@wildo-ai/saas-models 1.1.2 → 1.1.3

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.js

@@ -1,5 +1,7 @@
 import { EngineCapability } from './engine-capabilities.shared.schemas.js';
 /**
+ * @wildo_source:part:start saas.models.providers.capability-resolution-mode facet:layer:shared facet:audience:app-developer
+ *
  * How the engine resolves the provider(s) fulfilling an `EngineCapability`
  * when more than one is declared for the same scope.
  *
@@ -13,9 +15,19 @@ import { EngineCapability } from './engine-capabilities.shared.schemas.js';
 export var EngineCapabilityResolutionMode;
 (function (EngineCapabilityResolutionMode) {
     /**
-     * Exactly one active provider — `selection.<capability>.primary`, with
-     * `fallbacks` tried only on failure. The default for every capability
-     * (billing, email, observability, …): a request is served by one provider.
+     * Exactly one active provider: `selection.<capability>.primary`. The default for every capability
+     * (billing, email, observability, …), and a request is served by that one provider.
+     *
+     * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on
+     * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a
+     * primary that is not AVAILABLE at resolution time — undeclared in the scope, disabled, or
+     * unconfigured — and it decides which provider ends up first in the resolved list. Nothing
+     * retries a second provider when a call to the first one FAILS: the send raises the primary's
+     * error and stops.
+     *
+     * So do not read a declared `whenUnavailable` entry as redundancy, and do not size an
+     * availability argument on it. An application that wants call-time failover builds it at its own
+     * call site, per capability — a deliberate framework boundary, not an omission.
      */
     EngineCapabilityResolutionMode["SELECT_ONE"] = "SELECT_ONE";
     /**
@@ -26,6 +38,7 @@ export var EngineCapabilityResolutionMode;
      */
     EngineCapabilityResolutionMode["FAN_OUT"] = "FAN_OUT";
 })(EngineCapabilityResolutionMode || (EngineCapabilityResolutionMode = {}));
+/** @wildo_source:part:end saas.models.providers.capability-resolution-mode */
 /**
  * The DECLARED resolution mode for EVERY engine capability. Exhaustive by
  * construction: because this is a `Record<EngineCapability, …>`, adding a new
@@ -37,13 +50,27 @@ export var EngineCapabilityResolutionMode;
  *
  * Only `COMPLIANCE_AUDIT_TRAIL` is `FAN_OUT` today (audit events are additive —
  * every declared destination receives every event). Everything else is
- * `SELECT_ONE` (the failover norm — one active provider, fallbacks on failure).
+ * `SELECT_ONE`: one active provider, and no failover to a second one.
  */
 const ENGINE_CAPABILITY_RESOLUTION_MODE = {
     [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: EngineCapabilityResolutionMode.FAN_OUT,
+    /**
+     * NOMINAL for the two ACTIVATION capabilities below, and worth stating because the next reader
+     * will otherwise ask the right question. `BILLING_PAYMENTS` was withdrawn from the enum on
+     * 2026-09-09 for being classified `SELECT_ONE` with no provider capability able to fill it —
+     * "select one of zero candidates" is not a resolution mode. `ORGANIZATIONS` and `MULTI_LANGUAGE`
+     * have no provider capability either, so why do they stand?
+     *
+     * Because nothing ever RESOLVES them. They are engine-implemented activations (multi-tenancy, the
+     * i18n pipeline): an application enables them, the engine serves them, and no code path asks this
+     * record which provider fulfills them — where the withdrawn slot's whole purpose was to be
+     * resolved and it could not be. Their absence from `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` is a
+     * DECLARATION (`ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`), not a gap, and the row here
+     * exists only because this record is total over the enum by construction — which is the property
+     * that makes a genuinely resolvable new capability impossible to leave unclassified.
+     */
     [EngineCapability.ORGANIZATIONS]: EngineCapabilityResolutionMode.SELECT_ONE,
     [EngineCapability.BILLING]: EngineCapabilityResolutionMode.SELECT_ONE,
-    [EngineCapability.BILLING_PAYMENTS]: EngineCapabilityResolutionMode.SELECT_ONE,
     [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,
     [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,
     [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-resolution-mode.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,8BAcX;AAdD,WAAY,8BAA8B;IACxC;;;;OAIG;IACH,2DAAyB,CAAA;IACzB;;;;;OAKG;IACH,qDAAmB,CAAA;AACrB,CAAC,EAdW,8BAA8B,KAA9B,8BAA8B,QAczC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,iCAAiC,GAA6D;IAClG,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,OAAO;IAEjF,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACrE,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC9E,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC5E,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,8FAA8F;IAC9F,8FAA8F;IAC9F,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,oBAAoB;IACpB,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACvF,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACxF,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC/E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,UAAU;CACtF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA4B;IAE5B,OAAO,iCAAiC,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * How the engine resolves the provider(s) fulfilling an `EngineCapability`\n * when more than one is declared for the same scope.\n *\n * This is a FIRST-CLASS, declared property of a capability — NOT an implicit\n * per-consumer convention. A reader can tell whether a capability picks one\n * provider or writes to all of them; a new capability author declares it\n * here; and both the runtime registry resolver and the `defineSaaSProviders`\n * config validators branch on it (so a `FAN_OUT` capability is validated by\n * DECLARATION and never keyed off `selection`).\n */\nexport enum EngineCapabilityResolutionMode {\n  /**\n   * Exactly one active provider — `selection.<capability>.primary`, with\n   * `fallbacks` tried only on failure. The default for every capability\n   * (billing, email, observability, …): a request is served by one provider.\n   */\n  SELECT_ONE = 'SELECT_ONE',\n  /**\n   * ALL declared providers are active simultaneously — every one receives\n   * every emission (no primary, no failover). For sinks whose nature is\n   * additive rather than substitutable: `COMPLIANCE_AUDIT_TRAIL` writes each\n   * audit event to every configured destination.\n   */\n  FAN_OUT = 'FAN_OUT',\n}\n\n/**\n * The DECLARED resolution mode for EVERY engine capability. Exhaustive by\n * construction: because this is a `Record<EngineCapability, …>`, adding a new\n * member to the `EngineCapability` enum WITHOUT classifying it here is a COMPILE\n * error. That is deliberate — a bare \"default to SELECT_ONE\" would let a future\n * additive/fan-out capability silently collapse to single-provider resolution\n * (dropping emissions to every non-primary destination) just because its author\n * forgot a one-line edit. The compiler now forces the decision.\n *\n * Only `COMPLIANCE_AUDIT_TRAIL` is `FAN_OUT` today (audit events are additive —\n * every declared destination receives every event). Everything else is\n * `SELECT_ONE` (the failover norm — one active provider, fallbacks on failure).\n */\nconst ENGINE_CAPABILITY_RESOLUTION_MODE: Record<EngineCapability, EngineCapabilityResolutionMode> = {\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: EngineCapabilityResolutionMode.FAN_OUT,\n\n  [EngineCapability.ORGANIZATIONS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.BILLING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.BILLING_PAYMENTS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.SMS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_LLM]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_IMAGE_GENERATION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Embeddings are substitutable, not additive: one provider serves a vector space, and writing\n  // the same chunk through two providers would produce two incompatible spaces, not redundancy.\n  [EngineCapability.AI_EMBEDDINGS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Extraction is substitutable, not additive: one provider reads a document, and running the\n  // same bytes through two OCR services would produce two divergent transcriptions of one page\n  // with no principled way to merge them — plus a second egress of the same private content.\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One agent per task, and emphatically not fan-out: two coding agents given the same task\n  // against the same worktree do not produce redundancy, they produce a merge conflict nobody\n  // asked for — and the change attribution that follows a run could no longer say which agent\n  // wrote which file.\n  [EngineCapability.AI_CODING_AGENT]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.LLM_OBSERVABILITY]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: EngineCapabilityResolutionMode.SELECT_ONE,\n};\n\n/**\n * The declared resolution mode for an engine capability. A TOTAL lookup — every\n * capability is explicitly classified in `ENGINE_CAPABILITY_RESOLUTION_MODE`\n * (no silent default).\n *\n * Consumers: the runtime registry (`ExternalProvidersRegistryBackendService`\n * — `FAN_OUT` uses the full provider list, `SELECT_ONE` uses the primary) and\n * the `defineSaaSProviders` validators (a `FAN_OUT` capability is validated by\n * declaration and rejects a `selection` entry).\n */\nexport function getEngineCapabilityResolutionMode(\n  capability: EngineCapability,\n): EngineCapabilityResolutionMode {\n  return ENGINE_CAPABILITY_RESOLUTION_MODE[capability];\n}\n"]}
+{"version":3,"file":"engine-capability-resolution-mode.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAwBX;AAxBD,WAAY,8BAA8B;IACxC;;;;;;;;;;;;;;OAcG;IACH,2DAAyB,CAAA;IACzB;;;;;OAKG;IACH,qDAAmB,CAAA;AACrB,CAAC,EAxBW,8BAA8B,KAA9B,8BAA8B,QAwBzC;AACD,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,iCAAiC,GAA6D;IAClG,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,OAAO;IAEjF;;;;;;;;;;;;;;OAcG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACrE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC5E,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,8FAA8F;IAC9F,8FAA8F;IAC9F,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,oBAAoB;IACpB,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACvF,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACxF,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC/E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,UAAU;CACtF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA4B;IAE5B,OAAO,iCAAiC,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-resolution-mode facet:layer:shared facet:audience:app-developer\n *\n * How the engine resolves the provider(s) fulfilling an `EngineCapability`\n * when more than one is declared for the same scope.\n *\n * This is a FIRST-CLASS, declared property of a capability — NOT an implicit\n * per-consumer convention. A reader can tell whether a capability picks one\n * provider or writes to all of them; a new capability author declares it\n * here; and both the runtime registry resolver and the `defineSaaSProviders`\n * config validators branch on it (so a `FAN_OUT` capability is validated by\n * DECLARATION and never keyed off `selection`).\n */\nexport enum EngineCapabilityResolutionMode {\n  /**\n   * Exactly one active provider: `selection.<capability>.primary`. The default for every capability\n   * (billing, email, observability, …), and a request is served by that one provider.\n   *\n   * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on\n   * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a\n   * primary that is not AVAILABLE at resolution time — undeclared in the scope, disabled, or\n   * unconfigured — and it decides which provider ends up first in the resolved list. Nothing\n   * retries a second provider when a call to the first one FAILS: the send raises the primary's\n   * error and stops.\n   *\n   * So do not read a declared `whenUnavailable` entry as redundancy, and do not size an\n   * availability argument on it. An application that wants call-time failover builds it at its own\n   * call site, per capability — a deliberate framework boundary, not an omission.\n   */\n  SELECT_ONE = 'SELECT_ONE',\n  /**\n   * ALL declared providers are active simultaneously — every one receives\n   * every emission (no primary, no failover). For sinks whose nature is\n   * additive rather than substitutable: `COMPLIANCE_AUDIT_TRAIL` writes each\n   * audit event to every configured destination.\n   */\n  FAN_OUT = 'FAN_OUT',\n}\n/** @wildo_source:part:end saas.models.providers.capability-resolution-mode */\n\n/**\n * The DECLARED resolution mode for EVERY engine capability. Exhaustive by\n * construction: because this is a `Record<EngineCapability, …>`, adding a new\n * member to the `EngineCapability` enum WITHOUT classifying it here is a COMPILE\n * error. That is deliberate — a bare \"default to SELECT_ONE\" would let a future\n * additive/fan-out capability silently collapse to single-provider resolution\n * (dropping emissions to every non-primary destination) just because its author\n * forgot a one-line edit. The compiler now forces the decision.\n *\n * Only `COMPLIANCE_AUDIT_TRAIL` is `FAN_OUT` today (audit events are additive —\n * every declared destination receives every event). Everything else is\n * `SELECT_ONE`: one active provider, and no failover to a second one.\n */\nconst ENGINE_CAPABILITY_RESOLUTION_MODE: Record<EngineCapability, EngineCapabilityResolutionMode> = {\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: EngineCapabilityResolutionMode.FAN_OUT,\n\n  /**\n   * NOMINAL for the two ACTIVATION capabilities below, and worth stating because the next reader\n   * will otherwise ask the right question. `BILLING_PAYMENTS` was withdrawn from the enum on\n   * 2026-09-09 for being classified `SELECT_ONE` with no provider capability able to fill it —\n   * \"select one of zero candidates\" is not a resolution mode. `ORGANIZATIONS` and `MULTI_LANGUAGE`\n   * have no provider capability either, so why do they stand?\n   *\n   * Because nothing ever RESOLVES them. They are engine-implemented activations (multi-tenancy, the\n   * i18n pipeline): an application enables them, the engine serves them, and no code path asks this\n   * record which provider fulfills them — where the withdrawn slot's whole purpose was to be\n   * resolved and it could not be. Their absence from `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` is a\n   * DECLARATION (`ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`), not a gap, and the row here\n   * exists only because this record is total over the enum by construction — which is the property\n   * that makes a genuinely resolvable new capability impossible to leave unclassified.\n   */\n  [EngineCapability.ORGANIZATIONS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.BILLING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.SMS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_LLM]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_IMAGE_GENERATION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Embeddings are substitutable, not additive: one provider serves a vector space, and writing\n  // the same chunk through two providers would produce two incompatible spaces, not redundancy.\n  [EngineCapability.AI_EMBEDDINGS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Extraction is substitutable, not additive: one provider reads a document, and running the\n  // same bytes through two OCR services would produce two divergent transcriptions of one page\n  // with no principled way to merge them — plus a second egress of the same private content.\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One agent per task, and emphatically not fan-out: two coding agents given the same task\n  // against the same worktree do not produce redundancy, they produce a merge conflict nobody\n  // asked for — and the change attribution that follows a run could no longer say which agent\n  // wrote which file.\n  [EngineCapability.AI_CODING_AGENT]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.LLM_OBSERVABILITY]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: EngineCapabilityResolutionMode.SELECT_ONE,\n};\n\n/**\n * The declared resolution mode for an engine capability. A TOTAL lookup — every\n * capability is explicitly classified in `ENGINE_CAPABILITY_RESOLUTION_MODE`\n * (no silent default).\n *\n * Consumers: the runtime registry (`ExternalProvidersRegistryBackendService`\n * — `FAN_OUT` uses the full provider list, `SELECT_ONE` uses the primary) and\n * the `defineSaaSProviders` validators (a `FAN_OUT` capability is validated by\n * declaration and rejects a `selection` entry).\n */\nexport function getEngineCapabilityResolutionMode(\n  capability: EngineCapability,\n): EngineCapabilityResolutionMode {\n  return ENGINE_CAPABILITY_RESOLUTION_MODE[capability];\n}\n"]}

package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.d.ts

@@ -5,6 +5,17 @@ export declare const FrontendAppBootstrapPayloadSchema: z.ZodObject<{
         providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
             metadata: z.ZodObject<{
                 ref: z.ZodString;
+                packageName: z.ZodString;
+                tier: z.ZodEnum<typeof import("./provider-metadata.shared.schemas").ProviderTier>;
+                vendor: z.ZodString;
+                origin: z.ZodObject<{
+                    kind: z.ZodEnum<typeof import("./provider-metadata.shared.schemas").ProviderOriginKind>;
+                    catalogue: z.ZodOptional<z.ZodObject<{
+                        source: z.ZodEnum<typeof import("./provider-metadata.shared.schemas").ProviderCatalogueSource>;
+                        sourceRef: z.ZodString;
+                        sourceVersion: z.ZodString;
+                    }, z.core.$strip>>;
+                }, z.core.$strip>;
                 displayNameLabelKey: z.ZodOptional<z.ZodString>;
                 displayName: z.ZodOptional<z.ZodString>;
                 iconRef: z.ZodOptional<z.ZodString>;
@@ -12,7 +23,33 @@ export declare const FrontendAppBootstrapPayloadSchema: z.ZodObject<{
             providerCapabilities: z.ZodArray<z.ZodString>;
             protocols: z.ZodArray<z.ZodString>;
             publicConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        }, z.core.$strip>>>;
+            csp: z.ZodOptional<z.ZodObject<{
+                scriptOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                connectOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                frameOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                imgOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                styleOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                fontOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                derivedOrigins: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    publicConfigKey: z.ZodString;
+                    bucket: z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendCspOriginBucket>;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
+            sdk: z.ZodOptional<z.ZodObject<{
+                packageName: z.ZodString;
+                versionRange: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            scripts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                src: z.ZodString;
+                integrity: z.ZodOptional<z.ZodString>;
+                crossOrigin: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendScriptCrossOrigin>>;
+                async: z.ZodOptional<z.ZodBoolean>;
+                defer: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>>;
+            components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
+            }, z.core.$strict>>>;
+        }, z.core.$loose>>>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type FrontendAppBootstrapPayload = z.infer<typeof FrontendAppBootstrapPayloadSchema>;
@@ -157,6 +194,11 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
                 requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
                 expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
             }, z.core.$strip>>;
+            stepUpAuth: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+                maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+                methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").AuthMethod>>>>;
+            }, z.core.$strip>>;
         }, z.core.$strip>>;
         scimProvisioning: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -176,10 +218,6 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
     billing: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         providerRef: z.ZodOptional<z.ZodString>;
-        webhooks: z.ZodOptional<z.ZodObject<{
-            path: z.ZodDefault<z.ZodString>;
-            signingSecretRef: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>;
         defaultCurrency: z.ZodDefault<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>;
         supportedCurrencies: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodEnum<typeof import("@wildo-ai/zod-decorators").AvailableCurrency>, z.ZodString]>>>;
         tax: z.ZodDefault<z.ZodObject<{
@@ -198,7 +236,7 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
             defaultTrialDays: z.ZodDefault<z.ZodNumber>;
             paymentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
             maxPaymentRetries: z.ZodDefault<z.ZodNumber>;
-            defaultProration: z.ZodDefault<z.ZodEnum<typeof import("..").ProrationBehavior>>;
+            defaultProration: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ProrationBehavior>>;
             defaultCancellation: z.ZodDefault<z.ZodEnum<typeof import("..").BillingTiming>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
@@ -301,11 +339,23 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
     }, z.core.$strip>>;
     auditTrail: z.ZodOptional<z.ZodObject<{
         archiveAfterDays: z.ZodOptional<z.ZodNumber>;
+        allowPrivateNetworkSiemCollectors: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     frontendProviders: z.ZodObject<{
         providers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
             metadata: z.ZodObject<{
                 ref: z.ZodString;
+                packageName: z.ZodString;
+                tier: z.ZodEnum<typeof import("./provider-metadata.shared.schemas").ProviderTier>;
+                vendor: z.ZodString;
+                origin: z.ZodObject<{
+                    kind: z.ZodEnum<typeof import("./provider-metadata.shared.schemas").ProviderOriginKind>;
+                    catalogue: z.ZodOptional<z.ZodObject<{
+                        source: z.ZodEnum<typeof import("./provider-metadata.shared.schemas").ProviderCatalogueSource>;
+                        sourceRef: z.ZodString;
+                        sourceVersion: z.ZodString;
+                    }, z.core.$strip>>;
+                }, z.core.$strip>;
                 displayNameLabelKey: z.ZodOptional<z.ZodString>;
                 displayName: z.ZodOptional<z.ZodString>;
                 iconRef: z.ZodOptional<z.ZodString>;
@@ -313,7 +363,33 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
             providerCapabilities: z.ZodArray<z.ZodString>;
             protocols: z.ZodArray<z.ZodString>;
             publicConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-        }, z.core.$strip>>>;
+            csp: z.ZodOptional<z.ZodObject<{
+                scriptOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                connectOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                frameOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                imgOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                styleOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                fontOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                derivedOrigins: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    publicConfigKey: z.ZodString;
+                    bucket: z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendCspOriginBucket>;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
+            sdk: z.ZodOptional<z.ZodObject<{
+                packageName: z.ZodString;
+                versionRange: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            scripts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                src: z.ZodString;
+                integrity: z.ZodOptional<z.ZodString>;
+                crossOrigin: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendScriptCrossOrigin>>;
+                async: z.ZodOptional<z.ZodBoolean>;
+                defer: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>>;
+            components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
+            }, z.core.$strict>>>;
+        }, z.core.$loose>>>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type AppConfiguration_FrontendBootstrapResponse = z.infer<typeof AppConfiguration_FrontendBootstrapResponse_Schema>;

package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-bootstrap.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;iBAE5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1D,CAAC;AACL,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC9D,OAAO,iDAAiD,CACzD,CAAC"}
+{"version":3,"file":"frontend-bootstrap.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1D,CAAC;AACL,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC9D,OAAO,iDAAiD,CACzD,CAAC"}

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The public-config shape a BUILT-IN frontend capability expects, as a named
+ * schema rather than a convention.
+ *
+ * ## Why the capability owns this and not each provider
+ *
+ * `publicConfig` is `Record<string, unknown>`, so every consuming site was
+ * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter
+ * for strings, a Mb-to-bytes multiplication — and a renamed key produced
+ * `undefined` and a silently wrong picker rather than an error. The keys were a
+ * convention nobody had written down, which is the whole defect: three ad-hoc
+ * readers agreeing by luck.
+ *
+ * What a FILE PICKER's constraints mean is framework knowledge — the framework
+ * is what applies them to its own file fields — so the shape belongs to the
+ * CAPABILITY. A provider is free to carry its own keys beside these (a client
+ * id, an app key); it is not free to invent a different spelling of the ones
+ * the framework reads, and now it cannot.
+ *
+ * A provider declaring `publicConfigSchema` should EXTEND the schema for the
+ * capability it claims, so hydration validates the framework's fields and its
+ * own in one pass.
+ */
+import { z } from 'zod';
+/**
+ * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.
+ *
+ * Every field is optional: a provider that constrains nothing is legitimate,
+ * and the field's own Zod file metadata always wins anyway — a provider only
+ * fills the gaps the schema left open.
+ *
+ * LOOSE, because a provider's own keys live in the same object and must survive
+ * a parse that is only looking for these.
+ */
+export declare const FrontendFilePickerPublicConfigSchema: z.ZodObject<{
+    /**
+     * MIME types the picker can return.
+     *
+     * An EMPTY list is normalized to absent, and that is behaviour rather than
+     * decoration: the framework turns this into an `accept=` attribute, and an
+     * empty `accept=""` does not mean "anything" — it means the file dialog
+     * offers nothing. A provider that declares no types is unconstrained, so the
+     * normalization happens here, once, instead of at each reader that would have
+     * to remember it.
+     */
+    acceptedMimeTypes: z.ZodPipe<z.ZodOptional<z.ZodArray<z.ZodString>>, z.ZodTransform<string[], string[]>>;
+    /**
+     * Largest file the picker will hand back, in MEGABYTES.
+     *
+     * The unit is in the name because the framework's own constraint is in BYTES
+     * and the conversion is the kind of thing that is wrong by a factor of 1024²
+     * exactly once, silently, in production.
+     */
+    maxFileSizeMb: z.ZodOptional<z.ZodNumber>;
+    /** How many files one selection may return. Applies only to a `multiple` field. */
+    maxSelectionCount: z.ZodOptional<z.ZodNumber>;
+}, z.core.$loose>;
+export type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;
+//# sourceMappingURL=frontend-capability-public-config.shared.schemas.d.ts.map

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-capability-public-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC;IAC/C;;;;;;;;;OASG;;IAKH;;;;;;OAMG;;IAEH,mFAAmF;;iBAEnF,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.js

@@ -0,0 +1,61 @@
+/**
+ * The public-config shape a BUILT-IN frontend capability expects, as a named
+ * schema rather than a convention.
+ *
+ * ## Why the capability owns this and not each provider
+ *
+ * `publicConfig` is `Record<string, unknown>`, so every consuming site was
+ * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter
+ * for strings, a Mb-to-bytes multiplication — and a renamed key produced
+ * `undefined` and a silently wrong picker rather than an error. The keys were a
+ * convention nobody had written down, which is the whole defect: three ad-hoc
+ * readers agreeing by luck.
+ *
+ * What a FILE PICKER's constraints mean is framework knowledge — the framework
+ * is what applies them to its own file fields — so the shape belongs to the
+ * CAPABILITY. A provider is free to carry its own keys beside these (a client
+ * id, an app key); it is not free to invent a different spelling of the ones
+ * the framework reads, and now it cannot.
+ *
+ * A provider declaring `publicConfigSchema` should EXTEND the schema for the
+ * capability it claims, so hydration validates the framework's fields and its
+ * own in one pass.
+ */
+import { z } from 'zod';
+/**
+ * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.
+ *
+ * Every field is optional: a provider that constrains nothing is legitimate,
+ * and the field's own Zod file metadata always wins anyway — a provider only
+ * fills the gaps the schema left open.
+ *
+ * LOOSE, because a provider's own keys live in the same object and must survive
+ * a parse that is only looking for these.
+ */
+export const FrontendFilePickerPublicConfigSchema = z.looseObject({
+    /**
+     * MIME types the picker can return.
+     *
+     * An EMPTY list is normalized to absent, and that is behaviour rather than
+     * decoration: the framework turns this into an `accept=` attribute, and an
+     * empty `accept=""` does not mean "anything" — it means the file dialog
+     * offers nothing. A provider that declares no types is unconstrained, so the
+     * normalization happens here, once, instead of at each reader that would have
+     * to remember it.
+     */
+    acceptedMimeTypes: z
+        .array(z.string().min(1))
+        .optional()
+        .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),
+    /**
+     * Largest file the picker will hand back, in MEGABYTES.
+     *
+     * The unit is in the name because the framework's own constraint is in BYTES
+     * and the conversion is the kind of thing that is wrong by a factor of 1024²
+     * exactly once, silently, in production.
+     */
+    maxFileSizeMb: z.number().positive().optional(),
+    /** How many files one selection may return. Applies only to a `multiple` field. */
+    maxSelectionCount: z.number().int().positive().optional(),
+});
+//# sourceMappingURL=frontend-capability-public-config.shared.schemas.js.map

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-capability-public-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,WAAW,CAAC;IAChE;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC","sourcesContent":["/**\n * The public-config shape a BUILT-IN frontend capability expects, as a named\n * schema rather than a convention.\n *\n * ## Why the capability owns this and not each provider\n *\n * `publicConfig` is `Record<string, unknown>`, so every consuming site was\n * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter\n * for strings, a Mb-to-bytes multiplication — and a renamed key produced\n * `undefined` and a silently wrong picker rather than an error. The keys were a\n * convention nobody had written down, which is the whole defect: three ad-hoc\n * readers agreeing by luck.\n *\n * What a FILE PICKER's constraints mean is framework knowledge — the framework\n * is what applies them to its own file fields — so the shape belongs to the\n * CAPABILITY. A provider is free to carry its own keys beside these (a client\n * id, an app key); it is not free to invent a different spelling of the ones\n * the framework reads, and now it cannot.\n *\n * A provider declaring `publicConfigSchema` should EXTEND the schema for the\n * capability it claims, so hydration validates the framework's fields and its\n * own in one pass.\n */\n\nimport { z } from 'zod';\n\n/**\n * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.\n *\n * Every field is optional: a provider that constrains nothing is legitimate,\n * and the field's own Zod file metadata always wins anyway — a provider only\n * fills the gaps the schema left open.\n *\n * LOOSE, because a provider's own keys live in the same object and must survive\n * a parse that is only looking for these.\n */\nexport const FrontendFilePickerPublicConfigSchema = z.looseObject({\n  /**\n   * MIME types the picker can return.\n   *\n   * An EMPTY list is normalized to absent, and that is behaviour rather than\n   * decoration: the framework turns this into an `accept=` attribute, and an\n   * empty `accept=\"\"` does not mean \"anything\" — it means the file dialog\n   * offers nothing. A provider that declares no types is unconstrained, so the\n   * normalization happens here, once, instead of at each reader that would have\n   * to remember it.\n   */\n  acceptedMimeTypes: z\n    .array(z.string().min(1))\n    .optional()\n    .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),\n  /**\n   * Largest file the picker will hand back, in MEGABYTES.\n   *\n   * The unit is in the name because the framework's own constraint is in BYTES\n   * and the conversion is the kind of thing that is wrong by a factor of 1024²\n   * exactly once, silently, in production.\n   */\n  maxFileSizeMb: z.number().positive().optional(),\n  /** How many files one selection may return. Applies only to a `multiple` field. */\n  maxSelectionCount: z.number().int().positive().optional(),\n});\nexport type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;\n"]}

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The RUNTIME contract a built-in frontend capability expects of whichever
+ * provider fills it — the code-half sibling of
+ * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.
+ *
+ * ## Why the capability owns the shape, and not the framework's call site
+ *
+ * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider
+ * package must not know any vendor's type, and "a consumer that needs one narrows
+ * it at the point where it also knows which provider it asked for."
+ *
+ * That reasoning holds for a picker, where the surface really did ask for Drive.
+ * It inverts for an OBSERVABILITY capability: the framework reports a crash without
+ * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted
+ * collector is listening. Narrowing at the call site would mean a `switch` over
+ * vendors inside the engine, which is precisely what the capability model exists to
+ * prevent.
+ *
+ * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,
+ * and the framework calls one method it owns the definition of.
+ *
+ * ## Bundle-safe by construction
+ *
+ * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from
+ * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take
+ * a handful of atoms without the decorator-bound schema graph.
+ */
+/**
+ * One crash, as the framework describes it to whichever provider is listening.
+ *
+ * ## What is in it, and why that is the whole list
+ *
+ * `name`, `message`, `stack` and `componentStack` are exactly what
+ * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught
+ * crash. Nothing new is collected to fill this shape; what changes is only that the
+ * report can now leave the browser.
+ *
+ * **`message` is sent as authored, and that is a decision rather than an oversight.**
+ * It is the field most likely to carry user content — `new Error(\`Invalid value:
+ * ${input}\`)` — and it is also the field without which a crash report is close to
+ * useless. Every mainstream crash reporter sends the exception message and scrubs by
+ * KEY rather than by free-text inspection, because a scrubber over prose either
+ * destroys the diagnostic or gives false assurance. An application that cannot accept
+ * that should not declare `FRONTEND_ERROR_MONITORING`.
+ *
+ * ## What is deliberately NOT in it
+ *
+ * No user identity, no session or organisation id, no request or form payload, and no
+ * resource content. A crash report is a diagnostic about CODE; attributing it to a
+ * PERSON is a separate decision an application would have to take deliberately, and
+ * there is no field here through which it could happen by accident.
+ */
+export interface FrontendCrashReport {
+    /** The error's class name — `TypeError`, `WildoFrontendError`. */
+    readonly name: string;
+    /** The error's own message, unmodified. See the note above before changing this. */
+    readonly message: string;
+    /** The JavaScript stack, when the runtime produced one. */
+    readonly stack?: string;
+    /**
+     * React's component stack for a crash a boundary caught. Component NAMES only —
+     * no props, no state — so it says which screen broke without saying what was on it.
+     */
+    readonly componentStack?: string;
+    /**
+     * Framework classification, flattened to strings at this boundary.
+     *
+     * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,
+     * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must
+     * not pull in, and every mainstream vendor models exactly this as string tags. The
+     * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one
+     * named runtime source and only its serialization is local to this contract.
+     */
+    readonly tags?: Readonly<Record<string, string>>;
+}
+/**
+ * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated
+ * handle.
+ *
+ * Synchronous and returning nothing, deliberately. Reporting a crash must never
+ * become something a crashing surface has to await or handle: a vendor SDK queues and
+ * flushes on its own schedule, and a rejected promise here would be a second error
+ * raised from inside the first one's handler.
+ */
+export interface FrontendErrorMonitoringSink {
+    reportCrash(report: FrontendCrashReport): void;
+}
+/**
+ * Whether an activated SDK handle can receive crash reports.
+ *
+ * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor
+ * namespace that does not implement this contract — a mistake no type can catch,
+ * because `handle` is `unknown` by design. Checked at the seam so the failure is a
+ * reported diagnostic rather than a `TypeError` thrown while handling a crash.
+ */
+export declare function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink;
+//# sourceMappingURL=frontend-capability-runtime.shared.types.d.ts.map

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-capability-runtime.shared.types.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAMpG"}

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.js

@@ -0,0 +1,41 @@
+/**
+ * The RUNTIME contract a built-in frontend capability expects of whichever
+ * provider fills it — the code-half sibling of
+ * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.
+ *
+ * ## Why the capability owns the shape, and not the framework's call site
+ *
+ * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider
+ * package must not know any vendor's type, and "a consumer that needs one narrows
+ * it at the point where it also knows which provider it asked for."
+ *
+ * That reasoning holds for a picker, where the surface really did ask for Drive.
+ * It inverts for an OBSERVABILITY capability: the framework reports a crash without
+ * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted
+ * collector is listening. Narrowing at the call site would mean a `switch` over
+ * vendors inside the engine, which is precisely what the capability model exists to
+ * prevent.
+ *
+ * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,
+ * and the framework calls one method it owns the definition of.
+ *
+ * ## Bundle-safe by construction
+ *
+ * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from
+ * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take
+ * a handful of atoms without the decorator-bound schema graph.
+ */
+/**
+ * Whether an activated SDK handle can receive crash reports.
+ *
+ * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor
+ * namespace that does not implement this contract — a mistake no type can catch,
+ * because `handle` is `unknown` by design. Checked at the seam so the failure is a
+ * reported diagnostic rather than a `TypeError` thrown while handling a crash.
+ */
+export function isFrontendErrorMonitoringSink(handle) {
+    return (typeof handle === 'object'
+        && handle !== null
+        && typeof handle.reportCrash === 'function');
+}
+//# sourceMappingURL=frontend-capability-runtime.shared.types.js.map

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-capability-runtime.shared.types.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;WACvB,MAAM,KAAK,IAAI;WACf,OAAQ,MAAsC,CAAC,WAAW,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The RUNTIME contract a built-in frontend capability expects of whichever\n * provider fills it — the code-half sibling of\n * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.\n *\n * ## Why the capability owns the shape, and not the framework's call site\n *\n * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider\n * package must not know any vendor's type, and \"a consumer that needs one narrows\n * it at the point where it also knows which provider it asked for.\"\n *\n * That reasoning holds for a picker, where the surface really did ask for Drive.\n * It inverts for an OBSERVABILITY capability: the framework reports a crash without\n * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted\n * collector is listening. Narrowing at the call site would mean a `switch` over\n * vendors inside the engine, which is precisely what the capability model exists to\n * prevent.\n *\n * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,\n * and the framework calls one method it owns the definition of.\n *\n * ## Bundle-safe by construction\n *\n * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from\n * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take\n * a handful of atoms without the decorator-bound schema graph.\n */\n\n/**\n * One crash, as the framework describes it to whichever provider is listening.\n *\n * ## What is in it, and why that is the whole list\n *\n * `name`, `message`, `stack` and `componentStack` are exactly what\n * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught\n * crash. Nothing new is collected to fill this shape; what changes is only that the\n * report can now leave the browser.\n *\n * **`message` is sent as authored, and that is a decision rather than an oversight.**\n * It is the field most likely to carry user content — `new Error(\\`Invalid value:\n * ${input}\\`)` — and it is also the field without which a crash report is close to\n * useless. Every mainstream crash reporter sends the exception message and scrubs by\n * KEY rather than by free-text inspection, because a scrubber over prose either\n * destroys the diagnostic or gives false assurance. An application that cannot accept\n * that should not declare `FRONTEND_ERROR_MONITORING`.\n *\n * ## What is deliberately NOT in it\n *\n * No user identity, no session or organisation id, no request or form payload, and no\n * resource content. A crash report is a diagnostic about CODE; attributing it to a\n * PERSON is a separate decision an application would have to take deliberately, and\n * there is no field here through which it could happen by accident.\n */\nexport interface FrontendCrashReport {\n  /** The error's class name — `TypeError`, `WildoFrontendError`. */\n  readonly name: string;\n  /** The error's own message, unmodified. See the note above before changing this. */\n  readonly message: string;\n  /** The JavaScript stack, when the runtime produced one. */\n  readonly stack?: string;\n  /**\n   * React's component stack for a crash a boundary caught. Component NAMES only —\n   * no props, no state — so it says which screen broke without saying what was on it.\n   */\n  readonly componentStack?: string;\n  /**\n   * Framework classification, flattened to strings at this boundary.\n   *\n   * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,\n   * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must\n   * not pull in, and every mainstream vendor models exactly this as string tags. The\n   * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one\n   * named runtime source and only its serialization is local to this contract.\n   */\n  readonly tags?: Readonly<Record<string, string>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated\n * handle.\n *\n * Synchronous and returning nothing, deliberately. Reporting a crash must never\n * become something a crashing surface has to await or handle: a vendor SDK queues and\n * flushes on its own schedule, and a rejected promise here would be a second error\n * raised from inside the first one's handler.\n */\nexport interface FrontendErrorMonitoringSink {\n  reportCrash(report: FrontendCrashReport): void;\n}\n\n/**\n * Whether an activated SDK handle can receive crash reports.\n *\n * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor\n * namespace that does not implement this contract — a mistake no type can catch,\n * because `handle` is `unknown` by design. Checked at the seam so the failure is a\n * reported diagnostic rather than a `TypeError` thrown while handling a crash.\n */\nexport function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink {\n  return (\n    typeof handle === 'object'\n    && handle !== null\n    && typeof (handle as FrontendErrorMonitoringSink).reportCrash === 'function'\n  );\n}\n"]}