so\n * `APP_OWNED_SERVICE_NAME` is exactly the `wildo.saas.config.ts > workers`\n * bucket key. `APP_OWNED_SERVICE_KIND` is `BackgroundRuntimeType.WORKER` and\n * disambiguates worker vs minion, so both background-runtime kinds share ONE\n * identity contract across every deploy path (k8s manifest, docker-compose, and\n * the generated `.env`).\n \n `SERVICE_NAME` is the SEPARATE process/observability identity\n * (`wildo.worker.config.ts > name`, else the bucket key) — it also feeds\n * `OTEL_SERVICE_NAME`. It is NOT the routing identity above; do not conflate\n * the two.\n /\nexport enum ApplicationWorkerBootstrapEnvKey {\n APPLICATION_ID = 'APPLICATION_ID',\n /* `BackgroundRuntimeType.WORKER` — pins this app-owned runtime kind (vs a minion). /\n APP_OWNED_SERVICE_KIND = 'APP_OWNED_SERVICE_KIND',\n /\n The `wildo.saas.config.ts > workers` bucket key — forwarded to apps-manager\n * as the worker-bootstrap path segment (`appConfig.workers[name]` lookup).\n /\n APP_OWNED_SERVICE_NAME = 'APP_OWNED_SERVICE_NAME',\n /* Process/observability identity (`wildo.worker.config.ts > name`, else the bucket key); feeds `OTEL_SERVICE_NAME`. /\n SERVICE_NAME = 'SERVICE_NAME',\n PLATFORM_ENVIRONMENT_ID = 'PLATFORM_ENVIRONMENT_ID',\n PLATFORM_APPLICATION_PRIMARY_SECRET = 'PLATFORM_APPLICATION_PRIMARY_SECRET',\n PLATFORM_APPS_MANAGER_URL = 'PLATFORM_APPS_MANAGER_URL',\n APPLICATION_ENV = 'APPLICATION_ENV',\n}\n\nexport enum ApplicationWorkerRuntimeEnvKey {\n APPLICATION_RUNTIME_ENDPOINTS = 'APPLICATION_RUNTIME_ENDPOINTS',\n}\n\n/\n The worker's inbound HTTP-surface descriptor, projected from the authored\n * `wildo.worker.config.ts > http` block (`WorkerHttpSchema` in\n * `@wildo-ai/platform-config-lib`) into the worker process environment by\n * `wildo config sync`.\n \n Unlike {@link ApplicationWorkerBootstrapEnvKey} (required identity — the\n * worker fails closed when any key is missing), these keys are DEFAULTED: a\n * worker booted without them falls back to its language-runtime's built-in\n * defaults (`8080` / `/healthz` / `/readyz`), exactly as the Rust reference\n * worker does with `std::env::var(...).unwrap_or_else(...)`. The generator\n * always emits them from the authored config so the running port and probe\n * paths track `wildo.worker.config.ts` rather than a per-language hardcoded\n * default that only coincides with the authored value by luck.\n \n `WORKER_METRICS_PATH` mirrors the optional `WorkerHttpSchema.metricsPath` —\n * emitted only when the author opts a worker into a Prometheus scrape surface.\n */\nexport enum ApplicationWorkerHttpSurfaceEnvKey {\n WORKER_HTTP_PORT = 'WORKER_HTTP_PORT',\n WORKER_HEALTH_PATH = 'WORKER_HEALTH_PATH',\n WORKER_READY_PATH = 'WORKER_READY_PATH',\n WORKER_METRICS_PATH = 'WORKER_METRICS_PATH',\n}\n\nexport const ApplicationWorkerBootstrapEnvKeys = ApplicationWorkerBootstrapEnvKey;\nexport const ApplicationWorkerRuntimeEnvKeys = ApplicationWorkerRuntimeEnvKey;\nexport const ApplicationWorkerHttpSurfaceEnvKeys = ApplicationWorkerHttpSurfaceEnvKey;\n\nexport const APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST = [\n ApplicationWorkerBootstrapEnvKey.APPLICATION_ID,\n ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_KIND,\n ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_NAME,\n ApplicationWorkerBootstrapEnvKey.SERVICE_NAME,\n ApplicationWorkerBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,\n ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,\n ApplicationWorkerBootstrapEnvKey.APPLICATION_ENV,\n] as const;\n\nexport const APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST = [\n ApplicationWorkerRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,\n] as const;\n\nexport const APPLICATION_WORKER_HTTP_SURFACE_ENV_KEY_LIST = [\n ApplicationWorkerHttpSurfaceEnvKey.WORKER_HTTP_PORT,\n ApplicationWorkerHttpSurfaceEnvKey.WORKER_HEALTH_PATH,\n ApplicationWorkerHttpSurfaceEnvKey.WORKER_READY_PATH,\n ApplicationWorkerHttpSurfaceEnvKey.WORKER_METRICS_PATH,\n] as const;\n\nexport const APPLICATION_WORKER_ENV_KEY_LIST = [\n ...APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST,\n ...APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST,\n ...APPLICATION_WORKER_HTTP_SURFACE_ENV_KEY_LIST,\n] as const;\n\nexport const APPLICATION_WORKER_SENSITIVE_ENV_KEYS = new Set<string>([\n ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n]);\n\nexport type ApplicationWorkerEnvKey =\n typeof APPLICATION_WORKER_ENV_KEY_LIST[number];\n"]}
1	+ {"version":3,"file":"application-worker-env.contracts.js","sourceRoot":"","sources":["../../../src/runtime/application-worker-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAN,IAAY,gCAiBX;AAjBD,WAAY,gCAAgC;IAC1C,qEAAiC,CAAA;IACjC,uFAAuF;IACvF,qFAAiD,CAAA;IACjD;;;OAGG;IACH,qFAAiD,CAAA;IACjD,wHAAwH;IACxH,iEAA6B,CAAA;IAC7B,uFAAmD,CAAA;IACnD,+GAA2E,CAAA;IAC3E,2FAAuD,CAAA;IACvD,iSAAiS;IACjS,yIAAqG,CAAA;IACrG,uEAAmC,CAAA;AACrC,CAAC,EAjBW,gCAAgC,KAAhC,gCAAgC,QAiB3C;AAED,MAAM,CAAN,IAAY,8BAUX;AAVD,WAAY,8BAA8B;IACxC,iGAA+D,CAAA;IAC/D;;;;;;OAMG;IACH,uGAAqE,CAAA;AACvE,CAAC,EAVW,8BAA8B,KAA9B,8BAA8B,QAUzC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAN,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAC5C,2EAAqC,CAAA;IACrC,+EAAyC,CAAA;IACzC,6EAAuC,CAAA;IACvC,iFAA2C,CAAA;AAC7C,CAAC,EALW,kCAAkC,KAAlC,kCAAkC,QAK7C;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,gCAAgC,CAAC;AAClF,MAAM,CAAC,MAAM,+BAA+B,GAAG,8BAA8B,CAAC;AAC9E,MAAM,CAAC,MAAM,mCAAmC,GAAG,kCAAkC,CAAC;AAEtF,MAAM,CAAC,MAAM,yCAAyC,GAAG;IACvD,gCAAgC,CAAC,cAAc;IAC/C,gCAAgC,CAAC,sBAAsB;IACvD,gCAAgC,CAAC,sBAAsB;IACvD,gCAAgC,CAAC,YAAY;IAC7C,gCAAgC,CAAC,uBAAuB;IACxD,gCAAgC,CAAC,mCAAmC;IACpE,gCAAgC,CAAC,yBAAyB;IAC1D,gCAAgC,CAAC,gDAAgD;IACjF,gCAAgC,CAAC,eAAe;CACxC,CAAC;AAEX,MAAM,CAAC,MAAM,uCAAuC,GAAG;IACrD,8BAA8B,CAAC,6BAA6B;IAC5D,8BAA8B,CAAC,gCAAgC;CACvD,CAAC;AAEX,MAAM,CAAC,MAAM,4CAA4C,GAAG;IAC1D,kCAAkC,CAAC,gBAAgB;IACnD,kCAAkC,CAAC,kBAAkB;IACrD,kCAAkC,CAAC,iBAAiB;IACpD,kCAAkC,CAAC,mBAAmB;CAC9C,CAAC;AAEX,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,GAAG,yCAAyC;IAC5C,GAAG,uCAAuC;IAC1C,GAAG,4CAA4C;CACvC,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,GAAG,CAAS;IACnE,gCAAgC,CAAC,mCAAmC;CACrE,CAAC,CAAC","sourcesContent":["/*\n Shared environment contract for application worker processes.\n \n This surface is intentionally smaller than the backend contract:\n * workers are language-agnostic subprocesses, so they receive only the\n * bootstrap identity, worker identity, optional runtime topology hints,\n * and provider/config secrets that are safe to deliver via env.\n /\n\n/\n Bootstrap-identity env contract for application worker processes.\n \n The worker IDENTITY is carried by the canonical background-runtime pair\n * `APP_OWNED_SERVICE_KIND` + `APP_OWNED_SERVICE_NAME` — the SAME vocabulary the\n * `BackgroundRuntimeType` model (`@wildo-ai/saas-models`) declares apps-manager\n * injects, that the k8s worker AND minion Deployment templates stamp, and that\n * the reference Rust worker reads at boot. The worker forwards\n * `APP_OWNED_SERVICE_NAME` as the `/apps-to-manager/workers/{name}/bootstrap`\n * path segment, which apps-manager keys on `appConfig.workers[name]` — so\n * `APP_OWNED_SERVICE_NAME` is exactly the `wildo.saas.config.ts > workers`\n * bucket key. `APP_OWNED_SERVICE_KIND` is `BackgroundRuntimeType.WORKER` and\n * disambiguates worker vs minion, so both background-runtime kinds share ONE\n * identity contract across every deploy path (k8s manifest, docker-compose, and\n * the generated `.env`).\n \n `SERVICE_NAME` is the SEPARATE process/observability identity\n * (`wildo.worker.config.ts > name`, else the bucket key) — it also feeds\n * `OTEL_SERVICE_NAME`. It is NOT the routing identity above; do not conflate\n * the two.\n /\nexport enum ApplicationWorkerBootstrapEnvKey {\n APPLICATION_ID = 'APPLICATION_ID',\n /* `BackgroundRuntimeType.WORKER` — pins this app-owned runtime kind (vs a minion). /\n APP_OWNED_SERVICE_KIND = 'APP_OWNED_SERVICE_KIND',\n /\n The `wildo.saas.config.ts > workers` bucket key — forwarded to apps-manager\n * as the worker-bootstrap path segment (`appConfig.workers[name]` lookup).\n /\n APP_OWNED_SERVICE_NAME = 'APP_OWNED_SERVICE_NAME',\n /* Process/observability identity (`wildo.worker.config.ts > name`, else the bucket key); feeds `OTEL_SERVICE_NAME`. /\n SERVICE_NAME = 'SERVICE_NAME',\n PLATFORM_ENVIRONMENT_ID = 'PLATFORM_ENVIRONMENT_ID',\n PLATFORM_APPLICATION_PRIMARY_SECRET = 'PLATFORM_APPLICATION_PRIMARY_SECRET',\n PLATFORM_APPS_MANAGER_URL = 'PLATFORM_APPS_MANAGER_URL',\n /* The apps-manager response verification keys (#2921); see `ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS`. The Node worker verifies its bootstrap against them; a worker in another language must do the same (the Rust template does not yet, #2948). /\n PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS = 'PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS',\n APPLICATION_ENV = 'APPLICATION_ENV',\n}\n\nexport enum ApplicationWorkerRuntimeEnvKey {\n APPLICATION_RUNTIME_ENDPOINTS = 'APPLICATION_RUNTIME_ENDPOINTS',\n /\n The application's local runtime-signals home, where a node worker records how its start ended (#3288): `started`\n * once it listens, `failed` with the classified cause (a held port carries the port). The same variable, and the same\n * record, as the backend's `ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME`: the dev supervisor\n * (`wildo-dev-runtime serve`) reads it to name a process holding the worker's port. Emitted for a LOCAL deployment\n * only; absent, nothing is written.\n /\n APPLICATION_RUNTIME_SIGNALS_HOME = 'APPLICATION_RUNTIME_SIGNALS_HOME',\n}\n\n/\n The worker's inbound HTTP-surface descriptor, projected from the authored\n * `wildo.worker.config.ts > http` block (`WorkerHttpSchema` in\n * `@wildo-ai/platform-config-lib`) into the worker process environment by\n * `wildo config sync`.\n \n Unlike {@link ApplicationWorkerBootstrapEnvKey} (required identity — the\n * worker fails closed when any key is missing), these keys are DEFAULTED: a\n * worker booted without them falls back to its language-runtime's built-in\n * defaults (`8080` / `/healthz` / `/readyz`), exactly as the Rust reference\n * worker does with `std::env::var(...).unwrap_or_else(...)`. The generator\n * always emits them from the authored config so the running port and probe\n * paths track `wildo.worker.config.ts` rather than a per-language hardcoded\n * default that only coincides with the authored value by luck.\n \n `WORKER_METRICS_PATH` mirrors the optional `WorkerHttpSchema.metricsPath` —\n * emitted only when the author opts a worker into a Prometheus scrape surface.\n */\nexport enum ApplicationWorkerHttpSurfaceEnvKey {\n WORKER_HTTP_PORT = 'WORKER_HTTP_PORT',\n WORKER_HEALTH_PATH = 'WORKER_HEALTH_PATH',\n WORKER_READY_PATH = 'WORKER_READY_PATH',\n WORKER_METRICS_PATH = 'WORKER_METRICS_PATH',\n}\n\nexport const ApplicationWorkerBootstrapEnvKeys = ApplicationWorkerBootstrapEnvKey;\nexport const ApplicationWorkerRuntimeEnvKeys = ApplicationWorkerRuntimeEnvKey;\nexport const ApplicationWorkerHttpSurfaceEnvKeys = ApplicationWorkerHttpSurfaceEnvKey;\n\nexport const APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST = [\n ApplicationWorkerBootstrapEnvKey.APPLICATION_ID,\n ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_KIND,\n ApplicationWorkerBootstrapEnvKey.APP_OWNED_SERVICE_NAME,\n ApplicationWorkerBootstrapEnvKey.SERVICE_NAME,\n ApplicationWorkerBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,\n ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,\n ApplicationWorkerBootstrapEnvKey.PLATFORM_APPS_MANAGER_RESPONSE_VERIFICATION_KEYS,\n ApplicationWorkerBootstrapEnvKey.APPLICATION_ENV,\n] as const;\n\nexport const APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST = [\n ApplicationWorkerRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,\n ApplicationWorkerRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME,\n] as const;\n\nexport const APPLICATION_WORKER_HTTP_SURFACE_ENV_KEY_LIST = [\n ApplicationWorkerHttpSurfaceEnvKey.WORKER_HTTP_PORT,\n ApplicationWorkerHttpSurfaceEnvKey.WORKER_HEALTH_PATH,\n ApplicationWorkerHttpSurfaceEnvKey.WORKER_READY_PATH,\n ApplicationWorkerHttpSurfaceEnvKey.WORKER_METRICS_PATH,\n] as const;\n\nexport const APPLICATION_WORKER_ENV_KEY_LIST = [\n ...APPLICATION_WORKER_BOOTSTRAP_ENV_KEY_LIST,\n ...APPLICATION_WORKER_RUNTIME_ENV_KEY_LIST,\n ...APPLICATION_WORKER_HTTP_SURFACE_ENV_KEY_LIST,\n] as const;\n\nexport const APPLICATION_WORKER_SENSITIVE_ENV_KEYS = new Set<string>([\n ApplicationWorkerBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n]);\n\nexport type ApplicationWorkerEnvKey =\n typeof APPLICATION_WORKER_ENV_KEY_LIST[number];\n"]}

package/dist/esm/runtime/backend-start-outcome.contracts.d.ts CHANGED Viewed

@@ -28,6 +28,30 @@ export declare enum BackendStartOutcome {
     /** `initialize` threw: the process is about to exit, and `message` says why. */
     FAILED = "failed"
 }
+/**
+ * WHY a start failed, when the backend can tell (#3214, #3217).
+ *
+ * The distinction a reader acts on is whose problem it is. A refusal raised by the application's own startup (a resource
+ * configuration the factory refuses, a migration owed) is fixed in the application's code. A port another process holds
+ * is not: on `app-creation-test-007` an orphaned backend kept port 4241, every rebuild's start died binding it, and the
+ * build lane answered "Fix the task that broke it" about a task that had broken nothing. The message alone cannot carry
+ * that distinction without every reader re-parsing English, so the record says it.
+ */
+export declare enum BackendStartFailureCause {
+    /** The application's own startup refused: its configuration, its schema, a dependency it requires. */
+    STARTUP_REFUSED = "startup-refused",
+    /** The HTTP server could not bind its port because another process already listens on it. `port` names it. */
+    PORT_IN_USE = "port-in-use",
+    /**
+     * A service the backend connects to at startup did not answer: the connection was refused, the name did not resolve,
+     * or it timed out (the database, the cache, the broker, the platform). Or it answered that it cannot serve YET: a
+     * database starting up or full, a replica set with no primary, a search process its database cannot reach (#3377).
+     * The local infrastructure is down or not ready, not the code. One member for both, because every reader reacts to
+     * them alike (the dev supervisor crash-loops, the companion reports the infrastructure); see the engine's
+     * `dependency-unavailability.backend.utils.ts` for what is read.
+     */
+    DEPENDENCY_UNREACHABLE = "dependency-unreachable"
+}
 /** The directory, under `APPLICATION_RUNTIME_SIGNALS_HOME`, holding one record per backend service. */
 export declare const BACKEND_START_OUTCOME_DIRECTORY = "backend-start";
 export declare const BACKEND_START_OUTCOME_RECORD_KIND = "wildo-backend-start-outcome";
@@ -39,6 +63,9 @@ export declare const BackendStartOutcomeRecord_Schema: z.ZodObject<{
     at: z.ZodString;
     pid: z.ZodNumber;
     message: z.ZodOptional<z.ZodString>;
+    failureCause: z.ZodOptional<z.ZodEnum<typeof BackendStartFailureCause>>;
+    port: z.ZodOptional<z.ZodNumber>;
+    workingDirectory: z.ZodOptional<z.ZodString>;
     lastStartedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type BackendStartOutcomeRecord = z.infer<typeof BackendStartOutcomeRecord_Schema>;

package/dist/esm/runtime/backend-start-outcome.contracts.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"backend-start-outcome.contracts.d.ts","sourceRoot":"","sources":["../../../src/runtime/backend-start-outcome.contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,mBAAmB;IAC7B,6EAA6E;IAC7E,OAAO,YAAY;IACnB,gFAAgF;IAChF,MAAM,WAAW;CAClB;AAED,uGAAuG;AACvG,eAAO,MAAM,+BAA+B,kBAAkB,CAAC;AAE/D,eAAO,MAAM,iCAAiC,gCAAgC,CAAC;AAE/E,eAAO,MAAM,gCAAgC~~;;;;;;;;;iBAgB3C~~,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAEzF,kFAAkF;AAClF,wBAAgB,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAE7E"}
1	+ {"version":3,"file":"backend-start-outcome.contracts.d.ts","sourceRoot":"","sources":["../../../src/runtime/backend-start-outcome.contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,mBAAmB;IAC7B,6EAA6E;IAC7E,OAAO,YAAY;IACnB,gFAAgF;IAChF,MAAM,WAAW;CAClB;AAED;;;;;;;;GAQG;AACH,oBAAY,wBAAwB;IAClC,sGAAsG;IACtG,eAAe,oBAAoB;IACnC,8GAA8G;IAC9G,WAAW,gBAAgB;IAC3B;;;;;;;OAOG;IACH,sBAAsB,2BAA2B;CAClD;AAED,uGAAuG;AACvG,eAAO,MAAM,+BAA+B,kBAAkB,CAAC;AAE/D,eAAO,MAAM,iCAAiC,gCAAgC,CAAC;AAE/E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;iBAyB3C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAEzF,kFAAkF;AAClF,wBAAgB,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAE7E"}

package/dist/esm/runtime/backend-start-outcome.contracts.js CHANGED Viewed

@@ -29,6 +29,31 @@ export var BackendStartOutcome;
     /** `initialize` threw: the process is about to exit, and `message` says why. */
     BackendStartOutcome["FAILED"] = "failed";
 })(BackendStartOutcome || (BackendStartOutcome = {}));
+/**
+ * WHY a start failed, when the backend can tell (#3214, #3217).
+ *
+ * The distinction a reader acts on is whose problem it is. A refusal raised by the application's own startup (a resource
+ * configuration the factory refuses, a migration owed) is fixed in the application's code. A port another process holds
+ * is not: on `app-creation-test-007` an orphaned backend kept port 4241, every rebuild's start died binding it, and the
+ * build lane answered "Fix the task that broke it" about a task that had broken nothing. The message alone cannot carry
+ * that distinction without every reader re-parsing English, so the record says it.
+ */
+export var BackendStartFailureCause;
+(function (BackendStartFailureCause) {
+    /** The application's own startup refused: its configuration, its schema, a dependency it requires. */
+    BackendStartFailureCause["STARTUP_REFUSED"] = "startup-refused";
+    /** The HTTP server could not bind its port because another process already listens on it. `port` names it. */
+    BackendStartFailureCause["PORT_IN_USE"] = "port-in-use";
+    /**
+     * A service the backend connects to at startup did not answer: the connection was refused, the name did not resolve,
+     * or it timed out (the database, the cache, the broker, the platform). Or it answered that it cannot serve YET: a
+     * database starting up or full, a replica set with no primary, a search process its database cannot reach (#3377).
+     * The local infrastructure is down or not ready, not the code. One member for both, because every reader reacts to
+     * them alike (the dev supervisor crash-loops, the companion reports the infrastructure); see the engine's
+     * `dependency-unavailability.backend.utils.ts` for what is read.
+     */
+    BackendStartFailureCause["DEPENDENCY_UNREACHABLE"] = "dependency-unreachable";
+})(BackendStartFailureCause || (BackendStartFailureCause = {}));
 /** The directory, under `APPLICATION_RUNTIME_SIGNALS_HOME`, holding one record per backend service. */
 export const BACKEND_START_OUTCOME_DIRECTORY = 'backend-start';
 export const BACKEND_START_OUTCOME_RECORD_KIND = 'wildo-backend-start-outcome';
@@ -43,6 +68,15 @@ export const BackendStartOutcomeRecord_Schema = z.object({
     pid: z.number().int().positive(),
     /** `failed` only: the refusal, as `describeCaughtError` words it — the factory's own sentence for a configuration error. */
     message: z.string().optional(),
+    /** `failed` only: whose problem the failure is (see {@link BackendStartFailureCause}). Absent on a record from an older engine. */
+    failureCause: z.enum(BackendStartFailureCause).optional(),
+    /** With {@link BackendStartFailureCause.PORT_IN_USE}: the port the server could not bind. */
+    port: z.number().int().positive().optional(),
+    /**
+     * The working directory of the process that started, so a reader can tell WHICH runtime the record describes (the
+     * supervisor whose runtime it is carries the same directory). Absent on a record from an older engine.
+     */
+    workingDirectory: z.string().min(1).optional(),
     /**
      * When this service last STARTED, carried across a failure so a reader can name what changed between a good start and
      * a failed one. Absent until the first successful start.

package/dist/esm/runtime/backend-start-outcome.contracts.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"backend-start-outcome.contracts.js","sourceRoot":"","sources":["../../../src/runtime/backend-start-outcome.contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,6EAA6E;IAC7E,0CAAmB,CAAA;IACnB,gFAAgF;IAChF,wCAAiB,CAAA;AACnB,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,+BAA+B,GAAG,eAAe,CAAC;AAE/D,MAAM,CAAC,MAAM,iCAAiC,GAAG,6BAA6B,CAAC;AAE/E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;IAClD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,8GAA8G;IAC9G,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACpC,4BAA4B;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,4HAA4H;IAC5H,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,kFAAkF;AAClF,MAAM,UAAU,2BAA2B,CAAC,iBAAyB;IACnE,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC;AACxE,CAAC","sourcesContent":["import { z } from 'zod';\n\n/*\n How a local application backend's last START ended, written by the backend itself (#2405).\n \n ## Why the backend records it, rather than something watching it\n \n `app-creation-test-005` landed a resource configuration the engine's factory refuses at startup. Its backend then\n * failed at every start, 35 times in four hours, while the build lane landed about 45 further tasks on top, and nothing\n * in the lane noticed. The companion did read one runtime signal, a supervisor's PAUSED state, but an app-creator\n * application runs its backend under `pnpm dev` with no supervisor at all, and under the monorepo's supervisor every new\n * build resets the crash budget, so PAUSED was rarely reached. A watcher's inference is mode-dependent; the process\n * that failed to start is the one party that knows it did, and why.\n \n So `StartApplicationBackendService.initialize` writes one record per service when it finishes, `started` or\n * `failed` with the refusal's message, and the companion reads it. The file lives under\n * `APPLICATION_RUNTIME_SIGNALS_HOME`, the \"app-owned filesystem handoff shared by a local backend and its companion\",\n * which the CLI emits only for an explicit LOCAL topology: a remote backend never writes one.\n \n ## Freshness is the reader's question\n \n The record says how the last start ended, not that the process is still alive or that the current tree was the one\n * started. A reader compares `at` with what it knows (the newest commit, whether the dev loop is running) before\n * treating a `failed` as the state of the application now. See the companion's boot reader.\n /\nexport enum BackendStartOutcome {\n /* `initialize` returned and the application reported itself initialized. /\n STARTED = 'started',\n /* `initialize` threw: the process is about to exit, and `message` says why. /\n FAILED = 'failed',\n}\n\n/* The directory, under `APPLICATION_RUNTIME_SIGNALS_HOME`, holding one record per backend service. /\nexport const BACKEND_START_OUTCOME_DIRECTORY = 'backend-start';\n\nexport const BACKEND_START_OUTCOME_RECORD_KIND = 'wildo-backend-start-outcome';\n\nexport const BackendStartOutcomeRecord_Schema = z.object({\n kind: z.literal(BACKEND_START_OUTCOME_RECORD_KIND),\n schemaVersion: z.literal(1),\n /* The bootstrap's service identifier (`services.backendApi`), or `backend` when the bootstrap named none. /\n serviceIdentifier: z.string().min(1),\n outcome: z.enum(BackendStartOutcome),\n /* When the start ended. /\n at: z.string().min(1),\n pid: z.number().int().positive(),\n /* `failed` only: the refusal, as `describeCaughtError` words it — the factory's own sentence for a configuration error. /\n message: z.string().optional(),\n /\n When this service last STARTED, carried across a failure so a reader can name what changed between a good start and\n * a failed one. Absent until the first successful start.\n /\n lastStartedAt: z.string().optional(),\n});\nexport type BackendStartOutcomeRecord = z.infer<typeof BackendStartOutcomeRecord_Schema>;\n\n/* The record's file name for a service: its identifier, made filesystem-safe. */\nexport function backendStartOutcomeFileName(serviceIdentifier: string): string {\n return `${serviceIdentifier.replace(/[^A-Za-z0-9._-]+/gu, '_')}.json`;\n}\n"]}
1	+ {"version":3,"file":"backend-start-outcome.contracts.js","sourceRoot":"","sources":["../../../src/runtime/backend-start-outcome.contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,mBAKX;AALD,WAAY,mBAAmB;IAC7B,6EAA6E;IAC7E,0CAAmB,CAAA;IACnB,gFAAgF;IAChF,wCAAiB,CAAA;AACnB,CAAC,EALW,mBAAmB,KAAnB,mBAAmB,QAK9B;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,wBAcX;AAdD,WAAY,wBAAwB;IAClC,sGAAsG;IACtG,+DAAmC,CAAA;IACnC,8GAA8G;IAC9G,uDAA2B,CAAA;IAC3B;;;;;;;OAOG;IACH,6EAAiD,CAAA;AACnD,CAAC,EAdW,wBAAwB,KAAxB,wBAAwB,QAcnC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,+BAA+B,GAAG,eAAe,CAAC;AAE/D,MAAM,CAAC,MAAM,iCAAiC,GAAG,6BAA6B,CAAC;AAE/E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC;IAClD,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,8GAA8G;IAC9G,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACpC,4BAA4B;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,4HAA4H;IAC5H,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,mIAAmI;IACnI,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;IACzD,6FAA6F;IAC7F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C;;;OAGG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C;;;OAGG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,kFAAkF;AAClF,MAAM,UAAU,2BAA2B,CAAC,iBAAyB;IACnE,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC;AACxE,CAAC","sourcesContent":["import { z } from 'zod';\n\n/*\n How a local application backend's last START ended, written by the backend itself (#2405).\n \n ## Why the backend records it, rather than something watching it\n \n `app-creation-test-005` landed a resource configuration the engine's factory refuses at startup. Its backend then\n * failed at every start, 35 times in four hours, while the build lane landed about 45 further tasks on top, and nothing\n * in the lane noticed. The companion did read one runtime signal, a supervisor's PAUSED state, but an app-creator\n * application runs its backend under `pnpm dev` with no supervisor at all, and under the monorepo's supervisor every new\n * build resets the crash budget, so PAUSED was rarely reached. A watcher's inference is mode-dependent; the process\n * that failed to start is the one party that knows it did, and why.\n \n So `StartApplicationBackendService.initialize` writes one record per service when it finishes, `started` or\n * `failed` with the refusal's message, and the companion reads it. The file lives under\n * `APPLICATION_RUNTIME_SIGNALS_HOME`, the \"app-owned filesystem handoff shared by a local backend and its companion\",\n * which the CLI emits only for an explicit LOCAL topology: a remote backend never writes one.\n \n ## Freshness is the reader's question\n \n The record says how the last start ended, not that the process is still alive or that the current tree was the one\n * started. A reader compares `at` with what it knows (the newest commit, whether the dev loop is running) before\n * treating a `failed` as the state of the application now. See the companion's boot reader.\n /\nexport enum BackendStartOutcome {\n /* `initialize` returned and the application reported itself initialized. /\n STARTED = 'started',\n /* `initialize` threw: the process is about to exit, and `message` says why. /\n FAILED = 'failed',\n}\n\n/\n WHY a start failed, when the backend can tell (#3214, #3217).\n \n The distinction a reader acts on is whose problem it is. A refusal raised by the application's own startup (a resource\n * configuration the factory refuses, a migration owed) is fixed in the application's code. A port another process holds\n * is not: on `app-creation-test-007` an orphaned backend kept port 4241, every rebuild's start died binding it, and the\n * build lane answered \"Fix the task that broke it\" about a task that had broken nothing. The message alone cannot carry\n * that distinction without every reader re-parsing English, so the record says it.\n /\nexport enum BackendStartFailureCause {\n /* The application's own startup refused: its configuration, its schema, a dependency it requires. /\n STARTUP_REFUSED = 'startup-refused',\n /* The HTTP server could not bind its port because another process already listens on it. `port` names it. /\n PORT_IN_USE = 'port-in-use',\n /\n A service the backend connects to at startup did not answer: the connection was refused, the name did not resolve,\n * or it timed out (the database, the cache, the broker, the platform). Or it answered that it cannot serve YET: a\n * database starting up or full, a replica set with no primary, a search process its database cannot reach (#3377).\n * The local infrastructure is down or not ready, not the code. One member for both, because every reader reacts to\n * them alike (the dev supervisor crash-loops, the companion reports the infrastructure); see the engine's\n * `dependency-unavailability.backend.utils.ts` for what is read.\n /\n DEPENDENCY_UNREACHABLE = 'dependency-unreachable',\n}\n\n/* The directory, under `APPLICATION_RUNTIME_SIGNALS_HOME`, holding one record per backend service. /\nexport const BACKEND_START_OUTCOME_DIRECTORY = 'backend-start';\n\nexport const BACKEND_START_OUTCOME_RECORD_KIND = 'wildo-backend-start-outcome';\n\nexport const BackendStartOutcomeRecord_Schema = z.object({\n kind: z.literal(BACKEND_START_OUTCOME_RECORD_KIND),\n schemaVersion: z.literal(1),\n /* The bootstrap's service identifier (`services.backendApi`), or `backend` when the bootstrap named none. /\n serviceIdentifier: z.string().min(1),\n outcome: z.enum(BackendStartOutcome),\n /* When the start ended. /\n at: z.string().min(1),\n pid: z.number().int().positive(),\n /* `failed` only: the refusal, as `describeCaughtError` words it — the factory's own sentence for a configuration error. /\n message: z.string().optional(),\n /* `failed` only: whose problem the failure is (see {@link BackendStartFailureCause}). Absent on a record from an older engine. /\n failureCause: z.enum(BackendStartFailureCause).optional(),\n /* With {@link BackendStartFailureCause.PORT_IN_USE}: the port the server could not bind. /\n port: z.number().int().positive().optional(),\n /\n The working directory of the process that started, so a reader can tell WHICH runtime the record describes (the\n * supervisor whose runtime it is carries the same directory). Absent on a record from an older engine.\n /\n workingDirectory: z.string().min(1).optional(),\n /\n When this service last STARTED, carried across a failure so a reader can name what changed between a good start and\n * a failed one. Absent until the first successful start.\n /\n lastStartedAt: z.string().optional(),\n});\nexport type BackendStartOutcomeRecord = z.infer<typeof BackendStartOutcomeRecord_Schema>;\n\n/* The record's file name for a service: its identifier, made filesystem-safe. */\nexport function backendStartOutcomeFileName(serviceIdentifier: string): string {\n return `${serviceIdentifier.replace(/[^A-Za-z0-9._-]+/gu, '_')}.json`;\n}\n"]}

package/dist/esm/runtime/frontend-settings-hub-wiring.contracts.d.ts ADDED Viewed

@@ -0,0 +1,28 @@
+/**
+ * Does the RUNNING frontend receive the application's Settings rail? (#3101, #3228)
+ *
+ * The rail is authored in `frontend/src/config/settings-hub.config.ts` and reaches Settings only as `settingsHub` in
+ * `frontendBaseConfig` (`frontend/src/modules-registry.frontend.ts`): the engine places no hub of its own. The dev
+ * companion reads the rail from the frontend's companion export, which imports the config file directly, so a registry
+ * that dropped `settingsHub: settingsHubConfig` passed every check the companion ran — the coding gate, the placement
+ * task's landing — while Settings opened as an empty dialog (#3100).
+ *
+ * One predicate, read as TEXT, because the registry is a frontend module that neither the CLI nor the companion's
+ * process imports (it pulls in the whole React graph). Comments are removed first, so a commented-out line is not a wiring.
+ * Its three readers: `wildo local doctor` and the dev preflight (warn), the coding gate `check:settings-placement-content`
+ * (fail), and the settings-rail placement task's landing (not landed).
+ */
+/** What a reader reports when the running frontend does not receive the authored rail (#3101). */
+export declare enum FrontendSettingsHubWiringFindingCode {
+    /** `settings-hub.config.ts` authors a rail and the frontend registry does not pass it: Settings opens as an empty dialog. */
+    SETTINGS_HUB_NOT_PASSED_TO_RUNTIME = "SETTINGS_HUB_NOT_PASSED_TO_RUNTIME"
+}
+/** Where the application's frontend module registry is, relative to the application root. */
+export declare const FRONTEND_MODULES_REGISTRY_RELATIVE_PATH = "frontend/src/modules-registry.frontend.ts";
+/** Where the application's Settings rail is authored, relative to the application root. */
+export declare const FRONTEND_SETTINGS_HUB_CONFIG_RELATIVE_PATH = "frontend/src/config/settings-hub.config.ts";
+/** True when the registry's code passes a `settingsHub` to the frontend config (`settingsHub: …` or shorthand `settingsHub,`). */
+export declare function frontendRegistryPassesSettingsHub(registrySource: string): boolean;
+/** True when the settings config file exports an authored rail (`export const settingsHubConfig`). */
+export declare function settingsHubConfigAuthorsRail(settingsHubConfigSource: string): boolean;
+//# sourceMappingURL=frontend-settings-hub-wiring.contracts.d.ts.map

package/dist/esm/runtime/frontend-settings-hub-wiring.contracts.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"frontend-settings-hub-wiring.contracts.d.ts","sourceRoot":"","sources":["../../../src/runtime/frontend-settings-hub-wiring.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,kGAAkG;AAClG,oBAAY,oCAAoC;IAC9C,6HAA6H;IAC7H,kCAAkC,uCAAuC;CAC1E;AAED,6FAA6F;AAC7F,eAAO,MAAM,uCAAuC,8CAA8C,CAAC;AACnG,2FAA2F;AAC3F,eAAO,MAAM,0CAA0C,+CAA+C,CAAC;AAEvG,kIAAkI;AAClI,wBAAgB,iCAAiC,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAGjF;AAED,sGAAsG;AACtG,wBAAgB,4BAA4B,CAAC,uBAAuB,EAAE,MAAM,GAAG,OAAO,CAErF"}

package/dist/esm/runtime/frontend-settings-hub-wiring.contracts.js ADDED Viewed

@@ -0,0 +1,35 @@
+/**
+ * Does the RUNNING frontend receive the application's Settings rail? (#3101, #3228)
+ *
+ * The rail is authored in `frontend/src/config/settings-hub.config.ts` and reaches Settings only as `settingsHub` in
+ * `frontendBaseConfig` (`frontend/src/modules-registry.frontend.ts`): the engine places no hub of its own. The dev
+ * companion reads the rail from the frontend's companion export, which imports the config file directly, so a registry
+ * that dropped `settingsHub: settingsHubConfig` passed every check the companion ran — the coding gate, the placement
+ * task's landing — while Settings opened as an empty dialog (#3100).
+ *
+ * One predicate, read as TEXT, because the registry is a frontend module that neither the CLI nor the companion's
+ * process imports (it pulls in the whole React graph). Comments are removed first, so a commented-out line is not a wiring.
+ * Its three readers: `wildo local doctor` and the dev preflight (warn), the coding gate `check:settings-placement-content`
+ * (fail), and the settings-rail placement task's landing (not landed).
+ */
+import { blankSourceComments } from '@wildo-ai/saas-models/public-runtime';
+/** What a reader reports when the running frontend does not receive the authored rail (#3101). */
+export var FrontendSettingsHubWiringFindingCode;
+(function (FrontendSettingsHubWiringFindingCode) {
+    /** `settings-hub.config.ts` authors a rail and the frontend registry does not pass it: Settings opens as an empty dialog. */
+    FrontendSettingsHubWiringFindingCode["SETTINGS_HUB_NOT_PASSED_TO_RUNTIME"] = "SETTINGS_HUB_NOT_PASSED_TO_RUNTIME";
+})(FrontendSettingsHubWiringFindingCode || (FrontendSettingsHubWiringFindingCode = {}));
+/** Where the application's frontend module registry is, relative to the application root. */
+export const FRONTEND_MODULES_REGISTRY_RELATIVE_PATH = 'frontend/src/modules-registry.frontend.ts';
+/** Where the application's Settings rail is authored, relative to the application root. */
+export const FRONTEND_SETTINGS_HUB_CONFIG_RELATIVE_PATH = 'frontend/src/config/settings-hub.config.ts';
+/** True when the registry's code passes a `settingsHub` to the frontend config (`settingsHub: …` or shorthand `settingsHub,`). */
+export function frontendRegistryPassesSettingsHub(registrySource) {
+    const code = blankSourceComments(registrySource);
+    return /\bsettingsHub\s*:/u.test(code) || /\bsettingsHub\s*,/u.test(code);
+}
+/** True when the settings config file exports an authored rail (`export const settingsHubConfig`). */
+export function settingsHubConfigAuthorsRail(settingsHubConfigSource) {
+    return /export\s+const\s+settingsHubConfig\b/u.test(settingsHubConfigSource);
+}
+//# sourceMappingURL=frontend-settings-hub-wiring.contracts.js.map