@wildo-ai/platform-core-shared 1.1.5 → 1.1.6

package/dist/esm/index.d.ts

@@ -6,6 +6,7 @@ export * from './workbench/workbench-creation-plane.custom.shared.schemas';
 export * from './workbench/workbench-creation-plane.custom.shared.resources-config.schemas';
 export * from './workbench/workbench-aspect-resources.custom.shared.schemas';
 export * from './workbench/workbench-creation-conversation.custom.shared.schemas';
+export * from './workbench/workbench-creation-console.custom.shared.schemas';
 export * from './workbench/workbench-creation-dossier.custom.shared.schemas';
 export * from './workbench/workbench-domain-model.custom.shared.schemas';
 export * from './core/resources/resources-relationships.custom.shared.definitions';
@@ -13,6 +14,7 @@ export * from './core/resources/resources-operations.custom.shared.definitions';
 export * from './security/authorizations/roles.custom.shared.definitions';
 export * from './runtime/application-backend-env.contracts';
 export * from './runtime/application-worker-env.contracts';
+export * from './runtime/http-server-env.contracts';
 export * from './runtime/runtime-topology.contracts';
 import type { ProductDefinition } from '@wildo-ai/saas-models';
 export declare const CUSTOM_PRODUCT_CATALOG: ProductDefinition[];

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,wDAAwD,CAAC;AAWvE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AACtE,cAAc,wEAAwE,CAAC;AACvF,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,mEAAmE,CAAC;AAClF,cAAc,8DAA8D,CAAC;AAC7E,cAAc,0DAA0D,CAAC;AACzE,cAAc,oEAAoE,CAAC;AACnF,cAAc,iEAAiE,CAAC;AAGhF,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,sCAAsC,CAAC;AAGrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,eAAO,MAAM,sBAAsB,EAAE,iBAAiB,EAAO,CAAC;AAK9D,cAAc,+DAA+D,CAAC;AAC9E,cAAc,iFAAiF,CAAC;AAIhG,cAAc,mFAAmF,CAAC;AAClG,cAAc,yEAAyE,CAAC;AACxF,cAAc,oGAAoG,CAAC;AACnH,cAAc,0FAA0F,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,wDAAwD,CAAC;AAWvE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AACtE,cAAc,wEAAwE,CAAC;AACvF,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,mEAAmE,CAAC;AAClF,cAAc,8DAA8D,CAAC;AAC7E,cAAc,8DAA8D,CAAC;AAC7E,cAAc,0DAA0D,CAAC;AACzE,cAAc,oEAAoE,CAAC;AACnF,cAAc,iEAAiE,CAAC;AAGhF,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AAGrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,eAAO,MAAM,sBAAsB,EAAE,iBAAiB,EAAO,CAAC;AAK9D,cAAc,+DAA+D,CAAC;AAC9E,cAAc,iFAAiF,CAAC;AAIhG,cAAc,mFAAmF,CAAC;AAClG,cAAc,yEAAyE,CAAC;AACxF,cAAc,oGAAoG,CAAC;AACnH,cAAc,0FAA0F,CAAC"}

package/dist/esm/index.js

@@ -19,6 +19,7 @@ export * from './workbench/workbench-creation-plane.custom.shared.schemas.js';
 export * from './workbench/workbench-creation-plane.custom.shared.resources-config.schemas.js';
 export * from './workbench/workbench-aspect-resources.custom.shared.schemas.js';
 export * from './workbench/workbench-creation-conversation.custom.shared.schemas.js';
+export * from './workbench/workbench-creation-console.custom.shared.schemas.js';
 export * from './workbench/workbench-creation-dossier.custom.shared.schemas.js';
 export * from './workbench/workbench-domain-model.custom.shared.schemas.js';
 export * from './core/resources/resources-relationships.custom.shared.definitions.js';
@@ -27,6 +28,7 @@ export * from './core/resources/resources-operations.custom.shared.definitions.j
 export * from './security/authorizations/roles.custom.shared.definitions.js';
 export * from './runtime/application-backend-env.contracts.js';
 export * from './runtime/application-worker-env.contracts.js';
+export * from './runtime/http-server-env.contracts.js';
 export * from './runtime/runtime-topology.contracts.js';
 export const CUSTOM_PRODUCT_CATALOG = [];
 // ### [ WILDO_AI CODE PLACEHOLDER ] [ platform_internal_code_begin ] [ BEGIN ] - Do not edit this code block. It is used by the platform to manage the code -  ##########################################################

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,iBAAiB,EAAE,CAAC;AAEpB,mBAAmB;AACnB,cAAc,wDAAwD,CAAC;AAEvE;;;;;;;;GAQG;AACH,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AACtE,cAAc,wEAAwE,CAAC;AACvF,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,mEAAmE,CAAC;AAClF,cAAc,8DAA8D,CAAC;AAC7E,cAAc,0DAA0D,CAAC;AACzE,cAAc,oEAAoE,CAAC;AACnF,cAAc,iEAAiE,CAAC;AAEhF,kBAAkB;AAClB,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,sCAAsC,CAAC;AAIrD,MAAM,CAAC,MAAM,sBAAsB,GAAwB,EAAE,CAAC;AAG9D,0NAA0N;AAE1N,cAAc,+DAA+D,CAAC;AAC9E,cAAc,iFAAiF,CAAC;AAEhG,uIAAuI;AAEvI,cAAc,mFAAmF,CAAC;AAClG,cAAc,yEAAyE,CAAC;AACxF,cAAc,oGAAoG,CAAC;AACnH,cAAc,0FAA0F,CAAC","sourcesContent":["// Initialize Zod decorators early (lazy init will also happen on first use)\nimport { initZodDecorators } from '@wildo-ai/zod-decorators';\ninitZodDecorators();\n\n// Custom resources\nexport * from './core/resources/resources-types.custom.shared.schemas';\n\n/*\n * The workbench's own vocabulary, kept SEPARATE from `customShared_*` on purpose.\n *\n * These resources are INTROSPECTION-backed — derived per read by the dev companion, never stored.\n * Adding them to `customShared_ResourcesConfigurationsFactoryMap` would hand them to that map's six\n * consumers, two of which must not have them: `platform-apps-manager` (whose INIT lifecycle applies\n * migrations, and there is nothing here to migrate) and the companion's i18n labelling planner,\n * which enumerates that map's keys and would generate labels for them.\n */\nexport * from './workbench/workbench-resources-types.custom.shared.schemas';\nexport * from './workbench/workbench-resources.custom.shared.schemas';\nexport * from './workbench/workbench-resources.custom.shared.resources-config.schemas';\nexport * from './workbench/workbench-creation-plane.custom.shared.schemas';\nexport * from './workbench/workbench-creation-plane.custom.shared.resources-config.schemas';\nexport * from './workbench/workbench-aspect-resources.custom.shared.schemas';\nexport * from './workbench/workbench-creation-conversation.custom.shared.schemas';\nexport * from './workbench/workbench-creation-dossier.custom.shared.schemas';\nexport * from './workbench/workbench-domain-model.custom.shared.schemas';\nexport * from './core/resources/resources-relationships.custom.shared.definitions';\nexport * from './core/resources/resources-operations.custom.shared.definitions';\n\n// Custom security\nexport * from './security/authorizations/roles.custom.shared.definitions';\nexport * from './runtime/application-backend-env.contracts';\nexport * from './runtime/application-worker-env.contracts';\nexport * from './runtime/runtime-topology.contracts';\n\n// Custom billing — product catalog (placeholder until product definitions are configured)\nimport type { ProductDefinition } from '@wildo-ai/saas-models';\nexport const CUSTOM_PRODUCT_CATALOG: ProductDefinition[] = [];\n\n\n// ### [ WILDO_AI CODE PLACEHOLDER ] [ platform_internal_code_begin ] [ BEGIN ] - Do not edit this code block. It is used by the platform to manage the code -  ##########################################################\n\nexport * from './wildo-applications/wildo-applications.custom.shared.schemas';\nexport * from './wildo-applications-versions/wildo-applications-versions.custom.shared.schemas';\n\n// ### [ WILDO_AI CODE PLACEHOLDER ] [ platform_internal_code_end ] [ END ]  ##########################################################\n\nexport * from './wildo-application-executions/wildo-application-executions.custom.shared.schemas';\nexport * from './wildo-application-tasks/wildo-application-tasks.custom.shared.schemas';\nexport * from './wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas';\nexport * from './wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas';\n\n\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,iBAAiB,EAAE,CAAC;AAEpB,mBAAmB;AACnB,cAAc,wDAAwD,CAAC;AAEvE;;;;;;;;GAQG;AACH,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AACtE,cAAc,wEAAwE,CAAC;AACvF,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,mEAAmE,CAAC;AAClF,cAAc,8DAA8D,CAAC;AAC7E,cAAc,8DAA8D,CAAC;AAC7E,cAAc,0DAA0D,CAAC;AACzE,cAAc,oEAAoE,CAAC;AACnF,cAAc,iEAAiE,CAAC;AAEhF,kBAAkB;AAClB,cAAc,2DAA2D,CAAC;AAC1E,cAAc,6CAA6C,CAAC;AAC5D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AAIrD,MAAM,CAAC,MAAM,sBAAsB,GAAwB,EAAE,CAAC;AAG9D,0NAA0N;AAE1N,cAAc,+DAA+D,CAAC;AAC9E,cAAc,iFAAiF,CAAC;AAEhG,uIAAuI;AAEvI,cAAc,mFAAmF,CAAC;AAClG,cAAc,yEAAyE,CAAC;AACxF,cAAc,oGAAoG,CAAC;AACnH,cAAc,0FAA0F,CAAC","sourcesContent":["// Initialize Zod decorators early (lazy init will also happen on first use)\nimport { initZodDecorators } from '@wildo-ai/zod-decorators';\ninitZodDecorators();\n\n// Custom resources\nexport * from './core/resources/resources-types.custom.shared.schemas';\n\n/*\n * The workbench's own vocabulary, kept SEPARATE from `customShared_*` on purpose.\n *\n * These resources are INTROSPECTION-backed — derived per read by the dev companion, never stored.\n * Adding them to `customShared_ResourcesConfigurationsFactoryMap` would hand them to that map's six\n * consumers, two of which must not have them: `platform-apps-manager` (whose INIT lifecycle applies\n * migrations, and there is nothing here to migrate) and the companion's i18n labelling planner,\n * which enumerates that map's keys and would generate labels for them.\n */\nexport * from './workbench/workbench-resources-types.custom.shared.schemas';\nexport * from './workbench/workbench-resources.custom.shared.schemas';\nexport * from './workbench/workbench-resources.custom.shared.resources-config.schemas';\nexport * from './workbench/workbench-creation-plane.custom.shared.schemas';\nexport * from './workbench/workbench-creation-plane.custom.shared.resources-config.schemas';\nexport * from './workbench/workbench-aspect-resources.custom.shared.schemas';\nexport * from './workbench/workbench-creation-conversation.custom.shared.schemas';\nexport * from './workbench/workbench-creation-console.custom.shared.schemas';\nexport * from './workbench/workbench-creation-dossier.custom.shared.schemas';\nexport * from './workbench/workbench-domain-model.custom.shared.schemas';\nexport * from './core/resources/resources-relationships.custom.shared.definitions';\nexport * from './core/resources/resources-operations.custom.shared.definitions';\n\n// Custom security\nexport * from './security/authorizations/roles.custom.shared.definitions';\nexport * from './runtime/application-backend-env.contracts';\nexport * from './runtime/application-worker-env.contracts';\nexport * from './runtime/http-server-env.contracts';\nexport * from './runtime/runtime-topology.contracts';\n\n// Custom billing — product catalog (placeholder until product definitions are configured)\nimport type { ProductDefinition } from '@wildo-ai/saas-models';\nexport const CUSTOM_PRODUCT_CATALOG: ProductDefinition[] = [];\n\n\n// ### [ WILDO_AI CODE PLACEHOLDER ] [ platform_internal_code_begin ] [ BEGIN ] - Do not edit this code block. It is used by the platform to manage the code -  ##########################################################\n\nexport * from './wildo-applications/wildo-applications.custom.shared.schemas';\nexport * from './wildo-applications-versions/wildo-applications-versions.custom.shared.schemas';\n\n// ### [ WILDO_AI CODE PLACEHOLDER ] [ platform_internal_code_end ] [ END ]  ##########################################################\n\nexport * from './wildo-application-executions/wildo-application-executions.custom.shared.schemas';\nexport * from './wildo-application-tasks/wildo-application-tasks.custom.shared.schemas';\nexport * from './wildo-application-executions/wildo-application-executions.custom.shared.resources-config.schemas';\nexport * from './wildo-application-tasks/wildo-application-tasks.custom.shared.resources-config.schemas';\n\n\n"]}

package/dist/esm/runtime/application-backend-env.contracts.d.ts

@@ -94,6 +94,25 @@ export declare enum ApplicationBackendDataEnvKey {
     MONGODB_DATABASE = "MONGODB_DATABASE",
     MONGODB_PROTOCOL = "MONGODB_PROTOCOL",
     MONGODB_DIRECT_CONNECTION = "MONGODB_DIRECT_CONNECTION",
+    /**
+     * Whether the backend's MongoDB connection uses TLS (`'true'` / `'false'`), when the address it was given STATES
+     * it (#2000). Absent means the protocol's default: on for `mongodb+srv`, off for `mongodb`.
+     *
+     * It exists because a `mongodb://` seed list for a server that requires TLS — an Atlas cluster with no SRV address,
+     * whose `mongoURIWithOptions` carries `ssl=true` — was reduced to host, database and protocol, and the backend then
+     * opened it without TLS, which Atlas refuses. Written by the CLI from an authored `externalEndpoints.mongodb`
+     * connection URL, read by the backend config loader into `database.mongodb.options.tls`.
+     *
+     * spec-cite: MongoDB Manual, Connection String Options (https://www.mongodb.com/docs/manual/reference/connection-string-options/),
+     * fetched 2026-09-29 — "The `ssl` option is equivalent to the `tls` option"; `tls` `true` is the "Default for SRV
+     * Connection Format", `false` the "Default for Standard Connection String Format".
+     */
+    MONGODB_TLS = "MONGODB_TLS",
+    /**
+     * The replica set a `mongodb://` seed list in `MONGODB_HOST` belongs to (#2000), from the authored connection URL's
+     * `replicaSet` option. Absent for an SRV address, whose DNS record carries it.
+     */
+    MONGODB_REPLICA_SET = "MONGODB_REPLICA_SET",
     /**
      * PostgreSQL TOPOLOGY only — host, port, database, ssl.
      *
@@ -191,8 +210,8 @@ export declare const ApplicationBackendDataEnvKeys: typeof ApplicationBackendDat
 export declare const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST: readonly [ApplicationBackendBootstrapEnvKey.APPLICATION_ID, ApplicationBackendBootstrapEnvKey.SERVICE_NAME, ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE, ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationBackendBootstrapEnvKey.APPLICATION_ENV];
 export declare const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST: readonly [ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL, ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL];
 export declare const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST: readonly [ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME];
-export declare const APPLICATION_BACKEND_DATA_ENV_KEY_LIST: readonly [ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER, ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT, ApplicationBackendDataEnvKey.MONGODB_HOST, ApplicationBackendDataEnvKey.MONGODB_DATABASE, ApplicationBackendDataEnvKey.MONGODB_PROTOCOL, ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION, ApplicationBackendDataEnvKey.POSTGRESQL_HOST, ApplicationBackendDataEnvKey.POSTGRESQL_PORT, ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE, ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE, ApplicationBackendDataEnvKey.REDIS_HOST, ApplicationBackendDataEnvKey.REDIS_PORT, ApplicationBackendDataEnvKey.REDIS_DATABASE, ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX, ApplicationBackendDataEnvKey.RABBITMQ_HOST, ApplicationBackendDataEnvKey.RABBITMQ_PORT, ApplicationBackendDataEnvKey.RABBITMQ_VHOST, ApplicationBackendDataEnvKey.STORAGE_PROVIDER, ApplicationBackendDataEnvKey.STORAGE_ENDPOINT, ApplicationBackendDataEnvKey.STORAGE_PORT, ApplicationBackendDataEnvKey.STORAGE_USE_SSL, ApplicationBackendDataEnvKey.STORAGE_BUCKET, ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX, ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR, ApplicationBackendDataEnvKey.CLAMAV_HOST, ApplicationBackendDataEnvKey.CLAMAV_PORT, ApplicationBackendDataEnvKey.YARA_ENABLED, ApplicationBackendDataEnvKey.YARA_HOST, ApplicationBackendDataEnvKey.YARA_PORT];
-export declare const APPLICATION_BACKEND_ENV_KEY_LIST: readonly [ApplicationBackendBootstrapEnvKey.APPLICATION_ID, ApplicationBackendBootstrapEnvKey.SERVICE_NAME, ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE, ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationBackendBootstrapEnvKey.APPLICATION_ENV, ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL, ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME, ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER, ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT, ApplicationBackendDataEnvKey.MONGODB_HOST, ApplicationBackendDataEnvKey.MONGODB_DATABASE, ApplicationBackendDataEnvKey.MONGODB_PROTOCOL, ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION, ApplicationBackendDataEnvKey.POSTGRESQL_HOST, ApplicationBackendDataEnvKey.POSTGRESQL_PORT, ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE, ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE, ApplicationBackendDataEnvKey.REDIS_HOST, ApplicationBackendDataEnvKey.REDIS_PORT, ApplicationBackendDataEnvKey.REDIS_DATABASE, ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX, ApplicationBackendDataEnvKey.RABBITMQ_HOST, ApplicationBackendDataEnvKey.RABBITMQ_PORT, ApplicationBackendDataEnvKey.RABBITMQ_VHOST, ApplicationBackendDataEnvKey.STORAGE_PROVIDER, ApplicationBackendDataEnvKey.STORAGE_ENDPOINT, ApplicationBackendDataEnvKey.STORAGE_PORT, ApplicationBackendDataEnvKey.STORAGE_USE_SSL, ApplicationBackendDataEnvKey.STORAGE_BUCKET, ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX, ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR, ApplicationBackendDataEnvKey.CLAMAV_HOST, ApplicationBackendDataEnvKey.CLAMAV_PORT, ApplicationBackendDataEnvKey.YARA_ENABLED, ApplicationBackendDataEnvKey.YARA_HOST, ApplicationBackendDataEnvKey.YARA_PORT];
+export declare const APPLICATION_BACKEND_DATA_ENV_KEY_LIST: readonly [ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER, ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT, ApplicationBackendDataEnvKey.MONGODB_HOST, ApplicationBackendDataEnvKey.MONGODB_DATABASE, ApplicationBackendDataEnvKey.MONGODB_PROTOCOL, ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION, ApplicationBackendDataEnvKey.MONGODB_TLS, ApplicationBackendDataEnvKey.MONGODB_REPLICA_SET, ApplicationBackendDataEnvKey.POSTGRESQL_HOST, ApplicationBackendDataEnvKey.POSTGRESQL_PORT, ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE, ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE, ApplicationBackendDataEnvKey.REDIS_HOST, ApplicationBackendDataEnvKey.REDIS_PORT, ApplicationBackendDataEnvKey.REDIS_DATABASE, ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX, ApplicationBackendDataEnvKey.RABBITMQ_HOST, ApplicationBackendDataEnvKey.RABBITMQ_PORT, ApplicationBackendDataEnvKey.RABBITMQ_VHOST, ApplicationBackendDataEnvKey.STORAGE_PROVIDER, ApplicationBackendDataEnvKey.STORAGE_ENDPOINT, ApplicationBackendDataEnvKey.STORAGE_PORT, ApplicationBackendDataEnvKey.STORAGE_USE_SSL, ApplicationBackendDataEnvKey.STORAGE_BUCKET, ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX, ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR, ApplicationBackendDataEnvKey.CLAMAV_HOST, ApplicationBackendDataEnvKey.CLAMAV_PORT, ApplicationBackendDataEnvKey.YARA_ENABLED, ApplicationBackendDataEnvKey.YARA_HOST, ApplicationBackendDataEnvKey.YARA_PORT];
+export declare const APPLICATION_BACKEND_ENV_KEY_LIST: readonly [ApplicationBackendBootstrapEnvKey.APPLICATION_ID, ApplicationBackendBootstrapEnvKey.SERVICE_NAME, ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID, ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE, ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET, ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL, ApplicationBackendBootstrapEnvKey.APPLICATION_ENV, ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL, ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS, ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME, ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER, ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT, ApplicationBackendDataEnvKey.MONGODB_HOST, ApplicationBackendDataEnvKey.MONGODB_DATABASE, ApplicationBackendDataEnvKey.MONGODB_PROTOCOL, ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION, ApplicationBackendDataEnvKey.MONGODB_TLS, ApplicationBackendDataEnvKey.MONGODB_REPLICA_SET, ApplicationBackendDataEnvKey.POSTGRESQL_HOST, ApplicationBackendDataEnvKey.POSTGRESQL_PORT, ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE, ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE, ApplicationBackendDataEnvKey.REDIS_HOST, ApplicationBackendDataEnvKey.REDIS_PORT, ApplicationBackendDataEnvKey.REDIS_DATABASE, ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX, ApplicationBackendDataEnvKey.RABBITMQ_HOST, ApplicationBackendDataEnvKey.RABBITMQ_PORT, ApplicationBackendDataEnvKey.RABBITMQ_VHOST, ApplicationBackendDataEnvKey.STORAGE_PROVIDER, ApplicationBackendDataEnvKey.STORAGE_ENDPOINT, ApplicationBackendDataEnvKey.STORAGE_PORT, ApplicationBackendDataEnvKey.STORAGE_USE_SSL, ApplicationBackendDataEnvKey.STORAGE_BUCKET, ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX, ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR, ApplicationBackendDataEnvKey.CLAMAV_HOST, ApplicationBackendDataEnvKey.CLAMAV_PORT, ApplicationBackendDataEnvKey.YARA_ENABLED, ApplicationBackendDataEnvKey.YARA_HOST, ApplicationBackendDataEnvKey.YARA_PORT];
 /**
  * Keys that must always be treated as secrets when this app-backend env surface
  * is materialized into logs, CI artifacts, or deployment manifests.

package/dist/esm/runtime/application-backend-env.contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-backend-env.contracts.d.ts","sourceRoot":"","sources":["../../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oBAAY,iCAAiC;IAC3C,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,uBAAuB,4BAA4B;IACnD,oIAAoI;IACpI,wBAAwB,6BAA6B;IACrD,mCAAmC,wCAAwC;IAC3E,yBAAyB,8BAA8B;IACvD,eAAe,oBAAoB;CACpC;AAED,oBAAY,mCAAmC;IAC7C,qCAAqC,0CAA0C;IAC/E,4BAA4B,iCAAiC;CAC9D;AAED,oBAAY,+BAA+B;IACzC,6BAA6B,kCAAkC;IAC/D,8IAA8I;IAC9I,gCAAgC,qCAAqC;IACrE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,oBAAY,4BAA4B;IACtC;;;;;;;;;;;;;OAaG;IACH,wBAAwB,6BAA6B;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,kBAAkB,uBAAuB;IACzC,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,yBAAyB,8BAA8B;IACvD;;;;;;;OAOG;IACH,eAAe,oBAAoB;IACnC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAC3C,UAAU,eAAe;IACzB,UAAU,eAAe;IACzB;;;;OAIG;IACH,cAAc,mBAAmB;IACjC;;;;;;;;;;;;OAYG;IACH,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,qBAAqB;IACrC,YAAY,iBAAiB;IAC7B,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC;;;;;;;;;;;OAWG;IACH,qBAAqB,0BAA0B;IAc/C,sBAAsB,2BAA2B;IACjD,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,kCAAkC,0CAAoC,CAAC;AACpF,eAAO,MAAM,oCAAoC,4CAAsC,CAAC;AACxF,eAAO,MAAM,gCAAgC,wCAAkC,CAAC;AAChF,eAAO,MAAM,6BAA6B,qCAA+B,CAAC;AAE1E,eAAO,MAAM,0CAA0C,2ZAQ7C,CAAC;AAEX,eAAO,MAAM,6CAA6C,wJAGhD,CAAC;AAEX,eAAO,MAAM,wCAAwC,4IAG3C,CAAC;AAEX,eAAO,MAAM,qCAAqC,m0CA8BxC,CAAC;AAEX,eAAO,MAAM,gCAAgC,i+DAKnC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,sCAAsC,aAKjD,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAClC,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAC3D,eAAO,MAAM,2BAA2B,SAAS,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOpE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD"}
+{"version":3,"file":"application-backend-env.contracts.d.ts","sourceRoot":"","sources":["../../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,oBAAY,iCAAiC;IAC3C,cAAc,mBAAmB;IACjC,YAAY,iBAAiB;IAC7B,uBAAuB,4BAA4B;IACnD,oIAAoI;IACpI,wBAAwB,6BAA6B;IACrD,mCAAmC,wCAAwC;IAC3E,yBAAyB,8BAA8B;IACvD,eAAe,oBAAoB;CACpC;AAED,oBAAY,mCAAmC;IAC7C,qCAAqC,0CAA0C;IAC/E,4BAA4B,iCAAiC;CAC9D;AAED,oBAAY,+BAA+B;IACzC,6BAA6B,kCAAkC;IAC/D,8IAA8I;IAC9I,gCAAgC,qCAAqC;IACrE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,wBAAwB,6BAA6B;CACtD;AAED,oBAAY,4BAA4B;IACtC;;;;;;;;;;;;;OAaG;IACH,wBAAwB,6BAA6B;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,kBAAkB,uBAAuB;IACzC,YAAY,iBAAiB;IAC7B,gBAAgB,qBAAqB;IACrC,gBAAgB,qBAAqB;IACrC,yBAAyB,8BAA8B;IACvD;;;;;;;;;;;;OAYG;IACH,WAAW,gBAAgB;IAC3B;;;OAGG;IACH,mBAAmB,wBAAwB;IAC3C;;;;;;;OAOG;IACH,eAAe,oBAAoB;IACnC,eAAe,oBAAoB;IACnC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAC3C,UAAU,eAAe;IACzB,UAAU,eAAe;IACzB;;;;OAIG;IACH,cAAc,mBAAmB;IACjC;;;;;;;;;;;;OAYG;IACH,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,aAAa,kBAAkB;IAC/B;;;;;;;;OAQG;IACH,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;IACrC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,qBAAqB;IACrC,YAAY,iBAAiB;IAC7B,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC;;;;;;;;;;;OAWG;IACH,qBAAqB,0BAA0B;IAc/C,sBAAsB,2BAA2B;IACjD,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,SAAS,cAAc;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,kCAAkC,0CAAoC,CAAC;AACpF,eAAO,MAAM,oCAAoC,4CAAsC,CAAC;AACxF,eAAO,MAAM,gCAAgC,wCAAkC,CAAC;AAChF,eAAO,MAAM,6BAA6B,qCAA+B,CAAC;AAE1E,eAAO,MAAM,0CAA0C,2ZAQ7C,CAAC;AAEX,eAAO,MAAM,6CAA6C,wJAGhD,CAAC;AAEX,eAAO,MAAM,wCAAwC,4IAG3C,CAAC;AAEX,eAAO,MAAM,qCAAqC,+5CAgCxC,CAAC;AAEX,eAAO,MAAM,gCAAgC,6jEAKnC,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,sCAAsC,aAKjD,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAClC,OAAO,gCAAgC,CAAC,MAAM,CAAC,CAAC;AAElD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAC3D,eAAO,MAAM,2BAA2B,SAAS,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAOpE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD"}

package/dist/esm/runtime/application-backend-env.contracts.js

@@ -98,6 +98,25 @@ export var ApplicationBackendDataEnvKey;
     ApplicationBackendDataEnvKey["MONGODB_DATABASE"] = "MONGODB_DATABASE";
     ApplicationBackendDataEnvKey["MONGODB_PROTOCOL"] = "MONGODB_PROTOCOL";
     ApplicationBackendDataEnvKey["MONGODB_DIRECT_CONNECTION"] = "MONGODB_DIRECT_CONNECTION";
+    /**
+     * Whether the backend's MongoDB connection uses TLS (`'true'` / `'false'`), when the address it was given STATES
+     * it (#2000). Absent means the protocol's default: on for `mongodb+srv`, off for `mongodb`.
+     *
+     * It exists because a `mongodb://` seed list for a server that requires TLS — an Atlas cluster with no SRV address,
+     * whose `mongoURIWithOptions` carries `ssl=true` — was reduced to host, database and protocol, and the backend then
+     * opened it without TLS, which Atlas refuses. Written by the CLI from an authored `externalEndpoints.mongodb`
+     * connection URL, read by the backend config loader into `database.mongodb.options.tls`.
+     *
+     * spec-cite: MongoDB Manual, Connection String Options (https://www.mongodb.com/docs/manual/reference/connection-string-options/),
+     * fetched 2026-09-29 — "The `ssl` option is equivalent to the `tls` option"; `tls` `true` is the "Default for SRV
+     * Connection Format", `false` the "Default for Standard Connection String Format".
+     */
+    ApplicationBackendDataEnvKey["MONGODB_TLS"] = "MONGODB_TLS";
+    /**
+     * The replica set a `mongodb://` seed list in `MONGODB_HOST` belongs to (#2000), from the authored connection URL's
+     * `replicaSet` option. Absent for an SRV address, whose DNS record carries it.
+     */
+    ApplicationBackendDataEnvKey["MONGODB_REPLICA_SET"] = "MONGODB_REPLICA_SET";
     /**
      * PostgreSQL TOPOLOGY only — host, port, database, ssl.
      *
@@ -229,6 +248,8 @@ export const APPLICATION_BACKEND_DATA_ENV_KEY_LIST = [
     ApplicationBackendDataEnvKey.MONGODB_DATABASE,
     ApplicationBackendDataEnvKey.MONGODB_PROTOCOL,
     ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION,
+    ApplicationBackendDataEnvKey.MONGODB_TLS,
+    ApplicationBackendDataEnvKey.MONGODB_REPLICA_SET,
     ApplicationBackendDataEnvKey.POSTGRESQL_HOST,
     ApplicationBackendDataEnvKey.POSTGRESQL_PORT,
     ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE,

package/dist/esm/runtime/application-backend-env.contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-backend-env.contracts.js","sourceRoot":"","sources":["../../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAN,IAAY,iCASX;AATD,WAAY,iCAAiC;IAC3C,sEAAiC,CAAA;IACjC,kEAA6B,CAAA;IAC7B,wFAAmD,CAAA;IACnD,oIAAoI;IACpI,0FAAqD,CAAA;IACrD,gHAA2E,CAAA;IAC3E,4FAAuD,CAAA;IACvD,wEAAmC,CAAA;AACrC,CAAC,EATW,iCAAiC,KAAjC,iCAAiC,QAS5C;AAED,MAAM,CAAN,IAAY,mCAGX;AAHD,WAAY,mCAAmC;IAC7C,sHAA+E,CAAA;IAC/E,oGAA6D,CAAA;AAC/D,CAAC,EAHW,mCAAmC,KAAnC,mCAAmC,QAG9C;AAED,MAAM,CAAN,IAAY,+BA4BX;AA5BD,WAAY,+BAA+B;IACzC,kGAA+D,CAAA;IAC/D,8IAA8I;IAC9I,wGAAqE,CAAA;IACrE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,wFAAqD,CAAA;AACvD,CAAC,EA5BW,+BAA+B,KAA/B,+BAA+B,QA4B1C;AAED,MAAM,CAAN,IAAY,4BA+IX;AA/ID,WAAY,4BAA4B;IACtC;;;;;;;;;;;;;OAaG;IACH,qFAAqD,CAAA;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,yEAAyC,CAAA;IACzC,6DAA6B,CAAA;IAC7B,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,uFAAuD,CAAA;IACvD;;;;;;;OAOG;IACH,mEAAmC,CAAA;IACnC,mEAAmC,CAAA;IACnC,2EAA2C,CAAA;IAC3C,2EAA2C,CAAA;IAC3C,yDAAyB,CAAA;IACzB,yDAAyB,CAAA;IACzB;;;;OAIG;IACH,iEAAiC,CAAA;IACjC;;;;;;;;;;;;OAYG;IACH,qEAAqC,CAAA;IACrC,+DAA+B,CAAA;IAC/B,+DAA+B,CAAA;IAC/B;;;;;;;;OAQG;IACH,iEAAiC,CAAA;IACjC,qEAAqC,CAAA;IACrC;;;;;;;;;;;;;;OAcG;IACH,qEAAqC,CAAA;IACrC,6DAA6B,CAAA;IAC7B,mEAAmC,CAAA;IACnC,iEAAiC,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,+EAA+C,CAAA;IAC/C,8EAA8E;IAC9E,2CAA2C;IAC3C,EAAE;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,mEAAmE;IACnE,EAAE;IACF,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,sEAAsE;IACtE,iFAAiD,CAAA;IACjD,2DAA2B,CAAA;IAC3B,2DAA2B,CAAA;IAC3B,6DAA6B,CAAA;IAC7B,uDAAuB,CAAA;IACvB,uDAAuB,CAAA;AACzB,CAAC,EA/IW,4BAA4B,KAA5B,4BAA4B,QA+IvC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,iCAAiC,CAAC;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,mCAAmC,CAAC;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAC;AAChF,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC;AAE1E,MAAM,CAAC,MAAM,0CAA0C,GAAG;IACxD,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,YAAY;IAC9C,iCAAiC,CAAC,uBAAuB;IACzD,iCAAiC,CAAC,wBAAwB;IAC1D,iCAAiC,CAAC,mCAAmC;IACrE,iCAAiC,CAAC,yBAAyB;IAC3D,iCAAiC,CAAC,eAAe;CACzC,CAAC;AAEX,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D,mCAAmC,CAAC,qCAAqC;IACzE,mCAAmC,CAAC,4BAA4B;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,+BAA+B,CAAC,6BAA6B;IAC7D,+BAA+B,CAAC,gCAAgC;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,4BAA4B,CAAC,wBAAwB;IACrD,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,yBAAyB;IACtD,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,qBAAqB;IAClD,4BAA4B,CAAC,sBAAsB;IACnD,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,SAAS;IACtC,4BAA4B,CAAC,SAAS;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,GAAG,0CAA0C;IAC7C,GAAG,6CAA6C;IAChD,GAAG,wCAAwC;IAC3C,GAAG,qCAAqC;CAChC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAS;IACpE,iCAAiC,CAAC,mCAAmC;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,kDAAkD;CACnD,CAAC,CAAC;AAKH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,UAAU;SACd,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,uCAAuC;SAC9E,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,qCAAqC;SACpE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,mBAAmB;SACvC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,aAAa;SACnC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,GAAG,2BAA2B,GAAG,yBAAyB,CAAC,UAAU,CAAC,GAAG,2BAA2B,EAAE,CAAC;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,OAAO,GAAG;SACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,mCAAmC;SAC1E,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,+CAA+C;SAC3E,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,gCAAgC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAY;IACtF,OAAO,UAAU,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC","sourcesContent":["/**\n * Shared environment contract for application backend processes.\n *\n * This is the canonical vocabulary for the app-backend `.env` surface emitted\n * by the CLI and parsed by backend runtimes. Keep the keys here purely\n * declarative: they describe names and ownership, not executor-specific\n * behavior.\n */\n\nexport enum ApplicationBackendBootstrapEnvKey {\n  APPLICATION_ID = 'APPLICATION_ID',\n  SERVICE_NAME = 'SERVICE_NAME',\n  PLATFORM_ENVIRONMENT_ID = 'PLATFORM_ENVIRONMENT_ID',\n  /** Deployment topology authority (`local` or `remote`), distinct from APPLICATION_ENV behavior mode and from the environment id. */\n  DEPLOYMENT_LOCATION_TYPE = 'DEPLOYMENT_LOCATION_TYPE',\n  PLATFORM_APPLICATION_PRIMARY_SECRET = 'PLATFORM_APPLICATION_PRIMARY_SECRET',\n  PLATFORM_APPS_MANAGER_URL = 'PLATFORM_APPS_MANAGER_URL',\n  APPLICATION_ENV = 'APPLICATION_ENV',\n}\n\nexport enum ApplicationBackendPlatformUrlEnvKey {\n  PLATFORM_CRONTABS_BATCHES_MANAGER_URL = 'PLATFORM_CRONTABS_BATCHES_MANAGER_URL',\n  PLATFORM_MODULE_REGISTRY_URL = 'PLATFORM_MODULE_REGISTRY_URL',\n}\n\nexport enum ApplicationBackendRuntimeEnvKey {\n  APPLICATION_RUNTIME_ENDPOINTS = 'APPLICATION_RUNTIME_ENDPOINTS',\n  /** Explicit app-owned filesystem handoff shared by a local backend and its companion. Absence means no filesystem transport is authorized. */\n  APPLICATION_RUNTIME_SIGNALS_HOME = 'APPLICATION_RUNTIME_SIGNALS_HOME',\n  /**\n   * Secret gating the application's OPERATOR doors — the data-seeding admin surface and the\n   * external-data admin surface, both root-mounted under `/internal/admin/...`.\n   *\n   * ## Why this key is declared here, and why the engine has its own copies\n   *\n   * The two consumers read `process.env` DIRECTLY, from\n   * `data-seeding-admin.backend.contracts.ts` and `external-data-admin.backend.contracts.ts`, which\n   * each declare the literal so that surface stays self-contained to `saas-backend-lib`. This is the\n   * PRODUCER's copy: the CLI must know the name to emit it, and `saas-backend-lib` is not a\n   * dependency of the CLI. Three copies of one string, cross-referenced, and pinned together by\n   * `application-admin-secret-env-key.test.ts` — the same treatment the Node-version copies get,\n   * for the same reason: no import can span these packages.\n   *\n   * ## Why it exists at all (#586)\n   *\n   * It did not, and neither door could be opened in any deployment the framework generates. The key\n   * appeared in the two engine controllers that READ it and in shipped skill prose telling an\n   * operator to author it in `secrets.json` — which nothing read. `providerEnv` could not carry it\n   * either: `filterProviderEnvToScope` admits a key only when some scoped provider's secrets\n   * contract declares its env-var name, and no provider declares this one, so it was dropped with a\n   * warning. Measured 2026-09-10: zero writers, zero templates.\n   */\n  APPLICATION_ADMIN_SECRET = 'APPLICATION_ADMIN_SECRET',\n}\n\nexport enum ApplicationBackendDataEnvKey {\n  /**\n   * Which persistence adapter the application's resources use.\n   *\n   * DECLARED, not derived. Until this existed the config loader hard-coded MONGODB, so no\n   * environment, secret or bootstrap value could select PostgreSQL — the adapter was reachable only\n   * by a test that reached into the config object directly, which is why no application had ever\n   * booted on it. Deriving it instead (\"PostgreSQL keys are present, so use PostgreSQL\") was\n   * rejected: which store an application persists to is a deployment decision that must be legible\n   * in one place, not an emergent property of which variables happen to be set.\n   *\n   * Absent means MONGODB, so every existing deployment is unaffected. That default is for processes\n   * nothing configures; an APPLICATION backend never reaches it — the CLI writes the adapter resolved\n   * from `applicationDatabase` for both engines (#1571: an absent `applicationDatabase` is PostgreSQL).\n   */\n  DATABASE_DEFAULT_ADAPTER = 'DATABASE_DEFAULT_ADAPTER',\n  /**\n   * The format NEW resource identifiers are minted in — `object-id` or `uuid`.\n   *\n   * DECLARED, and specifically NOT derived from {@link DATABASE_DEFAULT_ADAPTER}. The engine used to\n   * derive it (MongoDB implied `OBJECT_ID`, PostgreSQL implied `UUID`), which made an application's\n   * identity format a side effect of where its rows happen to live: moving a resource between\n   * adapters silently changed the shape of every id it minted AND made every id it had already\n   * minted fail `validateForResource`. Identity reaches URLs, exports, external references and\n   * integrations, so it is an application-level decision that must outlive a storage decision.\n   *\n   * It needed an env key for the same reason the adapter did. The loader hard-coded\n   * `ResourceIdFormat.OBJECT_ID`, so the value was legible nowhere and changeable by nobody: an\n   * application could select PostgreSQL and still had no supported way to STATE its identity format,\n   * which left the engine's \"declared, never derived\" rule true in the schema and unreachable in\n   * practice.\n   *\n   * Absent means `OBJECT_ID` — what every existing application already mints — so no deployment\n   * changes behaviour by adding this key to the contract.\n   *\n   * One deployment constraint travels with it: on PostgreSQL the `_id` COLUMN must be able to hold\n   * the declared format. DDL rendered from the schema plan types it `text`, which is correct for\n   * either member; a hand-written `_id uuid` column restricts the application to `UUID` and rejects\n   * an `OBJECT_ID` outright.\n   */\n  RESOURCE_ID_FORMAT = 'RESOURCE_ID_FORMAT',\n  MONGODB_HOST = 'MONGODB_HOST',\n  MONGODB_DATABASE = 'MONGODB_DATABASE',\n  MONGODB_PROTOCOL = 'MONGODB_PROTOCOL',\n  MONGODB_DIRECT_CONNECTION = 'MONGODB_DIRECT_CONNECTION',\n  /**\n   * PostgreSQL TOPOLOGY only — host, port, database, ssl.\n   *\n   * CREDENTIALS are deliberately NOT here. They arrive through\n   * `secrets.database.postgresql`, exactly as MongoDB's do: env carries where the database is,\n   * secrets carry who may open it. Putting a password in an env contract would make it readable\n   * from every process listing and every container inspect.\n   */\n  POSTGRESQL_HOST = 'POSTGRESQL_HOST',\n  POSTGRESQL_PORT = 'POSTGRESQL_PORT',\n  POSTGRESQL_DATABASE = 'POSTGRESQL_DATABASE',\n  POSTGRESQL_SSL_MODE = 'POSTGRESQL_SSL_MODE',\n  REDIS_HOST = 'REDIS_HOST',\n  REDIS_PORT = 'REDIS_PORT',\n  /**\n   * Optional Redis logical database index (0–15). Emitted only when the\n   * author sets `backingServices.redis.database` in `wildo.infra.<env>.config.ts`.\n   * Consumers default to DB 0 when this var is missing.\n   */\n  REDIS_DATABASE = 'REDIS_DATABASE',\n  /**\n   * Canonical app-level Redis key namespace. Emitted only when the author\n   * sets `dataServices.redis.keyPrefix` in `wildo.saas.config.ts` (Slice 3.6).\n   * `RedisService` uses this as the `appPrefix` for all keys it writes — every\n   * key becomes `${REDIS_KEY_PREFIX}org:${orgId}:${key}` or\n   * `${REDIS_KEY_PREFIX}global:${key}`. When unset, the app-level prefix\n   * stays empty (multi-tenant isolation falls back to the\n   * `org:`/`global:` segment alone).\n   *\n   * REPLACE semantics: this supersedes the legacy\n   * `secrets.database.redis.username`-derived prefix (Slice 3.6 audit\n   * decision — single source of truth = `wildo.saas.config.dataServices`).\n   */\n  REDIS_KEY_PREFIX = 'REDIS_KEY_PREFIX',\n  RABBITMQ_HOST = 'RABBITMQ_HOST',\n  RABBITMQ_PORT = 'RABBITMQ_PORT',\n  /**\n   * Optional RabbitMQ virtual host. Emitted only when the author sets\n   * `backingServices.rabbitmq.vhost` in `wildo.infra.<env>.config.ts`.\n   * Consumers default to `/` (the RabbitMQ root vhost) when missing.\n   *\n   * Note (Slice 3.6 audit): the symmetric saas-side field\n   * `dataServices.rabbitmq.vhost` was DELETED. Vhost is an\n   * infra/topology concern with a single authoring seam (infra config).\n   */\n  RABBITMQ_VHOST = 'RABBITMQ_VHOST',\n  STORAGE_PROVIDER = 'STORAGE_PROVIDER',\n  /**\n   * S3-compatible endpoint **hostname** (NOT a URL). The variable name\n   * pre-dates the convention pin and is intentionally kept stable for\n   * backward compatibility with deployed manifests, but the value is\n   * always a bare host (`minio`, `s3.amazonaws.com`, `127.0.0.1`) — the\n   * `STORAGE_PORT` and `STORAGE_USE_SSL` siblings are what compose the\n   * full `https?://host:port` URL at the SDK initialization site.\n   *\n   * Slice 3.2 audit (L-4): authoring an explicit URL here (`http://...`)\n   * silently breaks the `host:port` contract downstream because the SDK\n   * concatenates the parts naively. If a future migration wants to flip\n   * the contract to a URL, rename the env key (`STORAGE_URL`) rather\n   * than overloading this one — the rename surfaces the breaking change\n   * to operators.\n   */\n  STORAGE_ENDPOINT = 'STORAGE_ENDPOINT',\n  STORAGE_PORT = 'STORAGE_PORT',\n  STORAGE_USE_SSL = 'STORAGE_USE_SSL',\n  STORAGE_BUCKET = 'STORAGE_BUCKET',\n  /**\n   * Optional app-level object-key namespace prefix prepended to every\n   * application file path produced by `WildoManagedStorageProvider`\n   * (Slice 3.6). Final key shape becomes\n   * `${STORAGE_BUCKET_PREFIX}/applications/${applicationId}/files/${fileId}`\n   * (extra segment above the existing `applicationId`-based namespace).\n   *\n   * Emitted only when the author sets `dataServices.s3.bucketPrefix` in\n   * `wildo.saas.config.ts`. The actual MinIO bucket name (`STORAGE_BUCKET`)\n   * remains infra-controlled and is unaffected by this prefix — N apps\n   * can share one bucket while keeping their object trees disjoint.\n   */\n  STORAGE_BUCKET_PREFIX = 'STORAGE_BUCKET_PREFIX',\n  // ⚠️ `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are deliberately ABSENT from\n  // this contract, and must not be re-added.\n  //\n  // They carried the object store's ROOT credential — the same pair the MinIO\n  // container itself is created with — into every application, minion and worker\n  // environment. An application now obtains short-lived, prefix-confined session\n  // credentials from apps-manager instead (`createStsStorageCredentialResolver`),\n  // so there is no application-tier storage credential to name here.\n  //\n  // Re-adding them would not merely restore a variable: this enum is the DECLARED\n  // app-backend env surface, so a key here is an invitation for a builder to fill\n  // it. `assertNoStorageSecretInGeneratedEnv` fails the build if one ever does.\n  // See `.claude/plans/object-storage-root-credential-distribution.md`.\n  STORAGE_LOCAL_BASE_DIR = 'STORAGE_LOCAL_BASE_DIR',\n  CLAMAV_HOST = 'CLAMAV_HOST',\n  CLAMAV_PORT = 'CLAMAV_PORT',\n  YARA_ENABLED = 'YARA_ENABLED',\n  YARA_HOST = 'YARA_HOST',\n  YARA_PORT = 'YARA_PORT',\n}\n\n/**\n * Keep the plural `*Keys` aliases so current consumers keep reading naturally,\n * while the actual source of truth is the scoped enum definition above.\n */\nexport const ApplicationBackendBootstrapEnvKeys = ApplicationBackendBootstrapEnvKey;\nexport const ApplicationBackendPlatformUrlEnvKeys = ApplicationBackendPlatformUrlEnvKey;\nexport const ApplicationBackendRuntimeEnvKeys = ApplicationBackendRuntimeEnvKey;\nexport const ApplicationBackendDataEnvKeys = ApplicationBackendDataEnvKey;\n\nexport const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST = [\n  ApplicationBackendBootstrapEnvKey.APPLICATION_ID,\n  ApplicationBackendBootstrapEnvKey.SERVICE_NAME,\n  ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,\n  ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE,\n  ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n  ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,\n  ApplicationBackendBootstrapEnvKey.APPLICATION_ENV,\n] as const;\n\nexport const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST = [\n  ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL,\n  ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL,\n] as const;\n\nexport const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST = [\n  ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,\n  ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME,\n] as const;\n\nexport const APPLICATION_BACKEND_DATA_ENV_KEY_LIST = [\n  ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER,\n  ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT,\n  ApplicationBackendDataEnvKey.MONGODB_HOST,\n  ApplicationBackendDataEnvKey.MONGODB_DATABASE,\n  ApplicationBackendDataEnvKey.MONGODB_PROTOCOL,\n  ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION,\n  ApplicationBackendDataEnvKey.POSTGRESQL_HOST,\n  ApplicationBackendDataEnvKey.POSTGRESQL_PORT,\n  ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE,\n  ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE,\n  ApplicationBackendDataEnvKey.REDIS_HOST,\n  ApplicationBackendDataEnvKey.REDIS_PORT,\n  ApplicationBackendDataEnvKey.REDIS_DATABASE,\n  ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX,\n  ApplicationBackendDataEnvKey.RABBITMQ_HOST,\n  ApplicationBackendDataEnvKey.RABBITMQ_PORT,\n  ApplicationBackendDataEnvKey.RABBITMQ_VHOST,\n  ApplicationBackendDataEnvKey.STORAGE_PROVIDER,\n  ApplicationBackendDataEnvKey.STORAGE_ENDPOINT,\n  ApplicationBackendDataEnvKey.STORAGE_PORT,\n  ApplicationBackendDataEnvKey.STORAGE_USE_SSL,\n  ApplicationBackendDataEnvKey.STORAGE_BUCKET,\n  ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX,\n  ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR,\n  ApplicationBackendDataEnvKey.CLAMAV_HOST,\n  ApplicationBackendDataEnvKey.CLAMAV_PORT,\n  ApplicationBackendDataEnvKey.YARA_ENABLED,\n  ApplicationBackendDataEnvKey.YARA_HOST,\n  ApplicationBackendDataEnvKey.YARA_PORT,\n] as const;\n\nexport const APPLICATION_BACKEND_ENV_KEY_LIST = [\n  ...APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST,\n  ...APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST,\n  ...APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST,\n  ...APPLICATION_BACKEND_DATA_ENV_KEY_LIST,\n] as const;\n\n/**\n * Keys that must always be treated as secrets when this app-backend env surface\n * is materialized into logs, CI artifacts, or deployment manifests.\n */\nexport const APPLICATION_BACKEND_SENSITIVE_ENV_KEYS = new Set<string>([\n  ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n  // The storage pair is gone rather than listed: an app-tier env no longer\n  // carries an object-storage credential at all, so there is nothing here to\n  // mark sensitive. See the note on the enum above.\n]);\n\nexport type ApplicationBackendEnvKey =\n  typeof APPLICATION_BACKEND_ENV_KEY_LIST[number];\n\n/**\n * ────────────────────────────────────────────────────────────────────────\n * Backend → worker dispatch contract (G-8 / MW4)\n * ────────────────────────────────────────────────────────────────────────\n * A declared worker's HTTP base URL is injected into the app-backend env at\n * deploy time as `WILDO_WORKER_<NAME>_URL`. The `<NAME>` segment is DYNAMIC\n * (one per declared worker), so — unlike the static enums above — the key is a\n * HELPER, not a fixed member. Both the CLI EMIT side\n * (`PlatformEnvVarsBuilder.buildApplicationBackendEnv`) and the backend READ\n * side (`WorkerRemoteClientFactoryBackendService`) MUST derive the key + URL\n * through these single helpers so the two can never drift.\n */\nexport const WILDO_WORKER_URL_ENV_PREFIX = 'WILDO_WORKER_';\nexport const WILDO_WORKER_URL_ENV_SUFFIX = '_URL';\n\n/**\n * Normalize a worker identifier (the `wildo.saas.config.ts` bucket key —\n * camelCase or kebab-case, e.g. `myNodeWorker` / `my-node-worker`) into the\n * UPPER_SNAKE segment embedded inside `WILDO_WORKER_<NAME>_URL`. Both\n * `myNodeWorker` and `my-node-worker` normalize to `MY_NODE_WORKER`, so the env\n * key is stable regardless of the authoring style.\n */\nexport function normalizeWorkerEnvSegment(workerName: string): string {\n  return workerName\n    .replace(/([a-z0-9])([A-Z])/g, '$1_$2') // camelCase word boundary → underscore\n    .replace(/[^A-Za-z0-9]+/g, '_') // kebab / space / other → underscore\n    .replace(/_+/g, '_') // collapse repeats\n    .replace(/^_|_$/g, '') // trim edges\n    .toUpperCase();\n}\n\n/**\n * The `WILDO_WORKER_<NAME>_URL` env-var name for a declared worker. The single\n * source of truth for both emit (CLI) and read (backend factory).\n *\n * @example wildoWorkerUrlEnvKey('myNodeWorker') // 'WILDO_WORKER_MY_NODE_WORKER_URL'\n */\nexport function wildoWorkerUrlEnvKey(workerName: string): string {\n  return `${WILDO_WORKER_URL_ENV_PREFIX}${normalizeWorkerEnvSegment(workerName)}${WILDO_WORKER_URL_ENV_SUFFIX}`;\n}\n\n/**\n * Normalize a service key (the `wildo.saas.config.ts` `minions`/`workers` bucket\n * key — authored camelCase or kebab, e.g. `marketingScrapper` / `my-rust-worker`)\n * into an RFC1123-valid DNS label segment: lowercase, `[a-z0-9-]` only, no\n * leading/trailing hyphen. `marketingScrapper` → `marketing-scrapper`,\n * `myNodeWorker` → `my-node-worker`.\n *\n * This is the DNS-NAME axis of a background runtime — the segment embedded in the\n * k8s object/Service name, the built container image ref, the compose service name,\n * and the worker dispatch URL host. It is DISTINCT from the IDENTITY axis (the raw\n * bucket key), which apps-manager keys on (`appConfig.workers[key]` /\n * `appConfig.minions[key]`) and which the worker stamps as `APP_OWNED_SERVICE_NAME`\n * / both runtimes carry as the `wildo.ai/owned-service-name` pod label — the\n * identity axis MUST stay raw and is NEVER passed through this helper. The\n * env-key axis (`WILDO_WORKER_<NAME>_URL`) has its own normalization,\n * {@link normalizeWorkerEnvSegment}, because an env-var name is UPPER_SNAKE, not a\n * DNS label.\n *\n * This helper does NOT truncate — a name too long for a DNS label (63 chars) is\n * REJECTED at authoring, not silently shortened (truncation risks colliding with\n * a sibling key). Returns `''` for all-symbol input. The authoring-time guard in\n * `define-saas-config.ts` fails fast on keys that normalize to empty, collide with\n * a sibling after normalization, or whose full `{slug}-{kind}-{name}` deploy name\n * exceeds 63 chars — so an empty / duplicate / over-long DNS name can never reach\n * the render.\n */\nexport function normalizeServiceKeyToDnsName(key: string): string {\n  return key\n    .replace(/([a-z0-9])([A-Z])/g, '$1-$2') // camelCase word boundary → hyphen\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-') // any non-DNS char (kebab already ok) → hyphen\n    .replace(/^-+|-+$/g, ''); // trim leading/trailing hyphens\n}\n\n/**\n * The k8s Service (and same-network compose service) name for a per-app worker:\n * `{appSlug}-worker-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Coherent-by-construction\n * with the CLI k8s render (`renderWorkerForTarget`), the compose render\n * (`deriveAppRuntimeServiceName`), the CI image build (`syncCicd`), and the worker\n * dispatch URL host ({@link buildWorkerInternalUrl}) — EVERY DNS-name site derives\n * the name through THIS helper (rather than inlining `{appSlug}-worker-{key}`), so\n * the backend calls the exact Service the render deploys and CI builds the exact\n * image ref the deploy pulls.\n *\n * `workerName` is the saas-config bucket key (NOT the per-folder `config.name`) —\n * passed raw; the normalization happens inside. The raw key remains the worker's\n * IDENTITY (apps-manager lookup + `APP_OWNED_SERVICE_NAME`), a separate axis that\n * is never derived from this function.\n */\nexport function buildWorkerServiceName(appSlug: string, workerName: string): string {\n  return `${appSlug}-worker-${normalizeServiceKeyToDnsName(workerName)}`;\n}\n\n/**\n * The k8s Deployment (and same-network compose service) name for a per-app minion:\n * `{appSlug}-minion-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Symmetric with\n * {@link buildWorkerServiceName} — minions have no inbound Service / dispatch URL,\n * but the k8s render, the compose render, and the CI image build all need the\n * deploy name, and it must be RFC1123-valid for the same reasons. `minionName` is\n * the saas-config bucket key; the raw key stays the minion's IDENTITY (the\n * `wildo.ai/owned-service-name` pod label), never derived from here.\n */\nexport function buildMinionServiceName(appSlug: string, minionName: string): string {\n  return `${appSlug}-minion-${normalizeServiceKeyToDnsName(minionName)}`;\n}\n\n/**\n * The in-cluster base URL the app-backend uses to reach a per-app worker\n * (`http://{appSlug}-worker-{workerName}:{port}`). The backend + its workers\n * deploy into the SAME namespace (per-app deploy), so the short Service name\n * resolves without a namespace qualifier. `port` is the worker's authored\n * `http.port` (schema default 8080).\n */\nexport function buildWorkerInternalUrl(appSlug: string, workerName: string, port: number): string {\n  return `http://${buildWorkerServiceName(appSlug, workerName)}:${port}`;\n}\n\n/**\n * The base URL the app-backend uses to reach a per-app worker in LOCAL development.\n *\n * There is no k8s Service locally, so there is no name to resolve — the worker is a supervised\n * process listening on its authored `http.port` on the loopback interface, which is the same\n * convention every other local runtime address in this repository uses.\n *\n * ## Why this exists at all (#426)\n *\n * `buildApplicationWorkerDispatchUrls` used to return `undefined` for anything but REMOTE, on the\n * reasoning that \"local dev has no k8s Services, and worker dispatch is a k8s-deploy concern\". The\n * first half is still true and the second no longer is: local dev now STARTS the worker, so the\n * only thing missing was an address. Without one, `WorkerRemoteClientFactory.client()` fails closed\n * on the absent `WILDO_WORKER_<NAME>_URL` — which is why the whole backend-to-worker chain had\n * never been exercised by anyone, in a test or in the dev stack.\n *\n * Declared here, beside its in-cluster sibling and the env-key helper both sides derive, so the\n * emit side and the read side cannot drift apart for either deployment shape.\n */\nexport function buildWorkerLocalUrl(port: number): string {\n  return `http://localhost:${port}`;\n}\n"]}
+{"version":3,"file":"application-backend-env.contracts.js","sourceRoot":"","sources":["../../../../src/runtime/application-backend-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAN,IAAY,iCASX;AATD,WAAY,iCAAiC;IAC3C,sEAAiC,CAAA;IACjC,kEAA6B,CAAA;IAC7B,wFAAmD,CAAA;IACnD,oIAAoI;IACpI,0FAAqD,CAAA;IACrD,gHAA2E,CAAA;IAC3E,4FAAuD,CAAA;IACvD,wEAAmC,CAAA;AACrC,CAAC,EATW,iCAAiC,KAAjC,iCAAiC,QAS5C;AAED,MAAM,CAAN,IAAY,mCAGX;AAHD,WAAY,mCAAmC;IAC7C,sHAA+E,CAAA;IAC/E,oGAA6D,CAAA;AAC/D,CAAC,EAHW,mCAAmC,KAAnC,mCAAmC,QAG9C;AAED,MAAM,CAAN,IAAY,+BA4BX;AA5BD,WAAY,+BAA+B;IACzC,kGAA+D,CAAA;IAC/D,8IAA8I;IAC9I,wGAAqE,CAAA;IACrE;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,wFAAqD,CAAA;AACvD,CAAC,EA5BW,+BAA+B,KAA/B,+BAA+B,QA4B1C;AAED,MAAM,CAAN,IAAY,4BAkKX;AAlKD,WAAY,4BAA4B;IACtC;;;;;;;;;;;;;OAaG;IACH,qFAAqD,CAAA;IACrD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,yEAAyC,CAAA;IACzC,6DAA6B,CAAA;IAC7B,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,uFAAuD,CAAA;IACvD;;;;;;;;;;;;OAYG;IACH,2DAA2B,CAAA;IAC3B;;;OAGG;IACH,2EAA2C,CAAA;IAC3C;;;;;;;OAOG;IACH,mEAAmC,CAAA;IACnC,mEAAmC,CAAA;IACnC,2EAA2C,CAAA;IAC3C,2EAA2C,CAAA;IAC3C,yDAAyB,CAAA;IACzB,yDAAyB,CAAA;IACzB;;;;OAIG;IACH,iEAAiC,CAAA;IACjC;;;;;;;;;;;;OAYG;IACH,qEAAqC,CAAA;IACrC,+DAA+B,CAAA;IAC/B,+DAA+B,CAAA;IAC/B;;;;;;;;OAQG;IACH,iEAAiC,CAAA;IACjC,qEAAqC,CAAA;IACrC;;;;;;;;;;;;;;OAcG;IACH,qEAAqC,CAAA;IACrC,6DAA6B,CAAA;IAC7B,mEAAmC,CAAA;IACnC,iEAAiC,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,+EAA+C,CAAA;IAC/C,8EAA8E;IAC9E,2CAA2C;IAC3C,EAAE;IACF,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,mEAAmE;IACnE,EAAE;IACF,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,sEAAsE;IACtE,iFAAiD,CAAA;IACjD,2DAA2B,CAAA;IAC3B,2DAA2B,CAAA;IAC3B,6DAA6B,CAAA;IAC7B,uDAAuB,CAAA;IACvB,uDAAuB,CAAA;AACzB,CAAC,EAlKW,4BAA4B,KAA5B,4BAA4B,QAkKvC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,iCAAiC,CAAC;AACpF,MAAM,CAAC,MAAM,oCAAoC,GAAG,mCAAmC,CAAC;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAAG,+BAA+B,CAAC;AAChF,MAAM,CAAC,MAAM,6BAA6B,GAAG,4BAA4B,CAAC;AAE1E,MAAM,CAAC,MAAM,0CAA0C,GAAG;IACxD,iCAAiC,CAAC,cAAc;IAChD,iCAAiC,CAAC,YAAY;IAC9C,iCAAiC,CAAC,uBAAuB;IACzD,iCAAiC,CAAC,wBAAwB;IAC1D,iCAAiC,CAAC,mCAAmC;IACrE,iCAAiC,CAAC,yBAAyB;IAC3D,iCAAiC,CAAC,eAAe;CACzC,CAAC;AAEX,MAAM,CAAC,MAAM,6CAA6C,GAAG;IAC3D,mCAAmC,CAAC,qCAAqC;IACzE,mCAAmC,CAAC,4BAA4B;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,wCAAwC,GAAG;IACtD,+BAA+B,CAAC,6BAA6B;IAC7D,+BAA+B,CAAC,gCAAgC;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,qCAAqC,GAAG;IACnD,4BAA4B,CAAC,wBAAwB;IACrD,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,yBAAyB;IACtD,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,mBAAmB;IAChD,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,UAAU;IACvC,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,aAAa;IAC1C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,gBAAgB;IAC7C,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,eAAe;IAC5C,4BAA4B,CAAC,cAAc;IAC3C,4BAA4B,CAAC,qBAAqB;IAClD,4BAA4B,CAAC,sBAAsB;IACnD,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,WAAW;IACxC,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,SAAS;IACtC,4BAA4B,CAAC,SAAS;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,GAAG,0CAA0C;IAC7C,GAAG,6CAA6C;IAChD,GAAG,wCAAwC;IAC3C,GAAG,qCAAqC;CAChC,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,GAAG,CAAS;IACpE,iCAAiC,CAAC,mCAAmC;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E,kDAAkD;CACnD,CAAC,CAAC;AAKH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAC3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,UAAkB;IAC1D,OAAO,UAAU;SACd,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,uCAAuC;SAC9E,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,qCAAqC;SACpE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,mBAAmB;SACvC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,aAAa;SACnC,WAAW,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,GAAG,2BAA2B,GAAG,yBAAyB,CAAC,UAAU,CAAC,GAAG,2BAA2B,EAAE,CAAC;AAChH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,4BAA4B,CAAC,GAAW;IACtD,OAAO,GAAG;SACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,mCAAmC;SAC1E,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,+CAA+C;SAC3E,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,gCAAgC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACxE,OAAO,GAAG,OAAO,WAAW,4BAA4B,CAAC,UAAU,CAAC,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAkB,EAAE,IAAY;IACtF,OAAO,UAAU,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC","sourcesContent":["/**\n * Shared environment contract for application backend processes.\n *\n * This is the canonical vocabulary for the app-backend `.env` surface emitted\n * by the CLI and parsed by backend runtimes. Keep the keys here purely\n * declarative: they describe names and ownership, not executor-specific\n * behavior.\n */\n\nexport enum ApplicationBackendBootstrapEnvKey {\n  APPLICATION_ID = 'APPLICATION_ID',\n  SERVICE_NAME = 'SERVICE_NAME',\n  PLATFORM_ENVIRONMENT_ID = 'PLATFORM_ENVIRONMENT_ID',\n  /** Deployment topology authority (`local` or `remote`), distinct from APPLICATION_ENV behavior mode and from the environment id. */\n  DEPLOYMENT_LOCATION_TYPE = 'DEPLOYMENT_LOCATION_TYPE',\n  PLATFORM_APPLICATION_PRIMARY_SECRET = 'PLATFORM_APPLICATION_PRIMARY_SECRET',\n  PLATFORM_APPS_MANAGER_URL = 'PLATFORM_APPS_MANAGER_URL',\n  APPLICATION_ENV = 'APPLICATION_ENV',\n}\n\nexport enum ApplicationBackendPlatformUrlEnvKey {\n  PLATFORM_CRONTABS_BATCHES_MANAGER_URL = 'PLATFORM_CRONTABS_BATCHES_MANAGER_URL',\n  PLATFORM_MODULE_REGISTRY_URL = 'PLATFORM_MODULE_REGISTRY_URL',\n}\n\nexport enum ApplicationBackendRuntimeEnvKey {\n  APPLICATION_RUNTIME_ENDPOINTS = 'APPLICATION_RUNTIME_ENDPOINTS',\n  /** Explicit app-owned filesystem handoff shared by a local backend and its companion. Absence means no filesystem transport is authorized. */\n  APPLICATION_RUNTIME_SIGNALS_HOME = 'APPLICATION_RUNTIME_SIGNALS_HOME',\n  /**\n   * Secret gating the application's OPERATOR doors — the data-seeding admin surface and the\n   * external-data admin surface, both root-mounted under `/internal/admin/...`.\n   *\n   * ## Why this key is declared here, and why the engine has its own copies\n   *\n   * The two consumers read `process.env` DIRECTLY, from\n   * `data-seeding-admin.backend.contracts.ts` and `external-data-admin.backend.contracts.ts`, which\n   * each declare the literal so that surface stays self-contained to `saas-backend-lib`. This is the\n   * PRODUCER's copy: the CLI must know the name to emit it, and `saas-backend-lib` is not a\n   * dependency of the CLI. Three copies of one string, cross-referenced, and pinned together by\n   * `application-admin-secret-env-key.test.ts` — the same treatment the Node-version copies get,\n   * for the same reason: no import can span these packages.\n   *\n   * ## Why it exists at all (#586)\n   *\n   * It did not, and neither door could be opened in any deployment the framework generates. The key\n   * appeared in the two engine controllers that READ it and in shipped skill prose telling an\n   * operator to author it in `secrets.json` — which nothing read. `providerEnv` could not carry it\n   * either: `filterProviderEnvToScope` admits a key only when some scoped provider's secrets\n   * contract declares its env-var name, and no provider declares this one, so it was dropped with a\n   * warning. Measured 2026-09-10: zero writers, zero templates.\n   */\n  APPLICATION_ADMIN_SECRET = 'APPLICATION_ADMIN_SECRET',\n}\n\nexport enum ApplicationBackendDataEnvKey {\n  /**\n   * Which persistence adapter the application's resources use.\n   *\n   * DECLARED, not derived. Until this existed the config loader hard-coded MONGODB, so no\n   * environment, secret or bootstrap value could select PostgreSQL — the adapter was reachable only\n   * by a test that reached into the config object directly, which is why no application had ever\n   * booted on it. Deriving it instead (\"PostgreSQL keys are present, so use PostgreSQL\") was\n   * rejected: which store an application persists to is a deployment decision that must be legible\n   * in one place, not an emergent property of which variables happen to be set.\n   *\n   * Absent means MONGODB, so every existing deployment is unaffected. That default is for processes\n   * nothing configures; an APPLICATION backend never reaches it — the CLI writes the adapter resolved\n   * from `applicationDatabase` for both engines (#1571: an absent `applicationDatabase` is PostgreSQL).\n   */\n  DATABASE_DEFAULT_ADAPTER = 'DATABASE_DEFAULT_ADAPTER',\n  /**\n   * The format NEW resource identifiers are minted in — `object-id` or `uuid`.\n   *\n   * DECLARED, and specifically NOT derived from {@link DATABASE_DEFAULT_ADAPTER}. The engine used to\n   * derive it (MongoDB implied `OBJECT_ID`, PostgreSQL implied `UUID`), which made an application's\n   * identity format a side effect of where its rows happen to live: moving a resource between\n   * adapters silently changed the shape of every id it minted AND made every id it had already\n   * minted fail `validateForResource`. Identity reaches URLs, exports, external references and\n   * integrations, so it is an application-level decision that must outlive a storage decision.\n   *\n   * It needed an env key for the same reason the adapter did. The loader hard-coded\n   * `ResourceIdFormat.OBJECT_ID`, so the value was legible nowhere and changeable by nobody: an\n   * application could select PostgreSQL and still had no supported way to STATE its identity format,\n   * which left the engine's \"declared, never derived\" rule true in the schema and unreachable in\n   * practice.\n   *\n   * Absent means `OBJECT_ID` — what every existing application already mints — so no deployment\n   * changes behaviour by adding this key to the contract.\n   *\n   * One deployment constraint travels with it: on PostgreSQL the `_id` COLUMN must be able to hold\n   * the declared format. DDL rendered from the schema plan types it `text`, which is correct for\n   * either member; a hand-written `_id uuid` column restricts the application to `UUID` and rejects\n   * an `OBJECT_ID` outright.\n   */\n  RESOURCE_ID_FORMAT = 'RESOURCE_ID_FORMAT',\n  MONGODB_HOST = 'MONGODB_HOST',\n  MONGODB_DATABASE = 'MONGODB_DATABASE',\n  MONGODB_PROTOCOL = 'MONGODB_PROTOCOL',\n  MONGODB_DIRECT_CONNECTION = 'MONGODB_DIRECT_CONNECTION',\n  /**\n   * Whether the backend's MongoDB connection uses TLS (`'true'` / `'false'`), when the address it was given STATES\n   * it (#2000). Absent means the protocol's default: on for `mongodb+srv`, off for `mongodb`.\n   *\n   * It exists because a `mongodb://` seed list for a server that requires TLS — an Atlas cluster with no SRV address,\n   * whose `mongoURIWithOptions` carries `ssl=true` — was reduced to host, database and protocol, and the backend then\n   * opened it without TLS, which Atlas refuses. Written by the CLI from an authored `externalEndpoints.mongodb`\n   * connection URL, read by the backend config loader into `database.mongodb.options.tls`.\n   *\n   * spec-cite: MongoDB Manual, Connection String Options (https://www.mongodb.com/docs/manual/reference/connection-string-options/),\n   * fetched 2026-09-29 — \"The `ssl` option is equivalent to the `tls` option\"; `tls` `true` is the \"Default for SRV\n   * Connection Format\", `false` the \"Default for Standard Connection String Format\".\n   */\n  MONGODB_TLS = 'MONGODB_TLS',\n  /**\n   * The replica set a `mongodb://` seed list in `MONGODB_HOST` belongs to (#2000), from the authored connection URL's\n   * `replicaSet` option. Absent for an SRV address, whose DNS record carries it.\n   */\n  MONGODB_REPLICA_SET = 'MONGODB_REPLICA_SET',\n  /**\n   * PostgreSQL TOPOLOGY only — host, port, database, ssl.\n   *\n   * CREDENTIALS are deliberately NOT here. They arrive through\n   * `secrets.database.postgresql`, exactly as MongoDB's do: env carries where the database is,\n   * secrets carry who may open it. Putting a password in an env contract would make it readable\n   * from every process listing and every container inspect.\n   */\n  POSTGRESQL_HOST = 'POSTGRESQL_HOST',\n  POSTGRESQL_PORT = 'POSTGRESQL_PORT',\n  POSTGRESQL_DATABASE = 'POSTGRESQL_DATABASE',\n  POSTGRESQL_SSL_MODE = 'POSTGRESQL_SSL_MODE',\n  REDIS_HOST = 'REDIS_HOST',\n  REDIS_PORT = 'REDIS_PORT',\n  /**\n   * Optional Redis logical database index (0–15). Emitted only when the\n   * author sets `backingServices.redis.database` in `wildo.infra.<env>.config.ts`.\n   * Consumers default to DB 0 when this var is missing.\n   */\n  REDIS_DATABASE = 'REDIS_DATABASE',\n  /**\n   * Canonical app-level Redis key namespace. Emitted only when the author\n   * sets `dataServices.redis.keyPrefix` in `wildo.saas.config.ts` (Slice 3.6).\n   * `RedisService` uses this as the `appPrefix` for all keys it writes — every\n   * key becomes `${REDIS_KEY_PREFIX}org:${orgId}:${key}` or\n   * `${REDIS_KEY_PREFIX}global:${key}`. When unset, the app-level prefix\n   * stays empty (multi-tenant isolation falls back to the\n   * `org:`/`global:` segment alone).\n   *\n   * REPLACE semantics: this supersedes the legacy\n   * `secrets.database.redis.username`-derived prefix (Slice 3.6 audit\n   * decision — single source of truth = `wildo.saas.config.dataServices`).\n   */\n  REDIS_KEY_PREFIX = 'REDIS_KEY_PREFIX',\n  RABBITMQ_HOST = 'RABBITMQ_HOST',\n  RABBITMQ_PORT = 'RABBITMQ_PORT',\n  /**\n   * Optional RabbitMQ virtual host. Emitted only when the author sets\n   * `backingServices.rabbitmq.vhost` in `wildo.infra.<env>.config.ts`.\n   * Consumers default to `/` (the RabbitMQ root vhost) when missing.\n   *\n   * Note (Slice 3.6 audit): the symmetric saas-side field\n   * `dataServices.rabbitmq.vhost` was DELETED. Vhost is an\n   * infra/topology concern with a single authoring seam (infra config).\n   */\n  RABBITMQ_VHOST = 'RABBITMQ_VHOST',\n  STORAGE_PROVIDER = 'STORAGE_PROVIDER',\n  /**\n   * S3-compatible endpoint **hostname** (NOT a URL). The variable name\n   * pre-dates the convention pin and is intentionally kept stable for\n   * backward compatibility with deployed manifests, but the value is\n   * always a bare host (`minio`, `s3.amazonaws.com`, `127.0.0.1`) — the\n   * `STORAGE_PORT` and `STORAGE_USE_SSL` siblings are what compose the\n   * full `https?://host:port` URL at the SDK initialization site.\n   *\n   * Slice 3.2 audit (L-4): authoring an explicit URL here (`http://...`)\n   * silently breaks the `host:port` contract downstream because the SDK\n   * concatenates the parts naively. If a future migration wants to flip\n   * the contract to a URL, rename the env key (`STORAGE_URL`) rather\n   * than overloading this one — the rename surfaces the breaking change\n   * to operators.\n   */\n  STORAGE_ENDPOINT = 'STORAGE_ENDPOINT',\n  STORAGE_PORT = 'STORAGE_PORT',\n  STORAGE_USE_SSL = 'STORAGE_USE_SSL',\n  STORAGE_BUCKET = 'STORAGE_BUCKET',\n  /**\n   * Optional app-level object-key namespace prefix prepended to every\n   * application file path produced by `WildoManagedStorageProvider`\n   * (Slice 3.6). Final key shape becomes\n   * `${STORAGE_BUCKET_PREFIX}/applications/${applicationId}/files/${fileId}`\n   * (extra segment above the existing `applicationId`-based namespace).\n   *\n   * Emitted only when the author sets `dataServices.s3.bucketPrefix` in\n   * `wildo.saas.config.ts`. The actual MinIO bucket name (`STORAGE_BUCKET`)\n   * remains infra-controlled and is unaffected by this prefix — N apps\n   * can share one bucket while keeping their object trees disjoint.\n   */\n  STORAGE_BUCKET_PREFIX = 'STORAGE_BUCKET_PREFIX',\n  // ⚠️ `STORAGE_ACCESS_KEY` / `STORAGE_SECRET_KEY` are deliberately ABSENT from\n  // this contract, and must not be re-added.\n  //\n  // They carried the object store's ROOT credential — the same pair the MinIO\n  // container itself is created with — into every application, minion and worker\n  // environment. An application now obtains short-lived, prefix-confined session\n  // credentials from apps-manager instead (`createStsStorageCredentialResolver`),\n  // so there is no application-tier storage credential to name here.\n  //\n  // Re-adding them would not merely restore a variable: this enum is the DECLARED\n  // app-backend env surface, so a key here is an invitation for a builder to fill\n  // it. `assertNoStorageSecretInGeneratedEnv` fails the build if one ever does.\n  // See `.claude/plans/object-storage-root-credential-distribution.md`.\n  STORAGE_LOCAL_BASE_DIR = 'STORAGE_LOCAL_BASE_DIR',\n  CLAMAV_HOST = 'CLAMAV_HOST',\n  CLAMAV_PORT = 'CLAMAV_PORT',\n  YARA_ENABLED = 'YARA_ENABLED',\n  YARA_HOST = 'YARA_HOST',\n  YARA_PORT = 'YARA_PORT',\n}\n\n/**\n * Keep the plural `*Keys` aliases so current consumers keep reading naturally,\n * while the actual source of truth is the scoped enum definition above.\n */\nexport const ApplicationBackendBootstrapEnvKeys = ApplicationBackendBootstrapEnvKey;\nexport const ApplicationBackendPlatformUrlEnvKeys = ApplicationBackendPlatformUrlEnvKey;\nexport const ApplicationBackendRuntimeEnvKeys = ApplicationBackendRuntimeEnvKey;\nexport const ApplicationBackendDataEnvKeys = ApplicationBackendDataEnvKey;\n\nexport const APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST = [\n  ApplicationBackendBootstrapEnvKey.APPLICATION_ID,\n  ApplicationBackendBootstrapEnvKey.SERVICE_NAME,\n  ApplicationBackendBootstrapEnvKey.PLATFORM_ENVIRONMENT_ID,\n  ApplicationBackendBootstrapEnvKey.DEPLOYMENT_LOCATION_TYPE,\n  ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n  ApplicationBackendBootstrapEnvKey.PLATFORM_APPS_MANAGER_URL,\n  ApplicationBackendBootstrapEnvKey.APPLICATION_ENV,\n] as const;\n\nexport const APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST = [\n  ApplicationBackendPlatformUrlEnvKey.PLATFORM_CRONTABS_BATCHES_MANAGER_URL,\n  ApplicationBackendPlatformUrlEnvKey.PLATFORM_MODULE_REGISTRY_URL,\n] as const;\n\nexport const APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST = [\n  ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_ENDPOINTS,\n  ApplicationBackendRuntimeEnvKey.APPLICATION_RUNTIME_SIGNALS_HOME,\n] as const;\n\nexport const APPLICATION_BACKEND_DATA_ENV_KEY_LIST = [\n  ApplicationBackendDataEnvKey.DATABASE_DEFAULT_ADAPTER,\n  ApplicationBackendDataEnvKey.RESOURCE_ID_FORMAT,\n  ApplicationBackendDataEnvKey.MONGODB_HOST,\n  ApplicationBackendDataEnvKey.MONGODB_DATABASE,\n  ApplicationBackendDataEnvKey.MONGODB_PROTOCOL,\n  ApplicationBackendDataEnvKey.MONGODB_DIRECT_CONNECTION,\n  ApplicationBackendDataEnvKey.MONGODB_TLS,\n  ApplicationBackendDataEnvKey.MONGODB_REPLICA_SET,\n  ApplicationBackendDataEnvKey.POSTGRESQL_HOST,\n  ApplicationBackendDataEnvKey.POSTGRESQL_PORT,\n  ApplicationBackendDataEnvKey.POSTGRESQL_DATABASE,\n  ApplicationBackendDataEnvKey.POSTGRESQL_SSL_MODE,\n  ApplicationBackendDataEnvKey.REDIS_HOST,\n  ApplicationBackendDataEnvKey.REDIS_PORT,\n  ApplicationBackendDataEnvKey.REDIS_DATABASE,\n  ApplicationBackendDataEnvKey.REDIS_KEY_PREFIX,\n  ApplicationBackendDataEnvKey.RABBITMQ_HOST,\n  ApplicationBackendDataEnvKey.RABBITMQ_PORT,\n  ApplicationBackendDataEnvKey.RABBITMQ_VHOST,\n  ApplicationBackendDataEnvKey.STORAGE_PROVIDER,\n  ApplicationBackendDataEnvKey.STORAGE_ENDPOINT,\n  ApplicationBackendDataEnvKey.STORAGE_PORT,\n  ApplicationBackendDataEnvKey.STORAGE_USE_SSL,\n  ApplicationBackendDataEnvKey.STORAGE_BUCKET,\n  ApplicationBackendDataEnvKey.STORAGE_BUCKET_PREFIX,\n  ApplicationBackendDataEnvKey.STORAGE_LOCAL_BASE_DIR,\n  ApplicationBackendDataEnvKey.CLAMAV_HOST,\n  ApplicationBackendDataEnvKey.CLAMAV_PORT,\n  ApplicationBackendDataEnvKey.YARA_ENABLED,\n  ApplicationBackendDataEnvKey.YARA_HOST,\n  ApplicationBackendDataEnvKey.YARA_PORT,\n] as const;\n\nexport const APPLICATION_BACKEND_ENV_KEY_LIST = [\n  ...APPLICATION_BACKEND_BOOTSTRAP_ENV_KEY_LIST,\n  ...APPLICATION_BACKEND_PLATFORM_URL_ENV_KEY_LIST,\n  ...APPLICATION_BACKEND_RUNTIME_ENV_KEY_LIST,\n  ...APPLICATION_BACKEND_DATA_ENV_KEY_LIST,\n] as const;\n\n/**\n * Keys that must always be treated as secrets when this app-backend env surface\n * is materialized into logs, CI artifacts, or deployment manifests.\n */\nexport const APPLICATION_BACKEND_SENSITIVE_ENV_KEYS = new Set<string>([\n  ApplicationBackendBootstrapEnvKey.PLATFORM_APPLICATION_PRIMARY_SECRET,\n  // The storage pair is gone rather than listed: an app-tier env no longer\n  // carries an object-storage credential at all, so there is nothing here to\n  // mark sensitive. See the note on the enum above.\n]);\n\nexport type ApplicationBackendEnvKey =\n  typeof APPLICATION_BACKEND_ENV_KEY_LIST[number];\n\n/**\n * ────────────────────────────────────────────────────────────────────────\n * Backend → worker dispatch contract (G-8 / MW4)\n * ────────────────────────────────────────────────────────────────────────\n * A declared worker's HTTP base URL is injected into the app-backend env at\n * deploy time as `WILDO_WORKER_<NAME>_URL`. The `<NAME>` segment is DYNAMIC\n * (one per declared worker), so — unlike the static enums above — the key is a\n * HELPER, not a fixed member. Both the CLI EMIT side\n * (`PlatformEnvVarsBuilder.buildApplicationBackendEnv`) and the backend READ\n * side (`WorkerRemoteClientFactoryBackendService`) MUST derive the key + URL\n * through these single helpers so the two can never drift.\n */\nexport const WILDO_WORKER_URL_ENV_PREFIX = 'WILDO_WORKER_';\nexport const WILDO_WORKER_URL_ENV_SUFFIX = '_URL';\n\n/**\n * Normalize a worker identifier (the `wildo.saas.config.ts` bucket key —\n * camelCase or kebab-case, e.g. `myNodeWorker` / `my-node-worker`) into the\n * UPPER_SNAKE segment embedded inside `WILDO_WORKER_<NAME>_URL`. Both\n * `myNodeWorker` and `my-node-worker` normalize to `MY_NODE_WORKER`, so the env\n * key is stable regardless of the authoring style.\n */\nexport function normalizeWorkerEnvSegment(workerName: string): string {\n  return workerName\n    .replace(/([a-z0-9])([A-Z])/g, '$1_$2') // camelCase word boundary → underscore\n    .replace(/[^A-Za-z0-9]+/g, '_') // kebab / space / other → underscore\n    .replace(/_+/g, '_') // collapse repeats\n    .replace(/^_|_$/g, '') // trim edges\n    .toUpperCase();\n}\n\n/**\n * The `WILDO_WORKER_<NAME>_URL` env-var name for a declared worker. The single\n * source of truth for both emit (CLI) and read (backend factory).\n *\n * @example wildoWorkerUrlEnvKey('myNodeWorker') // 'WILDO_WORKER_MY_NODE_WORKER_URL'\n */\nexport function wildoWorkerUrlEnvKey(workerName: string): string {\n  return `${WILDO_WORKER_URL_ENV_PREFIX}${normalizeWorkerEnvSegment(workerName)}${WILDO_WORKER_URL_ENV_SUFFIX}`;\n}\n\n/**\n * Normalize a service key (the `wildo.saas.config.ts` `minions`/`workers` bucket\n * key — authored camelCase or kebab, e.g. `marketingScrapper` / `my-rust-worker`)\n * into an RFC1123-valid DNS label segment: lowercase, `[a-z0-9-]` only, no\n * leading/trailing hyphen. `marketingScrapper` → `marketing-scrapper`,\n * `myNodeWorker` → `my-node-worker`.\n *\n * This is the DNS-NAME axis of a background runtime — the segment embedded in the\n * k8s object/Service name, the built container image ref, the compose service name,\n * and the worker dispatch URL host. It is DISTINCT from the IDENTITY axis (the raw\n * bucket key), which apps-manager keys on (`appConfig.workers[key]` /\n * `appConfig.minions[key]`) and which the worker stamps as `APP_OWNED_SERVICE_NAME`\n * / both runtimes carry as the `wildo.ai/owned-service-name` pod label — the\n * identity axis MUST stay raw and is NEVER passed through this helper. The\n * env-key axis (`WILDO_WORKER_<NAME>_URL`) has its own normalization,\n * {@link normalizeWorkerEnvSegment}, because an env-var name is UPPER_SNAKE, not a\n * DNS label.\n *\n * This helper does NOT truncate — a name too long for a DNS label (63 chars) is\n * REJECTED at authoring, not silently shortened (truncation risks colliding with\n * a sibling key). Returns `''` for all-symbol input. The authoring-time guard in\n * `define-saas-config.ts` fails fast on keys that normalize to empty, collide with\n * a sibling after normalization, or whose full `{slug}-{kind}-{name}` deploy name\n * exceeds 63 chars — so an empty / duplicate / over-long DNS name can never reach\n * the render.\n */\nexport function normalizeServiceKeyToDnsName(key: string): string {\n  return key\n    .replace(/([a-z0-9])([A-Z])/g, '$1-$2') // camelCase word boundary → hyphen\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-') // any non-DNS char (kebab already ok) → hyphen\n    .replace(/^-+|-+$/g, ''); // trim leading/trailing hyphens\n}\n\n/**\n * The k8s Service (and same-network compose service) name for a per-app worker:\n * `{appSlug}-worker-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Coherent-by-construction\n * with the CLI k8s render (`renderWorkerForTarget`), the compose render\n * (`deriveAppRuntimeServiceName`), the CI image build (`syncCicd`), and the worker\n * dispatch URL host ({@link buildWorkerInternalUrl}) — EVERY DNS-name site derives\n * the name through THIS helper (rather than inlining `{appSlug}-worker-{key}`), so\n * the backend calls the exact Service the render deploys and CI builds the exact\n * image ref the deploy pulls.\n *\n * `workerName` is the saas-config bucket key (NOT the per-folder `config.name`) —\n * passed raw; the normalization happens inside. The raw key remains the worker's\n * IDENTITY (apps-manager lookup + `APP_OWNED_SERVICE_NAME`), a separate axis that\n * is never derived from this function.\n */\nexport function buildWorkerServiceName(appSlug: string, workerName: string): string {\n  return `${appSlug}-worker-${normalizeServiceKeyToDnsName(workerName)}`;\n}\n\n/**\n * The k8s Deployment (and same-network compose service) name for a per-app minion:\n * `{appSlug}-minion-{dnsName}`, where `dnsName` is the bucket key normalized to an\n * RFC1123 label ({@link normalizeServiceKeyToDnsName}). Symmetric with\n * {@link buildWorkerServiceName} — minions have no inbound Service / dispatch URL,\n * but the k8s render, the compose render, and the CI image build all need the\n * deploy name, and it must be RFC1123-valid for the same reasons. `minionName` is\n * the saas-config bucket key; the raw key stays the minion's IDENTITY (the\n * `wildo.ai/owned-service-name` pod label), never derived from here.\n */\nexport function buildMinionServiceName(appSlug: string, minionName: string): string {\n  return `${appSlug}-minion-${normalizeServiceKeyToDnsName(minionName)}`;\n}\n\n/**\n * The in-cluster base URL the app-backend uses to reach a per-app worker\n * (`http://{appSlug}-worker-{workerName}:{port}`). The backend + its workers\n * deploy into the SAME namespace (per-app deploy), so the short Service name\n * resolves without a namespace qualifier. `port` is the worker's authored\n * `http.port` (schema default 8080).\n */\nexport function buildWorkerInternalUrl(appSlug: string, workerName: string, port: number): string {\n  return `http://${buildWorkerServiceName(appSlug, workerName)}:${port}`;\n}\n\n/**\n * The base URL the app-backend uses to reach a per-app worker in LOCAL development.\n *\n * There is no k8s Service locally, so there is no name to resolve — the worker is a supervised\n * process listening on its authored `http.port` on the loopback interface, which is the same\n * convention every other local runtime address in this repository uses.\n *\n * ## Why this exists at all (#426)\n *\n * `buildApplicationWorkerDispatchUrls` used to return `undefined` for anything but REMOTE, on the\n * reasoning that \"local dev has no k8s Services, and worker dispatch is a k8s-deploy concern\". The\n * first half is still true and the second no longer is: local dev now STARTS the worker, so the\n * only thing missing was an address. Without one, `WorkerRemoteClientFactory.client()` fails closed\n * on the absent `WILDO_WORKER_<NAME>_URL` — which is why the whole backend-to-worker chain had\n * never been exercised by anyone, in a test or in the dev stack.\n *\n * Declared here, beside its in-cluster sibling and the env-key helper both sides derive, so the\n * emit side and the read side cannot drift apart for either deployment shape.\n */\nexport function buildWorkerLocalUrl(port: number): string {\n  return `http://localhost:${port}`;\n}\n"]}

package/dist/esm/runtime/http-server-env.contracts.d.ts

@@ -0,0 +1,46 @@
+/**
+ * How many HTTP reverse proxies sit in front of a runtime's HTTP server — the deployment fact Express's
+ * `trust proxy` needs, and the only thing that makes `req.ip` the CLIENT's address rather than the last
+ * proxy's (#1788).
+ *
+ * Every per-client-IP control in the engine — the machine-credential failure lockout, the per-endpoint
+ * rate limits, the global HTTP limiter, the audit trail's client address — keys on `req.ip`. Behind a
+ * proxy with `trust proxy` unset, `req.ip` is the proxy for EVERY caller, so all of them share one
+ * bucket: one client presenting bad keys locks every machine caller out.
+ *
+ * It is a property of the DEPLOYMENT, not of the application, so it arrives in the process environment,
+ * rendered by the lane that put the proxy there — like `HOST` and `PORT` — and is read at the one HTTP
+ * server every runtime shares (applications, the dev companion and the platform services alike).
+ * Absent means zero: no proxy is trusted, which is the safe reading — a trusted hop that is not really
+ * there would let a client choose its own address through `X-Forwarded-For`.
+ */
+export declare enum HttpServerEnvKey {
+    /** Non-negative integer: the number of trusted reverse-proxy hops in front of this runtime. */
+    HTTP_TRUSTED_PROXY_HOPS = "HTTP_TRUSTED_PROXY_HOPS"
+}
+/**
+ * The hops in front of a REMOTE runtime: both remote deployment lanes put exactly ONE HTTP reverse proxy
+ * (Traefik) before the backend — as the cluster ingress in the Kubernetes lane, as the TLS-terminating
+ * edge in the remote compose lane. A local runtime is reached directly and trusts none.
+ *
+ * One hop is only the client's address if Traefik itself SAW the client. A cloud load balancer in front
+ * of it works at TCP level and adds no forwarded header, so it is not a hop — but kube-proxy source-NATs
+ * a LoadBalancer Service by default, and Traefik would then see a node. The Kubernetes lane's Traefik
+ * values set `externalTrafficPolicy: Local` for exactly this reason; the compose lane publishes Traefik's
+ * ports directly, which keeps the source address (#1788 review).
+ *
+ * The limit, stated rather than implied: trusting a hop COUNT means a caller that reaches the backend
+ * WITHOUT Traefik — another pod in the same cluster — can name its own address in `X-Forwarded-For`.
+ * Every such caller is one of this application's own runtimes or the platform, not an internet client,
+ * and trusting Traefik's own addresses instead would need the cluster's pod network, which no lane
+ * knows. The controls this protects are the ones aimed at the internet.
+ */
+export declare const REMOTE_EDGE_PROXY_HOPS = 1;
+/**
+ * Read {@link HttpServerEnvKey.HTTP_TRUSTED_PROXY_HOPS}: an absent or empty value is 0; anything that is
+ * not a non-negative integer is REFUSED, because silently reading a typo as 0 would collapse every
+ * client into one rate-limit bucket without a word, and reading it as anything else would trust hops
+ * that are not there.
+ */
+export declare function parseTrustedProxyHops(value: string | undefined): number;
+//# sourceMappingURL=http-server-env.contracts.d.ts.map

package/dist/esm/runtime/http-server-env.contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server-env.contracts.d.ts","sourceRoot":"","sources":["../../../../src/runtime/http-server-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,gBAAgB;IAC1B,+FAA+F;IAC/F,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAOvE"}

package/dist/esm/runtime/http-server-env.contracts.js

@@ -0,0 +1,55 @@
+/**
+ * How many HTTP reverse proxies sit in front of a runtime's HTTP server — the deployment fact Express's
+ * `trust proxy` needs, and the only thing that makes `req.ip` the CLIENT's address rather than the last
+ * proxy's (#1788).
+ *
+ * Every per-client-IP control in the engine — the machine-credential failure lockout, the per-endpoint
+ * rate limits, the global HTTP limiter, the audit trail's client address — keys on `req.ip`. Behind a
+ * proxy with `trust proxy` unset, `req.ip` is the proxy for EVERY caller, so all of them share one
+ * bucket: one client presenting bad keys locks every machine caller out.
+ *
+ * It is a property of the DEPLOYMENT, not of the application, so it arrives in the process environment,
+ * rendered by the lane that put the proxy there — like `HOST` and `PORT` — and is read at the one HTTP
+ * server every runtime shares (applications, the dev companion and the platform services alike).
+ * Absent means zero: no proxy is trusted, which is the safe reading — a trusted hop that is not really
+ * there would let a client choose its own address through `X-Forwarded-For`.
+ */
+export var HttpServerEnvKey;
+(function (HttpServerEnvKey) {
+    /** Non-negative integer: the number of trusted reverse-proxy hops in front of this runtime. */
+    HttpServerEnvKey["HTTP_TRUSTED_PROXY_HOPS"] = "HTTP_TRUSTED_PROXY_HOPS";
+})(HttpServerEnvKey || (HttpServerEnvKey = {}));
+/**
+ * The hops in front of a REMOTE runtime: both remote deployment lanes put exactly ONE HTTP reverse proxy
+ * (Traefik) before the backend — as the cluster ingress in the Kubernetes lane, as the TLS-terminating
+ * edge in the remote compose lane. A local runtime is reached directly and trusts none.
+ *
+ * One hop is only the client's address if Traefik itself SAW the client. A cloud load balancer in front
+ * of it works at TCP level and adds no forwarded header, so it is not a hop — but kube-proxy source-NATs
+ * a LoadBalancer Service by default, and Traefik would then see a node. The Kubernetes lane's Traefik
+ * values set `externalTrafficPolicy: Local` for exactly this reason; the compose lane publishes Traefik's
+ * ports directly, which keeps the source address (#1788 review).
+ *
+ * The limit, stated rather than implied: trusting a hop COUNT means a caller that reaches the backend
+ * WITHOUT Traefik — another pod in the same cluster — can name its own address in `X-Forwarded-For`.
+ * Every such caller is one of this application's own runtimes or the platform, not an internet client,
+ * and trusting Traefik's own addresses instead would need the cluster's pod network, which no lane
+ * knows. The controls this protects are the ones aimed at the internet.
+ */
+export const REMOTE_EDGE_PROXY_HOPS = 1;
+/**
+ * Read {@link HttpServerEnvKey.HTTP_TRUSTED_PROXY_HOPS}: an absent or empty value is 0; anything that is
+ * not a non-negative integer is REFUSED, because silently reading a typo as 0 would collapse every
+ * client into one rate-limit bucket without a word, and reading it as anything else would trust hops
+ * that are not there.
+ */
+export function parseTrustedProxyHops(value) {
+    if (value === undefined || value.trim() === '')
+        return 0;
+    const trimmed = value.trim();
+    if (!/^\d+$/.test(trimmed)) {
+        throw new Error(`${HttpServerEnvKey.HTTP_TRUSTED_PROXY_HOPS} must be a non-negative integer (got "${value}").`);
+    }
+    return Number(trimmed);
+}
+//# sourceMappingURL=http-server-env.contracts.js.map

package/dist/esm/runtime/http-server-env.contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server-env.contracts.js","sourceRoot":"","sources":["../../../../src/runtime/http-server-env.contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC1B,+FAA+F;IAC/F,uEAAmD,CAAA;AACrD,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAyB;IAC7D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,gBAAgB,CAAC,uBAAuB,yCAAyC,KAAK,KAAK,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/**\n * How many HTTP reverse proxies sit in front of a runtime's HTTP server — the deployment fact Express's\n * `trust proxy` needs, and the only thing that makes `req.ip` the CLIENT's address rather than the last\n * proxy's (#1788).\n *\n * Every per-client-IP control in the engine — the machine-credential failure lockout, the per-endpoint\n * rate limits, the global HTTP limiter, the audit trail's client address — keys on `req.ip`. Behind a\n * proxy with `trust proxy` unset, `req.ip` is the proxy for EVERY caller, so all of them share one\n * bucket: one client presenting bad keys locks every machine caller out.\n *\n * It is a property of the DEPLOYMENT, not of the application, so it arrives in the process environment,\n * rendered by the lane that put the proxy there — like `HOST` and `PORT` — and is read at the one HTTP\n * server every runtime shares (applications, the dev companion and the platform services alike).\n * Absent means zero: no proxy is trusted, which is the safe reading — a trusted hop that is not really\n * there would let a client choose its own address through `X-Forwarded-For`.\n */\nexport enum HttpServerEnvKey {\n  /** Non-negative integer: the number of trusted reverse-proxy hops in front of this runtime. */\n  HTTP_TRUSTED_PROXY_HOPS = 'HTTP_TRUSTED_PROXY_HOPS',\n}\n\n/**\n * The hops in front of a REMOTE runtime: both remote deployment lanes put exactly ONE HTTP reverse proxy\n * (Traefik) before the backend — as the cluster ingress in the Kubernetes lane, as the TLS-terminating\n * edge in the remote compose lane. A local runtime is reached directly and trusts none.\n *\n * One hop is only the client's address if Traefik itself SAW the client. A cloud load balancer in front\n * of it works at TCP level and adds no forwarded header, so it is not a hop — but kube-proxy source-NATs\n * a LoadBalancer Service by default, and Traefik would then see a node. The Kubernetes lane's Traefik\n * values set `externalTrafficPolicy: Local` for exactly this reason; the compose lane publishes Traefik's\n * ports directly, which keeps the source address (#1788 review).\n *\n * The limit, stated rather than implied: trusting a hop COUNT means a caller that reaches the backend\n * WITHOUT Traefik — another pod in the same cluster — can name its own address in `X-Forwarded-For`.\n * Every such caller is one of this application's own runtimes or the platform, not an internet client,\n * and trusting Traefik's own addresses instead would need the cluster's pod network, which no lane\n * knows. The controls this protects are the ones aimed at the internet.\n */\nexport const REMOTE_EDGE_PROXY_HOPS = 1;\n\n/**\n * Read {@link HttpServerEnvKey.HTTP_TRUSTED_PROXY_HOPS}: an absent or empty value is 0; anything that is\n * not a non-negative integer is REFUSED, because silently reading a typo as 0 would collapse every\n * client into one rate-limit bucket without a word, and reading it as anything else would trust hops\n * that are not there.\n */\nexport function parseTrustedProxyHops(value: string | undefined): number {\n  if (value === undefined || value.trim() === '') return 0;\n  const trimmed = value.trim();\n  if (!/^\\d+$/.test(trimmed)) {\n    throw new Error(`${HttpServerEnvKey.HTTP_TRUSTED_PROXY_HOPS} must be a non-negative integer (got \"${value}\").`);\n  }\n  return Number(trimmed);\n}\n"]}

package/dist/esm/runtime/runtime-topology.contracts.d.ts

@@ -45,10 +45,6 @@ export interface ApplicationRuntimeEndpointsInput {
     website?: RuntimeEndpointUrls | undefined;
     technicalDocumentation?: RuntimeEndpointUrls | undefined;
     mainBackendApi?: RuntimeEndpointUrls | undefined;
-    healthCheckApi?: RuntimeEndpointUrls | undefined;
-    mainWebhookApi?: RuntimeEndpointUrls | undefined;
-    oauth2ProviderApi?: RuntimeEndpointUrls | undefined;
-    mcpApi?: RuntimeEndpointUrls | undefined;
 }
 export declare function buildApplicationRuntimeEndpoints(input: ApplicationRuntimeEndpointsInput): Record<string, RuntimeEndpointUrls>;
 export declare function serializeRuntimeEndpointsRecord(endPoints: Record<string, RuntimeEndpointUrls>): string;

package/dist/esm/runtime/runtime-topology.contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-topology.contracts.d.ts","sourceRoot":"","sources":["../../../../src/runtime/runtime-topology.contracts.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,oBAAY,uBAAuB;IACjC,qBAAqB,0BAA0B;IAC/C,iCAAiC,sCAAsC;IACvE,wBAAwB,6BAA6B;IACrD,qBAAqB,0BAA0B;IAC/C,QAAQ,aAAa;IACrB,aAAa,kBAAkB;CAChC;AAED;;;;;GAKG;AACH,oBAAY,0BAA0B;IACpC,qBAAqB,0BAAgD;IACrE,iCAAiC,sCAA4D;IAC7F,wBAAwB,6BAAmD;CAC5E;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,mBAAmB,CAAC;IACjC,sBAAsB,EAAE,mBAAmB,CAAC;IAC5C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,6BAA6B,GACnC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CASrC;AAED,MAAM,WAAW,gCAAgC;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,SAAS,CAAC;IACvE,OAAO,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC1C,sBAAsB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACzD,cAAc,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACjD,cAAc,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACjD,cAAc,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACjD,iBAAiB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAC1C;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,gCAAgC,GACtC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CA2BrC;AAED,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAC7C,MAAM,CAER;AAED,wBAAgB,2BAA2B,CACzC,0BAA0B,EAAE,MAAM,GACjC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAsBrC"}
+{"version":3,"file":"runtime-topology.contracts.d.ts","sourceRoot":"","sources":["../../../../src/runtime/runtime-topology.contracts.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,oBAAY,uBAAuB;IACjC,qBAAqB,0BAA0B;IAC/C,iCAAiC,sCAAsC;IACvE,wBAAwB,6BAA6B;IACrD,qBAAqB,0BAA0B;IAC/C,QAAQ,aAAa;IACrB,aAAa,kBAAkB;CAChC;AAED;;;;;GAKG;AACH,oBAAY,0BAA0B;IACpC,qBAAqB,0BAAgD;IACrE,iCAAiC,sCAA4D;IAC7F,wBAAwB,6BAAmD;CAC5E;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,mBAAmB,CAAC;IACjC,sBAAsB,EAAE,mBAAmB,CAAC;IAC5C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;CACtC;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,6BAA6B,GACnC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CASrC;AAED,MAAM,WAAW,gCAAgC;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,SAAS,CAAC;IACvE,OAAO,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IAC1C,sBAAsB,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACzD,cAAc,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;CAClD;AAED,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,gCAAgC,GACtC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAerC;AAED,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAC7C,MAAM,CAER;AAED,wBAAgB,2BAA2B,CACzC,0BAA0B,EAAE,MAAM,GACjC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAsBrC"}

package/dist/esm/runtime/runtime-topology.contracts.js

@@ -49,18 +49,6 @@ export function buildApplicationRuntimeEndpoints(input) {
     if (input.mainBackendApi) {
         endPoints[BackendApiType.MAIN_BACKEND_API] = input.mainBackendApi;
     }
-    if (input.healthCheckApi) {
-        endPoints[BackendApiType.HEALTH_CHECK_API] = input.healthCheckApi;
-    }
-    if (input.mainWebhookApi) {
-        endPoints[BackendApiType.MAIN_WEBHOOK_API] = input.mainWebhookApi;
-    }
-    if (input.oauth2ProviderApi) {
-        endPoints[BackendApiType.OAUTH2_PROVIDER_API] = input.oauth2ProviderApi;
-    }
-    if (input.mcpApi) {
-        endPoints[BackendApiType.MCP_API] = input.mcpApi;
-    }
     return endPoints;
 }
 export function serializeRuntimeEndpointsRecord(endPoints) {

package/dist/esm/runtime/runtime-topology.contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-topology.contracts.js","sourceRoot":"","sources":["../../../../src/runtime/runtime-topology.contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAO/B;;;;;GAKG;AACH,MAAM,CAAN,IAAY,uBAOX;AAPD,WAAY,uBAAuB;IACjC,0EAA+C,CAAA;IAC/C,kGAAuE,CAAA;IACvE,gFAAqD,CAAA;IACrD,0EAA+C,CAAA;IAC/C,gDAAqB,CAAA;IACrB,0DAA+B,CAAA;AACjC,CAAC,EAPW,uBAAuB,KAAvB,uBAAuB,QAOlC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,6EAAqE,CAAA;IACrE,qGAA6F,CAAA;IAC7F,mFAA2E,CAAA;AAC7E,CAAC,EAJW,0BAA0B,KAA1B,0BAA0B,QAIrC;AAeD,MAAM,UAAU,6BAA6B,CAC3C,KAAoC;IAEpC,MAAM,GAAG,GAAwC;QAC/C,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,WAAW;QACrE,CAAC,0BAA0B,CAAC,iCAAiC,CAAC,EAAE,KAAK,CAAC,sBAAsB;KAC7F,CAAC;IACF,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,GAAG,CAAC,0BAA0B,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAaD,MAAM,UAAU,gCAAgC,CAC9C,KAAuC;IAEvC,MAAM,SAAS,GAAwC;QACrD,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC;KACtC,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,SAAS,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,sBAAsB,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IACnD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,SAA8C;IAE9C,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,0BAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAY,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,SAAS,GAAI,KAAiC,CAAC,SAAS,CAAC;QAC/D,MAAM,WAAW,GAAI,KAAiC,CAAC,WAAW,CAAC;QACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,4CAA4C,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import {\n  BackendApiType,\n  StaticFrontEndType,\n} from '@wildo-ai/saas-models';\n\nexport interface RuntimeEndpointUrls {\n  publicUrl: string;\n  internalUrl: string;\n}\n\n/**\n * Shared application/service identifiers for platform-owned runtimes.\n *\n * This enum must live in the shared contract layer because CLI/runtime topology\n * code needs these semantics without importing backend runtime packages.\n */\nexport enum PlatformApplicationType {\n  PLATFORM_APPS_MANAGER = 'platform_apps_manager',\n  PLATFORM_CRONTABS_BATCHES_MANAGER = 'platform_crontabs_batches_manager',\n  PLATFORM_MODULE_REGISTRY = 'platform_module_registry',\n  APP_LIFECYCLE_MANAGER = 'app_lifecycle_manager',\n  APP_CICD = 'app_cicd',\n  PLATFORM_CICD = 'platform_cicd',\n}\n\n/**\n * Shared runtime endpoint keys for platform services.\n *\n * These are the subset of `PlatformApplicationType` that expose runtime\n * endpoints directly.\n */\nexport enum PlatformRuntimeEndpointKey {\n  PLATFORM_APPS_MANAGER = PlatformApplicationType.PLATFORM_APPS_MANAGER,\n  PLATFORM_CRONTABS_BATCHES_MANAGER = PlatformApplicationType.PLATFORM_CRONTABS_BATCHES_MANAGER,\n  PLATFORM_MODULE_REGISTRY = PlatformApplicationType.PLATFORM_MODULE_REGISTRY,\n}\n\nexport interface PlatformRuntimeEndpointsInput {\n  appsManager: RuntimeEndpointUrls;\n  crontabsBatchesManager: RuntimeEndpointUrls;\n  /**\n   * Module-registry endpoint (Phase 3 / KD-7). Optional during the\n   * Phase 3 rollout: existing platform deployments that haven't\n   * yet provisioned the registry pass `undefined` and the entry\n   * is omitted from the resulting record. New deployments + every\n   * Phase 4+ caller MUST set it.\n   */\n  moduleRegistry?: RuntimeEndpointUrls;\n}\n\nexport function buildPlatformRuntimeEndpoints(\n  input: PlatformRuntimeEndpointsInput,\n): Record<string, RuntimeEndpointUrls> {\n  const out: Record<string, RuntimeEndpointUrls> = {\n    [PlatformRuntimeEndpointKey.PLATFORM_APPS_MANAGER]: input.appsManager,\n    [PlatformRuntimeEndpointKey.PLATFORM_CRONTABS_BATCHES_MANAGER]: input.crontabsBatchesManager,\n  };\n  if (input.moduleRegistry) {\n    out[PlatformRuntimeEndpointKey.PLATFORM_MODULE_REGISTRY] = input.moduleRegistry;\n  }\n  return out;\n}\n\nexport interface ApplicationRuntimeEndpointsInput {\n  frontendApplications?: Record<string, RuntimeEndpointUrls> | undefined;\n  website?: RuntimeEndpointUrls | undefined;\n  technicalDocumentation?: RuntimeEndpointUrls | undefined;\n  mainBackendApi?: RuntimeEndpointUrls | undefined;\n  healthCheckApi?: RuntimeEndpointUrls | undefined;\n  mainWebhookApi?: RuntimeEndpointUrls | undefined;\n  oauth2ProviderApi?: RuntimeEndpointUrls | undefined;\n  mcpApi?: RuntimeEndpointUrls | undefined;\n}\n\nexport function buildApplicationRuntimeEndpoints(\n  input: ApplicationRuntimeEndpointsInput,\n): Record<string, RuntimeEndpointUrls> {\n  const endPoints: Record<string, RuntimeEndpointUrls> = {\n    ...(input.frontendApplications ?? {}),\n  };\n  if (input.website) {\n    endPoints[StaticFrontEndType.WEBSITE] = input.website;\n  }\n  if (input.technicalDocumentation) {\n    endPoints[StaticFrontEndType.TECHNICAL_DOCUMENTATION] = input.technicalDocumentation;\n  }\n  if (input.mainBackendApi) {\n    endPoints[BackendApiType.MAIN_BACKEND_API] = input.mainBackendApi;\n  }\n  if (input.healthCheckApi) {\n    endPoints[BackendApiType.HEALTH_CHECK_API] = input.healthCheckApi;\n  }\n  if (input.mainWebhookApi) {\n    endPoints[BackendApiType.MAIN_WEBHOOK_API] = input.mainWebhookApi;\n  }\n  if (input.oauth2ProviderApi) {\n    endPoints[BackendApiType.OAUTH2_PROVIDER_API] = input.oauth2ProviderApi;\n  }\n  if (input.mcpApi) {\n    endPoints[BackendApiType.MCP_API] = input.mcpApi;\n  }\n\n  return endPoints;\n}\n\nexport function serializeRuntimeEndpointsRecord(\n  endPoints: Record<string, RuntimeEndpointUrls>,\n): string {\n  return JSON.stringify(endPoints);\n}\n\nexport function parseRuntimeEndpointsRecord(\n  serializedRuntimeEndpoints: string,\n): Record<string, RuntimeEndpointUrls> {\n  const parsed = JSON.parse(serializedRuntimeEndpoints) as unknown;\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error('Runtime endpoints payload must be a JSON object');\n  }\n\n  const record: Record<string, RuntimeEndpointUrls> = {};\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!value || typeof value !== 'object' || Array.isArray(value)) {\n      throw new Error(`Runtime endpoint \"${key}\" must be an object`);\n    }\n\n    const publicUrl = (value as Record<string, unknown>).publicUrl;\n    const internalUrl = (value as Record<string, unknown>).internalUrl;\n    if (typeof publicUrl !== 'string' || typeof internalUrl !== 'string') {\n      throw new Error(`Runtime endpoint \"${key}\" must expose string publicUrl/internalUrl`);\n    }\n\n    record[key] = { publicUrl, internalUrl };\n  }\n\n  return record;\n}\n"]}
+{"version":3,"file":"runtime-topology.contracts.js","sourceRoot":"","sources":["../../../../src/runtime/runtime-topology.contracts.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAO/B;;;;;GAKG;AACH,MAAM,CAAN,IAAY,uBAOX;AAPD,WAAY,uBAAuB;IACjC,0EAA+C,CAAA;IAC/C,kGAAuE,CAAA;IACvE,gFAAqD,CAAA;IACrD,0EAA+C,CAAA;IAC/C,gDAAqB,CAAA;IACrB,0DAA+B,CAAA;AACjC,CAAC,EAPW,uBAAuB,KAAvB,uBAAuB,QAOlC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,0BAIX;AAJD,WAAY,0BAA0B;IACpC,6EAAqE,CAAA;IACrE,qGAA6F,CAAA;IAC7F,mFAA2E,CAAA;AAC7E,CAAC,EAJW,0BAA0B,KAA1B,0BAA0B,QAIrC;AAeD,MAAM,UAAU,6BAA6B,CAC3C,KAAoC;IAEpC,MAAM,GAAG,GAAwC;QAC/C,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,WAAW;QACrE,CAAC,0BAA0B,CAAC,iCAAiC,CAAC,EAAE,KAAK,CAAC,sBAAsB;KAC7F,CAAC;IACF,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,GAAG,CAAC,0BAA0B,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IAClF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD,MAAM,UAAU,gCAAgC,CAC9C,KAAuC;IAEvC,MAAM,SAAS,GAAwC;QACrD,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC;KACtC,CAAC;IACF,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,SAAS,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,sBAAsB,EAAE,CAAC;QACjC,SAAS,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,sBAAsB,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACzB,SAAS,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC;IACpE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,SAA8C;IAE9C,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,0BAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAY,CAAC;IACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,SAAS,GAAI,KAAiC,CAAC,SAAS,CAAC;QAC/D,MAAM,WAAW,GAAI,KAAiC,CAAC,WAAW,CAAC;QACnE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,4CAA4C,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import {\n  BackendApiType,\n  StaticFrontEndType,\n} from '@wildo-ai/saas-models';\n\nexport interface RuntimeEndpointUrls {\n  publicUrl: string;\n  internalUrl: string;\n}\n\n/**\n * Shared application/service identifiers for platform-owned runtimes.\n *\n * This enum must live in the shared contract layer because CLI/runtime topology\n * code needs these semantics without importing backend runtime packages.\n */\nexport enum PlatformApplicationType {\n  PLATFORM_APPS_MANAGER = 'platform_apps_manager',\n  PLATFORM_CRONTABS_BATCHES_MANAGER = 'platform_crontabs_batches_manager',\n  PLATFORM_MODULE_REGISTRY = 'platform_module_registry',\n  APP_LIFECYCLE_MANAGER = 'app_lifecycle_manager',\n  APP_CICD = 'app_cicd',\n  PLATFORM_CICD = 'platform_cicd',\n}\n\n/**\n * Shared runtime endpoint keys for platform services.\n *\n * These are the subset of `PlatformApplicationType` that expose runtime\n * endpoints directly.\n */\nexport enum PlatformRuntimeEndpointKey {\n  PLATFORM_APPS_MANAGER = PlatformApplicationType.PLATFORM_APPS_MANAGER,\n  PLATFORM_CRONTABS_BATCHES_MANAGER = PlatformApplicationType.PLATFORM_CRONTABS_BATCHES_MANAGER,\n  PLATFORM_MODULE_REGISTRY = PlatformApplicationType.PLATFORM_MODULE_REGISTRY,\n}\n\nexport interface PlatformRuntimeEndpointsInput {\n  appsManager: RuntimeEndpointUrls;\n  crontabsBatchesManager: RuntimeEndpointUrls;\n  /**\n   * Module-registry endpoint (Phase 3 / KD-7). Optional during the\n   * Phase 3 rollout: existing platform deployments that haven't\n   * yet provisioned the registry pass `undefined` and the entry\n   * is omitted from the resulting record. New deployments + every\n   * Phase 4+ caller MUST set it.\n   */\n  moduleRegistry?: RuntimeEndpointUrls;\n}\n\nexport function buildPlatformRuntimeEndpoints(\n  input: PlatformRuntimeEndpointsInput,\n): Record<string, RuntimeEndpointUrls> {\n  const out: Record<string, RuntimeEndpointUrls> = {\n    [PlatformRuntimeEndpointKey.PLATFORM_APPS_MANAGER]: input.appsManager,\n    [PlatformRuntimeEndpointKey.PLATFORM_CRONTABS_BATCHES_MANAGER]: input.crontabsBatchesManager,\n  };\n  if (input.moduleRegistry) {\n    out[PlatformRuntimeEndpointKey.PLATFORM_MODULE_REGISTRY] = input.moduleRegistry;\n  }\n  return out;\n}\n\nexport interface ApplicationRuntimeEndpointsInput {\n  frontendApplications?: Record<string, RuntimeEndpointUrls> | undefined;\n  website?: RuntimeEndpointUrls | undefined;\n  technicalDocumentation?: RuntimeEndpointUrls | undefined;\n  mainBackendApi?: RuntimeEndpointUrls | undefined;\n}\n\nexport function buildApplicationRuntimeEndpoints(\n  input: ApplicationRuntimeEndpointsInput,\n): Record<string, RuntimeEndpointUrls> {\n  const endPoints: Record<string, RuntimeEndpointUrls> = {\n    ...(input.frontendApplications ?? {}),\n  };\n  if (input.website) {\n    endPoints[StaticFrontEndType.WEBSITE] = input.website;\n  }\n  if (input.technicalDocumentation) {\n    endPoints[StaticFrontEndType.TECHNICAL_DOCUMENTATION] = input.technicalDocumentation;\n  }\n  if (input.mainBackendApi) {\n    endPoints[BackendApiType.MAIN_BACKEND_API] = input.mainBackendApi;\n  }\n\n  return endPoints;\n}\n\nexport function serializeRuntimeEndpointsRecord(\n  endPoints: Record<string, RuntimeEndpointUrls>,\n): string {\n  return JSON.stringify(endPoints);\n}\n\nexport function parseRuntimeEndpointsRecord(\n  serializedRuntimeEndpoints: string,\n): Record<string, RuntimeEndpointUrls> {\n  const parsed = JSON.parse(serializedRuntimeEndpoints) as unknown;\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error('Runtime endpoints payload must be a JSON object');\n  }\n\n  const record: Record<string, RuntimeEndpointUrls> = {};\n  for (const [key, value] of Object.entries(parsed)) {\n    if (!value || typeof value !== 'object' || Array.isArray(value)) {\n      throw new Error(`Runtime endpoint \"${key}\" must be an object`);\n    }\n\n    const publicUrl = (value as Record<string, unknown>).publicUrl;\n    const internalUrl = (value as Record<string, unknown>).internalUrl;\n    if (typeof publicUrl !== 'string' || typeof internalUrl !== 'string') {\n      throw new Error(`Runtime endpoint \"${key}\" must expose string publicUrl/internalUrl`);\n    }\n\n    record[key] = { publicUrl, internalUrl };\n  }\n\n  return record;\n}\n"]}