@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/external-providers/provider-metadata.shared.schemas.js

@@ -7,16 +7,24 @@
  * contracts, no backend behavior. The fields are exactly what a UI needs
  * to render a provider entry (translation-ready display-name key, optional
  * legacy fallback label, optional icon ref) plus the stable `ref` used as
- * the join key between facet modules.
+ * the join key between facet modules — and, since #328, the provider's
+ * IDENTITY: which package ships it, which tier it belongs to, which vendor
+ * groups it, and where it came from.
  *
- * Phase 0 of the provider-registration refactor introduces this type as
- * the single source of truth for provider header information so that the
- * cross-facet seam (`FrontendBootstrapBackendService`) can project a
- * `BackendProviderModule` into a `FrontendProviderEntry` without ever
- * leaking backend-only fields.
+ * ## Why identity lives here and not on the ref
  *
- * See `.cursor/plans/provider-registration-refactor-implementation-plan.md`
- * §Phase 0.1 for the full rationale.
+ * A bare `ref` string cannot say whether a provider is one the engine
+ * REQUIRES (a MAIN provider binding an `EngineCapability` slot), one that
+ * merely MAY bind a slot as a substitute (EXTENSION), or one of the bulk
+ * loaded on demand that must never claim a slot (CATALOGUE). Nor can it say
+ * that `microsoft-graph-mail` and `microsoft-teams` are two packages of one
+ * vendor sharing an OAuth client. Encoding any of that in the ref's
+ * spelling is invisible to the compiler and to every consumer; encoding it
+ * as fields is what lets composition ENFORCE the tier rule
+ * (`assertProviderTierCoherence`) and lets tooling display and group.
+ *
+ * The identity fields are REQUIRED. A provider without a tier is a provider
+ * nobody has decided about, and "undecided" must not parse as "fine".
  */
 import { z } from 'zod';
 /**
@@ -29,13 +37,145 @@ import { z } from 'zod';
 export function buildProviderDisplayNameLabelKey(providerRef) {
     return `providers.${providerRef}.displayName`;
 }
+/**
+ * The three provider tiers (decided 2026-09-05, epic #337).
+ *
+ * The tier is a DECISION recorded on the module, never inferred from its
+ * capabilities at runtime — inference is silent and wrong for a provider
+ * such as Odoo, whose empty capability list says nothing about whether the
+ * engine depends on it.
+ */
+export var ProviderTier;
+(function (ProviderTier) {
+    /**
+     * Mandatory, engine-shipped. Binds an `EngineCapability` slot the engine
+     * itself consumes (email, billing, SMS, the AI slots) or is an SSO login
+     * provider the auth subsystem consumes. MAIN is the engine's own set:
+     * its origin is always `ENGINE`, and it is what stays in the static
+     * engine registry when everything else loads on demand.
+     */
+    ProviderTier["MAIN"] = "MAIN";
+    /**
+     * May ALSO bind an engine slot, as a substitute for a MAIN provider
+     * (a second email sink, a telemetry sink, an audit sink). Kept distinct
+     * from MAIN so the engine's floor is not confused with what happens to
+     * be installed.
+     */
+    ProviderTier["EXTENSION"] = "EXTENSION";
+    /**
+     * The bulk: integrations with no engine slot, loaded on demand when an
+     * application declares them. A CATALOGUE provider may claim only OPEN
+     * `ProviderCapability` tokens — never one that maps to an engine slot —
+     * which composition enforces.
+     */
+    ProviderTier["CATALOGUE"] = "CATALOGUE";
+})(ProviderTier || (ProviderTier = {}));
+/** Where a provider module's code comes from. */
+export var ProviderOriginKind;
+(function (ProviderOriginKind) {
+    /** Shipped by the framework's own connector packages. */
+    ProviderOriginKind["ENGINE"] = "ENGINE";
+    /** Authored inside an application (its own `provider-contributions`). */
+    ProviderOriginKind["APPLICATION"] = "APPLICATION";
+    /**
+     * Emitted by the framework packager from an external catalogue source;
+     * carries the catalogue provenance so the wrapped upstream artifact can
+     * be named, attributed and re-generated.
+     */
+    ProviderOriginKind["GENERATED"] = "GENERATED";
+})(ProviderOriginKind || (ProviderOriginKind = {}));
+/**
+ * External catalogues a build-time MAPPER reads to emit a native Wildo provider package.
+ *
+ * Every member is a SOURCE that is read, never a runtime the application depends on: the mapper
+ * extracts each operation's method, URL template, parameters and auth shape as DATA, and Wildo's
+ * own HTTP client executes them. Nothing third-party is installed or executed by a generated
+ * application. (An earlier revision of this enum described Activepieces as a set of executable
+ * bundles Wildo would WRAP; that model was built, measured and deleted on 2026-09-06 — see
+ * `providers-are-scraped-never-wrapped`.)
+ *
+ * - `ACTIVEPIECES` — the community pieces monorepo. Each piece's actions and triggers call
+ *   `httpClient.sendRequest({ method, url, body })` in plain TypeScript an AST pass can read.
+ *   Note the PUBLISHED bundle is NOT a usable input: its metadata carries name, inputs and auth
+ *   but not the endpoint, which lives inside the compiled `run`.
+ * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.
+ *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response
+ *   shaping stays Wildo's.
+ * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the
+ *   same output shape. Authoritative where it exists, since it is the vendor's own description.
+ */
+export var ProviderCatalogueSource;
+(function (ProviderCatalogueSource) {
+    ProviderCatalogueSource["ACTIVEPIECES"] = "ACTIVEPIECES";
+    ProviderCatalogueSource["SIM"] = "SIM";
+    ProviderCatalogueSource["OPENAPI_DOCUMENT"] = "OPENAPI_DOCUMENT";
+})(ProviderCatalogueSource || (ProviderCatalogueSource = {}));
+export const ProviderCatalogueProvenanceSchema = z.object({
+    source: z.enum(ProviderCatalogueSource),
+    /**
+     * The upstream artifact read, addressed the way its catalogue addresses it: the piece's
+     * directory or package name, the Sim tool's module, the OpenAPI document's path.
+     */
+    sourceRef: z.string().min(1),
+    /**
+     * The exact upstream revision read — a source-control revision for a monorepo catalogue, a
+     * document version for an OpenAPI input. A re-generation pins a new one, which is what makes a
+     * regenerated package's diff attributable to a specific upstream movement.
+     */
+    sourceVersion: z.string().min(1),
+});
+/**
+ * Origin as ONE object with a `kind` and a provenance that is REQUIRED exactly when the kind is
+ * `GENERATED` (and forbidden otherwise), enforced by the refinement below.
+ *
+ * Not a `z.discriminatedUnion`, deliberately: under `strictNullChecks: false` — how the engine
+ * packages compile — Zod 4 infers a union-typed object key as OPTIONAL (the members' `optout`
+ * collapses to `"optional"` once `undefined` is erased), so `metadata.origin` would type as
+ * omittable in every engine consumer while the runtime refused its absence. A plain object
+ * infers as required in both modes; the invariant the union expressed lives in the refinement
+ * and in the `ProviderOrigin` type below.
+ */
+export const ProviderOriginSchema = z
+    .object({
+    kind: z.enum(ProviderOriginKind),
+    /** Present iff `kind === GENERATED`. */
+    catalogue: ProviderCatalogueProvenanceSchema.optional(),
+})
+    .superRefine((origin, ctx) => {
+    if (origin.kind === ProviderOriginKind.GENERATED && origin.catalogue === undefined) {
+        ctx.addIssue({ code: 'custom', path: ['catalogue'], message: 'A GENERATED origin must carry its catalogue provenance.' });
+    }
+    if (origin.kind !== ProviderOriginKind.GENERATED && origin.catalogue !== undefined) {
+        ctx.addIssue({ code: 'custom', path: ['catalogue'], message: `Only a GENERATED origin carries catalogue provenance (kind is ${origin.kind}).` });
+    }
+});
+/** The one engine origin value, so 22 modules do not each spell it. */
+export const ENGINE_PROVIDER_ORIGIN = Object.freeze({ kind: ProviderOriginKind.ENGINE });
 export const ProviderMetadataSchema = z.object({
     /**
      * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,
      * `'openai'`. Used as the join key across facet modules and as the
      * map key inside `BackendProviderRegistry.modules`.
      */
-    ref: z.string(),
+    ref: z.string().min(1),
+    /**
+     * The npm package that ships this provider's module(s), e.g.
+     * `@wildo-ai/external-connectors-private` for an engine provider or
+     * `@wildo-ai/provider-slack` for a per-provider package. One package,
+     * several facet barrels — this is the package, not a barrel.
+     */
+    packageName: z.string().min(1),
+    /** See {@link ProviderTier}. A recorded decision, never inferred. */
+    tier: z.enum(ProviderTier),
+    /**
+     * Vendor grouping. Equal to `ref` for a single-package vendor; the shared
+     * name for a sub-cut vendor (`vendor: 'microsoft'` on both
+     * `microsoft-graph-mail` and `microsoft-teams`), which is what lets an
+     * OAuth client or a secret be shared by reference across sub-packages.
+     */
+    vendor: z.string().min(1),
+    /** See {@link ProviderOriginSchema}. */
+    origin: ProviderOriginSchema,
     /**
      * Translation-ready key for the provider display name.
      *
@@ -55,4 +195,36 @@ export const ProviderMetadataSchema = z.object({
      */
     iconRef: z.string().optional(),
 });
+/**
+ * The identity half of {@link ProviderMetadataSchema} on its own — what a
+ * companion contribution carries so tooling can display tiers and group
+ * vendors without loading a provider's runtime module.
+ */
+export const ProviderIdentitySchema = ProviderMetadataSchema.pick({
+    packageName: true,
+    tier: true,
+    vendor: true,
+    origin: true,
+});
+/**
+ * The one way a provider module authors its metadata.
+ *
+ * Derives `displayNameLabelKey` from the ref (every module used to call
+ * `buildProviderDisplayNameLabelKey` by hand), defaults `vendor` to the ref,
+ * and parses the result so an incomplete identity fails at MODULE LOAD —
+ * in the package that owns the module — rather than at the first consumer
+ * that reads a field which is not there.
+ */
+export function defineProviderMetadata(input) {
+    return ProviderMetadataSchema.parse({
+        ref: input.ref,
+        packageName: input.packageName,
+        tier: input.tier,
+        vendor: input.vendor ?? input.ref,
+        origin: input.origin,
+        displayNameLabelKey: buildProviderDisplayNameLabelKey(input.ref),
+        ...(input.displayName === undefined ? {} : { displayName: input.displayName }),
+        ...(input.iconRef === undefined ? {} : { iconRef: input.iconRef }),
+    });
+}
 //# sourceMappingURL=provider-metadata.shared.schemas.js.map

package/dist/esm/external-providers/provider-metadata.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,OAAO,aAAa,WAAW,cAAc,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;OAIG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC","sourcesContent":["/**\n * `ProviderMetadata` — shared, frontend-safe header carried by every\n * provider module across every facet (backend, frontend-app, techdoc,\n * website).\n *\n * Intentionally **frontend-safe**: holds no secrets, no protocol\n * contracts, no backend behavior. The fields are exactly what a UI needs\n * to render a provider entry (translation-ready display-name key, optional\n * legacy fallback label, optional icon ref) plus the stable `ref` used as\n * the join key between facet modules.\n *\n * Phase 0 of the provider-registration refactor introduces this type as\n * the single source of truth for provider header information so that the\n * cross-facet seam (`FrontendBootstrapBackendService`) can project a\n * `BackendProviderModule` into a `FrontendProviderEntry` without ever\n * leaking backend-only fields.\n *\n * See `.cursor/plans/provider-registration-refactor-implementation-plan.md`\n * §Phase 0.1 for the full rationale.\n */\n\nimport { z } from 'zod';\n\n/**\n * Translation key builder for provider display names.\n *\n * Provider modules stay locale-neutral by exporting this stable label key;\n * consuming frontend surfaces resolve it via the app i18n service at render\n * time instead of freezing human copy into generated/runtime artifacts.\n */\nexport function buildProviderDisplayNameLabelKey(providerRef: string): string {\n  return `providers.${providerRef}.displayName`;\n}\n\nexport const ProviderMetadataSchema = z.object({\n  /**\n   * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,\n   * `'openai'`. Used as the join key across facet modules and as the\n   * map key inside `BackendProviderRegistry.modules`.\n   */\n  ref: z.string(),\n  /**\n   * Translation-ready key for the provider display name.\n   *\n   * Frontend/public surfaces should prefer this field over embedding\n   * locale-bound copy in provider modules or runtime artifacts.\n   */\n  displayNameLabelKey: z.string().optional(),\n  /**\n   * Legacy human-readable fallback label for non-i18n-aware consumers.\n   * When absent, consumers fall back to the `ref`.\n   */\n  displayName: z.string().optional(),\n  /**\n   * Optional icon reference resolved through the frontend icon registry.\n   * Stays a string (not a URL or component reference) to keep this type\n   * frontend-safe AND portable to non-React surfaces.\n   */\n  iconRef: z.string().optional(),\n});\n\nexport type ProviderMetadata = z.infer<typeof ProviderMetadataSchema>;\n"]}
+{"version":3,"file":"provider-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,OAAO,aAAa,WAAW,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,YAuBX;AAvBD,WAAY,YAAY;IACtB;;;;;;OAMG;IACH,6BAAa,CAAA;IACb;;;;;OAKG;IACH,uCAAuB,CAAA;IACvB;;;;;OAKG;IACH,uCAAuB,CAAA;AACzB,CAAC,EAvBW,YAAY,KAAZ,YAAY,QAuBvB;AAED,iDAAiD;AACjD,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,yDAAyD;IACzD,uCAAiB,CAAA;IACjB,yEAAyE;IACzE,iDAA2B,CAAA;IAC3B;;;;OAIG;IACH,6CAAuB,CAAA;AACzB,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,wDAA6B,CAAA;IAC7B,sCAAW,CAAA;IACX,gEAAqC,CAAA;AACvC,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,wCAAwC;IACxC,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,iEAAiE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC,CAAC,CAAC;AAML,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;OAIG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,qEAAqE;IACrE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC1B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,wCAAwC;IACxC,MAAM,EAAE,oBAAoB;IAC5B;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC;IAChE,WAAW,EAAE,IAAI;IACjB,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAcH;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACnE,CAAqB,CAAC;AACzB,CAAC","sourcesContent":["/**\n * `ProviderMetadata` — shared, frontend-safe header carried by every\n * provider module across every facet (backend, frontend-app, techdoc,\n * website).\n *\n * Intentionally **frontend-safe**: holds no secrets, no protocol\n * contracts, no backend behavior. The fields are exactly what a UI needs\n * to render a provider entry (translation-ready display-name key, optional\n * legacy fallback label, optional icon ref) plus the stable `ref` used as\n * the join key between facet modules — and, since #328, the provider's\n * IDENTITY: which package ships it, which tier it belongs to, which vendor\n * groups it, and where it came from.\n *\n * ## Why identity lives here and not on the ref\n *\n * A bare `ref` string cannot say whether a provider is one the engine\n * REQUIRES (a MAIN provider binding an `EngineCapability` slot), one that\n * merely MAY bind a slot as a substitute (EXTENSION), or one of the bulk\n * loaded on demand that must never claim a slot (CATALOGUE). Nor can it say\n * that `microsoft-graph-mail` and `microsoft-teams` are two packages of one\n * vendor sharing an OAuth client. Encoding any of that in the ref's\n * spelling is invisible to the compiler and to every consumer; encoding it\n * as fields is what lets composition ENFORCE the tier rule\n * (`assertProviderTierCoherence`) and lets tooling display and group.\n *\n * The identity fields are REQUIRED. A provider without a tier is a provider\n * nobody has decided about, and \"undecided\" must not parse as \"fine\".\n */\n\nimport { z } from 'zod';\n\n\n/**\n * Translation key builder for provider display names.\n *\n * Provider modules stay locale-neutral by exporting this stable label key;\n * consuming frontend surfaces resolve it via the app i18n service at render\n * time instead of freezing human copy into generated/runtime artifacts.\n */\nexport function buildProviderDisplayNameLabelKey(providerRef: string): string {\n  return `providers.${providerRef}.displayName`;\n}\n\n/**\n * The three provider tiers (decided 2026-09-05, epic #337).\n *\n * The tier is a DECISION recorded on the module, never inferred from its\n * capabilities at runtime — inference is silent and wrong for a provider\n * such as Odoo, whose empty capability list says nothing about whether the\n * engine depends on it.\n */\nexport enum ProviderTier {\n  /**\n   * Mandatory, engine-shipped. Binds an `EngineCapability` slot the engine\n   * itself consumes (email, billing, SMS, the AI slots) or is an SSO login\n   * provider the auth subsystem consumes. MAIN is the engine's own set:\n   * its origin is always `ENGINE`, and it is what stays in the static\n   * engine registry when everything else loads on demand.\n   */\n  MAIN = 'MAIN',\n  /**\n   * May ALSO bind an engine slot, as a substitute for a MAIN provider\n   * (a second email sink, a telemetry sink, an audit sink). Kept distinct\n   * from MAIN so the engine's floor is not confused with what happens to\n   * be installed.\n   */\n  EXTENSION = 'EXTENSION',\n  /**\n   * The bulk: integrations with no engine slot, loaded on demand when an\n   * application declares them. A CATALOGUE provider may claim only OPEN\n   * `ProviderCapability` tokens — never one that maps to an engine slot —\n   * which composition enforces.\n   */\n  CATALOGUE = 'CATALOGUE',\n}\n\n/** Where a provider module's code comes from. */\nexport enum ProviderOriginKind {\n  /** Shipped by the framework's own connector packages. */\n  ENGINE = 'ENGINE',\n  /** Authored inside an application (its own `provider-contributions`). */\n  APPLICATION = 'APPLICATION',\n  /**\n   * Emitted by the framework packager from an external catalogue source;\n   * carries the catalogue provenance so the wrapped upstream artifact can\n   * be named, attributed and re-generated.\n   */\n  GENERATED = 'GENERATED',\n}\n\n/**\n * External catalogues a build-time MAPPER reads to emit a native Wildo provider package.\n *\n * Every member is a SOURCE that is read, never a runtime the application depends on: the mapper\n * extracts each operation's method, URL template, parameters and auth shape as DATA, and Wildo's\n * own HTTP client executes them. Nothing third-party is installed or executed by a generated\n * application. (An earlier revision of this enum described Activepieces as a set of executable\n * bundles Wildo would WRAP; that model was built, measured and deleted on 2026-09-06 — see\n * `providers-are-scraped-never-wrapped`.)\n *\n * - `ACTIVEPIECES` — the community pieces monorepo. Each piece's actions and triggers call\n *   `httpClient.sendRequest({ method, url, body })` in plain TypeScript an AST pass can read.\n *   Note the PUBLISHED bundle is NOT a usable input: its metadata carries name, inputs and auth\n *   but not the endpoint, which lives inside the compiled `run`.\n * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.\n *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response\n *   shaping stays Wildo's.\n * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the\n *   same output shape. Authoritative where it exists, since it is the vendor's own description.\n */\nexport enum ProviderCatalogueSource {\n  ACTIVEPIECES = 'ACTIVEPIECES',\n  SIM = 'SIM',\n  OPENAPI_DOCUMENT = 'OPENAPI_DOCUMENT',\n}\n\nexport const ProviderCatalogueProvenanceSchema = z.object({\n  source: z.enum(ProviderCatalogueSource),\n  /**\n   * The upstream artifact read, addressed the way its catalogue addresses it: the piece's\n   * directory or package name, the Sim tool's module, the OpenAPI document's path.\n   */\n  sourceRef: z.string().min(1),\n  /**\n   * The exact upstream revision read — a source-control revision for a monorepo catalogue, a\n   * document version for an OpenAPI input. A re-generation pins a new one, which is what makes a\n   * regenerated package's diff attributable to a specific upstream movement.\n   */\n  sourceVersion: z.string().min(1),\n});\nexport type ProviderCatalogueProvenance = z.infer<typeof ProviderCatalogueProvenanceSchema>;\n\n/**\n * Origin as ONE object with a `kind` and a provenance that is REQUIRED exactly when the kind is\n * `GENERATED` (and forbidden otherwise), enforced by the refinement below.\n *\n * Not a `z.discriminatedUnion`, deliberately: under `strictNullChecks: false` — how the engine\n * packages compile — Zod 4 infers a union-typed object key as OPTIONAL (the members' `optout`\n * collapses to `\"optional\"` once `undefined` is erased), so `metadata.origin` would type as\n * omittable in every engine consumer while the runtime refused its absence. A plain object\n * infers as required in both modes; the invariant the union expressed lives in the refinement\n * and in the `ProviderOrigin` type below.\n */\nexport const ProviderOriginSchema = z\n  .object({\n    kind: z.enum(ProviderOriginKind),\n    /** Present iff `kind === GENERATED`. */\n    catalogue: ProviderCatalogueProvenanceSchema.optional(),\n  })\n  .superRefine((origin, ctx) => {\n    if (origin.kind === ProviderOriginKind.GENERATED && origin.catalogue === undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: 'A GENERATED origin must carry its catalogue provenance.' });\n    }\n    if (origin.kind !== ProviderOriginKind.GENERATED && origin.catalogue !== undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: `Only a GENERATED origin carries catalogue provenance (kind is ${origin.kind}).` });\n    }\n  });\nexport type ProviderOrigin =\n  | { kind: ProviderOriginKind.ENGINE; catalogue?: undefined }\n  | { kind: ProviderOriginKind.APPLICATION; catalogue?: undefined }\n  | { kind: ProviderOriginKind.GENERATED; catalogue: ProviderCatalogueProvenance };\n\n/** The one engine origin value, so 22 modules do not each spell it. */\nexport const ENGINE_PROVIDER_ORIGIN: ProviderOrigin = Object.freeze({ kind: ProviderOriginKind.ENGINE });\n\nexport const ProviderMetadataSchema = z.object({\n  /**\n   * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,\n   * `'openai'`. Used as the join key across facet modules and as the\n   * map key inside `BackendProviderRegistry.modules`.\n   */\n  ref: z.string().min(1),\n  /**\n   * The npm package that ships this provider's module(s), e.g.\n   * `@wildo-ai/external-connectors-private` for an engine provider or\n   * `@wildo-ai/provider-slack` for a per-provider package. One package,\n   * several facet barrels — this is the package, not a barrel.\n   */\n  packageName: z.string().min(1),\n  /** See {@link ProviderTier}. A recorded decision, never inferred. */\n  tier: z.enum(ProviderTier),\n  /**\n   * Vendor grouping. Equal to `ref` for a single-package vendor; the shared\n   * name for a sub-cut vendor (`vendor: 'microsoft'` on both\n   * `microsoft-graph-mail` and `microsoft-teams`), which is what lets an\n   * OAuth client or a secret be shared by reference across sub-packages.\n   */\n  vendor: z.string().min(1),\n  /** See {@link ProviderOriginSchema}. */\n  origin: ProviderOriginSchema,\n  /**\n   * Translation-ready key for the provider display name.\n   *\n   * Frontend/public surfaces should prefer this field over embedding\n   * locale-bound copy in provider modules or runtime artifacts.\n   */\n  displayNameLabelKey: z.string().optional(),\n  /**\n   * Legacy human-readable fallback label for non-i18n-aware consumers.\n   * When absent, consumers fall back to the `ref`.\n   */\n  displayName: z.string().optional(),\n  /**\n   * Optional icon reference resolved through the frontend icon registry.\n   * Stays a string (not a URL or component reference) to keep this type\n   * frontend-safe AND portable to non-React surfaces.\n   */\n  iconRef: z.string().optional(),\n});\n\nexport type ProviderMetadata = Omit<z.infer<typeof ProviderMetadataSchema>, 'origin'> & { origin: ProviderOrigin };\n\n/**\n * The identity half of {@link ProviderMetadataSchema} on its own — what a\n * companion contribution carries so tooling can display tiers and group\n * vendors without loading a provider's runtime module.\n */\nexport const ProviderIdentitySchema = ProviderMetadataSchema.pick({\n  packageName: true,\n  tier: true,\n  vendor: true,\n  origin: true,\n});\nexport type ProviderIdentity = Omit<z.infer<typeof ProviderIdentitySchema>, 'origin'> & { origin: ProviderOrigin };\n\nexport interface DefineProviderMetadataInput {\n  ref: string;\n  packageName: string;\n  tier: ProviderTier;\n  origin: ProviderOrigin;\n  /** Defaults to `ref` — the single-package vendor case. */\n  vendor?: string;\n  displayName?: string;\n  iconRef?: string;\n}\n\n/**\n * The one way a provider module authors its metadata.\n *\n * Derives `displayNameLabelKey` from the ref (every module used to call\n * `buildProviderDisplayNameLabelKey` by hand), defaults `vendor` to the ref,\n * and parses the result so an incomplete identity fails at MODULE LOAD —\n * in the package that owns the module — rather than at the first consumer\n * that reads a field which is not there.\n */\nexport function defineProviderMetadata(input: DefineProviderMetadataInput): ProviderMetadata {\n  return ProviderMetadataSchema.parse({\n    ref: input.ref,\n    packageName: input.packageName,\n    tier: input.tier,\n    vendor: input.vendor ?? input.ref,\n    origin: input.origin,\n    displayNameLabelKey: buildProviderDisplayNameLabelKey(input.ref),\n    ...(input.displayName === undefined ? {} : { displayName: input.displayName }),\n    ...(input.iconRef === undefined ? {} : { iconRef: input.iconRef }),\n  }) as ProviderMetadata;\n}\n"]}

package/dist/esm/external-providers/provider-protocol.shared.schemas.d.ts

@@ -24,14 +24,19 @@
  * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and
  * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and
  * for the exact condition under which they are admitted.
+ *
+ * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,
+ * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,
+ * declared by no provider module, resolvable by no runtime arm. An application that still
+ * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts
+ * ONLY these keys (the engine's snake_case wire values were also accepted before, a second
+ * spelling nothing else understood).
  */
 export declare const BUILTIN_PROVIDER_PROTOCOL: {
     readonly REST_API: "REST_API";
     readonly WEBHOOK_ORIGINATOR: "WEBHOOK_ORIGINATOR";
     readonly LLM_PROVIDER: "LLM_PROVIDER";
     readonly AGENT_CLIENT_PROTOCOL: "AGENT_CLIENT_PROTOCOL";
-    readonly MCP_CONNECTOR: "MCP_CONNECTOR";
-    readonly A2A_CONNECTOR: "A2A_CONNECTOR";
     /**
      * Text-to-image generation (wired: gpt-image, via the OpenAI provider's
      * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.
@@ -52,10 +57,7 @@ export declare const BUILTIN_PROVIDER_PROTOCOL: {
      */
     readonly DOCUMENT_EXTRACTION_PROVIDER: "DOCUMENT_EXTRACTION_PROVIDER";
     readonly EMAIL_PROVIDER: "EMAIL_PROVIDER";
-    readonly GIT_PROVIDER: "GIT_PROVIDER";
-    readonly GRPC: "GRPC";
     readonly SSO_OAUTH2: "SSO_OAUTH2";
-    readonly SSO_SAML: "SSO_SAML";
     readonly BILLING_PROVIDER: "BILLING_PROVIDER";
     readonly SMS_PROVIDER: "SMS_PROVIDER";
     readonly FRONTEND_SDK: "FRONTEND_SDK";

package/dist/esm/external-providers/provider-protocol.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-protocol.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,yBAAyB;;;;;;;IAOpC;;;OAGG;;IAEH;;;;;;OAMG;;IAEH;;;;OAIG;;;;;;;;;;CAUK,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}
+{"version":3,"file":"provider-protocol.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB;;;;;IAKpC;;;OAGG;;IAEH;;;;;;OAMG;;IAEH;;;;OAIG;;;;;;;CAOK,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}

package/dist/esm/external-providers/provider-protocol.shared.schemas.js

@@ -24,14 +24,19 @@
  * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and
  * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and
  * for the exact condition under which they are admitted.
+ *
+ * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,
+ * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,
+ * declared by no provider module, resolvable by no runtime arm. An application that still
+ * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts
+ * ONLY these keys (the engine's snake_case wire values were also accepted before, a second
+ * spelling nothing else understood).
  */
 export const BUILTIN_PROVIDER_PROTOCOL = {
     REST_API: 'REST_API',
     WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',
     LLM_PROVIDER: 'LLM_PROVIDER',
     AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',
-    MCP_CONNECTOR: 'MCP_CONNECTOR',
-    A2A_CONNECTOR: 'A2A_CONNECTOR',
     /**
      * Text-to-image generation (wired: gpt-image, via the OpenAI provider's
      * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.
@@ -52,10 +57,7 @@ export const BUILTIN_PROVIDER_PROTOCOL = {
      */
     DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',
     EMAIL_PROVIDER: 'EMAIL_PROVIDER',
-    GIT_PROVIDER: 'GIT_PROVIDER',
-    GRPC: 'GRPC',
     SSO_OAUTH2: 'SSO_OAUTH2',
-    SSO_SAML: 'SSO_SAML',
     BILLING_PROVIDER: 'BILLING_PROVIDER',
     SMS_PROVIDER: 'SMS_PROVIDER',
     FRONTEND_SDK: 'FRONTEND_SDK',

package/dist/esm/external-providers/provider-protocol.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-protocol.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B;;;OAGG;IACH,cAAc,EAAE,gBAAgB;IAChC;;;;;;OAMG;IACH,mBAAmB,EAAE,qBAAqB;IAC1C;;;;OAIG;IACH,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;IACpB,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC","sourcesContent":["/**\n * Closed built-in provider protocol vocabulary used by app authoring and\n * runtime-provider declarations.\n *\n * This is intentionally a pure `as const` object + union type so browser-bound\n * packages can consume it through `@wildo-ai/saas-models/public-runtime`\n * without pulling decorators or broader config-authoring seams. Do NOT add an\n * import here — not even an `import type` of the engine enum this list mirrors.\n *\n * ## Relationship to `ExternalProvider_ExchangeProtocol_Kind`\n *\n * This list re-states a population the engine owns: every member of\n * `ExternalProvider_ExchangeProtocol_Kind`\n * (`@wildo-ai/external-connectors-models`) that an application may legally\n * WRITE in `wildo.saas.config.ts > providers.scopes.<scope>.providers.<ref>`.\n * Two hand-maintained enumerations of one population is the shape that drifts,\n * and this one did: `IMAGE_PROVIDER` and `EMBEDDINGS_PROVIDER` shipped as live\n * engine protocols — a provider module declares them, discovery reports them,\n * the backend registry resolves them — while this list had no legal value for\n * either, so no application could declare what those transports speak.\n *\n * The keys are therefore checked against the engine enum by\n * `__tests__/provider-protocol-vocabulary.drift.test.ts`, which also owns the\n * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and\n * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and\n * for the exact condition under which they are admitted.\n */\nexport const BUILTIN_PROVIDER_PROTOCOL = {\n  REST_API: 'REST_API',\n  WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',\n  LLM_PROVIDER: 'LLM_PROVIDER',\n  AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',\n  MCP_CONNECTOR: 'MCP_CONNECTOR',\n  A2A_CONNECTOR: 'A2A_CONNECTOR',\n  /**\n   * Text-to-image generation (wired: gpt-image, via the OpenAI provider's\n   * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.\n   */\n  IMAGE_PROVIDER: 'IMAGE_PROVIDER',\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the\n   * RAG derived-data tier — corpus embedding in the `rag:embedding-drain`\n   * worker, query-time embedding in retrieval. Its own protocol rather than an\n   * `LLM_PROVIDER` operation so a provider can be selected for embeddings\n   * independently of chat.\n   */\n  EMBEDDINGS_PROVIDER: 'EMBEDDINGS_PROVIDER',\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves file text extraction and\n   * the `.ragSource()` corpus built on it, and fills `EngineCapability.AI_DOCUMENT_EXTRACTION` so\n   * an OCR provider is selected independently of chat and embeddings.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',\n  EMAIL_PROVIDER: 'EMAIL_PROVIDER',\n  GIT_PROVIDER: 'GIT_PROVIDER',\n  GRPC: 'GRPC',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  SSO_SAML: 'SSO_SAML',\n  BILLING_PROVIDER: 'BILLING_PROVIDER',\n  SMS_PROVIDER: 'SMS_PROVIDER',\n  FRONTEND_SDK: 'FRONTEND_SDK',\n} as const;\n\nexport type BuiltinProviderProtocol =\n  (typeof BUILTIN_PROVIDER_PROTOCOL)[keyof typeof BUILTIN_PROVIDER_PROTOCOL];\n\nexport type ProviderProtocol = BuiltinProviderProtocol;\n"]}
+{"version":3,"file":"provider-protocol.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C;;;OAGG;IACH,cAAc,EAAE,gBAAgB;IAChC;;;;;;OAMG;IACH,mBAAmB,EAAE,qBAAqB;IAC1C;;;;OAIG;IACH,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,YAAY;IACxB,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC","sourcesContent":["/**\n * Closed built-in provider protocol vocabulary used by app authoring and\n * runtime-provider declarations.\n *\n * This is intentionally a pure `as const` object + union type so browser-bound\n * packages can consume it through `@wildo-ai/saas-models/public-runtime`\n * without pulling decorators or broader config-authoring seams. Do NOT add an\n * import here — not even an `import type` of the engine enum this list mirrors.\n *\n * ## Relationship to `ExternalProvider_ExchangeProtocol_Kind`\n *\n * This list re-states a population the engine owns: every member of\n * `ExternalProvider_ExchangeProtocol_Kind`\n * (`@wildo-ai/external-connectors-models`) that an application may legally\n * WRITE in `wildo.saas.config.ts > providers.scopes.<scope>.providers.<ref>`.\n * Two hand-maintained enumerations of one population is the shape that drifts,\n * and this one did: `IMAGE_PROVIDER` and `EMBEDDINGS_PROVIDER` shipped as live\n * engine protocols — a provider module declares them, discovery reports them,\n * the backend registry resolves them — while this list had no legal value for\n * either, so no application could declare what those transports speak.\n *\n * The keys are therefore checked against the engine enum by\n * `__tests__/provider-protocol-vocabulary.drift.test.ts`, which also owns the\n * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and\n * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and\n * for the exact condition under which they are admitted.\n *\n * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,\n * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,\n * declared by no provider module, resolvable by no runtime arm. An application that still\n * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts\n * ONLY these keys (the engine's snake_case wire values were also accepted before, a second\n * spelling nothing else understood).\n */\nexport const BUILTIN_PROVIDER_PROTOCOL = {\n  REST_API: 'REST_API',\n  WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',\n  LLM_PROVIDER: 'LLM_PROVIDER',\n  AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',\n  /**\n   * Text-to-image generation (wired: gpt-image, via the OpenAI provider's\n   * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.\n   */\n  IMAGE_PROVIDER: 'IMAGE_PROVIDER',\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the\n   * RAG derived-data tier — corpus embedding in the `rag:embedding-drain`\n   * worker, query-time embedding in retrieval. Its own protocol rather than an\n   * `LLM_PROVIDER` operation so a provider can be selected for embeddings\n   * independently of chat.\n   */\n  EMBEDDINGS_PROVIDER: 'EMBEDDINGS_PROVIDER',\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves file text extraction and\n   * the `.ragSource()` corpus built on it, and fills `EngineCapability.AI_DOCUMENT_EXTRACTION` so\n   * an OCR provider is selected independently of chat and embeddings.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',\n  EMAIL_PROVIDER: 'EMAIL_PROVIDER',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  BILLING_PROVIDER: 'BILLING_PROVIDER',\n  SMS_PROVIDER: 'SMS_PROVIDER',\n  FRONTEND_SDK: 'FRONTEND_SDK',\n} as const;\n\nexport type BuiltinProviderProtocol =\n  (typeof BUILTIN_PROVIDER_PROTOCOL)[keyof typeof BUILTIN_PROVIDER_PROTOCOL];\n\nexport type ProviderProtocol = BuiltinProviderProtocol;\n"]}

package/dist/esm/external-providers/provider-tier-rule.shared.utils.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The provider TIER RULE, enforced at composition on every facet (#328).
+ *
+ * - A `CATALOGUE` provider may claim only OPEN `ProviderCapability` tokens.
+ *   It must never bind an `EngineCapability` slot: the engine's floor is
+ *   the MAIN set, and a bulk-loaded integration that quietly filled the
+ *   billing or email slot would make "mandatory" mean "whatever happened
+ *   to be installed".
+ * - A `MAIN` provider is the engine's own: its origin is `ENGINE`. An
+ *   application or a generated package cannot declare itself MAIN.
+ * - An `EXTENSION` provider may bind a slot through
+ *   `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` — that is what the tier is for.
+ *
+ * Lives in `saas-models` (not in the private package) because the rule is
+ * facet-neutral: the three browser-bound registries compose through it too,
+ * and they reach this package only through `/public-runtime`.
+ */
+import { type EngineCapability } from './engine-capabilities.shared.schemas';
+import { type ProviderMetadata } from './provider-metadata.shared.schemas';
+/** What the rule needs from a module, on any facet. */
+export interface ProviderTierRuleSubject {
+    metadata: ProviderMetadata;
+    providerCapabilities: ReadonlyArray<string>;
+}
+/** Engine slots a capability list binds through the closed map. */
+export declare function engineSlotsBoundByCapabilities(providerCapabilities: ReadonlyArray<string>): Array<{
+    capability: string;
+    slot: EngineCapability;
+}>;
+/**
+ * Every tier-rule violation across the given modules, as human sentences
+ * naming the ref, the tier and the offending fact. Empty when coherent.
+ */
+export declare function findProviderTierViolations(modules: Iterable<ProviderTierRuleSubject>): string[];
+/**
+ * Refuse a registry whose modules break the tier rule. Called by every
+ * facet's `compose*Providers` so the rule holds wherever modules meet.
+ */
+export declare function assertProviderTierCoherence(facetLabel: string, modules: Iterable<ProviderTierRuleSubject>): void;
+//# sourceMappingURL=provider-tier-rule.shared.utils.d.ts.map

package/dist/esm/external-providers/provider-tier-rule.shared.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-tier-rule.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-tier-rule.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAG7G,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,mEAAmE;AACnE,wBAAgB,8BAA8B,CAC5C,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1C,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAOvD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,GAAG,MAAM,EAAE,CAuC/F;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAOhH"}

package/dist/esm/external-providers/provider-tier-rule.shared.utils.js

@@ -0,0 +1,80 @@
+/**
+ * The provider TIER RULE, enforced at composition on every facet (#328).
+ *
+ * - A `CATALOGUE` provider may claim only OPEN `ProviderCapability` tokens.
+ *   It must never bind an `EngineCapability` slot: the engine's floor is
+ *   the MAIN set, and a bulk-loaded integration that quietly filled the
+ *   billing or email slot would make "mandatory" mean "whatever happened
+ *   to be installed".
+ * - A `MAIN` provider is the engine's own: its origin is `ENGINE`. An
+ *   application or a generated package cannot declare itself MAIN.
+ * - An `EXTENSION` provider may bind a slot through
+ *   `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` — that is what the tier is for.
+ *
+ * Lives in `saas-models` (not in the private package) because the rule is
+ * facet-neutral: the three browser-bound registries compose through it too,
+ * and they reach this package only through `/public-runtime`.
+ */
+import { PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY, } from './engine-capabilities.shared.schemas.js';
+import { ProviderOriginKind, ProviderTier } from './provider-metadata.shared.schemas.js';
+/** Engine slots a capability list binds through the closed map. */
+export function engineSlotsBoundByCapabilities(providerCapabilities) {
+    const bound = [];
+    for (const capability of providerCapabilities) {
+        const slot = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability];
+        if (slot !== undefined)
+            bound.push({ capability, slot });
+    }
+    return bound;
+}
+/**
+ * Every tier-rule violation across the given modules, as human sentences
+ * naming the ref, the tier and the offending fact. Empty when coherent.
+ */
+export function findProviderTierViolations(modules) {
+    const violations = [];
+    for (const module of modules) {
+        if (!module.metadata) {
+            // A module with no metadata has no ref to name; refuse in words rather than with a TypeError.
+            violations.push('(module without metadata): every provider module declares ProviderMetadata via defineProviderMetadata');
+            continue;
+        }
+        const { ref, tier, origin } = module.metadata;
+        switch (tier) {
+            case ProviderTier.CATALOGUE: {
+                const bound = engineSlotsBoundByCapabilities(module.providerCapabilities);
+                if (bound.length > 0) {
+                    violations.push(`${ref}: tier CATALOGUE may claim only open ProviderCapability tokens, but `
+                        + bound.map((entry) => `"${entry.capability}" binds the ${entry.slot} engine slot`).join(', ')
+                        + '. Declare the provider EXTENSION if it is meant to substitute for a MAIN provider.');
+                }
+                break;
+            }
+            case ProviderTier.MAIN: {
+                if (origin.kind !== ProviderOriginKind.ENGINE) {
+                    violations.push(`${ref}: tier MAIN is the engine's own set, but its origin is ${origin.kind}. `
+                        + 'A package or application provider that binds an engine slot is an EXTENSION.');
+                }
+                break;
+            }
+            case ProviderTier.EXTENSION:
+                break;
+            default: {
+                const unhandled = tier;
+                violations.push(`${ref}: unknown provider tier "${String(unhandled)}".`);
+            }
+        }
+    }
+    return violations;
+}
+/**
+ * Refuse a registry whose modules break the tier rule. Called by every
+ * facet's `compose*Providers` so the rule holds wherever modules meet.
+ */
+export function assertProviderTierCoherence(facetLabel, modules) {
+    const violations = findProviderTierViolations(modules);
+    if (violations.length > 0) {
+        throw new Error(`${facetLabel} provider composition refused by the tier rule — ${violations.join('; ')}`);
+    }
+}
+//# sourceMappingURL=provider-tier-rule.shared.utils.js.map

package/dist/esm/external-providers/provider-tier-rule.shared.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-tier-rule.shared.utils.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-tier-rule.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,wCAAwC,GAEzC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAyB,MAAM,oCAAoC,CAAC;AAS7G,mEAAmE;AACnE,MAAM,UAAU,8BAA8B,CAC5C,oBAA2C;IAE3C,MAAM,KAAK,GAA0D,EAAE,CAAC;IACxE,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,wCAAwC,CAAC,UAAuC,CAAC,CAAC;QAC/F,IAAI,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA0C;IACnF,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,8FAA8F;YAC9F,UAAU,CAAC,IAAI,CAAC,uGAAuG,CAAC,CAAC;YACzH,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC9C,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,8BAA8B,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC1E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,UAAU,CAAC,IAAI,CACb,GAAG,GAAG,sEAAsE;0BACxE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,eAAe,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;0BAC5F,oFAAoF,CACzF,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvB,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,MAAM,EAAE,CAAC;oBAC9C,UAAU,CAAC,IAAI,CACb,GAAG,GAAG,0DAA0D,MAAM,CAAC,IAAI,IAAI;0BAC3E,8EAA8E,CACnF,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,YAAY,CAAC,SAAS;gBACzB,MAAM;YACR,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,SAAS,GAAU,IAAI,CAAC;gBAC9B,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,4BAA4B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB,EAAE,OAA0C;IACxG,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,oDAAoD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * The provider TIER RULE, enforced at composition on every facet (#328).\n *\n * - A `CATALOGUE` provider may claim only OPEN `ProviderCapability` tokens.\n *   It must never bind an `EngineCapability` slot: the engine's floor is\n *   the MAIN set, and a bulk-loaded integration that quietly filled the\n *   billing or email slot would make \"mandatory\" mean \"whatever happened\n *   to be installed\".\n * - A `MAIN` provider is the engine's own: its origin is `ENGINE`. An\n *   application or a generated package cannot declare itself MAIN.\n * - An `EXTENSION` provider may bind a slot through\n *   `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` — that is what the tier is for.\n *\n * Lives in `saas-models` (not in the private package) because the rule is\n * facet-neutral: the three browser-bound registries compose through it too,\n * and they reach this package only through `/public-runtime`.\n */\n\nimport {\n  PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY,\n  type EngineCapability,\n} from './engine-capabilities.shared.schemas';\nimport { ProviderOriginKind, ProviderTier, type ProviderMetadata } from './provider-metadata.shared.schemas';\nimport type { BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** What the rule needs from a module, on any facet. */\nexport interface ProviderTierRuleSubject {\n  metadata: ProviderMetadata;\n  providerCapabilities: ReadonlyArray<string>;\n}\n\n/** Engine slots a capability list binds through the closed map. */\nexport function engineSlotsBoundByCapabilities(\n  providerCapabilities: ReadonlyArray<string>,\n): Array<{ capability: string; slot: EngineCapability }> {\n  const bound: Array<{ capability: string; slot: EngineCapability }> = [];\n  for (const capability of providerCapabilities) {\n    const slot = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability as BuiltinProviderCapability];\n    if (slot !== undefined) bound.push({ capability, slot });\n  }\n  return bound;\n}\n\n/**\n * Every tier-rule violation across the given modules, as human sentences\n * naming the ref, the tier and the offending fact. Empty when coherent.\n */\nexport function findProviderTierViolations(modules: Iterable<ProviderTierRuleSubject>): string[] {\n  const violations: string[] = [];\n  for (const module of modules) {\n    if (!module.metadata) {\n      // A module with no metadata has no ref to name; refuse in words rather than with a TypeError.\n      violations.push('(module without metadata): every provider module declares ProviderMetadata via defineProviderMetadata');\n      continue;\n    }\n    const { ref, tier, origin } = module.metadata;\n    switch (tier) {\n      case ProviderTier.CATALOGUE: {\n        const bound = engineSlotsBoundByCapabilities(module.providerCapabilities);\n        if (bound.length > 0) {\n          violations.push(\n            `${ref}: tier CATALOGUE may claim only open ProviderCapability tokens, but `\n              + bound.map((entry) => `\"${entry.capability}\" binds the ${entry.slot} engine slot`).join(', ')\n              + '. Declare the provider EXTENSION if it is meant to substitute for a MAIN provider.',\n          );\n        }\n        break;\n      }\n      case ProviderTier.MAIN: {\n        if (origin.kind !== ProviderOriginKind.ENGINE) {\n          violations.push(\n            `${ref}: tier MAIN is the engine's own set, but its origin is ${origin.kind}. `\n              + 'A package or application provider that binds an engine slot is an EXTENSION.',\n          );\n        }\n        break;\n      }\n      case ProviderTier.EXTENSION:\n        break;\n      default: {\n        const unhandled: never = tier;\n        violations.push(`${ref}: unknown provider tier \"${String(unhandled)}\".`);\n      }\n    }\n  }\n  return violations;\n}\n\n/**\n * Refuse a registry whose modules break the tier rule. Called by every\n * facet's `compose*Providers` so the rule holds wherever modules meet.\n */\nexport function assertProviderTierCoherence(facetLabel: string, modules: Iterable<ProviderTierRuleSubject>): void {\n  const violations = findProviderTierViolations(modules);\n  if (violations.length > 0) {\n    throw new Error(\n      `${facetLabel} provider composition refused by the tier rule — ${violations.join('; ')}`,\n    );\n  }\n}\n"]}

package/dist/esm/features/core-feature-definitions.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-feature-definitions.shared.d.ts","sourceRoot":"","sources":["../../../../src/features/core-feature-definitions.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAAiB,EAwHvD,CAAC"}
+{"version":3,"file":"core-feature-definitions.shared.d.ts","sourceRoot":"","sources":["../../../../src/features/core-feature-definitions.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAAiB,EA8HvD,CAAC"}

package/dist/esm/features/core-feature-definitions.shared.js

@@ -99,7 +99,13 @@ export const CORE_FEATURE_DEFINITIONS = [
         defaultValue: false,
         scopeBoundary: true,
     },
-    // ─── LIMIT features with counting configs (auto-checked by gate) ───
+    // ─── LIMIT features with counting configs ───
+    //
+    // NOT auto-checked. `registerCoreFeatures` registers these definitions and stops there; the
+    // auto-registration of a `limitChecks` entry runs only in `registerCustomFeatures`, for an
+    // application-declared limit built with `countResource`. No operation declares a check for either
+    // of the two below, so `counting` names the resource that WOULD be counted and nothing counts it.
+    // An application that wants the cap enforced declares the check on the counted resource's CREATE.
     {
         identifier: 'MAX_MEMBERS',
         valueType: FeatureValueType.LIMIT,

package/dist/esm/features/core-feature-definitions.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-feature-definitions.shared.js","sourceRoot":"","sources":["../../../../src/features/core-feature-definitions.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uDAAuD,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAGjH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAErE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwB;IAC3D,4CAA4C;IAC5C;QACE,UAAU,EAAE,WAAW,CAAC,eAAe;QACvC,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,UAAU,EAAE,WAAW,CAAC,kBAAkB;QAC1C,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,UAAU,EAAE,WAAW,CAAC,cAAc;QACtC,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,mEAAmE;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,wCAAwC;QACxC,UAAU,EAAE,WAAW,CAAC,qBAAqB;QAC7C,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,oEAAoE;QACpE,qEAAqE;QACrE,oDAAoD;QACpD,UAAU,EAAE,WAAW,CAAC,sBAAsB;QAC9C,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,oEAAoE;QACpE,qEAAqE;QACrE,mFAAmF;QACnF,iEAAiE;QACjE,UAAU,EAAE,WAAW,CAAC,oBAAoB;QAC5C,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE;YAChB,oBAAoB,CAAC,WAAW;YAChC,oBAAoB,CAAC,aAAa;SACnC;QACD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;QACnB,aAAa,EAAE,IAAI;KACpB;IACD,sEAAsE;IACtE;QACE,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,gBAAgB,CAAC,KAAK;QACjC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,oBAAoB,EAAE;KAClE;IACD;QACE,UAAU,EAAE,cAAc;QAC1B,SAAS,EAAE,gBAAgB,CAAC,KAAK;QACjC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,YAAY,EAAE;KAC1D;IACD;QACE,0EAA0E;QAC1E,EAAE;QACF,0FAA0F;QAC1F,2DAA2D;QAC3D,EAAE;QACF,0FAA0F;QAC1F,+FAA+F;QAC/F,6FAA6F;QAC7F,8FAA8F;QAC9F,mDAAmD;QACnD,EAAE;QACF,4FAA4F;QAC5F,gGAAgG;QAChG,4FAA4F;QAC5F,6FAA6F;QAC7F,EAAE;QACF,sFAAsF;QACtF,+FAA+F;QAC/F,6FAA6F;QAC7F,+EAA+E;QAC/E,UAAU,EAAE,2BAA2B;QACvC,SAAS,EAAE,gBAAgB,CAAC,KAAK;QACjC,aAAa,EAAE,oBAAoB,CAAC,OAAO;QAC3C,wFAAwF;QACxF,sFAAsF;QACtF,6FAA6F;QAC7F,4FAA4F;QAC5F,6FAA6F;QAC7F,gBAAgB,EAAE;YAChB,oBAAoB,CAAC,SAAS;YAC9B,oBAAoB,CAAC,aAAa;YAClC,oBAAoB,CAAC,WAAW;SACjC;QACD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,kBAAkB;KACjC;CACF,CAAC","sourcesContent":["/**\n * Framework Core Feature Definitions\n *\n * These are business features managed by the engine (not tied to external providers).\n * Enabled by config profiles, billing products, or manual admin overrides.\n *\n * Note: PRIORITY_SUPPORT, CUSTOM_INTEGRATIONS, ADVANCED_PERMISSIONS from the old CoreOrganizationFeature\n * enum were dropped:\n * - PRIORITY_SUPPORT → modeled as a custom app feature (not engine-level)\n * - CUSTOM_INTEGRATIONS → modeled by provider declarations, not entitlement features\n * - ADVANCED_PERMISSIONS → handled by RBAC system, not feature gating\n */\n\nimport { CoreFeature } from '../organizations/organization-features.shared.schemas';\nimport { CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport { FEATURES_UNLIMITED, FeatureLimitSemantic, FeatureValueType } from './feature-definition.shared.schemas';\nimport type { FeatureDefinition } from './feature-definition.shared.schemas';\n\n/**\n * LIMIT-feature identifier for the inbound Agent2Agent (A2A) LLM **token budget**: how many LLM\n * tokens a tenant's A2A agent turns may consume per billing period. Grant it from a billing plan\n * (a `LimitGrant` on the product) and the A2A transport enforces it fail-closed, denying further\n * turns with HTTP 402 once exhausted.\n *\n * The single named source for this identifier — the backend budget service resolves the allowance\n * by this exact key, so definition and enforcement cannot drift.\n *\n * Measured in TOKENS, not currency: the framework's canonical provider-usage pricing registry is\n * deliberately not consulted by this A2A entitlement gate. The gate caps the transport's directly\n * metered token consumption; monetary reservation and settlement belong to the separate Work Cycle\n * budget authority.\n */\nexport const A2A_TOKEN_BUDGET_FEATURE_ID = 'a2a.llm.tokensPerPeriod';\n\n/**\n * Core feature definitions: every CoreFeature value + core LIMIT features.\n * Merged with custom app feature definitions at startup.\n */\nexport const CORE_FEATURE_DEFINITIONS: FeatureDefinition[] = [\n  // ─── BOOLEAN features (on/off toggles) ───\n  {\n    identifier: CoreFeature.CUSTOM_BRANDING,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    identifier: CoreFeature.ADVANCED_ANALYTICS,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    identifier: CoreFeature.SINGLE_SIGN_ON,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    identifier: CoreFeature.AUDIT_LOGS,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    // Outbound delivery of audit-trail events to a tenant-owned SIEM /\n    // compliance store. Depends on `AUDIT_LOGS` for the read-side surface,\n    // but the gate is independent so admins can enable read-only auditing\n    // without paying for outbound delivery.\n    identifier: CoreFeature.SECURITY_EVENT_EXPORT,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    // SCIM-driven user/group provisioning. Typically procured alongside\n    // `SINGLE_SIGN_ON` but each feature is an independent gate so an org\n    // can run SSO without provisioning (or vice versa).\n    identifier: CoreFeature.DIRECTORY_PROVISIONING,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    // M2M_WEBHOOK_DELIVERY is scope-bound: enabling it at the app level\n    // does NOT auto-enable it for every organization. Each scope (app or\n    // organization) opts in independently. See `FeatureDefinitionSchema.scopeBoundary`\n    // and `FeatureResolutionBackendService.isFeatureEnabledAtScope`.\n    identifier: CoreFeature.M2M_WEBHOOK_DELIVERY,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [\n      ResourcePrimaryScope.APPLICATION,\n      ResourcePrimaryScope.ORGANIZATIONS,\n    ],\n    dependencies: [],\n    defaultValue: false,\n    scopeBoundary: true,\n  },\n  // ─── LIMIT features with counting configs (auto-checked by gate) ───\n  {\n    identifier: 'MAX_MEMBERS',\n    valueType: FeatureValueType.LIMIT,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: 5,\n    counting: { resourceType: CoreResourceType.ORGANIZATION_MEMBERS },\n  },\n  {\n    identifier: 'MAX_API_KEYS',\n    valueType: FeatureValueType.LIMIT,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: 2,\n    counting: { resourceType: CoreResourceType.ORG_API_KEYS },\n  },\n  {\n    // Inbound A2A LLM token budget — see {@link A2A_TOKEN_BUDGET_FEATURE_ID}.\n    //\n    // Applies to all THREE A2A owner scopes: a user-delegated turn is owned by the delegating\n    // user, a machine turn by its organization or application.\n    //\n    // NO `counting` config, deliberately: consumption here is a SUM OF TOKENS, not a count of\n    // resource rows, so the gate's row-counting strategy cannot measure it. The A2A budget service\n    // owns measurement (accumulating into the `a2aTokenBudgetState` singleton) and resolves this\n    // limit directly — which is exactly the \"limit checking done in custom service code\" case the\n    // `counting` field documents as its absent-branch.\n    //\n    // ⚠️ `limitSemantic: CEILING` is LOAD-BEARING — without it this feature is inert. Under the\n    // default FLOOR semantic the merge is most-permissive-wins, so the `FEATURES_UNLIMITED` default\n    // below would absorb every finite plan grant (`max(-1, 10_000) = -1`) and no cap could ever\n    // engage. CEILING inverts it: `-1` means \"no ceiling\" and YIELDS to the plan's finite grant.\n    //\n    // With CEILING, `defaultValue: FEATURES_UNLIMITED` is both correct and required: this\n    // definition is registered for EVERY application, so a finite default would silently cap every\n    // tenant that never opted into A2A budgeting (and `0` would deny every A2A turn everywhere).\n    // Budgeting stays opt-in — a real cap arrives only from a plan's `LimitGrant`.\n    identifier: A2A_TOKEN_BUDGET_FEATURE_ID,\n    valueType: FeatureValueType.LIMIT,\n    limitSemantic: FeatureLimitSemantic.CEILING,\n    // All three A2A owner scopes are declared because all three can OWN a turn. ⚠️ But only\n    // ORGANIZATIONS and USER_SELF have a BILLING rail (`BILLING_SCOPE_TO_VARIANTS` has no\n    // application variant), so an APPLICATION-scope cap cannot arrive from a plan `LimitGrant` —\n    // it must come from a features profile or a manual `limitOverrides`. Declaring the scope is\n    // still correct: without it an app-machine principal could never be capped by ANY mechanism.\n    applicableScopes: [\n      ResourcePrimaryScope.USER_SELF,\n      ResourcePrimaryScope.ORGANIZATIONS,\n      ResourcePrimaryScope.APPLICATION,\n    ],\n    dependencies: [],\n    defaultValue: FEATURES_UNLIMITED,\n  },\n];\n"]}
+{"version":3,"file":"core-feature-definitions.shared.js","sourceRoot":"","sources":["../../../../src/features/core-feature-definitions.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,uDAAuD,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,gDAAgD,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAGjH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAErE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAwB;IAC3D,4CAA4C;IAC5C;QACE,UAAU,EAAE,WAAW,CAAC,eAAe;QACvC,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,UAAU,EAAE,WAAW,CAAC,kBAAkB;QAC1C,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,UAAU,EAAE,WAAW,CAAC,cAAc;QACtC,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,mEAAmE;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,wCAAwC;QACxC,UAAU,EAAE,WAAW,CAAC,qBAAqB;QAC7C,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,oEAAoE;QACpE,qEAAqE;QACrE,oDAAoD;QACpD,UAAU,EAAE,WAAW,CAAC,sBAAsB;QAC9C,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;KACpB;IACD;QACE,oEAAoE;QACpE,qEAAqE;QACrE,mFAAmF;QACnF,iEAAiE;QACjE,UAAU,EAAE,WAAW,CAAC,oBAAoB;QAC5C,SAAS,EAAE,gBAAgB,CAAC,OAAO;QACnC,gBAAgB,EAAE;YAChB,oBAAoB,CAAC,WAAW;YAChC,oBAAoB,CAAC,aAAa;SACnC;QACD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,KAAK;QACnB,aAAa,EAAE,IAAI;KACpB;IACD,+CAA+C;IAC/C,EAAE;IACF,4FAA4F;IAC5F,2FAA2F;IAC3F,kGAAkG;IAClG,kGAAkG;IAClG,kGAAkG;IAClG;QACE,UAAU,EAAE,aAAa;QACzB,SAAS,EAAE,gBAAgB,CAAC,KAAK;QACjC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,oBAAoB,EAAE;KAClE;IACD;QACE,UAAU,EAAE,cAAc;QAC1B,SAAS,EAAE,gBAAgB,CAAC,KAAK;QACjC,gBAAgB,EAAE,CAAC,oBAAoB,CAAC,aAAa,CAAC;QACtD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,CAAC;QACf,QAAQ,EAAE,EAAE,YAAY,EAAE,gBAAgB,CAAC,YAAY,EAAE;KAC1D;IACD;QACE,0EAA0E;QAC1E,EAAE;QACF,0FAA0F;QAC1F,2DAA2D;QAC3D,EAAE;QACF,0FAA0F;QAC1F,+FAA+F;QAC/F,6FAA6F;QAC7F,8FAA8F;QAC9F,mDAAmD;QACnD,EAAE;QACF,4FAA4F;QAC5F,gGAAgG;QAChG,4FAA4F;QAC5F,6FAA6F;QAC7F,EAAE;QACF,sFAAsF;QACtF,+FAA+F;QAC/F,6FAA6F;QAC7F,+EAA+E;QAC/E,UAAU,EAAE,2BAA2B;QACvC,SAAS,EAAE,gBAAgB,CAAC,KAAK;QACjC,aAAa,EAAE,oBAAoB,CAAC,OAAO;QAC3C,wFAAwF;QACxF,sFAAsF;QACtF,6FAA6F;QAC7F,4FAA4F;QAC5F,6FAA6F;QAC7F,gBAAgB,EAAE;YAChB,oBAAoB,CAAC,SAAS;YAC9B,oBAAoB,CAAC,aAAa;YAClC,oBAAoB,CAAC,WAAW;SACjC;QACD,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,kBAAkB;KACjC;CACF,CAAC","sourcesContent":["/**\n * Framework Core Feature Definitions\n *\n * These are business features managed by the engine (not tied to external providers).\n * Enabled by config profiles, billing products, or manual admin overrides.\n *\n * Note: PRIORITY_SUPPORT, CUSTOM_INTEGRATIONS, ADVANCED_PERMISSIONS from the old CoreOrganizationFeature\n * enum were dropped:\n * - PRIORITY_SUPPORT → modeled as a custom app feature (not engine-level)\n * - CUSTOM_INTEGRATIONS → modeled by provider declarations, not entitlement features\n * - ADVANCED_PERMISSIONS → handled by RBAC system, not feature gating\n */\n\nimport { CoreFeature } from '../organizations/organization-features.shared.schemas';\nimport { CoreResourceType } from '../resources/resources.shared.core.definitions';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport { FEATURES_UNLIMITED, FeatureLimitSemantic, FeatureValueType } from './feature-definition.shared.schemas';\nimport type { FeatureDefinition } from './feature-definition.shared.schemas';\n\n/**\n * LIMIT-feature identifier for the inbound Agent2Agent (A2A) LLM **token budget**: how many LLM\n * tokens a tenant's A2A agent turns may consume per billing period. Grant it from a billing plan\n * (a `LimitGrant` on the product) and the A2A transport enforces it fail-closed, denying further\n * turns with HTTP 402 once exhausted.\n *\n * The single named source for this identifier — the backend budget service resolves the allowance\n * by this exact key, so definition and enforcement cannot drift.\n *\n * Measured in TOKENS, not currency: the framework's canonical provider-usage pricing registry is\n * deliberately not consulted by this A2A entitlement gate. The gate caps the transport's directly\n * metered token consumption; monetary reservation and settlement belong to the separate Work Cycle\n * budget authority.\n */\nexport const A2A_TOKEN_BUDGET_FEATURE_ID = 'a2a.llm.tokensPerPeriod';\n\n/**\n * Core feature definitions: every CoreFeature value + core LIMIT features.\n * Merged with custom app feature definitions at startup.\n */\nexport const CORE_FEATURE_DEFINITIONS: FeatureDefinition[] = [\n  // ─── BOOLEAN features (on/off toggles) ───\n  {\n    identifier: CoreFeature.CUSTOM_BRANDING,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    identifier: CoreFeature.ADVANCED_ANALYTICS,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    identifier: CoreFeature.SINGLE_SIGN_ON,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    identifier: CoreFeature.AUDIT_LOGS,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    // Outbound delivery of audit-trail events to a tenant-owned SIEM /\n    // compliance store. Depends on `AUDIT_LOGS` for the read-side surface,\n    // but the gate is independent so admins can enable read-only auditing\n    // without paying for outbound delivery.\n    identifier: CoreFeature.SECURITY_EVENT_EXPORT,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    // SCIM-driven user/group provisioning. Typically procured alongside\n    // `SINGLE_SIGN_ON` but each feature is an independent gate so an org\n    // can run SSO without provisioning (or vice versa).\n    identifier: CoreFeature.DIRECTORY_PROVISIONING,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: false,\n  },\n  {\n    // M2M_WEBHOOK_DELIVERY is scope-bound: enabling it at the app level\n    // does NOT auto-enable it for every organization. Each scope (app or\n    // organization) opts in independently. See `FeatureDefinitionSchema.scopeBoundary`\n    // and `FeatureResolutionBackendService.isFeatureEnabledAtScope`.\n    identifier: CoreFeature.M2M_WEBHOOK_DELIVERY,\n    valueType: FeatureValueType.BOOLEAN,\n    applicableScopes: [\n      ResourcePrimaryScope.APPLICATION,\n      ResourcePrimaryScope.ORGANIZATIONS,\n    ],\n    dependencies: [],\n    defaultValue: false,\n    scopeBoundary: true,\n  },\n  // ─── LIMIT features with counting configs ───\n  //\n  // NOT auto-checked. `registerCoreFeatures` registers these definitions and stops there; the\n  // auto-registration of a `limitChecks` entry runs only in `registerCustomFeatures`, for an\n  // application-declared limit built with `countResource`. No operation declares a check for either\n  // of the two below, so `counting` names the resource that WOULD be counted and nothing counts it.\n  // An application that wants the cap enforced declares the check on the counted resource's CREATE.\n  {\n    identifier: 'MAX_MEMBERS',\n    valueType: FeatureValueType.LIMIT,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: 5,\n    counting: { resourceType: CoreResourceType.ORGANIZATION_MEMBERS },\n  },\n  {\n    identifier: 'MAX_API_KEYS',\n    valueType: FeatureValueType.LIMIT,\n    applicableScopes: [ResourcePrimaryScope.ORGANIZATIONS],\n    dependencies: [],\n    defaultValue: 2,\n    counting: { resourceType: CoreResourceType.ORG_API_KEYS },\n  },\n  {\n    // Inbound A2A LLM token budget — see {@link A2A_TOKEN_BUDGET_FEATURE_ID}.\n    //\n    // Applies to all THREE A2A owner scopes: a user-delegated turn is owned by the delegating\n    // user, a machine turn by its organization or application.\n    //\n    // NO `counting` config, deliberately: consumption here is a SUM OF TOKENS, not a count of\n    // resource rows, so the gate's row-counting strategy cannot measure it. The A2A budget service\n    // owns measurement (accumulating into the `a2aTokenBudgetState` singleton) and resolves this\n    // limit directly — which is exactly the \"limit checking done in custom service code\" case the\n    // `counting` field documents as its absent-branch.\n    //\n    // ⚠️ `limitSemantic: CEILING` is LOAD-BEARING — without it this feature is inert. Under the\n    // default FLOOR semantic the merge is most-permissive-wins, so the `FEATURES_UNLIMITED` default\n    // below would absorb every finite plan grant (`max(-1, 10_000) = -1`) and no cap could ever\n    // engage. CEILING inverts it: `-1` means \"no ceiling\" and YIELDS to the plan's finite grant.\n    //\n    // With CEILING, `defaultValue: FEATURES_UNLIMITED` is both correct and required: this\n    // definition is registered for EVERY application, so a finite default would silently cap every\n    // tenant that never opted into A2A budgeting (and `0` would deny every A2A turn everywhere).\n    // Budgeting stays opt-in — a real cap arrives only from a plan's `LimitGrant`.\n    identifier: A2A_TOKEN_BUDGET_FEATURE_ID,\n    valueType: FeatureValueType.LIMIT,\n    limitSemantic: FeatureLimitSemantic.CEILING,\n    // All three A2A owner scopes are declared because all three can OWN a turn. ⚠️ But only\n    // ORGANIZATIONS and USER_SELF have a BILLING rail (`BILLING_SCOPE_TO_VARIANTS` has no\n    // application variant), so an APPLICATION-scope cap cannot arrive from a plan `LimitGrant` —\n    // it must come from a features profile or a manual `limitOverrides`. Declaring the scope is\n    // still correct: without it an app-machine principal could never be capped by ANY mechanism.\n    applicableScopes: [\n      ResourcePrimaryScope.USER_SELF,\n      ResourcePrimaryScope.ORGANIZATIONS,\n      ResourcePrimaryScope.APPLICATION,\n    ],\n    dependencies: [],\n    defaultValue: FEATURES_UNLIMITED,\n  },\n];\n"]}

package/dist/esm/features/feature-builders.shared.d.ts

@@ -24,6 +24,37 @@ export type FeatureDefinitionWithAutoRegister = FeatureDefinition & {
     };
 };
 /**
+ * @wildo_source:part:start saas.models.features.definition-builders facet:layer:shared facet:audience:app-developer
+ *
+ * Declaring what an application can SELL or gate on. Two builders, from `@wildo-ai/saas-models`:
+ * `defineFeature` for a boolean capability, `defineLimitFeature` for a numeric allowance.
+ *
+ * A product in the billing catalogue then grants them through `grantedFeatures` / `grantedLimits`,
+ * and any surface gates on the identifier with `requiredFeatures` — a resource operation, a view, a
+ * chart, a navigation item, a settings section.
+ *
+ * ## Two things that decide whether the gate actually fires
+ *
+ * (`limitSemantic` is the third and is covered by the product-definitions skill's own guidance —
+ * the default `FLOOR` is an entitlement the tenant is ALLOWED, and a consumption CAP needs `CEILING`.)
+ *
+ * - **`countResource` is the one-call form.** It registers a limit check on that resource's CREATE
+ *   automatically, so "at most ten projects per organisation" is one declaration rather than a
+ *   definition plus a hand-written gate. A limit declared WITHOUT counting cannot be checked
+ *   automatically: `checkLimit` REFUSES rather than guessing at a remaining quota, and the caller
+ *   must pass a counting override or measure consumption itself. That is the right answer for a
+ *   quantity that is not a row count — a sum of tokens, for instance.
+ * - **`rateLimit` on a definition is RESERVED and ignored by the gate.** A time-windowed allowance
+ *   like "one hundred calls an hour" is not expressible here at all; abuse throttling is a separate
+ *   mechanism with its own declaration.
+ *
+ * ## Granting a capability does not configure it
+ *
+ * An entitlement says the tenant MAY have the thing. Single sign-on entitles an organisation to
+ * register an identity provider; somebody still has to register one. The same holds for provisioning
+ * tokens, export destinations and webhook endpoints — so a plan that grants one of these still needs
+ * an onboarding step behind it.
+ *
  * Simple boolean feature builder.
  *
  * @example
@@ -98,4 +129,5 @@ export declare function defineLimitFeature(identifier: string, options: {
     dependencies?: string[];
     unavailability?: FeatureUnavailabilityOverride;
 }): FeatureDefinitionWithAutoRegister;
+/** @wildo_source:part:end saas.models.features.definition-builders */
 //# sourceMappingURL=feature-builders.shared.d.ts.map

package/dist/esm/features/feature-builders.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feature-builders.shared.d.ts","sourceRoot":"","sources":["../../../../src/features/feature-builders.shared.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAGL,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACzB,MAAM,qCAAqC,CAAC;AAM7C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eAA0C,CAAC;AAEjF;;;GAGG;AACH,MAAM,MAAM,iCAAiC,GAAG,iBAAiB,GAAG;IAClE,CAAC,yBAAyB,CAAC,CAAC,EAAE;QAC5B,oFAAoF;QACpF,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH,CAAC;AAcF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IACP,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,EAAE,CAAC;IACrD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD,GACA,iBAAiB,CASnB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IACP,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,EAAE,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD,GACA,iCAAiC,CA0BnC"}
+{"version":3,"file":"feature-builders.shared.d.ts","sourceRoot":"","sources":["../../../../src/features/feature-builders.shared.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAGL,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACzB,MAAM,qCAAqC,CAAC;AAM7C;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,eAA0C,CAAC;AAEjF;;;GAGG;AACH,MAAM,MAAM,iCAAiC,GAAG,iBAAiB,GAAG;IAClE,CAAC,yBAAyB,CAAC,CAAC,EAAE;QAC5B,oFAAoF;QACpF,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH,CAAC;AAcF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IACP,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,EAAE,CAAC;IACrD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD,GACA,iBAAiB,CASnB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IACP,KAAK,EAAE,oBAAoB,GAAG,oBAAoB,EAAE,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,wFAAwF;IACxF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD,GACA,iCAAiC,CA0BnC;AACD,sEAAsE"}