@wildo-ai/saas-models 1.1.2 → 1.1.4

package/dist/esm/external-providers/provider-metadata.shared.schemas.js

@@ -7,16 +7,24 @@
  * contracts, no backend behavior. The fields are exactly what a UI needs
  * to render a provider entry (translation-ready display-name key, optional
  * legacy fallback label, optional icon ref) plus the stable `ref` used as
- * the join key between facet modules.
+ * the join key between facet modules — and, since #328, the provider's
+ * IDENTITY: which package ships it, which tier it belongs to, which vendor
+ * groups it, and where it came from.
  *
- * Phase 0 of the provider-registration refactor introduces this type as
- * the single source of truth for provider header information so that the
- * cross-facet seam (`FrontendBootstrapBackendService`) can project a
- * `BackendProviderModule` into a `FrontendProviderEntry` without ever
- * leaking backend-only fields.
+ * ## Why identity lives here and not on the ref
  *
- * See `.cursor/plans/provider-registration-refactor-implementation-plan.md`
- * §Phase 0.1 for the full rationale.
+ * A bare `ref` string cannot say whether a provider is one the engine
+ * REQUIRES (a MAIN provider binding an `EngineCapability` slot), one that
+ * merely MAY bind a slot as a substitute (EXTENSION), or one of the bulk
+ * loaded on demand that must never claim a slot (CATALOGUE). Nor can it say
+ * that `microsoft-graph-mail` and `microsoft-teams` are two packages of one
+ * vendor sharing an OAuth client. Encoding any of that in the ref's
+ * spelling is invisible to the compiler and to every consumer; encoding it
+ * as fields is what lets composition ENFORCE the tier rule
+ * (`assertProviderTierCoherence`) and lets tooling display and group.
+ *
+ * The identity fields are REQUIRED. A provider without a tier is a provider
+ * nobody has decided about, and "undecided" must not parse as "fine".
  */
 import { z } from 'zod';
 /**
@@ -29,13 +37,145 @@ import { z } from 'zod';
 export function buildProviderDisplayNameLabelKey(providerRef) {
     return `providers.${providerRef}.displayName`;
 }
+/**
+ * The three provider tiers (decided 2026-09-05, epic #337).
+ *
+ * The tier is a DECISION recorded on the module, never inferred from its
+ * capabilities at runtime — inference is silent and wrong for a provider
+ * such as Odoo, whose empty capability list says nothing about whether the
+ * engine depends on it.
+ */
+export var ProviderTier;
+(function (ProviderTier) {
+    /**
+     * Mandatory, engine-shipped. Binds an `EngineCapability` slot the engine
+     * itself consumes (email, billing, SMS, the AI slots) or is an SSO login
+     * provider the auth subsystem consumes. MAIN is the engine's own set:
+     * its origin is always `ENGINE`, and it is what stays in the static
+     * engine registry when everything else loads on demand.
+     */
+    ProviderTier["MAIN"] = "MAIN";
+    /**
+     * May ALSO bind an engine slot, as a substitute for a MAIN provider
+     * (a second email sink, a telemetry sink, an audit sink). Kept distinct
+     * from MAIN so the engine's floor is not confused with what happens to
+     * be installed.
+     */
+    ProviderTier["EXTENSION"] = "EXTENSION";
+    /**
+     * The bulk: integrations with no engine slot, loaded on demand when an
+     * application declares them. A CATALOGUE provider may claim only OPEN
+     * `ProviderCapability` tokens — never one that maps to an engine slot —
+     * which composition enforces.
+     */
+    ProviderTier["CATALOGUE"] = "CATALOGUE";
+})(ProviderTier || (ProviderTier = {}));
+/** Where a provider module's code comes from. */
+export var ProviderOriginKind;
+(function (ProviderOriginKind) {
+    /** Shipped by the framework's own connector packages. */
+    ProviderOriginKind["ENGINE"] = "ENGINE";
+    /** Authored inside an application (its own `provider-contributions`). */
+    ProviderOriginKind["APPLICATION"] = "APPLICATION";
+    /**
+     * Emitted by the framework packager from an external catalogue source;
+     * carries the catalogue provenance so the wrapped upstream artifact can
+     * be named, attributed and re-generated.
+     */
+    ProviderOriginKind["GENERATED"] = "GENERATED";
+})(ProviderOriginKind || (ProviderOriginKind = {}));
+/**
+ * External catalogues a build-time MAPPER reads to emit a native Wildo provider package.
+ *
+ * Every member is a SOURCE that is read, never a runtime the application depends on: the mapper
+ * extracts each operation's method, URL template, parameters and auth shape as DATA, and Wildo's
+ * own HTTP client executes them. Nothing third-party is installed or executed by a generated
+ * application. (An earlier revision of this enum described Activepieces as a set of executable
+ * bundles Wildo would WRAP; that model was built, measured and deleted on 2026-09-06 — see
+ * `providers-are-scraped-never-wrapped`.)
+ *
+ * - `ACTIVEPIECES` — the community pieces monorepo. Each piece's actions and triggers call
+ *   `httpClient.sendRequest({ method, url, body })` in plain TypeScript an AST pass can read.
+ *   Note the PUBLISHED bundle is NOT a usable input: its metadata carries name, inputs and auth
+ *   but not the endpoint, which lives inside the compiled `run`.
+ * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.
+ *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response
+ *   shaping stays Wildo's.
+ * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the
+ *   same output shape. Authoritative where it exists, since it is the vendor's own description.
+ */
+export var ProviderCatalogueSource;
+(function (ProviderCatalogueSource) {
+    ProviderCatalogueSource["ACTIVEPIECES"] = "ACTIVEPIECES";
+    ProviderCatalogueSource["SIM"] = "SIM";
+    ProviderCatalogueSource["OPENAPI_DOCUMENT"] = "OPENAPI_DOCUMENT";
+})(ProviderCatalogueSource || (ProviderCatalogueSource = {}));
+export const ProviderCatalogueProvenanceSchema = z.object({
+    source: z.enum(ProviderCatalogueSource),
+    /**
+     * The upstream artifact read, addressed the way its catalogue addresses it: the piece's
+     * directory or package name, the Sim tool's module, the OpenAPI document's path.
+     */
+    sourceRef: z.string().min(1),
+    /**
+     * The exact upstream revision read — a source-control revision for a monorepo catalogue, a
+     * document version for an OpenAPI input. A re-generation pins a new one, which is what makes a
+     * regenerated package's diff attributable to a specific upstream movement.
+     */
+    sourceVersion: z.string().min(1),
+});
+/**
+ * Origin as ONE object with a `kind` and a provenance that is REQUIRED exactly when the kind is
+ * `GENERATED` (and forbidden otherwise), enforced by the refinement below.
+ *
+ * Not a `z.discriminatedUnion`, deliberately: under `strictNullChecks: false` — how the engine
+ * packages compile — Zod 4 infers a union-typed object key as OPTIONAL (the members' `optout`
+ * collapses to `"optional"` once `undefined` is erased), so `metadata.origin` would type as
+ * omittable in every engine consumer while the runtime refused its absence. A plain object
+ * infers as required in both modes; the invariant the union expressed lives in the refinement
+ * and in the `ProviderOrigin` type below.
+ */
+export const ProviderOriginSchema = z
+    .object({
+    kind: z.enum(ProviderOriginKind),
+    /** Present iff `kind === GENERATED`. */
+    catalogue: ProviderCatalogueProvenanceSchema.optional(),
+})
+    .superRefine((origin, ctx) => {
+    if (origin.kind === ProviderOriginKind.GENERATED && origin.catalogue === undefined) {
+        ctx.addIssue({ code: 'custom', path: ['catalogue'], message: 'A GENERATED origin must carry its catalogue provenance.' });
+    }
+    if (origin.kind !== ProviderOriginKind.GENERATED && origin.catalogue !== undefined) {
+        ctx.addIssue({ code: 'custom', path: ['catalogue'], message: `Only a GENERATED origin carries catalogue provenance (kind is ${origin.kind}).` });
+    }
+});
+/** The one engine origin value, so 22 modules do not each spell it. */
+export const ENGINE_PROVIDER_ORIGIN = Object.freeze({ kind: ProviderOriginKind.ENGINE });
 export const ProviderMetadataSchema = z.object({
     /**
      * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,
      * `'openai'`. Used as the join key across facet modules and as the
      * map key inside `BackendProviderRegistry.modules`.
      */
-    ref: z.string(),
+    ref: z.string().min(1),
+    /**
+     * The npm package that ships this provider's module(s), e.g.
+     * `@wildo-ai/external-connectors-private` for an engine provider or
+     * `@wildo-ai/provider-slack` for a per-provider package. One package,
+     * several facet barrels — this is the package, not a barrel.
+     */
+    packageName: z.string().min(1),
+    /** See {@link ProviderTier}. A recorded decision, never inferred. */
+    tier: z.enum(ProviderTier),
+    /**
+     * Vendor grouping. Equal to `ref` for a single-package vendor; the shared
+     * name for a sub-cut vendor (`vendor: 'microsoft'` on both
+     * `microsoft-graph-mail` and `microsoft-teams`), which is what lets an
+     * OAuth client or a secret be shared by reference across sub-packages.
+     */
+    vendor: z.string().min(1),
+    /** See {@link ProviderOriginSchema}. */
+    origin: ProviderOriginSchema,
     /**
      * Translation-ready key for the provider display name.
      *
@@ -55,4 +195,36 @@ export const ProviderMetadataSchema = z.object({
      */
     iconRef: z.string().optional(),
 });
+/**
+ * The identity half of {@link ProviderMetadataSchema} on its own — what a
+ * companion contribution carries so tooling can display tiers and group
+ * vendors without loading a provider's runtime module.
+ */
+export const ProviderIdentitySchema = ProviderMetadataSchema.pick({
+    packageName: true,
+    tier: true,
+    vendor: true,
+    origin: true,
+});
+/**
+ * The one way a provider module authors its metadata.
+ *
+ * Derives `displayNameLabelKey` from the ref (every module used to call
+ * `buildProviderDisplayNameLabelKey` by hand), defaults `vendor` to the ref,
+ * and parses the result so an incomplete identity fails at MODULE LOAD —
+ * in the package that owns the module — rather than at the first consumer
+ * that reads a field which is not there.
+ */
+export function defineProviderMetadata(input) {
+    return ProviderMetadataSchema.parse({
+        ref: input.ref,
+        packageName: input.packageName,
+        tier: input.tier,
+        vendor: input.vendor ?? input.ref,
+        origin: input.origin,
+        displayNameLabelKey: buildProviderDisplayNameLabelKey(input.ref),
+        ...(input.displayName === undefined ? {} : { displayName: input.displayName }),
+        ...(input.iconRef === undefined ? {} : { iconRef: input.iconRef }),
+    });
+}
 //# sourceMappingURL=provider-metadata.shared.schemas.js.map

package/dist/esm/external-providers/provider-metadata.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,OAAO,aAAa,WAAW,cAAc,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;OAIG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC","sourcesContent":["/**\n * `ProviderMetadata` — shared, frontend-safe header carried by every\n * provider module across every facet (backend, frontend-app, techdoc,\n * website).\n *\n * Intentionally **frontend-safe**: holds no secrets, no protocol\n * contracts, no backend behavior. The fields are exactly what a UI needs\n * to render a provider entry (translation-ready display-name key, optional\n * legacy fallback label, optional icon ref) plus the stable `ref` used as\n * the join key between facet modules.\n *\n * Phase 0 of the provider-registration refactor introduces this type as\n * the single source of truth for provider header information so that the\n * cross-facet seam (`FrontendBootstrapBackendService`) can project a\n * `BackendProviderModule` into a `FrontendProviderEntry` without ever\n * leaking backend-only fields.\n *\n * See `.cursor/plans/provider-registration-refactor-implementation-plan.md`\n * §Phase 0.1 for the full rationale.\n */\n\nimport { z } from 'zod';\n\n/**\n * Translation key builder for provider display names.\n *\n * Provider modules stay locale-neutral by exporting this stable label key;\n * consuming frontend surfaces resolve it via the app i18n service at render\n * time instead of freezing human copy into generated/runtime artifacts.\n */\nexport function buildProviderDisplayNameLabelKey(providerRef: string): string {\n  return `providers.${providerRef}.displayName`;\n}\n\nexport const ProviderMetadataSchema = z.object({\n  /**\n   * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,\n   * `'openai'`. Used as the join key across facet modules and as the\n   * map key inside `BackendProviderRegistry.modules`.\n   */\n  ref: z.string(),\n  /**\n   * Translation-ready key for the provider display name.\n   *\n   * Frontend/public surfaces should prefer this field over embedding\n   * locale-bound copy in provider modules or runtime artifacts.\n   */\n  displayNameLabelKey: z.string().optional(),\n  /**\n   * Legacy human-readable fallback label for non-i18n-aware consumers.\n   * When absent, consumers fall back to the `ref`.\n   */\n  displayName: z.string().optional(),\n  /**\n   * Optional icon reference resolved through the frontend icon registry.\n   * Stays a string (not a URL or component reference) to keep this type\n   * frontend-safe AND portable to non-React surfaces.\n   */\n  iconRef: z.string().optional(),\n});\n\nexport type ProviderMetadata = z.infer<typeof ProviderMetadataSchema>;\n"]}
+{"version":3,"file":"provider-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,OAAO,aAAa,WAAW,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,YAuBX;AAvBD,WAAY,YAAY;IACtB;;;;;;OAMG;IACH,6BAAa,CAAA;IACb;;;;;OAKG;IACH,uCAAuB,CAAA;IACvB;;;;;OAKG;IACH,uCAAuB,CAAA;AACzB,CAAC,EAvBW,YAAY,KAAZ,YAAY,QAuBvB;AAED,iDAAiD;AACjD,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,yDAAyD;IACzD,uCAAiB,CAAA;IACjB,yEAAyE;IACzE,iDAA2B,CAAA;IAC3B;;;;OAIG;IACH,6CAAuB,CAAA;AACzB,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,wDAA6B,CAAA;IAC7B,sCAAW,CAAA;IACX,gEAAqC,CAAA;AACvC,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,wCAAwC;IACxC,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,iEAAiE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC,CAAC,CAAC;AAML,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;OAIG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,qEAAqE;IACrE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC1B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,wCAAwC;IACxC,MAAM,EAAE,oBAAoB;IAC5B;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC;IAChE,WAAW,EAAE,IAAI;IACjB,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAcH;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACnE,CAAqB,CAAC;AACzB,CAAC","sourcesContent":["/**\n * `ProviderMetadata` — shared, frontend-safe header carried by every\n * provider module across every facet (backend, frontend-app, techdoc,\n * website).\n *\n * Intentionally **frontend-safe**: holds no secrets, no protocol\n * contracts, no backend behavior. The fields are exactly what a UI needs\n * to render a provider entry (translation-ready display-name key, optional\n * legacy fallback label, optional icon ref) plus the stable `ref` used as\n * the join key between facet modules — and, since #328, the provider's\n * IDENTITY: which package ships it, which tier it belongs to, which vendor\n * groups it, and where it came from.\n *\n * ## Why identity lives here and not on the ref\n *\n * A bare `ref` string cannot say whether a provider is one the engine\n * REQUIRES (a MAIN provider binding an `EngineCapability` slot), one that\n * merely MAY bind a slot as a substitute (EXTENSION), or one of the bulk\n * loaded on demand that must never claim a slot (CATALOGUE). Nor can it say\n * that `microsoft-graph-mail` and `microsoft-teams` are two packages of one\n * vendor sharing an OAuth client. Encoding any of that in the ref's\n * spelling is invisible to the compiler and to every consumer; encoding it\n * as fields is what lets composition ENFORCE the tier rule\n * (`assertProviderTierCoherence`) and lets tooling display and group.\n *\n * The identity fields are REQUIRED. A provider without a tier is a provider\n * nobody has decided about, and \"undecided\" must not parse as \"fine\".\n */\n\nimport { z } from 'zod';\n\n\n/**\n * Translation key builder for provider display names.\n *\n * Provider modules stay locale-neutral by exporting this stable label key;\n * consuming frontend surfaces resolve it via the app i18n service at render\n * time instead of freezing human copy into generated/runtime artifacts.\n */\nexport function buildProviderDisplayNameLabelKey(providerRef: string): string {\n  return `providers.${providerRef}.displayName`;\n}\n\n/**\n * The three provider tiers (decided 2026-09-05, epic #337).\n *\n * The tier is a DECISION recorded on the module, never inferred from its\n * capabilities at runtime — inference is silent and wrong for a provider\n * such as Odoo, whose empty capability list says nothing about whether the\n * engine depends on it.\n */\nexport enum ProviderTier {\n  /**\n   * Mandatory, engine-shipped. Binds an `EngineCapability` slot the engine\n   * itself consumes (email, billing, SMS, the AI slots) or is an SSO login\n   * provider the auth subsystem consumes. MAIN is the engine's own set:\n   * its origin is always `ENGINE`, and it is what stays in the static\n   * engine registry when everything else loads on demand.\n   */\n  MAIN = 'MAIN',\n  /**\n   * May ALSO bind an engine slot, as a substitute for a MAIN provider\n   * (a second email sink, a telemetry sink, an audit sink). Kept distinct\n   * from MAIN so the engine's floor is not confused with what happens to\n   * be installed.\n   */\n  EXTENSION = 'EXTENSION',\n  /**\n   * The bulk: integrations with no engine slot, loaded on demand when an\n   * application declares them. A CATALOGUE provider may claim only OPEN\n   * `ProviderCapability` tokens — never one that maps to an engine slot —\n   * which composition enforces.\n   */\n  CATALOGUE = 'CATALOGUE',\n}\n\n/** Where a provider module's code comes from. */\nexport enum ProviderOriginKind {\n  /** Shipped by the framework's own connector packages. */\n  ENGINE = 'ENGINE',\n  /** Authored inside an application (its own `provider-contributions`). */\n  APPLICATION = 'APPLICATION',\n  /**\n   * Emitted by the framework packager from an external catalogue source;\n   * carries the catalogue provenance so the wrapped upstream artifact can\n   * be named, attributed and re-generated.\n   */\n  GENERATED = 'GENERATED',\n}\n\n/**\n * External catalogues a build-time MAPPER reads to emit a native Wildo provider package.\n *\n * Every member is a SOURCE that is read, never a runtime the application depends on: the mapper\n * extracts each operation's method, URL template, parameters and auth shape as DATA, and Wildo's\n * own HTTP client executes them. Nothing third-party is installed or executed by a generated\n * application. (An earlier revision of this enum described Activepieces as a set of executable\n * bundles Wildo would WRAP; that model was built, measured and deleted on 2026-09-06 — see\n * `providers-are-scraped-never-wrapped`.)\n *\n * - `ACTIVEPIECES` — the community pieces monorepo. Each piece's actions and triggers call\n *   `httpClient.sendRequest({ method, url, body })` in plain TypeScript an AST pass can read.\n *   Note the PUBLISHED bundle is NOT a usable input: its metadata carries name, inputs and auth\n *   but not the endpoint, which lives inside the compiled `run`.\n * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.\n *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response\n *   shaping stays Wildo's.\n * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the\n *   same output shape. Authoritative where it exists, since it is the vendor's own description.\n */\nexport enum ProviderCatalogueSource {\n  ACTIVEPIECES = 'ACTIVEPIECES',\n  SIM = 'SIM',\n  OPENAPI_DOCUMENT = 'OPENAPI_DOCUMENT',\n}\n\nexport const ProviderCatalogueProvenanceSchema = z.object({\n  source: z.enum(ProviderCatalogueSource),\n  /**\n   * The upstream artifact read, addressed the way its catalogue addresses it: the piece's\n   * directory or package name, the Sim tool's module, the OpenAPI document's path.\n   */\n  sourceRef: z.string().min(1),\n  /**\n   * The exact upstream revision read — a source-control revision for a monorepo catalogue, a\n   * document version for an OpenAPI input. A re-generation pins a new one, which is what makes a\n   * regenerated package's diff attributable to a specific upstream movement.\n   */\n  sourceVersion: z.string().min(1),\n});\nexport type ProviderCatalogueProvenance = z.infer<typeof ProviderCatalogueProvenanceSchema>;\n\n/**\n * Origin as ONE object with a `kind` and a provenance that is REQUIRED exactly when the kind is\n * `GENERATED` (and forbidden otherwise), enforced by the refinement below.\n *\n * Not a `z.discriminatedUnion`, deliberately: under `strictNullChecks: false` — how the engine\n * packages compile — Zod 4 infers a union-typed object key as OPTIONAL (the members' `optout`\n * collapses to `\"optional\"` once `undefined` is erased), so `metadata.origin` would type as\n * omittable in every engine consumer while the runtime refused its absence. A plain object\n * infers as required in both modes; the invariant the union expressed lives in the refinement\n * and in the `ProviderOrigin` type below.\n */\nexport const ProviderOriginSchema = z\n  .object({\n    kind: z.enum(ProviderOriginKind),\n    /** Present iff `kind === GENERATED`. */\n    catalogue: ProviderCatalogueProvenanceSchema.optional(),\n  })\n  .superRefine((origin, ctx) => {\n    if (origin.kind === ProviderOriginKind.GENERATED && origin.catalogue === undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: 'A GENERATED origin must carry its catalogue provenance.' });\n    }\n    if (origin.kind !== ProviderOriginKind.GENERATED && origin.catalogue !== undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: `Only a GENERATED origin carries catalogue provenance (kind is ${origin.kind}).` });\n    }\n  });\nexport type ProviderOrigin =\n  | { kind: ProviderOriginKind.ENGINE; catalogue?: undefined }\n  | { kind: ProviderOriginKind.APPLICATION; catalogue?: undefined }\n  | { kind: ProviderOriginKind.GENERATED; catalogue: ProviderCatalogueProvenance };\n\n/** The one engine origin value, so 22 modules do not each spell it. */\nexport const ENGINE_PROVIDER_ORIGIN: ProviderOrigin = Object.freeze({ kind: ProviderOriginKind.ENGINE });\n\nexport const ProviderMetadataSchema = z.object({\n  /**\n   * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,\n   * `'openai'`. Used as the join key across facet modules and as the\n   * map key inside `BackendProviderRegistry.modules`.\n   */\n  ref: z.string().min(1),\n  /**\n   * The npm package that ships this provider's module(s), e.g.\n   * `@wildo-ai/external-connectors-private` for an engine provider or\n   * `@wildo-ai/provider-slack` for a per-provider package. One package,\n   * several facet barrels — this is the package, not a barrel.\n   */\n  packageName: z.string().min(1),\n  /** See {@link ProviderTier}. A recorded decision, never inferred. */\n  tier: z.enum(ProviderTier),\n  /**\n   * Vendor grouping. Equal to `ref` for a single-package vendor; the shared\n   * name for a sub-cut vendor (`vendor: 'microsoft'` on both\n   * `microsoft-graph-mail` and `microsoft-teams`), which is what lets an\n   * OAuth client or a secret be shared by reference across sub-packages.\n   */\n  vendor: z.string().min(1),\n  /** See {@link ProviderOriginSchema}. */\n  origin: ProviderOriginSchema,\n  /**\n   * Translation-ready key for the provider display name.\n   *\n   * Frontend/public surfaces should prefer this field over embedding\n   * locale-bound copy in provider modules or runtime artifacts.\n   */\n  displayNameLabelKey: z.string().optional(),\n  /**\n   * Legacy human-readable fallback label for non-i18n-aware consumers.\n   * When absent, consumers fall back to the `ref`.\n   */\n  displayName: z.string().optional(),\n  /**\n   * Optional icon reference resolved through the frontend icon registry.\n   * Stays a string (not a URL or component reference) to keep this type\n   * frontend-safe AND portable to non-React surfaces.\n   */\n  iconRef: z.string().optional(),\n});\n\nexport type ProviderMetadata = Omit<z.infer<typeof ProviderMetadataSchema>, 'origin'> & { origin: ProviderOrigin };\n\n/**\n * The identity half of {@link ProviderMetadataSchema} on its own — what a\n * companion contribution carries so tooling can display tiers and group\n * vendors without loading a provider's runtime module.\n */\nexport const ProviderIdentitySchema = ProviderMetadataSchema.pick({\n  packageName: true,\n  tier: true,\n  vendor: true,\n  origin: true,\n});\nexport type ProviderIdentity = Omit<z.infer<typeof ProviderIdentitySchema>, 'origin'> & { origin: ProviderOrigin };\n\nexport interface DefineProviderMetadataInput {\n  ref: string;\n  packageName: string;\n  tier: ProviderTier;\n  origin: ProviderOrigin;\n  /** Defaults to `ref` — the single-package vendor case. */\n  vendor?: string;\n  displayName?: string;\n  iconRef?: string;\n}\n\n/**\n * The one way a provider module authors its metadata.\n *\n * Derives `displayNameLabelKey` from the ref (every module used to call\n * `buildProviderDisplayNameLabelKey` by hand), defaults `vendor` to the ref,\n * and parses the result so an incomplete identity fails at MODULE LOAD —\n * in the package that owns the module — rather than at the first consumer\n * that reads a field which is not there.\n */\nexport function defineProviderMetadata(input: DefineProviderMetadataInput): ProviderMetadata {\n  return ProviderMetadataSchema.parse({\n    ref: input.ref,\n    packageName: input.packageName,\n    tier: input.tier,\n    vendor: input.vendor ?? input.ref,\n    origin: input.origin,\n    displayNameLabelKey: buildProviderDisplayNameLabelKey(input.ref),\n    ...(input.displayName === undefined ? {} : { displayName: input.displayName }),\n    ...(input.iconRef === undefined ? {} : { iconRef: input.iconRef }),\n  }) as ProviderMetadata;\n}\n"]}

package/dist/esm/external-providers/provider-protocol.shared.schemas.d.ts

@@ -24,14 +24,19 @@
  * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and
  * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and
  * for the exact condition under which they are admitted.
+ *
+ * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,
+ * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,
+ * declared by no provider module, resolvable by no runtime arm. An application that still
+ * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts
+ * ONLY these keys (the engine's snake_case wire values were also accepted before, a second
+ * spelling nothing else understood).
  */
 export declare const BUILTIN_PROVIDER_PROTOCOL: {
     readonly REST_API: "REST_API";
     readonly WEBHOOK_ORIGINATOR: "WEBHOOK_ORIGINATOR";
     readonly LLM_PROVIDER: "LLM_PROVIDER";
     readonly AGENT_CLIENT_PROTOCOL: "AGENT_CLIENT_PROTOCOL";
-    readonly MCP_CONNECTOR: "MCP_CONNECTOR";
-    readonly A2A_CONNECTOR: "A2A_CONNECTOR";
     /**
      * Text-to-image generation (wired: gpt-image, via the OpenAI provider's
      * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.
@@ -52,10 +57,7 @@ export declare const BUILTIN_PROVIDER_PROTOCOL: {
      */
     readonly DOCUMENT_EXTRACTION_PROVIDER: "DOCUMENT_EXTRACTION_PROVIDER";
     readonly EMAIL_PROVIDER: "EMAIL_PROVIDER";
-    readonly GIT_PROVIDER: "GIT_PROVIDER";
-    readonly GRPC: "GRPC";
     readonly SSO_OAUTH2: "SSO_OAUTH2";
-    readonly SSO_SAML: "SSO_SAML";
     readonly BILLING_PROVIDER: "BILLING_PROVIDER";
     readonly SMS_PROVIDER: "SMS_PROVIDER";
     readonly FRONTEND_SDK: "FRONTEND_SDK";

package/dist/esm/external-providers/provider-protocol.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-protocol.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,yBAAyB;;;;;;;IAOpC;;;OAGG;;IAEH;;;;;;OAMG;;IAEH;;;;OAIG;;;;;;;;;;CAUK,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}
+{"version":3,"file":"provider-protocol.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB;;;;;IAKpC;;;OAGG;;IAEH;;;;;;OAMG;;IAEH;;;;OAIG;;;;;;;CAOK,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}

package/dist/esm/external-providers/provider-protocol.shared.schemas.js

@@ -24,14 +24,19 @@
  * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and
  * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and
  * for the exact condition under which they are admitted.
+ *
+ * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,
+ * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,
+ * declared by no provider module, resolvable by no runtime arm. An application that still
+ * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts
+ * ONLY these keys (the engine's snake_case wire values were also accepted before, a second
+ * spelling nothing else understood).
  */
 export const BUILTIN_PROVIDER_PROTOCOL = {
     REST_API: 'REST_API',
     WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',
     LLM_PROVIDER: 'LLM_PROVIDER',
     AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',
-    MCP_CONNECTOR: 'MCP_CONNECTOR',
-    A2A_CONNECTOR: 'A2A_CONNECTOR',
     /**
      * Text-to-image generation (wired: gpt-image, via the OpenAI provider's
      * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.
@@ -52,10 +57,7 @@ export const BUILTIN_PROVIDER_PROTOCOL = {
      */
     DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',
     EMAIL_PROVIDER: 'EMAIL_PROVIDER',
-    GIT_PROVIDER: 'GIT_PROVIDER',
-    GRPC: 'GRPC',
     SSO_OAUTH2: 'SSO_OAUTH2',
-    SSO_SAML: 'SSO_SAML',
     BILLING_PROVIDER: 'BILLING_PROVIDER',
     SMS_PROVIDER: 'SMS_PROVIDER',
     FRONTEND_SDK: 'FRONTEND_SDK',

package/dist/esm/external-providers/provider-protocol.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-protocol.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B;;;OAGG;IACH,cAAc,EAAE,gBAAgB;IAChC;;;;;;OAMG;IACH,mBAAmB,EAAE,qBAAqB;IAC1C;;;;OAIG;IACH,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC,YAAY,EAAE,cAAc;IAC5B,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;IACpB,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC","sourcesContent":["/**\n * Closed built-in provider protocol vocabulary used by app authoring and\n * runtime-provider declarations.\n *\n * This is intentionally a pure `as const` object + union type so browser-bound\n * packages can consume it through `@wildo-ai/saas-models/public-runtime`\n * without pulling decorators or broader config-authoring seams. Do NOT add an\n * import here — not even an `import type` of the engine enum this list mirrors.\n *\n * ## Relationship to `ExternalProvider_ExchangeProtocol_Kind`\n *\n * This list re-states a population the engine owns: every member of\n * `ExternalProvider_ExchangeProtocol_Kind`\n * (`@wildo-ai/external-connectors-models`) that an application may legally\n * WRITE in `wildo.saas.config.ts > providers.scopes.<scope>.providers.<ref>`.\n * Two hand-maintained enumerations of one population is the shape that drifts,\n * and this one did: `IMAGE_PROVIDER` and `EMBEDDINGS_PROVIDER` shipped as live\n * engine protocols — a provider module declares them, discovery reports them,\n * the backend registry resolves them — while this list had no legal value for\n * either, so no application could declare what those transports speak.\n *\n * The keys are therefore checked against the engine enum by\n * `__tests__/provider-protocol-vocabulary.drift.test.ts`, which also owns the\n * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and\n * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and\n * for the exact condition under which they are admitted.\n */\nexport const BUILTIN_PROVIDER_PROTOCOL = {\n  REST_API: 'REST_API',\n  WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',\n  LLM_PROVIDER: 'LLM_PROVIDER',\n  AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',\n  MCP_CONNECTOR: 'MCP_CONNECTOR',\n  A2A_CONNECTOR: 'A2A_CONNECTOR',\n  /**\n   * Text-to-image generation (wired: gpt-image, via the OpenAI provider's\n   * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.\n   */\n  IMAGE_PROVIDER: 'IMAGE_PROVIDER',\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the\n   * RAG derived-data tier — corpus embedding in the `rag:embedding-drain`\n   * worker, query-time embedding in retrieval. Its own protocol rather than an\n   * `LLM_PROVIDER` operation so a provider can be selected for embeddings\n   * independently of chat.\n   */\n  EMBEDDINGS_PROVIDER: 'EMBEDDINGS_PROVIDER',\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves file text extraction and\n   * the `.ragSource()` corpus built on it, and fills `EngineCapability.AI_DOCUMENT_EXTRACTION` so\n   * an OCR provider is selected independently of chat and embeddings.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',\n  EMAIL_PROVIDER: 'EMAIL_PROVIDER',\n  GIT_PROVIDER: 'GIT_PROVIDER',\n  GRPC: 'GRPC',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  SSO_SAML: 'SSO_SAML',\n  BILLING_PROVIDER: 'BILLING_PROVIDER',\n  SMS_PROVIDER: 'SMS_PROVIDER',\n  FRONTEND_SDK: 'FRONTEND_SDK',\n} as const;\n\nexport type BuiltinProviderProtocol =\n  (typeof BUILTIN_PROVIDER_PROTOCOL)[keyof typeof BUILTIN_PROVIDER_PROTOCOL];\n\nexport type ProviderProtocol = BuiltinProviderProtocol;\n"]}
+{"version":3,"file":"provider-protocol.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C;;;OAGG;IACH,cAAc,EAAE,gBAAgB;IAChC;;;;;;OAMG;IACH,mBAAmB,EAAE,qBAAqB;IAC1C;;;;OAIG;IACH,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,YAAY;IACxB,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC","sourcesContent":["/**\n * Closed built-in provider protocol vocabulary used by app authoring and\n * runtime-provider declarations.\n *\n * This is intentionally a pure `as const` object + union type so browser-bound\n * packages can consume it through `@wildo-ai/saas-models/public-runtime`\n * without pulling decorators or broader config-authoring seams. Do NOT add an\n * import here — not even an `import type` of the engine enum this list mirrors.\n *\n * ## Relationship to `ExternalProvider_ExchangeProtocol_Kind`\n *\n * This list re-states a population the engine owns: every member of\n * `ExternalProvider_ExchangeProtocol_Kind`\n * (`@wildo-ai/external-connectors-models`) that an application may legally\n * WRITE in `wildo.saas.config.ts > providers.scopes.<scope>.providers.<ref>`.\n * Two hand-maintained enumerations of one population is the shape that drifts,\n * and this one did: `IMAGE_PROVIDER` and `EMBEDDINGS_PROVIDER` shipped as live\n * engine protocols — a provider module declares them, discovery reports them,\n * the backend registry resolves them — while this list had no legal value for\n * either, so no application could declare what those transports speak.\n *\n * The keys are therefore checked against the engine enum by\n * `__tests__/provider-protocol-vocabulary.drift.test.ts`, which also owns the\n * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and\n * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and\n * for the exact condition under which they are admitted.\n *\n * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,\n * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,\n * declared by no provider module, resolvable by no runtime arm. An application that still\n * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts\n * ONLY these keys (the engine's snake_case wire values were also accepted before, a second\n * spelling nothing else understood).\n */\nexport const BUILTIN_PROVIDER_PROTOCOL = {\n  REST_API: 'REST_API',\n  WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',\n  LLM_PROVIDER: 'LLM_PROVIDER',\n  AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',\n  /**\n   * Text-to-image generation (wired: gpt-image, via the OpenAI provider's\n   * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.\n   */\n  IMAGE_PROVIDER: 'IMAGE_PROVIDER',\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the\n   * RAG derived-data tier — corpus embedding in the `rag:embedding-drain`\n   * worker, query-time embedding in retrieval. Its own protocol rather than an\n   * `LLM_PROVIDER` operation so a provider can be selected for embeddings\n   * independently of chat.\n   */\n  EMBEDDINGS_PROVIDER: 'EMBEDDINGS_PROVIDER',\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves file text extraction and\n   * the `.ragSource()` corpus built on it, and fills `EngineCapability.AI_DOCUMENT_EXTRACTION` so\n   * an OCR provider is selected independently of chat and embeddings.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',\n  EMAIL_PROVIDER: 'EMAIL_PROVIDER',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  BILLING_PROVIDER: 'BILLING_PROVIDER',\n  SMS_PROVIDER: 'SMS_PROVIDER',\n  FRONTEND_SDK: 'FRONTEND_SDK',\n} as const;\n\nexport type BuiltinProviderProtocol =\n  (typeof BUILTIN_PROVIDER_PROTOCOL)[keyof typeof BUILTIN_PROVIDER_PROTOCOL];\n\nexport type ProviderProtocol = BuiltinProviderProtocol;\n"]}

package/dist/esm/external-providers/provider-tier-rule.shared.utils.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The provider TIER RULE, enforced at composition on every facet (#328).
+ *
+ * - A `CATALOGUE` provider may claim only OPEN `ProviderCapability` tokens.
+ *   It must never bind an `EngineCapability` slot: the engine's floor is
+ *   the MAIN set, and a bulk-loaded integration that quietly filled the
+ *   billing or email slot would make "mandatory" mean "whatever happened
+ *   to be installed".
+ * - A `MAIN` provider is the engine's own: its origin is `ENGINE`. An
+ *   application or a generated package cannot declare itself MAIN.
+ * - An `EXTENSION` provider may bind a slot through
+ *   `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` — that is what the tier is for.
+ *
+ * Lives in `saas-models` (not in the private package) because the rule is
+ * facet-neutral: the three browser-bound registries compose through it too,
+ * and they reach this package only through `/public-runtime`.
+ */
+import { type EngineCapability } from './engine-capabilities.shared.schemas';
+import { type ProviderMetadata } from './provider-metadata.shared.schemas';
+/** What the rule needs from a module, on any facet. */
+export interface ProviderTierRuleSubject {
+    metadata: ProviderMetadata;
+    providerCapabilities: ReadonlyArray<string>;
+}
+/** Engine slots a capability list binds through the closed map. */
+export declare function engineSlotsBoundByCapabilities(providerCapabilities: ReadonlyArray<string>): Array<{
+    capability: string;
+    slot: EngineCapability;
+}>;
+/**
+ * Every tier-rule violation across the given modules, as human sentences
+ * naming the ref, the tier and the offending fact. Empty when coherent.
+ */
+export declare function findProviderTierViolations(modules: Iterable<ProviderTierRuleSubject>): string[];
+/**
+ * Refuse a registry whose modules break the tier rule. Called by every
+ * facet's `compose*Providers` so the rule holds wherever modules meet.
+ */
+export declare function assertProviderTierCoherence(facetLabel: string, modules: Iterable<ProviderTierRuleSubject>): void;
+//# sourceMappingURL=provider-tier-rule.shared.utils.d.ts.map

package/dist/esm/external-providers/provider-tier-rule.shared.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-tier-rule.shared.utils.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-tier-rule.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAG7G,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,mEAAmE;AACnE,wBAAgB,8BAA8B,CAC5C,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1C,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAOvD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,GAAG,MAAM,EAAE,CAuC/F;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAOhH"}

package/dist/esm/external-providers/provider-tier-rule.shared.utils.js

@@ -0,0 +1,80 @@
+/**
+ * The provider TIER RULE, enforced at composition on every facet (#328).
+ *
+ * - A `CATALOGUE` provider may claim only OPEN `ProviderCapability` tokens.
+ *   It must never bind an `EngineCapability` slot: the engine's floor is
+ *   the MAIN set, and a bulk-loaded integration that quietly filled the
+ *   billing or email slot would make "mandatory" mean "whatever happened
+ *   to be installed".
+ * - A `MAIN` provider is the engine's own: its origin is `ENGINE`. An
+ *   application or a generated package cannot declare itself MAIN.
+ * - An `EXTENSION` provider may bind a slot through
+ *   `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` — that is what the tier is for.
+ *
+ * Lives in `saas-models` (not in the private package) because the rule is
+ * facet-neutral: the three browser-bound registries compose through it too,
+ * and they reach this package only through `/public-runtime`.
+ */
+import { PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY, } from './engine-capabilities.shared.schemas.js';
+import { ProviderOriginKind, ProviderTier } from './provider-metadata.shared.schemas.js';
+/** Engine slots a capability list binds through the closed map. */
+export function engineSlotsBoundByCapabilities(providerCapabilities) {
+    const bound = [];
+    for (const capability of providerCapabilities) {
+        const slot = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability];
+        if (slot !== undefined)
+            bound.push({ capability, slot });
+    }
+    return bound;
+}
+/**
+ * Every tier-rule violation across the given modules, as human sentences
+ * naming the ref, the tier and the offending fact. Empty when coherent.
+ */
+export function findProviderTierViolations(modules) {
+    const violations = [];
+    for (const module of modules) {
+        if (!module.metadata) {
+            // A module with no metadata has no ref to name; refuse in words rather than with a TypeError.
+            violations.push('(module without metadata): every provider module declares ProviderMetadata via defineProviderMetadata');
+            continue;
+        }
+        const { ref, tier, origin } = module.metadata;
+        switch (tier) {
+            case ProviderTier.CATALOGUE: {
+                const bound = engineSlotsBoundByCapabilities(module.providerCapabilities);
+                if (bound.length > 0) {
+                    violations.push(`${ref}: tier CATALOGUE may claim only open ProviderCapability tokens, but `
+                        + bound.map((entry) => `"${entry.capability}" binds the ${entry.slot} engine slot`).join(', ')
+                        + '. Declare the provider EXTENSION if it is meant to substitute for a MAIN provider.');
+                }
+                break;
+            }
+            case ProviderTier.MAIN: {
+                if (origin.kind !== ProviderOriginKind.ENGINE) {
+                    violations.push(`${ref}: tier MAIN is the engine's own set, but its origin is ${origin.kind}. `
+                        + 'A package or application provider that binds an engine slot is an EXTENSION.');
+                }
+                break;
+            }
+            case ProviderTier.EXTENSION:
+                break;
+            default: {
+                const unhandled = tier;
+                violations.push(`${ref}: unknown provider tier "${String(unhandled)}".`);
+            }
+        }
+    }
+    return violations;
+}
+/**
+ * Refuse a registry whose modules break the tier rule. Called by every
+ * facet's `compose*Providers` so the rule holds wherever modules meet.
+ */
+export function assertProviderTierCoherence(facetLabel, modules) {
+    const violations = findProviderTierViolations(modules);
+    if (violations.length > 0) {
+        throw new Error(`${facetLabel} provider composition refused by the tier rule — ${violations.join('; ')}`);
+    }
+}
+//# sourceMappingURL=provider-tier-rule.shared.utils.js.map

package/dist/esm/external-providers/provider-tier-rule.shared.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-tier-rule.shared.utils.js","sourceRoot":"","sources":["../../../src/external-providers/provider-tier-rule.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,wCAAwC,GAEzC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAyB,MAAM,oCAAoC,CAAC;AAS7G,mEAAmE;AACnE,MAAM,UAAU,8BAA8B,CAC5C,oBAA2C;IAE3C,MAAM,KAAK,GAA0D,EAAE,CAAC;IACxE,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,wCAAwC,CAAC,UAAuC,CAAC,CAAC;QAC/F,IAAI,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA0C;IACnF,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,8FAA8F;YAC9F,UAAU,CAAC,IAAI,CAAC,uGAAuG,CAAC,CAAC;YACzH,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC9C,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,8BAA8B,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC1E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,UAAU,CAAC,IAAI,CACb,GAAG,GAAG,sEAAsE;0BACxE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,eAAe,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;0BAC5F,oFAAoF,CACzF,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvB,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,MAAM,EAAE,CAAC;oBAC9C,UAAU,CAAC,IAAI,CACb,GAAG,GAAG,0DAA0D,MAAM,CAAC,IAAI,IAAI;0BAC3E,8EAA8E,CACnF,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,YAAY,CAAC,SAAS;gBACzB,MAAM;YACR,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,SAAS,GAAU,IAAI,CAAC;gBAC9B,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,4BAA4B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB,EAAE,OAA0C;IACxG,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,oDAAoD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * The provider TIER RULE, enforced at composition on every facet (#328).\n *\n * - A `CATALOGUE` provider may claim only OPEN `ProviderCapability` tokens.\n *   It must never bind an `EngineCapability` slot: the engine's floor is\n *   the MAIN set, and a bulk-loaded integration that quietly filled the\n *   billing or email slot would make \"mandatory\" mean \"whatever happened\n *   to be installed\".\n * - A `MAIN` provider is the engine's own: its origin is `ENGINE`. An\n *   application or a generated package cannot declare itself MAIN.\n * - An `EXTENSION` provider may bind a slot through\n *   `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` — that is what the tier is for.\n *\n * Lives in `saas-models` (not in the private package) because the rule is\n * facet-neutral: the three browser-bound registries compose through it too,\n * and they reach this package only through `/public-runtime`.\n */\n\nimport {\n  PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY,\n  type EngineCapability,\n} from './engine-capabilities.shared.schemas';\nimport { ProviderOriginKind, ProviderTier, type ProviderMetadata } from './provider-metadata.shared.schemas';\nimport type { BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** What the rule needs from a module, on any facet. */\nexport interface ProviderTierRuleSubject {\n  metadata: ProviderMetadata;\n  providerCapabilities: ReadonlyArray<string>;\n}\n\n/** Engine slots a capability list binds through the closed map. */\nexport function engineSlotsBoundByCapabilities(\n  providerCapabilities: ReadonlyArray<string>,\n): Array<{ capability: string; slot: EngineCapability }> {\n  const bound: Array<{ capability: string; slot: EngineCapability }> = [];\n  for (const capability of providerCapabilities) {\n    const slot = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability as BuiltinProviderCapability];\n    if (slot !== undefined) bound.push({ capability, slot });\n  }\n  return bound;\n}\n\n/**\n * Every tier-rule violation across the given modules, as human sentences\n * naming the ref, the tier and the offending fact. Empty when coherent.\n */\nexport function findProviderTierViolations(modules: Iterable<ProviderTierRuleSubject>): string[] {\n  const violations: string[] = [];\n  for (const module of modules) {\n    if (!module.metadata) {\n      // A module with no metadata has no ref to name; refuse in words rather than with a TypeError.\n      violations.push('(module without metadata): every provider module declares ProviderMetadata via defineProviderMetadata');\n      continue;\n    }\n    const { ref, tier, origin } = module.metadata;\n    switch (tier) {\n      case ProviderTier.CATALOGUE: {\n        const bound = engineSlotsBoundByCapabilities(module.providerCapabilities);\n        if (bound.length > 0) {\n          violations.push(\n            `${ref}: tier CATALOGUE may claim only open ProviderCapability tokens, but `\n              + bound.map((entry) => `\"${entry.capability}\" binds the ${entry.slot} engine slot`).join(', ')\n              + '. Declare the provider EXTENSION if it is meant to substitute for a MAIN provider.',\n          );\n        }\n        break;\n      }\n      case ProviderTier.MAIN: {\n        if (origin.kind !== ProviderOriginKind.ENGINE) {\n          violations.push(\n            `${ref}: tier MAIN is the engine's own set, but its origin is ${origin.kind}. `\n              + 'A package or application provider that binds an engine slot is an EXTENSION.',\n          );\n        }\n        break;\n      }\n      case ProviderTier.EXTENSION:\n        break;\n      default: {\n        const unhandled: never = tier;\n        violations.push(`${ref}: unknown provider tier \"${String(unhandled)}\".`);\n      }\n    }\n  }\n  return violations;\n}\n\n/**\n * Refuse a registry whose modules break the tier rule. Called by every\n * facet's `compose*Providers` so the rule holds wherever modules meet.\n */\nexport function assertProviderTierCoherence(facetLabel: string, modules: Iterable<ProviderTierRuleSubject>): void {\n  const violations = findProviderTierViolations(modules);\n  if (violations.length > 0) {\n    throw new Error(\n      `${facetLabel} provider composition refused by the tier rule — ${violations.join('; ')}`,\n    );\n  }\n}\n"]}

package/dist/esm/external-providers/provider-usage-pricing.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-usage-pricing.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-usage-pricing.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,6GAA6G;AAC7G,oBAAY,4BAA4B;IACtC,WAAW,gBAAgB;IAC3B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,YAAY,iBAAiB;IAC7B,eAAe,oBAAoB;CACpC;AAED,eAAO,MAAM,qCAAqC,EAAE,SAAS,4BAA4B,EAMvF,CAAC;AAEH,yGAAyG;AACzG,oBAAY,gCAAgC;IAC1C,+BAA+B,oCAAoC;CACpE;AAED,4DAA4D;AAC5D,oBAAY,gCAAgC;IAC1C,0BAA0B,+BAA+B;CAC1D;AAID,eAAO,MAAM,kCAAkC;;;;;kBAK7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,8BAA8B;;IAEzC,0EAA0E;;kBAE1E,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;QAZhD,0EAA0E;;;IAuB1E,mFAAmF;;;;;;;;;;;;kBA2BnF,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;;GAKG;AACH,MAAM,MAAM,oCAAoC,GAAG,IAAI,CACrD,+BAA+B,EAC/B,sBAAsB,GAAG,eAAe,GAAG,OAAO,GAAG,gBAAgB,CACtE,GAAG;IACF,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACpD,QAAQ,CAAC,cAAc,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAClE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oDAAoD,EAAE,oCA2BjE,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,6BAA6B;;;;;;kBAMxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}
+{"version":3,"file":"provider-usage-pricing.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-usage-pricing.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,6GAA6G;AAC7G,oBAAY,4BAA4B;IACtC,WAAW,gBAAgB;IAC3B,kBAAkB,uBAAuB;IACzC,uBAAuB,4BAA4B;IACnD,YAAY,iBAAiB;IAC7B,eAAe,oBAAoB;CACpC;AAED,eAAO,MAAM,qCAAqC,EAAE,SAAS,4BAA4B,EAMvF,CAAC;AAEH,yGAAyG;AACzG,oBAAY,gCAAgC;IAC1C,+BAA+B,oCAAoC;CACpE;AAED,4DAA4D;AAC5D,oBAAY,gCAAgC;IAC1C,0BAA0B,+BAA+B;CAC1D;AAID,eAAO,MAAM,kCAAkC;;;;;kBAK7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,8BAA8B;;IAEzC,0EAA0E;;kBAE1E,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;QAZhD,0EAA0E;;;IAuB1E,mFAAmF;;;;;;;;;;;;kBA2BnF,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;;GAKG;AACH,MAAM,MAAM,oCAAoC,GAAG,IAAI,CACrD,+BAA+B,EAC/B,sBAAsB,GAAG,eAAe,GAAG,OAAO,GAAG,gBAAgB,CACtE,GAAG;IACF,QAAQ,CAAC,KAAK,EAAE,SAAS,wBAAwB,EAAE,CAAC;IACpD,QAAQ,CAAC,cAAc,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAClE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oDAAoD,EAAE,oCA2BjE,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,6BAA6B;;;;;;kBAMxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/esm/features/application-features.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-features.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/features/application-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,uDAAuD,CAAC;AAGpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAMzG,oBAAY,8BAA8B;IACxC,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;CAClC;AAED,eAAO,MAAM,gDAAgD;;;iBAG3D,CAAC;AAEH,eAAO,MAAM,iDAAiD;;;iBAG5D,CAAC;AAEH,eAAO,MAAM,gDAAgD;;iBAE3D,CAAC;AAEH,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;kBA8H3H,CAAC"}
+{"version":3,"file":"application-features.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../src/features/application-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,uDAAuD,CAAC;AAGpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAMzG,oBAAY,8BAA8B;IACxC,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;CAClC;AAED,eAAO,MAAM,gDAAgD;;;iBAG3D,CAAC;AAEH,eAAO,MAAM,iDAAiD;;;iBAG5D,CAAC;AAEH,eAAO,MAAM,gDAAgD;;iBAE3D,CAAC;AAEH,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;kBA0I3H,CAAC"}

package/dist/esm/features/application-features.shared.resources-config.schemas.js

@@ -48,6 +48,18 @@ export const applicationFeaturesResourceConfiguration_InitializationFactory = (r
         CoreResourceOperation.DELETE,
     ],
     customOperation: ApplicationFeatures_Operations,
+    // assurance-control: WILDO.ENTITLEMENT.NO_SELF_GRANT — the application-wide entitlement set is
+    // operator-gated on every operation, read included.
+    //
+    // This is the widest of the three feature ledgers: a write here changes what EVERY tenant is
+    // entitled to, so it is the one ledger where even READ and SEARCH are `APP_ADMIN_SUPER_ADMIN`
+    // rather than a tenant role. That asymmetry against the organization and user ledgers is the
+    // deliberate part — those two let a tenant see its own entitlements; this one is not a tenant's to
+    // see at all.
+    //
+    // As on the sibling ledgers the role is the entire control, because the super-admin path must write
+    // these fields and so they cannot be field-protected. Pinned by
+    // `security-sensitive-operation-reachability.backend.test.ts`.
     operationsConfiguration: {
         [CoreResourceOperation.CREATE]: {
             variants: [

package/dist/esm/features/application-features.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-features.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/features/application-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,uDAAuD,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAEnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,mEAAiC,CAAA;IACjC,qEAAmC,CAAA;IACnC,mEAAiC,CAAA;AACnC,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AASH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI1K;IACA,UAAU,EAAE,gCAAgC;IAC5C,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,mFAAmF;QACnF,oFAAoF;QACpF,oFAAoF;QACpF,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,8BAA8B;IAE/C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,UAAU,EAAE,gCAAgC,CAAC,OAAO,EAAE;iBACvD;aACF;SACF;QAED,kFAAkF;QAClF,4EAA4E;QAC5E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,cAAc,CAAC,EAAE;YAC/C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,gDAAgD;iBAC7D;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,eAAe,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,iDAAiD;iBAC9D;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,cAAc,CAAC,EAAE;YAC/C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,gDAAgD;iBAC7D;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application Features Shared Resource Configuration\n *\n * Application-scope entitlement ledger. This mirrors organization/user feature\n * ledgers so exact-scope gates such as `M2M_WEBHOOK_DELIVERY` can be enabled\n * for `WEBHOOK_APPLICATION` without leaking app enablement to every org.\n */\n\nimport { z } from 'zod';\nimport { CoreFeature } from '../organizations/organization-features.shared.schemas';\nimport { ScopeFeaturesWithOverridesSchema } from './scope-features.shared.schemas';\n\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\nexport enum ApplicationFeatures_Operations {\n  ENABLE_FEATURE = 'enable_feature',\n  DISABLE_FEATURE = 'disable_feature',\n  RESET_FEATURES = 'reset_features',\n}\n\nexport const ApplicationFeaturesEnableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().max(500).optional(),\n});\n\nexport const ApplicationFeaturesDisableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().min(1).max(500),\n});\n\nexport const ApplicationFeaturesResetFeaturesRequestDtoSchema = z.object({\n  reason: z.string().min(1).max(500),\n});\n\ntype ApplicationFeaturesCoreOperations =\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\nexport const applicationFeaturesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof ApplicationFeatures_Operations,\n  ApplicationFeaturesCoreOperations,\n  typeof ScopeFeaturesWithOverridesSchema\n>({\n  mainSchema: ScopeFeaturesWithOverridesSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_FEATURES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_FEATURES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition onParentDelete\n    // cascade so the row is physically removed when its application is deleted. Without\n    // it the cascade throws ErrorType.CONFIGURATION on any app that has a features row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: ApplicationFeatures_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          requestDto: ScopeFeaturesWithOverridesSchema.partial(),\n        },\n      ],\n    },\n\n    // Internal-only (REPOSITORY_ONLY): powers the composition onParentDelete cascade,\n    // not a public API surface — the ledger is reset, never DELETEd, over HTTP.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.ENABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesEnableFeatureRequestDtoSchema,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.DISABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesDisableFeatureRequestDtoSchema,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.RESET_FEATURES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesResetFeaturesRequestDtoSchema,\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"application-features.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../src/features/application-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,uDAAuD,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAEnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,mEAAiC,CAAA;IACjC,qEAAmC,CAAA;IACnC,mEAAiC,CAAA;AACnC,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AASH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI1K;IACA,UAAU,EAAE,gCAAgC;IAC5C,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,mFAAmF;QACnF,oFAAoF;QACpF,oFAAoF;QACpF,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,8BAA8B;IAE/C,+FAA+F;IAC/F,oDAAoD;IACpD,EAAE;IACF,6FAA6F;IAC7F,8FAA8F;IAC9F,6FAA6F;IAC7F,mGAAmG;IACnG,cAAc;IACd,EAAE;IACF,oGAAoG;IACpG,gEAAgE;IAChE,+DAA+D;IAC/D,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,UAAU,EAAE,gCAAgC,CAAC,OAAO,EAAE;iBACvD;aACF;SACF;QAED,kFAAkF;QAClF,4EAA4E;QAC5E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,cAAc,CAAC,EAAE;YAC/C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,gDAAgD;iBAC7D;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,eAAe,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,iDAAiD;iBAC9D;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,cAAc,CAAC,EAAE;YAC/C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,gDAAgD;iBAC7D;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application Features Shared Resource Configuration\n *\n * Application-scope entitlement ledger. This mirrors organization/user feature\n * ledgers so exact-scope gates such as `M2M_WEBHOOK_DELIVERY` can be enabled\n * for `WEBHOOK_APPLICATION` without leaking app enablement to every org.\n */\n\nimport { z } from 'zod';\nimport { CoreFeature } from '../organizations/organization-features.shared.schemas';\nimport { ScopeFeaturesWithOverridesSchema } from './scope-features.shared.schemas';\n\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\nexport enum ApplicationFeatures_Operations {\n  ENABLE_FEATURE = 'enable_feature',\n  DISABLE_FEATURE = 'disable_feature',\n  RESET_FEATURES = 'reset_features',\n}\n\nexport const ApplicationFeaturesEnableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().max(500).optional(),\n});\n\nexport const ApplicationFeaturesDisableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().min(1).max(500),\n});\n\nexport const ApplicationFeaturesResetFeaturesRequestDtoSchema = z.object({\n  reason: z.string().min(1).max(500),\n});\n\ntype ApplicationFeaturesCoreOperations =\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\nexport const applicationFeaturesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof ApplicationFeatures_Operations,\n  ApplicationFeaturesCoreOperations,\n  typeof ScopeFeaturesWithOverridesSchema\n>({\n  mainSchema: ScopeFeaturesWithOverridesSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_FEATURES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_FEATURES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition onParentDelete\n    // cascade so the row is physically removed when its application is deleted. Without\n    // it the cascade throws ErrorType.CONFIGURATION on any app that has a features row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: ApplicationFeatures_Operations,\n\n  // assurance-control: WILDO.ENTITLEMENT.NO_SELF_GRANT — the application-wide entitlement set is\n  // operator-gated on every operation, read included.\n  //\n  // This is the widest of the three feature ledgers: a write here changes what EVERY tenant is\n  // entitled to, so it is the one ledger where even READ and SEARCH are `APP_ADMIN_SUPER_ADMIN`\n  // rather than a tenant role. That asymmetry against the organization and user ledgers is the\n  // deliberate part — those two let a tenant see its own entitlements; this one is not a tenant's to\n  // see at all.\n  //\n  // As on the sibling ledgers the role is the entire control, because the super-admin path must write\n  // these fields and so they cannot be field-protected. Pinned by\n  // `security-sensitive-operation-reachability.backend.test.ts`.\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          requestDto: ScopeFeaturesWithOverridesSchema.partial(),\n        },\n      ],\n    },\n\n    // Internal-only (REPOSITORY_ONLY): powers the composition onParentDelete cascade,\n    // not a public API surface — the ledger is reset, never DELETEd, over HTTP.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.ENABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesEnableFeatureRequestDtoSchema,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.DISABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesDisableFeatureRequestDtoSchema,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.RESET_FEATURES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesResetFeaturesRequestDtoSchema,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/features/core-feature-definitions.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-feature-definitions.shared.d.ts","sourceRoot":"","sources":["../../../../src/features/core-feature-definitions.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAAiB,EAwHvD,CAAC"}
+{"version":3,"file":"core-feature-definitions.shared.d.ts","sourceRoot":"","sources":["../../../src/features/core-feature-definitions.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAAiB,EA8HvD,CAAC"}

package/dist/esm/features/core-feature-definitions.shared.js

@@ -99,7 +99,13 @@ export const CORE_FEATURE_DEFINITIONS = [
         defaultValue: false,
         scopeBoundary: true,
     },
-    // ─── LIMIT features with counting configs (auto-checked by gate) ───
+    // ─── LIMIT features with counting configs ───
+    //
+    // NOT auto-checked. `registerCoreFeatures` registers these definitions and stops there; the
+    // auto-registration of a `limitChecks` entry runs only in `registerCustomFeatures`, for an
+    // application-declared limit built with `countResource`. No operation declares a check for either
+    // of the two below, so `counting` names the resource that WOULD be counted and nothing counts it.
+    // An application that wants the cap enforced declares the check on the counted resource's CREATE.
     {
         identifier: 'MAX_MEMBERS',
         valueType: FeatureValueType.LIMIT,