@wildo-ai/saas-models 1.1.3 → 1.1.4

package/dist/esm/external-providers/engine-capabilities.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capabilities.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAkC,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,gBAyKX;AAzKD,WAAY,gBAAgB;IAC1B,mDAA+B,CAAA;IAC/B,uCAAmB,CAAA;IACnB,qDAAiC,CAAA;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qEAAiD,CAAA;IAEjD,+DAA2C,CAAA;IAC3C,uDAAmC,CAAA;IACnC,+BAAW,CAAA;IAEX,qCAAiB,CAAA;IACjB,+DAA2C,CAAA;IAC3C;;;;;;;;OAQG;IACH,mDAA+B,CAAA;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,qEAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uDAAmC,CAAA;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IAEH,2EAAuD,CAAA;IACvD,6EAAyD,CAAA;IAEzD;;;;;OAKG;IACH,2DAAuC,CAAA;IAEvC;;;;;;;;OAQG;IACH,uEAAmD,CAAA;AACrD,CAAC,EAzKW,gBAAgB,KAAhB,gBAAgB,QAyK3B;AACD,6DAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,gDAAgD,GAAG;IACvD,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACvF,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC/E,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,GAAG;IACvD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,OAAO;IAC/D,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,MAAM;IAC/D;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,aAAa;IAC5E;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;IAC/F,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC5E,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACpF,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,yBAAyB;IACnG,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,0BAA0B;IACrG,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,iBAAiB;IACnF,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,uBAAuB;IAC/F,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;CACd,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAEjD,gDAAgD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D;;;OAGG;IACH,gBAAgB,CAAC,aAAa;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,cAAc;CACe,CAAC;AA8CjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAkC,IAAI,GAAG,CAAC;IAC1G,gBAAgB,CAAC,mBAAmB;IACpC,gBAAgB,CAAC,OAAO;IACxB,gBAAgB,CAAC,GAAG;CACrB,CAAC,CAAC","sourcesContent":["import { BUILTIN_PROVIDER_CAPABILITY, type BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** @wildo_source:part:start saas.models.engine-capabilities facet:kind:api facet:audience:app-developer\n *\n * Closed application capability vocabulary used to declare what the\n * application needs from its configured providers.\n *\n * `EngineCapability` no longer means \"feature gate id\" and no longer\n * carries provider routing by itself. Provider-backed fulfillment is selected\n * by the application's provider configuration; entitlement/billing features\n * remain application feature decisions. Import this enum from\n * `@wildo-ai/saas-models` and declare only capabilities the application\n * actually intends to configure and operate.\n */\nexport enum EngineCapability {\n  ORGANIZATIONS = 'ORGANIZATIONS',\n  BILLING = 'BILLING',\n  MULTI_LANGUAGE = 'MULTI_LANGUAGE',\n  /**\n   * Durable, provider-backed audit trail — and the capability with the widest reach into what the\n   * application is able to CLAIM about itself.\n   *\n   * Leaving it out is a legitimate choice, but it is not a small one, and the cost is invisible\n   * until much later. The assurance surface attests roughly half its control objectives through the\n   * audit trail: with this capability absent, about a third of them cannot be claimed AT ALL — every\n   * objective whose only attesting capability is the audit trail — and several more resolve to\n   * \"undetermined\", meaning the application may genuinely operate the control while being unable to\n   * evidence it. Enabling it typically moves an application from partial to complete coverage in one\n   * step.\n   *\n   * Two things this does NOT mean, because both are easy to assume:\n   *\n   * - It is not what makes security events happen. Authentication, authorization, privilege and\n   *   credential events are recorded in the application's own database regardless. What this\n   *   capability adds is the provider-backed fan-out — the durable, external, tamper-evident\n   *   destination an assurance reader can be pointed at.\n   * - It is not retroactive. Turning it on later starts a trail from that moment; it does not\n   *   furnish evidence for the period it was off, and a control's evidence cannot begin before its\n   *   evidence store does.\n   *\n   * So decide it with the compliance posture rather than as an infrastructure detail: if the\n   * application intends to claim access, audit, identity or privacy control objectives to anyone\n   * outside itself, this is the capability those claims rest on.\n   */\n  COMPLIANCE_AUDIT_TRAIL = 'COMPLIANCE_AUDIT_TRAIL',\n\n  EMAIL_TRANSACTIONAL = 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING = 'EMAIL_MARKETING',\n  SMS = 'SMS',\n\n  AI_LLM = 'AI_LLM',\n  AI_IMAGE_GENERATION = 'AI_IMAGE_GENERATION',\n  /**\n   * Text → vector embeddings (the RAG derived-data tier: `.ragSource()` corpus embedding by the\n   * `rag:embedding-drain` worker, and query-time embedding in retrieval). A slot of its OWN,\n   * deliberately separate from `AI_LLM` (RAG plan DL2/H4): while `LLM_EMBEDDINGS` mapped into the\n   * `AI_LLM` slot, an application structurally could not pick Anthropic for chat and a different\n   * provider for embeddings — one `selection[AI_LLM].primary` decided both. Embeddings resolve\n   * through `EMBEDDINGS_PROVIDER` protocol bindings and are selected by applicability class\n   * (`Embeddings_Applicability`), never by a concrete model id at a call site.\n   */\n  AI_EMBEDDINGS = 'AI_EMBEDDINGS',\n  /**\n   * Document bytes → text: provider-backed extraction (OCR) for uploaded documents, serving\n   * `FileTextExtractionBackendService` and, through it, `.ragSource()` corpus ingestion.\n   *\n   * ## Why a slot of its own\n   *\n   * Three unrelated procurement decisions were otherwise fused. A deployment may well want one\n   * vendor for chat, another for embeddings, and a third for OCR — vendors are not equally good\n   * at all three, and their pricing models do not even share a unit (tokens vs. pages). Mapping\n   * extraction into `AI_LLM` would have made one `selection[AI_LLM].primary` decide all three,\n   * which is exactly the defect that split `AI_EMBEDDINGS` out of `AI_LLM`.\n   *\n   * ## Not to be confused with PDF GENERATION\n   *\n   * PDF generation — templates and data become bytes — is the `pdfTemplates` surface, done\n   * in-process and with no provider slot of its own. This is the opposite direction: bytes become\n   * text. The two are unrelated and nothing routes between them. (There WAS an\n   * `EngineCapability.DOCUMENT_GENERATION` that this paragraph used to name; it was withdrawn\n   * because no provider capability could ever fill it.)\n   *\n   * ## Absence is benign, and that is load-bearing\n   *\n   * With no provider selected, extraction falls back to the local `pdfjs-dist` text-layer read.\n   * That is a real answer for a born-digital PDF and returns nothing for a SCAN — so this\n   * capability is what makes scanned documents answerable, never what makes extraction work at\n   * all. An application that ingests only born-digital documents may leave it unset deliberately.\n   */\n  AI_DOCUMENT_EXTRACTION = 'AI_DOCUMENT_EXTRACTION',\n  /**\n   * An autonomous coding agent that mutates the application workspace.\n   *\n   * Its own slot rather than `AI_LLM`, for exactly the reason `AI_EMBEDDINGS`\n   * was split out of it: one `selection[AI_LLM].primary` decides every provider\n   * mapped into that slot. While the coding transport mapped to `AI_LLM`, an\n   * application structurally could NOT choose one vendor's coding agent and a\n   * different vendor for chat — picking a chat provider silently picked the\n   * agent that would be allowed to edit its source.\n   *\n   * The stakes differ too, which is why fusing them was wrong beyond the\n   * ergonomics: selecting a chat model is a quality and cost decision, while\n   * selecting the agent that writes your code is those things AND an\n   * authorisation decision. They deserve separate, deliberate answers.\n   */\n  AI_CODING_AGENT = 'AI_CODING_AGENT',\n\n  /*\n   * WITHDRAWN 2026-09-03: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` were members here and are\n   * not any more. Neither could ever be filled — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` had no\n   * entry pointing at either, so no provider capability token could claim the slot — while both were\n   * classified `SELECT_ONE`, which asserts that exactly one provider must be selected. Selecting one\n   * of zero candidates is not a resolution mode.\n   *\n   * Both capabilities are real and both are delivered elsewhere, which is why withdrawing the slots\n   * costs nothing: antivirus scanning is `InfraCapability.ANTIVIRUS_SCANNING`, fulfilled by ClamAV\n   * and consumed by `FileScanningBackendService`; PDF generation is the in-process `pdfTemplates`\n   * surface, rendered by `@react-pdf/renderer` inside the backend. Neither has an external\n   * provider, and neither is planned to.\n   *\n   * `InfraCapability.DOCUMENT_RENDERING` (Gotenberg) was provisioned beside the PDF surface and\n   * consumed by nothing; it was withdrawn on 2026-09-08 (#477) because in-process rendering had\n   * superseded it. Note the two are not interchangeable if it is ever reconsidered:\n   * `@react-pdf/renderer` composes a document from React primitives, while Gotenberg converts\n   * EXISTING HTML and Office documents — that is a different capability, not a second\n   * implementation of this one.\n   *\n   * Removing `ANTIVIRUS_SCANNING` also removes a collision: the identical spelling named an engine\n   * slot nothing could fill AND a live infra capability, in two packages, so a reader grepping the\n   * word landed in whichever they searched first.\n   *\n   * If a hosted AV or document-rendering vendor is ever adopted, the member comes back WITH its\n   * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` entry and its own JSDoc in the same change.\n   *\n   * WITHDRAWN 2026-09-09: `BILLING_PAYMENTS`, the third member of exactly that shape, and the one\n   * this paragraph's own closing rule should have caught. It was never withdrawn with the other two\n   * because it had been left behind DELIBERATELY — as a \"reserved slot\" — which reads as a decision\n   * and is why nobody re-examined it. Measured before removing, across the whole repository outside\n   * `node_modules` / `dist`: it appeared in live source at exactly THREE sites, and none of them was\n   * a use — the enum declaration itself, its row in the compile-forced\n   * `ENGINE_CAPABILITY_RESOLUTION_MODE` record, and a comment in a test naming it as a slot the\n   * billing provider must NOT be registered under. Zero applications enabled it, zero scaffolds\n   * wrote it, zero consumers queried it, and no provider capability token mapped to it.\n   *\n   * The capability it names is real and is already delivered: a billing provider (Stripe) declares\n   * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills `EngineCapability.BILLING`, which is the slot\n   * applications enable and `getProvidersForEngineCapability` gates on. Payment EXECUTION is served\n   * through that same provider's `BILLING_PROVIDER` protocol; splitting it into a second engine slot\n   * was a plan-era intention (`provider-registry-materialization-workflow.md`) that the shipped\n   * model settled the other way. So the withdrawal removes a name, not a capability.\n   *\n   * The reason a reserved slot is worse than no slot is `EngineCapabilityResolutionMode`: every\n   * member must be classified, `BILLING_PAYMENTS` was classified `SELECT_ONE`, and `SELECT_ONE`\n   * asserts that exactly one provider is selected from the candidates. There were zero candidates\n   * and there could never be one. A vocabulary member that no configuration can satisfy is not a\n   * reservation, it is a false statement the compiler is forced to carry.\n   *\n   * If a payments vendor is ever selected independently of the billing vendor, the member comes back\n   * with its provider-capability token and its map entry in the same change — the same rule as\n   * above, now with three instances behind it.\n   */\n\n  FRONTEND_ERROR_MONITORING = 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS = 'FRONTEND_PRODUCT_ANALYTICS',\n\n  /**\n   * Backend LLM-call observability (model/tokens/cost/latency per `invokeAgent`),\n   * platform-scoped. This enables model-call observability when the selected\n   * provider configuration supplies that capability; it does not itself\n   * configure a provider or make telemetry operational.\n   */\n  LLM_OBSERVABILITY = 'LLM_OBSERVABILITY',\n\n  /**\n   * Operational telemetry (traces/metrics/logs) shipped via the OpenTelemetry\n   * SDK over OTLP to a provider (for example, BetterStack). Unlike\n   * `LLM_OBSERVABILITY`, the connection is preloaded from\n   * `OTEL_*` env vars (the CLI translates the saas-config selection + per-env\n   * infra config into them) BEFORE app config — not resolved through the runtime\n   * registry. Author the corresponding infrastructure/provider settings in\n   * the application environment before relying on telemetry.\n   */\n  OBSERVABILITY_TELEMETRY = 'OBSERVABILITY_TELEMETRY',\n}\n/** @wildo_source:part:end saas.models.engine-capabilities */\n\n/**\n * Canonical, single-source-of-truth mapping from the open\n * `ProviderCapability` vocabulary (the built-in subset) to the closed\n * `EngineCapability` slots the engine actually fulfills.\n *\n * A provider declares which `providerCapabilities` it satisfies (e.g.\n * Stripe → `BILLING`, Resend → `EMAIL_TRANSACTIONAL`, Anthropic →\n * `LLM_CHAT`/`CODING_AGENT`). This map projects each built-in\n * capability onto the engine slot it fills, so a provider's\n * `engineCapabilities` set can be derived mechanically. Multiple\n * provider capabilities may share one engine slot (every `LLM_*`\n * capability maps to `AI_LLM`); de-duplicate after projecting.\n *\n * **Why this lives here (one map, three consumers).** The projection\n * used to be hand-copied in three places that silently drifted:\n *   1. The runtime registry projection in `saas-backend-lib`\n *      (`ExternalProvidersRegistryBackendService.buildRuntimeRegistryFromProviderModules`),\n *      which decides which provider answers `getProvidersForEngineCapability`.\n *   2. The backend companion-discovery export in\n *      `@wildo-ai/external-connectors-private` (feeds the generated\n *      `provider-catalog.types.ts` autocomplete via `wildo config sync`).\n *   3. The frontend companion-discovery export in\n *      `@wildo-ai/external-connectors-public` (same, for browser-bound\n *      provider modules).\n * A missing/wrong entry in any copy silently breaks a different surface\n * (a registry resolution, or the catalog autocomplete). It is co-located\n * with the `EngineCapability` enum it projects onto, and every consumer\n * imports it from the `@wildo-ai/saas-models` package root barrel.\n *\n * **Bundle boundary — why here and not beside `BUILTIN_PROVIDER_CAPABILITY`.**\n * This map references `EngineCapability`, which is deliberately kept off\n * the browser-safe `@wildo-ai/saas-models/public-runtime` seam. So it must\n * live in a full-only module. `engine-capabilities.shared.schemas.ts` is\n * exactly that (exported from the root barrel, never from\n * `public-runtime/index.ts`), whereas `provider-capability.shared.schemas.ts`\n * — the other natural home — IS on the public seam and would drag\n * `EngineCapability` into the browser bundle. The frontend discovery\n * consumer (#3) imports this map through its Node-only `./companion`\n * subpath, which already pulls the full root barrel; the browser-shipped\n * `./app`/`./techdoc`/`./website` subpaths never reach it.\n *\n * **BILLING → BILLING.** A billing provider (Stripe) declares\n * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills the\n * `EngineCapability.BILLING` slot — the SAME slot apps enable in\n * `defineSaaSProviders`/`engineCapabilities` activation config and that\n * `getProvidersForEngineCapability` gates resolution on. The runtime copy\n * of this projection historically mapped it onto a distinct\n * `EngineCapability.BILLING_PAYMENTS` slot instead, registering Stripe\n * under something no activation config enables and no consumer queries,\n * which made it unreachable through the registry. That second slot was\n * withdrawn from the enum on 2026-09-09 (see the WITHDRAWN block beside\n * the enum) — it had no producer and no consumer other than the bug.\n *\n * **Intentionally unmapped.** `SSO_OAUTH2`, `SSO_SAML`, `FRONTEND_SEARCH`,\n * `FRONTEND_FILE_PICKER`, and `FRONTEND_CAPTCHA` have no closed engine\n * slot today — they are fulfilled by provider protocols / app wiring, not\n * by an `EngineCapability`. Their absence here is by construction, not an\n * oversight: a `Partial<Record<…>>` lookup returns `undefined` and the\n * capability contributes nothing to a provider's `engineCapabilities`.\n *\n * There are no app-extended provider capabilities: the augmentation point was\n * removed as an extension point with no resolver (#502), so this map covers the\n * whole vocabulary rather than the built-in half of it.\n */\nconst PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: EngineCapability.EMAIL_TRANSACTIONAL,\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: EngineCapability.EMAIL_MARKETING,\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: EngineCapability.SMS,\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: EngineCapability.BILLING,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: EngineCapability.AI_LLM,\n  /**\n   * REPOINTED 2026-08-27 (RAG plan DL2/H4): `LLM_EMBEDDINGS` used to map into `AI_LLM`, which\n   * fused the chat and embeddings provider selections into one slot. The TOKEN keeps its name —\n   * it correctly says \"this provider can produce embeddings\", and it sits inside the anchored\n   * `saas.models.provider-capabilities` block compiled into shipped skills — only the slot it\n   * fills changed. Exactly one token claims the embeddings slot.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: EngineCapability.AI_EMBEDDINGS,\n  /**\n   * EXACTLY ONE token claims the document-extraction slot, and it is a new one. Checked rather\n   * than assumed before adding it: `IMAGE_GENERATION` maps to `AI_IMAGE_GENERATION` (output),\n   * `LLM_CHAT` to `AI_LLM`, `LLM_EMBEDDINGS` to `AI_EMBEDDINGS`, and no built-in token mapped\n   * anywhere near document INPUT. Repointing an existing token — the move that kept\n   * `LLM_EMBEDDINGS` alive — was not available here because none of them meant this.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: EngineCapability.AI_DOCUMENT_EXTRACTION,\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: EngineCapability.AI_CODING_AGENT,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: EngineCapability.AI_IMAGE_GENERATION,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: EngineCapability.FRONTEND_ERROR_MONITORING,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: EngineCapability.FRONTEND_PRODUCT_ANALYTICS,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: EngineCapability.LLM_OBSERVABILITY,\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: EngineCapability.OBSERVABILITY_TELEMETRY,\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n} as const satisfies Partial<Record<BuiltinProviderCapability, EngineCapability>>;\n\n/**\n * The projection every consumer uses, with the WIDE type it has always had.\n *\n * **Why the literal above and the widened alias here are two declarations.** Consumers index this\n * map with a `BuiltinProviderCapability` VARIABLE — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[cap]`\n * in the runtime registry, in both companion-discovery exports, in `defineSaaSProviders` and in the\n * tier rule — and that only type-checks against `Partial<Record<…>>`, which admits every token in\n * the vocabulary and answers `undefined` for the five that map nowhere. Annotating the literal that\n * way is what USED to be written here, and it is also what erased the information the totality\n * check below needs: an annotation discards the per-property literal types, so\n * `(typeof MAP)[keyof typeof MAP]` collapsed to `EngineCapability | undefined` and could not say\n * WHICH slots are filled.\n *\n * `as const satisfies` on the literal keeps both: the compiler still rejects a wrong key or a\n * non-`EngineCapability` value at the site where it is written, and the exact filled set survives\n * into the type system. The widening then happens once, here, so no consumer changes and nobody has\n * to know the literal exists.\n */\nexport const PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY: Partial<\n  Record<BuiltinProviderCapability, EngineCapability>\n> = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES;\n\n/**\n * Engine capabilities that DELIBERATELY have no provider capability pointing at them, each named\n * with the reason it is an empty slot rather than a hole.\n *\n * This exists so the two states can never be confused. Before it, an `EngineCapability` member with\n * no entry in the map above looked exactly like one whose entry someone forgot — the absence WAS the\n * record — and that indistinguishability is the whole mechanism behind three separate slots shipping\n * unfillable: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` (withdrawn 2026-09-03) and\n * `BILLING_PAYMENTS` (withdrawn 2026-09-09, and left standing for six days precisely because\n * \"reserved\" reads like a decision). A capability listed here has been looked at; one that is\n * neither listed here nor mapped above does not compile.\n *\n * **Both members are ACTIVATION capabilities, and that is the criterion.** Each is a real, live,\n * enabled-or-not decision an application makes in `wildo.saas.config.ts` (`ORGANIZATIONS` is\n * enabled by both dogfood applications, `MULTI_LANGUAGE` is written by the scaffold and by the\n * application-creation composition step), and each is implemented BY THE ENGINE — multi-tenancy is\n * the engine's own organization model and scoping, translation is the engine's own i18n pipeline.\n * There is no external party to select, so there is nothing for a provider capability to say. That\n * is categorically different from a withdrawn slot, which named work an external party WOULD do and\n * had no external party able to do it.\n *\n * **Adding a member here is a decision that must be argued, not a way to make a compile error go\n * away.** The test beside this file pins the set to exactly these two, so a third one cannot arrive\n * as a silent edit — see `__tests__/engine-capability-provider-coverage.shared.test.ts`.\n */\nexport const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY = [\n  /**\n   * Multi-tenancy: organizations, memberships, roles and organization scoping are engine resources\n   * and engine authorization. Nothing about them is procured.\n   */\n  EngineCapability.ORGANIZATIONS,\n  /**\n   * Application-wide i18n: the label tree, the locale negotiation and the translation pipeline are\n   * the engine's. Where translation is MODEL-backed it reaches a provider through `AI_LLM`, which is\n   * its own slot with its own selection — so even that path is not this capability's producer.\n   */\n  EngineCapability.MULTI_LANGUAGE,\n] as const satisfies readonly EngineCapability[];\n\n/**\n * COMPILE-TIME TOTALITY: every `EngineCapability` is either filled by a provider capability or\n * declared an empty slot above. Adding a member to the enum without doing one of the two is a\n * TypeScript error at this line, not a test failure and not a runtime surprise.\n *\n * A compile error is the right instrument here because both inputs are static literals in this one\n * file — there is no runtime state to consult, so nothing is gained by deferring the question to\n * execution, and a great deal is lost: a test only fails for someone who runs it, while this fails\n * for whoever adds the member, in the editor, before the commit.\n *\n * The error a violation produces is `TS2344` on `EngineCapabilityAccountedFor`, reading\n * `Type 'EngineCapability.X' does not satisfy the constraint 'never'` — X being the exact member\n * that is neither mapped nor declared. Measured rather than asserted: deleting the\n * `BUILTIN_PROVIDER_CAPABILITY.SMS` row from the literal above produced exactly that diagnostic,\n * naming `EngineCapability.SMS`, and the row was restored.\n *\n * The two declarations below are unused by design — the assertion IS the declaration, and it is\n * evaluated the moment the file is type-checked. `noUnusedLocals` is off in this package's\n * tsconfig, so nothing objects; do not \"clean them up\".\n */\ntype EngineCapabilityFilledByAProviderCapability =\n  (typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES)[keyof typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES];\n\ntype EngineCapabilityDeclaredEmpty = (typeof ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY)[number];\n\n/** Resolves to `never` when the two sets above cover the enum, and to the offending member(s) when they do not. */\ntype EngineCapabilityAccountedFor<Unaccounted extends never> = Unaccounted;\n\ntype _EveryEngineCapabilityIsMappedOrDeclaredEmpty = EngineCapabilityAccountedFor<\n  Exclude<EngineCapability, EngineCapabilityFilledByAProviderCapability | EngineCapabilityDeclaredEmpty>\n>;\n\n/**\n * The mirror assertion: a capability may not be BOTH mapped and declared empty.\n *\n * Without it the totality check is satisfiable by lying in the easier direction — list a mapped\n * capability as an empty slot and the union still covers the enum, so a genuinely missing mapping\n * elsewhere could be hidden by a bogus declaration here. `TS2344` again, naming the member that\n * appears on both sides.\n */\ntype _NoEngineCapabilityIsBothMappedAndDeclaredEmpty = EngineCapabilityAccountedFor<\n  Extract<EngineCapabilityDeclaredEmpty, EngineCapabilityFilledByAProviderCapability>\n>;\n\n/**\n * Engine capabilities that REQUIRE a resolved provider the moment an\n * application ENABLES them — the engine-level MAIN floor (#328).\n *\n * `EngineCapabilityActivation.required` is the application's decision;\n * this set is the ENGINE's: for each member, an enabled capability with no\n * provider is not a degraded mode but a boot-time misconfiguration, because\n * an engine flow the application already relies on fails at first use:\n *\n * - `EMAIL_TRANSACTIONAL` — invitations, address verification and password\n *   reset are engine flows that send mail; with no provider they fail\n *   silently at the moment a user needs them.\n * - `BILLING` — `initializeBillingServices` already fails loud with no\n *   provider; the floor names it in the same place as the others.\n * - `SMS` — phone verification and MFA-by-SMS are engine flows.\n *\n * DELIBERATELY ABSENT, with the reason each would need to overturn:\n * - the `AI_*` slots — consumed per feature (an agent, the logo generator)\n *   and legitimately served on a DIFFERENT host (the companion reaches image\n *   generation; the backend need not), so \"enabled with no backend provider\"\n *   is a normal topology, not a fault. A feature that needs one refuses at\n *   its own site.\n * - the sinks (`COMPLIANCE_AUDIT_TRAIL`, `LLM_OBSERVABILITY`,\n *   `OBSERVABILITY_TELEMETRY`) — fail-OPEN by design (the G4 reconcile\n *   warns), because Layer-1 persistence is unaffected.\n * - `EMAIL_MARKETING` — a campaign feature, not an engine flow.\n * - the `FRONTEND_*` slots — resolved by the frontend facet, invisible to\n *   the backend registry that evaluates this floor.\n * - `ORGANIZATIONS` and `MULTI_LANGUAGE` — no provider token maps to them,\n *   deliberately and by declaration; see\n *   `ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`. A floor requiring a\n *   resolved provider for a slot nothing can fill would refuse every boot that\n *   enabled them. (`BILLING_PAYMENTS` was named here too until it was withdrawn\n *   from the enum on 2026-09-09.)\n *\n * The floor runs only on a host expected to SERVE these slots (see\n * `ApplicationRuntimeProfileBootAssertions.assertsEngineCapabilityProviderFloor`);\n * a minion's scope-filtered registry legitimately resolves none of them.\n */\nexport const ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED: ReadonlySet<EngineCapability> = new Set([\n  EngineCapability.EMAIL_TRANSACTIONAL,\n  EngineCapability.BILLING,\n  EngineCapability.SMS,\n]);\n"]}
+{"version":3,"file":"engine-capabilities.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAkC,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,gBAyKX;AAzKD,WAAY,gBAAgB;IAC1B,mDAA+B,CAAA;IAC/B,uCAAmB,CAAA;IACnB,qDAAiC,CAAA;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qEAAiD,CAAA;IAEjD,+DAA2C,CAAA;IAC3C,uDAAmC,CAAA;IACnC,+BAAW,CAAA;IAEX,qCAAiB,CAAA;IACjB,+DAA2C,CAAA;IAC3C;;;;;;;;OAQG;IACH,mDAA+B,CAAA;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,qEAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uDAAmC,CAAA;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IAEH,2EAAuD,CAAA;IACvD,6EAAyD,CAAA;IAEzD;;;;;OAKG;IACH,2DAAuC,CAAA;IAEvC;;;;;;;;OAQG;IACH,uEAAmD,CAAA;AACrD,CAAC,EAzKW,gBAAgB,KAAhB,gBAAgB,QAyK3B;AACD,6DAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,gDAAgD,GAAG;IACvD,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACvF,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC/E,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,GAAG;IACvD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,OAAO;IAC/D,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,MAAM;IAC/D;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,aAAa;IAC5E;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;IAC/F,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC5E,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACpF,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,yBAAyB;IACnG,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,0BAA0B;IACrG,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,iBAAiB;IACnF,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,uBAAuB;IAC/F,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;CACd,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAEjD,gDAAgD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D;;;OAGG;IACH,gBAAgB,CAAC,aAAa;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,cAAc;CACe,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAkC,IAAI,GAAG,CAAC;IAC1G,gBAAgB,CAAC,mBAAmB;IACpC,gBAAgB,CAAC,OAAO;IACxB,gBAAgB,CAAC,GAAG;CACrB,CAAC,CAAC;AACH,qFAAqF","sourcesContent":["import { BUILTIN_PROVIDER_CAPABILITY, type BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** @wildo_source:part:start saas.models.engine-capabilities facet:kind:api facet:audience:app-developer\n *\n * Closed application capability vocabulary used to declare what the\n * application needs from its configured providers.\n *\n * `EngineCapability` no longer means \"feature gate id\" and no longer\n * carries provider routing by itself. Provider-backed fulfillment is selected\n * by the application's provider configuration; entitlement/billing features\n * remain application feature decisions. Import this enum from\n * `@wildo-ai/saas-models` and declare only capabilities the application\n * actually intends to configure and operate.\n */\nexport enum EngineCapability {\n  ORGANIZATIONS = 'ORGANIZATIONS',\n  BILLING = 'BILLING',\n  MULTI_LANGUAGE = 'MULTI_LANGUAGE',\n  /**\n   * Durable, provider-backed audit trail — and the capability with the widest reach into what the\n   * application is able to CLAIM about itself.\n   *\n   * Leaving it out is a legitimate choice, but it is not a small one, and the cost is invisible\n   * until much later. The assurance surface attests roughly half its control objectives through the\n   * audit trail: with this capability absent, about a third of them cannot be claimed AT ALL — every\n   * objective whose only attesting capability is the audit trail — and several more resolve to\n   * \"undetermined\", meaning the application may genuinely operate the control while being unable to\n   * evidence it. Enabling it typically moves an application from partial to complete coverage in one\n   * step.\n   *\n   * Two things this does NOT mean, because both are easy to assume:\n   *\n   * - It is not what makes security events happen. Authentication, authorization, privilege and\n   *   credential events are recorded in the application's own database regardless. What this\n   *   capability adds is the provider-backed fan-out — the durable, external, tamper-evident\n   *   destination an assurance reader can be pointed at.\n   * - It is not retroactive. Turning it on later starts a trail from that moment; it does not\n   *   furnish evidence for the period it was off, and a control's evidence cannot begin before its\n   *   evidence store does.\n   *\n   * So decide it with the compliance posture rather than as an infrastructure detail: if the\n   * application intends to claim access, audit, identity or privacy control objectives to anyone\n   * outside itself, this is the capability those claims rest on.\n   */\n  COMPLIANCE_AUDIT_TRAIL = 'COMPLIANCE_AUDIT_TRAIL',\n\n  EMAIL_TRANSACTIONAL = 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING = 'EMAIL_MARKETING',\n  SMS = 'SMS',\n\n  AI_LLM = 'AI_LLM',\n  AI_IMAGE_GENERATION = 'AI_IMAGE_GENERATION',\n  /**\n   * Text → vector embeddings (the RAG derived-data tier: `.ragSource()` corpus embedding by the\n   * `rag:embedding-drain` worker, and query-time embedding in retrieval). A slot of its OWN,\n   * deliberately separate from `AI_LLM` (RAG plan DL2/H4): while `LLM_EMBEDDINGS` mapped into the\n   * `AI_LLM` slot, an application structurally could not pick Anthropic for chat and a different\n   * provider for embeddings — one `selection[AI_LLM].primary` decided both. Embeddings resolve\n   * through `EMBEDDINGS_PROVIDER` protocol bindings and are selected by applicability class\n   * (`Embeddings_Applicability`), never by a concrete model id at a call site.\n   */\n  AI_EMBEDDINGS = 'AI_EMBEDDINGS',\n  /**\n   * Document bytes → text: provider-backed extraction (OCR) for uploaded documents, serving\n   * `FileTextExtractionBackendService` and, through it, `.ragSource()` corpus ingestion.\n   *\n   * ## Why a slot of its own\n   *\n   * Three unrelated procurement decisions were otherwise fused. A deployment may well want one\n   * vendor for chat, another for embeddings, and a third for OCR — vendors are not equally good\n   * at all three, and their pricing models do not even share a unit (tokens vs. pages). Mapping\n   * extraction into `AI_LLM` would have made one `selection[AI_LLM].primary` decide all three,\n   * which is exactly the defect that split `AI_EMBEDDINGS` out of `AI_LLM`.\n   *\n   * ## Not to be confused with PDF GENERATION\n   *\n   * PDF generation — templates and data become bytes — is the `pdfTemplates` surface, done\n   * in-process and with no provider slot of its own. This is the opposite direction: bytes become\n   * text. The two are unrelated and nothing routes between them. (There WAS an\n   * `EngineCapability.DOCUMENT_GENERATION` that this paragraph used to name; it was withdrawn\n   * because no provider capability could ever fill it.)\n   *\n   * ## Absence is benign, and that is load-bearing\n   *\n   * With no provider selected, extraction falls back to the local `pdfjs-dist` text-layer read.\n   * That is a real answer for a born-digital PDF and returns nothing for a SCAN — so this\n   * capability is what makes scanned documents answerable, never what makes extraction work at\n   * all. An application that ingests only born-digital documents may leave it unset deliberately.\n   */\n  AI_DOCUMENT_EXTRACTION = 'AI_DOCUMENT_EXTRACTION',\n  /**\n   * An autonomous coding agent that mutates the application workspace.\n   *\n   * Its own slot rather than `AI_LLM`, for exactly the reason `AI_EMBEDDINGS`\n   * was split out of it: one `selection[AI_LLM].primary` decides every provider\n   * mapped into that slot. While the coding transport mapped to `AI_LLM`, an\n   * application structurally could NOT choose one vendor's coding agent and a\n   * different vendor for chat — picking a chat provider silently picked the\n   * agent that would be allowed to edit its source.\n   *\n   * The stakes differ too, which is why fusing them was wrong beyond the\n   * ergonomics: selecting a chat model is a quality and cost decision, while\n   * selecting the agent that writes your code is those things AND an\n   * authorisation decision. They deserve separate, deliberate answers.\n   */\n  AI_CODING_AGENT = 'AI_CODING_AGENT',\n\n  /*\n   * WITHDRAWN 2026-09-03: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` were members here and are\n   * not any more. Neither could ever be filled — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` had no\n   * entry pointing at either, so no provider capability token could claim the slot — while both were\n   * classified `SELECT_ONE`, which asserts that exactly one provider must be selected. Selecting one\n   * of zero candidates is not a resolution mode.\n   *\n   * Both capabilities are real and both are delivered elsewhere, which is why withdrawing the slots\n   * costs nothing: antivirus scanning is `InfraCapability.ANTIVIRUS_SCANNING`, fulfilled by ClamAV\n   * and consumed by `FileScanningBackendService`; PDF generation is the in-process `pdfTemplates`\n   * surface, rendered by `@react-pdf/renderer` inside the backend. Neither has an external\n   * provider, and neither is planned to.\n   *\n   * `InfraCapability.DOCUMENT_RENDERING` (Gotenberg) was provisioned beside the PDF surface and\n   * consumed by nothing; it was withdrawn on 2026-09-08 (#477) because in-process rendering had\n   * superseded it. Note the two are not interchangeable if it is ever reconsidered:\n   * `@react-pdf/renderer` composes a document from React primitives, while Gotenberg converts\n   * EXISTING HTML and Office documents — that is a different capability, not a second\n   * implementation of this one.\n   *\n   * Removing `ANTIVIRUS_SCANNING` also removes a collision: the identical spelling named an engine\n   * slot nothing could fill AND a live infra capability, in two packages, so a reader grepping the\n   * word landed in whichever they searched first.\n   *\n   * If a hosted AV or document-rendering vendor is ever adopted, the member comes back WITH its\n   * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` entry and its own JSDoc in the same change.\n   *\n   * WITHDRAWN 2026-09-09: `BILLING_PAYMENTS`, the third member of exactly that shape, and the one\n   * this paragraph's own closing rule should have caught. It was never withdrawn with the other two\n   * because it had been left behind DELIBERATELY — as a \"reserved slot\" — which reads as a decision\n   * and is why nobody re-examined it. Measured before removing, across the whole repository outside\n   * `node_modules` / `dist`: it appeared in live source at exactly THREE sites, and none of them was\n   * a use — the enum declaration itself, its row in the compile-forced\n   * `ENGINE_CAPABILITY_RESOLUTION_MODE` record, and a comment in a test naming it as a slot the\n   * billing provider must NOT be registered under. Zero applications enabled it, zero scaffolds\n   * wrote it, zero consumers queried it, and no provider capability token mapped to it.\n   *\n   * The capability it names is real and is already delivered: a billing provider (Stripe) declares\n   * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills `EngineCapability.BILLING`, which is the slot\n   * applications enable and `getProvidersForEngineCapability` gates on. Payment EXECUTION is served\n   * through that same provider's `BILLING_PROVIDER` protocol; splitting it into a second engine slot\n   * was a plan-era intention (`provider-registry-materialization-workflow.md`) that the shipped\n   * model settled the other way. So the withdrawal removes a name, not a capability.\n   *\n   * The reason a reserved slot is worse than no slot is `EngineCapabilityResolutionMode`: every\n   * member must be classified, `BILLING_PAYMENTS` was classified `SELECT_ONE`, and `SELECT_ONE`\n   * asserts that exactly one provider is selected from the candidates. There were zero candidates\n   * and there could never be one. A vocabulary member that no configuration can satisfy is not a\n   * reservation, it is a false statement the compiler is forced to carry.\n   *\n   * If a payments vendor is ever selected independently of the billing vendor, the member comes back\n   * with its provider-capability token and its map entry in the same change — the same rule as\n   * above, now with three instances behind it.\n   */\n\n  FRONTEND_ERROR_MONITORING = 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS = 'FRONTEND_PRODUCT_ANALYTICS',\n\n  /**\n   * Backend LLM-call observability (model/tokens/cost/latency per `invokeAgent`),\n   * platform-scoped. This enables model-call observability when the selected\n   * provider configuration supplies that capability; it does not itself\n   * configure a provider or make telemetry operational.\n   */\n  LLM_OBSERVABILITY = 'LLM_OBSERVABILITY',\n\n  /**\n   * Operational telemetry (traces/metrics/logs) shipped via the OpenTelemetry\n   * SDK over OTLP to a provider (for example, BetterStack). Unlike\n   * `LLM_OBSERVABILITY`, the connection is preloaded from\n   * `OTEL_*` env vars (the CLI translates the saas-config selection + per-env\n   * infra config into them) BEFORE app config — not resolved through the runtime\n   * registry. Author the corresponding infrastructure/provider settings in\n   * the application environment before relying on telemetry.\n   */\n  OBSERVABILITY_TELEMETRY = 'OBSERVABILITY_TELEMETRY',\n}\n/** @wildo_source:part:end saas.models.engine-capabilities */\n\n/**\n * Canonical, single-source-of-truth mapping from the open\n * `ProviderCapability` vocabulary (the built-in subset) to the closed\n * `EngineCapability` slots the engine actually fulfills.\n *\n * A provider declares which `providerCapabilities` it satisfies (e.g.\n * Stripe → `BILLING`, Resend → `EMAIL_TRANSACTIONAL`, Anthropic →\n * `LLM_CHAT`/`CODING_AGENT`). This map projects each built-in\n * capability onto the engine slot it fills, so a provider's\n * `engineCapabilities` set can be derived mechanically. Multiple\n * provider capabilities may share one engine slot (every `LLM_*`\n * capability maps to `AI_LLM`); de-duplicate after projecting.\n *\n * **Why this lives here (one map, three consumers).** The projection\n * used to be hand-copied in three places that silently drifted:\n *   1. The runtime registry projection in `saas-backend-lib`\n *      (`ExternalProvidersRegistryBackendService.buildRuntimeRegistryFromProviderModules`),\n *      which decides which provider answers `getProvidersForEngineCapability`.\n *   2. The backend companion-discovery export in\n *      `@wildo-ai/external-connectors-private` (feeds the generated\n *      `provider-catalog.types.ts` autocomplete via `wildo config sync`).\n *   3. The frontend companion-discovery export in\n *      `@wildo-ai/external-connectors-public` (same, for browser-bound\n *      provider modules).\n * A missing/wrong entry in any copy silently breaks a different surface\n * (a registry resolution, or the catalog autocomplete). It is co-located\n * with the `EngineCapability` enum it projects onto, and every consumer\n * imports it from the `@wildo-ai/saas-models` package root barrel.\n *\n * **Bundle boundary — why here and not beside `BUILTIN_PROVIDER_CAPABILITY`.**\n * This map references `EngineCapability`, which is deliberately kept off\n * the browser-safe `@wildo-ai/saas-models/public-runtime` seam. So it must\n * live in a full-only module. `engine-capabilities.shared.schemas.ts` is\n * exactly that (exported from the root barrel, never from\n * `public-runtime/index.ts`), whereas `provider-capability.shared.schemas.ts`\n * — the other natural home — IS on the public seam and would drag\n * `EngineCapability` into the browser bundle. The frontend discovery\n * consumer (#3) imports this map through its Node-only `./companion`\n * subpath, which already pulls the full root barrel; the browser-shipped\n * `./app`/`./techdoc`/`./website` subpaths never reach it.\n *\n * **BILLING → BILLING.** A billing provider (Stripe) declares\n * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills the\n * `EngineCapability.BILLING` slot — the SAME slot apps enable in\n * `defineSaaSProviders`/`engineCapabilities` activation config and that\n * `getProvidersForEngineCapability` gates resolution on. The runtime copy\n * of this projection historically mapped it onto a distinct\n * `EngineCapability.BILLING_PAYMENTS` slot instead, registering Stripe\n * under something no activation config enables and no consumer queries,\n * which made it unreachable through the registry. That second slot was\n * withdrawn from the enum on 2026-09-09 (see the WITHDRAWN block beside\n * the enum) — it had no producer and no consumer other than the bug.\n *\n * **Intentionally unmapped.** `SSO_OAUTH2`, `SSO_SAML`, `FRONTEND_SEARCH`,\n * `FRONTEND_FILE_PICKER`, and `FRONTEND_CAPTCHA` have no closed engine\n * slot today — they are fulfilled by provider protocols / app wiring, not\n * by an `EngineCapability`. Their absence here is by construction, not an\n * oversight: a `Partial<Record<…>>` lookup returns `undefined` and the\n * capability contributes nothing to a provider's `engineCapabilities`.\n *\n * There are no app-extended provider capabilities: the augmentation point was\n * removed as an extension point with no resolver (#502), so this map covers the\n * whole vocabulary rather than the built-in half of it.\n */\nconst PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: EngineCapability.EMAIL_TRANSACTIONAL,\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: EngineCapability.EMAIL_MARKETING,\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: EngineCapability.SMS,\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: EngineCapability.BILLING,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: EngineCapability.AI_LLM,\n  /**\n   * REPOINTED 2026-08-27 (RAG plan DL2/H4): `LLM_EMBEDDINGS` used to map into `AI_LLM`, which\n   * fused the chat and embeddings provider selections into one slot. The TOKEN keeps its name —\n   * it correctly says \"this provider can produce embeddings\", and it sits inside the anchored\n   * `saas.models.provider-capabilities` block compiled into shipped skills — only the slot it\n   * fills changed. Exactly one token claims the embeddings slot.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: EngineCapability.AI_EMBEDDINGS,\n  /**\n   * EXACTLY ONE token claims the document-extraction slot, and it is a new one. Checked rather\n   * than assumed before adding it: `IMAGE_GENERATION` maps to `AI_IMAGE_GENERATION` (output),\n   * `LLM_CHAT` to `AI_LLM`, `LLM_EMBEDDINGS` to `AI_EMBEDDINGS`, and no built-in token mapped\n   * anywhere near document INPUT. Repointing an existing token — the move that kept\n   * `LLM_EMBEDDINGS` alive — was not available here because none of them meant this.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: EngineCapability.AI_DOCUMENT_EXTRACTION,\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: EngineCapability.AI_CODING_AGENT,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: EngineCapability.AI_IMAGE_GENERATION,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: EngineCapability.FRONTEND_ERROR_MONITORING,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: EngineCapability.FRONTEND_PRODUCT_ANALYTICS,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: EngineCapability.LLM_OBSERVABILITY,\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: EngineCapability.OBSERVABILITY_TELEMETRY,\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n} as const satisfies Partial<Record<BuiltinProviderCapability, EngineCapability>>;\n\n/**\n * The projection every consumer uses, with the WIDE type it has always had.\n *\n * **Why the literal above and the widened alias here are two declarations.** Consumers index this\n * map with a `BuiltinProviderCapability` VARIABLE — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[cap]`\n * in the runtime registry, in both companion-discovery exports, in `defineSaaSProviders` and in the\n * tier rule — and that only type-checks against `Partial<Record<…>>`, which admits every token in\n * the vocabulary and answers `undefined` for the five that map nowhere. Annotating the literal that\n * way is what USED to be written here, and it is also what erased the information the totality\n * check below needs: an annotation discards the per-property literal types, so\n * `(typeof MAP)[keyof typeof MAP]` collapsed to `EngineCapability | undefined` and could not say\n * WHICH slots are filled.\n *\n * `as const satisfies` on the literal keeps both: the compiler still rejects a wrong key or a\n * non-`EngineCapability` value at the site where it is written, and the exact filled set survives\n * into the type system. The widening then happens once, here, so no consumer changes and nobody has\n * to know the literal exists.\n */\nexport const PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY: Partial<\n  Record<BuiltinProviderCapability, EngineCapability>\n> = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES;\n\n/**\n * Engine capabilities that DELIBERATELY have no provider capability pointing at them, each named\n * with the reason it is an empty slot rather than a hole.\n *\n * This exists so the two states can never be confused. Before it, an `EngineCapability` member with\n * no entry in the map above looked exactly like one whose entry someone forgot — the absence WAS the\n * record — and that indistinguishability is the whole mechanism behind three separate slots shipping\n * unfillable: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` (withdrawn 2026-09-03) and\n * `BILLING_PAYMENTS` (withdrawn 2026-09-09, and left standing for six days precisely because\n * \"reserved\" reads like a decision). A capability listed here has been looked at; one that is\n * neither listed here nor mapped above does not compile.\n *\n * **Both members are ACTIVATION capabilities, and that is the criterion.** Each is a real, live,\n * enabled-or-not decision an application makes in `wildo.saas.config.ts` (`ORGANIZATIONS` is\n * enabled by both dogfood applications, `MULTI_LANGUAGE` is written by the scaffold and by the\n * application-creation composition step), and each is implemented BY THE ENGINE — multi-tenancy is\n * the engine's own organization model and scoping, translation is the engine's own i18n pipeline.\n * There is no external party to select, so there is nothing for a provider capability to say. That\n * is categorically different from a withdrawn slot, which named work an external party WOULD do and\n * had no external party able to do it.\n *\n * **Adding a member here is a decision that must be argued, not a way to make a compile error go\n * away.** The test beside this file pins the set to exactly these two, so a third one cannot arrive\n * as a silent edit — see `__tests__/engine-capability-provider-coverage.shared.test.ts`.\n */\nexport const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY = [\n  /**\n   * Multi-tenancy: organizations, memberships, roles and organization scoping are engine resources\n   * and engine authorization. Nothing about them is procured.\n   */\n  EngineCapability.ORGANIZATIONS,\n  /**\n   * Application-wide i18n: the label tree, the locale negotiation and the translation pipeline are\n   * the engine's. Where translation is MODEL-backed it reaches a provider through `AI_LLM`, which is\n   * its own slot with its own selection — so even that path is not this capability's producer.\n   */\n  EngineCapability.MULTI_LANGUAGE,\n] as const satisfies readonly EngineCapability[];\n\n/**\n * COMPILE-TIME TOTALITY: every `EngineCapability` is either filled by a provider capability or\n * declared an empty slot above. Adding a member to the enum without doing one of the two is a\n * TypeScript error at this line, not a test failure and not a runtime surprise.\n *\n * A compile error is the right instrument here because both inputs are static literals in this one\n * file — there is no runtime state to consult, so nothing is gained by deferring the question to\n * execution, and a great deal is lost: a test only fails for someone who runs it, while this fails\n * for whoever adds the member, in the editor, before the commit.\n *\n * The error a violation produces is `TS2344` on `EngineCapabilityAccountedFor`, reading\n * `Type 'EngineCapability.X' does not satisfy the constraint 'never'` — X being the exact member\n * that is neither mapped nor declared. Measured rather than asserted: deleting the\n * `BUILTIN_PROVIDER_CAPABILITY.SMS` row from the literal above produced exactly that diagnostic,\n * naming `EngineCapability.SMS`, and the row was restored.\n *\n * The two declarations below are unused by design — the assertion IS the declaration, and it is\n * evaluated the moment the file is type-checked. `noUnusedLocals` is off in this package's\n * tsconfig, so nothing objects; do not \"clean them up\".\n */\ntype EngineCapabilityFilledByAProviderCapability =\n  (typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES)[keyof typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES];\n\ntype EngineCapabilityDeclaredEmpty = (typeof ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY)[number];\n\n/** Resolves to `never` when the two sets above cover the enum, and to the offending member(s) when they do not. */\ntype EngineCapabilityAccountedFor<Unaccounted extends never> = Unaccounted;\n\ntype _EveryEngineCapabilityIsMappedOrDeclaredEmpty = EngineCapabilityAccountedFor<\n  Exclude<EngineCapability, EngineCapabilityFilledByAProviderCapability | EngineCapabilityDeclaredEmpty>\n>;\n\n/**\n * The mirror assertion: a capability may not be BOTH mapped and declared empty.\n *\n * Without it the totality check is satisfiable by lying in the easier direction — list a mapped\n * capability as an empty slot and the union still covers the enum, so a genuinely missing mapping\n * elsewhere could be hidden by a bogus declaration here. `TS2344` again, naming the member that\n * appears on both sides.\n */\ntype _NoEngineCapabilityIsBothMappedAndDeclaredEmpty = EngineCapabilityAccountedFor<\n  Extract<EngineCapabilityDeclaredEmpty, EngineCapabilityFilledByAProviderCapability>\n>;\n\n/** @wildo_source:part:start saas.models.engine-capabilities.required-provider-floor facet:layer:shared facet:audience:app-developer */\n/**\n * Engine capabilities that REQUIRE a resolved provider the moment an\n * application ENABLES them — the engine-level MAIN floor (#328).\n *\n * The asymmetry is the thing to carry away: **enabling a capability with nothing serving it fails at\n * BOOT for these three and at the point of USE for every other slot.** So an author who tries one\n * unserved slot, sees the application come up, and concludes that an unserved capability degrades\n * gracefully has learned the wrong rule from the larger half of the vocabulary.\n *\n * `EngineCapabilityActivation.required` is the application's decision;\n * this set is the ENGINE's: for each member, an enabled capability with no\n * provider is not a degraded mode but a boot-time misconfiguration, because\n * an engine flow the application already relies on fails at first use:\n *\n * - `EMAIL_TRANSACTIONAL` — invitations, address verification and password\n *   reset are engine flows that send mail; with no provider they fail\n *   silently at the moment a user needs them.\n * - `BILLING` — `initializeBillingServices` already fails loud with no\n *   provider; the floor names it in the same place as the others.\n * - `SMS` — phone verification and MFA-by-SMS are engine flows.\n *\n * DELIBERATELY ABSENT, with the reason each would need to overturn:\n * - the `AI_*` slots — consumed per feature (an agent, the logo generator)\n *   and legitimately served on a DIFFERENT host (the companion reaches image\n *   generation; the backend need not), so \"enabled with no backend provider\"\n *   is a normal topology, not a fault. A feature that needs one refuses at\n *   its own site.\n * - the sinks (`COMPLIANCE_AUDIT_TRAIL`, `LLM_OBSERVABILITY`,\n *   `OBSERVABILITY_TELEMETRY`) — fail-OPEN by design (the G4 reconcile\n *   warns), because Layer-1 persistence is unaffected.\n * - `EMAIL_MARKETING` — a campaign feature, not an engine flow.\n * - the `FRONTEND_*` slots — resolved by the frontend facet, invisible to\n *   the backend registry that evaluates this floor.\n * - `ORGANIZATIONS` and `MULTI_LANGUAGE` — no provider token maps to them,\n *   deliberately and by declaration; see\n *   `ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`. A floor requiring a\n *   resolved provider for a slot nothing can fill would refuse every boot that\n *   enabled them. (`BILLING_PAYMENTS` was named here too until it was withdrawn\n *   from the enum on 2026-09-09.)\n *\n * The floor runs only on a host expected to SERVE these slots (see\n * `ApplicationRuntimeProfileBootAssertions.assertsEngineCapabilityProviderFloor`);\n * a minion's scope-filtered registry legitimately resolves none of them.\n */\nexport const ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED: ReadonlySet<EngineCapability> = new Set([\n  EngineCapability.EMAIL_TRANSACTIONAL,\n  EngineCapability.BILLING,\n  EngineCapability.SMS,\n]);\n/** @wildo_source:part:end saas.models.engine-capabilities.required-provider-floor */\n"]}

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-resolution-mode.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC;;;;;;;;;;;;;;OAcG;IACH,UAAU,eAAe;IACzB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AA4DD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,gBAAgB,GAC3B,8BAA8B,CAEhC"}
+{"version":3,"file":"engine-capability-resolution-mode.shared.d.ts","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC;;;;;;;;;;;;;;OAcG;IACH,UAAU,eAAe;IACzB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AA4DD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,gBAAgB,GAC3B,8BAA8B,CAEhC"}

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-resolution-mode.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAwBX;AAxBD,WAAY,8BAA8B;IACxC;;;;;;;;;;;;;;OAcG;IACH,2DAAyB,CAAA;IACzB;;;;;OAKG;IACH,qDAAmB,CAAA;AACrB,CAAC,EAxBW,8BAA8B,KAA9B,8BAA8B,QAwBzC;AACD,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,iCAAiC,GAA6D;IAClG,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,OAAO;IAEjF;;;;;;;;;;;;;;OAcG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACrE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC5E,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,8FAA8F;IAC9F,8FAA8F;IAC9F,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,oBAAoB;IACpB,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACvF,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACxF,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC/E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,UAAU;CACtF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA4B;IAE5B,OAAO,iCAAiC,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-resolution-mode facet:layer:shared facet:audience:app-developer\n *\n * How the engine resolves the provider(s) fulfilling an `EngineCapability`\n * when more than one is declared for the same scope.\n *\n * This is a FIRST-CLASS, declared property of a capability — NOT an implicit\n * per-consumer convention. A reader can tell whether a capability picks one\n * provider or writes to all of them; a new capability author declares it\n * here; and both the runtime registry resolver and the `defineSaaSProviders`\n * config validators branch on it (so a `FAN_OUT` capability is validated by\n * DECLARATION and never keyed off `selection`).\n */\nexport enum EngineCapabilityResolutionMode {\n  /**\n   * Exactly one active provider: `selection.<capability>.primary`. The default for every capability\n   * (billing, email, observability, …), and a request is served by that one provider.\n   *\n   * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on\n   * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a\n   * primary that is not AVAILABLE at resolution time — undeclared in the scope, disabled, or\n   * unconfigured — and it decides which provider ends up first in the resolved list. Nothing\n   * retries a second provider when a call to the first one FAILS: the send raises the primary's\n   * error and stops.\n   *\n   * So do not read a declared `whenUnavailable` entry as redundancy, and do not size an\n   * availability argument on it. An application that wants call-time failover builds it at its own\n   * call site, per capability — a deliberate framework boundary, not an omission.\n   */\n  SELECT_ONE = 'SELECT_ONE',\n  /**\n   * ALL declared providers are active simultaneously — every one receives\n   * every emission (no primary, no failover). For sinks whose nature is\n   * additive rather than substitutable: `COMPLIANCE_AUDIT_TRAIL` writes each\n   * audit event to every configured destination.\n   */\n  FAN_OUT = 'FAN_OUT',\n}\n/** @wildo_source:part:end saas.models.providers.capability-resolution-mode */\n\n/**\n * The DECLARED resolution mode for EVERY engine capability. Exhaustive by\n * construction: because this is a `Record<EngineCapability, …>`, adding a new\n * member to the `EngineCapability` enum WITHOUT classifying it here is a COMPILE\n * error. That is deliberate — a bare \"default to SELECT_ONE\" would let a future\n * additive/fan-out capability silently collapse to single-provider resolution\n * (dropping emissions to every non-primary destination) just because its author\n * forgot a one-line edit. The compiler now forces the decision.\n *\n * Only `COMPLIANCE_AUDIT_TRAIL` is `FAN_OUT` today (audit events are additive —\n * every declared destination receives every event). Everything else is\n * `SELECT_ONE`: one active provider, and no failover to a second one.\n */\nconst ENGINE_CAPABILITY_RESOLUTION_MODE: Record<EngineCapability, EngineCapabilityResolutionMode> = {\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: EngineCapabilityResolutionMode.FAN_OUT,\n\n  /**\n   * NOMINAL for the two ACTIVATION capabilities below, and worth stating because the next reader\n   * will otherwise ask the right question. `BILLING_PAYMENTS` was withdrawn from the enum on\n   * 2026-09-09 for being classified `SELECT_ONE` with no provider capability able to fill it —\n   * \"select one of zero candidates\" is not a resolution mode. `ORGANIZATIONS` and `MULTI_LANGUAGE`\n   * have no provider capability either, so why do they stand?\n   *\n   * Because nothing ever RESOLVES them. They are engine-implemented activations (multi-tenancy, the\n   * i18n pipeline): an application enables them, the engine serves them, and no code path asks this\n   * record which provider fulfills them — where the withdrawn slot's whole purpose was to be\n   * resolved and it could not be. Their absence from `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` is a\n   * DECLARATION (`ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`), not a gap, and the row here\n   * exists only because this record is total over the enum by construction — which is the property\n   * that makes a genuinely resolvable new capability impossible to leave unclassified.\n   */\n  [EngineCapability.ORGANIZATIONS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.BILLING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.SMS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_LLM]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_IMAGE_GENERATION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Embeddings are substitutable, not additive: one provider serves a vector space, and writing\n  // the same chunk through two providers would produce two incompatible spaces, not redundancy.\n  [EngineCapability.AI_EMBEDDINGS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Extraction is substitutable, not additive: one provider reads a document, and running the\n  // same bytes through two OCR services would produce two divergent transcriptions of one page\n  // with no principled way to merge them — plus a second egress of the same private content.\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One agent per task, and emphatically not fan-out: two coding agents given the same task\n  // against the same worktree do not produce redundancy, they produce a merge conflict nobody\n  // asked for — and the change attribution that follows a run could no longer say which agent\n  // wrote which file.\n  [EngineCapability.AI_CODING_AGENT]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.LLM_OBSERVABILITY]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: EngineCapabilityResolutionMode.SELECT_ONE,\n};\n\n/**\n * The declared resolution mode for an engine capability. A TOTAL lookup — every\n * capability is explicitly classified in `ENGINE_CAPABILITY_RESOLUTION_MODE`\n * (no silent default).\n *\n * Consumers: the runtime registry (`ExternalProvidersRegistryBackendService`\n * — `FAN_OUT` uses the full provider list, `SELECT_ONE` uses the primary) and\n * the `defineSaaSProviders` validators (a `FAN_OUT` capability is validated by\n * declaration and rejects a `selection` entry).\n */\nexport function getEngineCapabilityResolutionMode(\n  capability: EngineCapability,\n): EngineCapabilityResolutionMode {\n  return ENGINE_CAPABILITY_RESOLUTION_MODE[capability];\n}\n"]}
+{"version":3,"file":"engine-capability-resolution-mode.shared.js","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAwBX;AAxBD,WAAY,8BAA8B;IACxC;;;;;;;;;;;;;;OAcG;IACH,2DAAyB,CAAA;IACzB;;;;;OAKG;IACH,qDAAmB,CAAA;AACrB,CAAC,EAxBW,8BAA8B,KAA9B,8BAA8B,QAwBzC;AACD,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,iCAAiC,GAA6D;IAClG,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,OAAO;IAEjF;;;;;;;;;;;;;;OAcG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACrE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC5E,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,8FAA8F;IAC9F,8FAA8F;IAC9F,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,oBAAoB;IACpB,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACvF,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACxF,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC/E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,UAAU;CACtF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA4B;IAE5B,OAAO,iCAAiC,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-resolution-mode facet:layer:shared facet:audience:app-developer\n *\n * How the engine resolves the provider(s) fulfilling an `EngineCapability`\n * when more than one is declared for the same scope.\n *\n * This is a FIRST-CLASS, declared property of a capability — NOT an implicit\n * per-consumer convention. A reader can tell whether a capability picks one\n * provider or writes to all of them; a new capability author declares it\n * here; and both the runtime registry resolver and the `defineSaaSProviders`\n * config validators branch on it (so a `FAN_OUT` capability is validated by\n * DECLARATION and never keyed off `selection`).\n */\nexport enum EngineCapabilityResolutionMode {\n  /**\n   * Exactly one active provider: `selection.<capability>.primary`. The default for every capability\n   * (billing, email, observability, …), and a request is served by that one provider.\n   *\n   * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on\n   * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a\n   * primary that is not AVAILABLE at resolution time — undeclared in the scope, disabled, or\n   * unconfigured — and it decides which provider ends up first in the resolved list. Nothing\n   * retries a second provider when a call to the first one FAILS: the send raises the primary's\n   * error and stops.\n   *\n   * So do not read a declared `whenUnavailable` entry as redundancy, and do not size an\n   * availability argument on it. An application that wants call-time failover builds it at its own\n   * call site, per capability — a deliberate framework boundary, not an omission.\n   */\n  SELECT_ONE = 'SELECT_ONE',\n  /**\n   * ALL declared providers are active simultaneously — every one receives\n   * every emission (no primary, no failover). For sinks whose nature is\n   * additive rather than substitutable: `COMPLIANCE_AUDIT_TRAIL` writes each\n   * audit event to every configured destination.\n   */\n  FAN_OUT = 'FAN_OUT',\n}\n/** @wildo_source:part:end saas.models.providers.capability-resolution-mode */\n\n/**\n * The DECLARED resolution mode for EVERY engine capability. Exhaustive by\n * construction: because this is a `Record<EngineCapability, …>`, adding a new\n * member to the `EngineCapability` enum WITHOUT classifying it here is a COMPILE\n * error. That is deliberate — a bare \"default to SELECT_ONE\" would let a future\n * additive/fan-out capability silently collapse to single-provider resolution\n * (dropping emissions to every non-primary destination) just because its author\n * forgot a one-line edit. The compiler now forces the decision.\n *\n * Only `COMPLIANCE_AUDIT_TRAIL` is `FAN_OUT` today (audit events are additive —\n * every declared destination receives every event). Everything else is\n * `SELECT_ONE`: one active provider, and no failover to a second one.\n */\nconst ENGINE_CAPABILITY_RESOLUTION_MODE: Record<EngineCapability, EngineCapabilityResolutionMode> = {\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: EngineCapabilityResolutionMode.FAN_OUT,\n\n  /**\n   * NOMINAL for the two ACTIVATION capabilities below, and worth stating because the next reader\n   * will otherwise ask the right question. `BILLING_PAYMENTS` was withdrawn from the enum on\n   * 2026-09-09 for being classified `SELECT_ONE` with no provider capability able to fill it —\n   * \"select one of zero candidates\" is not a resolution mode. `ORGANIZATIONS` and `MULTI_LANGUAGE`\n   * have no provider capability either, so why do they stand?\n   *\n   * Because nothing ever RESOLVES them. They are engine-implemented activations (multi-tenancy, the\n   * i18n pipeline): an application enables them, the engine serves them, and no code path asks this\n   * record which provider fulfills them — where the withdrawn slot's whole purpose was to be\n   * resolved and it could not be. Their absence from `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` is a\n   * DECLARATION (`ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`), not a gap, and the row here\n   * exists only because this record is total over the enum by construction — which is the property\n   * that makes a genuinely resolvable new capability impossible to leave unclassified.\n   */\n  [EngineCapability.ORGANIZATIONS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.BILLING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.SMS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_LLM]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_IMAGE_GENERATION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Embeddings are substitutable, not additive: one provider serves a vector space, and writing\n  // the same chunk through two providers would produce two incompatible spaces, not redundancy.\n  [EngineCapability.AI_EMBEDDINGS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Extraction is substitutable, not additive: one provider reads a document, and running the\n  // same bytes through two OCR services would produce two divergent transcriptions of one page\n  // with no principled way to merge them — plus a second egress of the same private content.\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One agent per task, and emphatically not fan-out: two coding agents given the same task\n  // against the same worktree do not produce redundancy, they produce a merge conflict nobody\n  // asked for — and the change attribution that follows a run could no longer say which agent\n  // wrote which file.\n  [EngineCapability.AI_CODING_AGENT]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.LLM_OBSERVABILITY]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: EngineCapabilityResolutionMode.SELECT_ONE,\n};\n\n/**\n * The declared resolution mode for an engine capability. A TOTAL lookup — every\n * capability is explicitly classified in `ENGINE_CAPABILITY_RESOLUTION_MODE`\n * (no silent default).\n *\n * Consumers: the runtime registry (`ExternalProvidersRegistryBackendService`\n * — `FAN_OUT` uses the full provider list, `SELECT_ONE` uses the primary) and\n * the `defineSaaSProviders` validators (a `FAN_OUT` capability is validated by\n * declaration and rejects a `selection` entry).\n */\nexport function getEngineCapabilityResolutionMode(\n  capability: EngineCapability,\n): EngineCapabilityResolutionMode {\n  return ENGINE_CAPABILITY_RESOLUTION_MODE[capability];\n}\n"]}

package/dist/esm/external-providers/external-providers.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-providers.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EAEf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE;;;;;;;;GAQG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAehD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9C,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM7F;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;iBAqB5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;kBAGvC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}
+{"version":3,"file":"external-providers.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EAEf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE;;;;;;;;GAQG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAehD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9C,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM7F;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;iBAqB5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;kBAGvC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.d.ts

@@ -49,6 +49,8 @@ export declare const FrontendAppBootstrapPayloadSchema: z.ZodObject<{
             components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
             }, z.core.$strict>>>;
+            publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            fileStorage: z.ZodOptional<z.ZodEnum<typeof import("@wildo-ai/zod-decorators").FileStorageAccepted>>;
         }, z.core.$loose>>>;
     }, z.core.$strip>;
 }, z.core.$strip>;
@@ -389,6 +391,8 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
             components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
             }, z.core.$strict>>>;
+            publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            fileStorage: z.ZodOptional<z.ZodEnum<typeof import("@wildo-ai/zod-decorators").FileStorageAccepted>>;
         }, z.core.$loose>>>;
     }, z.core.$strip>;
 }, z.core.$strip>;

package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-bootstrap.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1D,CAAC;AACL,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC9D,OAAO,iDAAiD,CACzD,CAAC"}
+{"version":3,"file":"frontend-bootstrap.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1D,CAAC;AACL,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC9D,OAAO,iDAAiD,CACzD,CAAC"}

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-public-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC;IAC/C;;;;;;;;;OASG;;IAKH;;;;;;OAMG;;IAEH,mFAAmF;;iBAEnF,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}
+{"version":3,"file":"frontend-capability-public-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC;IAC/C;;;;;;;;;OASG;;IAKH;;;;;;OAMG;;IAEH,mFAAmF;;iBAEnF,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-public-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,WAAW,CAAC;IAChE;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC","sourcesContent":["/**\n * The public-config shape a BUILT-IN frontend capability expects, as a named\n * schema rather than a convention.\n *\n * ## Why the capability owns this and not each provider\n *\n * `publicConfig` is `Record<string, unknown>`, so every consuming site was\n * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter\n * for strings, a Mb-to-bytes multiplication — and a renamed key produced\n * `undefined` and a silently wrong picker rather than an error. The keys were a\n * convention nobody had written down, which is the whole defect: three ad-hoc\n * readers agreeing by luck.\n *\n * What a FILE PICKER's constraints mean is framework knowledge — the framework\n * is what applies them to its own file fields — so the shape belongs to the\n * CAPABILITY. A provider is free to carry its own keys beside these (a client\n * id, an app key); it is not free to invent a different spelling of the ones\n * the framework reads, and now it cannot.\n *\n * A provider declaring `publicConfigSchema` should EXTEND the schema for the\n * capability it claims, so hydration validates the framework's fields and its\n * own in one pass.\n */\n\nimport { z } from 'zod';\n\n/**\n * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.\n *\n * Every field is optional: a provider that constrains nothing is legitimate,\n * and the field's own Zod file metadata always wins anyway — a provider only\n * fills the gaps the schema left open.\n *\n * LOOSE, because a provider's own keys live in the same object and must survive\n * a parse that is only looking for these.\n */\nexport const FrontendFilePickerPublicConfigSchema = z.looseObject({\n  /**\n   * MIME types the picker can return.\n   *\n   * An EMPTY list is normalized to absent, and that is behaviour rather than\n   * decoration: the framework turns this into an `accept=` attribute, and an\n   * empty `accept=\"\"` does not mean \"anything\" — it means the file dialog\n   * offers nothing. A provider that declares no types is unconstrained, so the\n   * normalization happens here, once, instead of at each reader that would have\n   * to remember it.\n   */\n  acceptedMimeTypes: z\n    .array(z.string().min(1))\n    .optional()\n    .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),\n  /**\n   * Largest file the picker will hand back, in MEGABYTES.\n   *\n   * The unit is in the name because the framework's own constraint is in BYTES\n   * and the conversion is the kind of thing that is wrong by a factor of 1024²\n   * exactly once, silently, in production.\n   */\n  maxFileSizeMb: z.number().positive().optional(),\n  /** How many files one selection may return. Applies only to a `multiple` field. */\n  maxSelectionCount: z.number().int().positive().optional(),\n});\nexport type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;\n"]}
+{"version":3,"file":"frontend-capability-public-config.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,WAAW,CAAC;IAChE;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC","sourcesContent":["/**\n * The public-config shape a BUILT-IN frontend capability expects, as a named\n * schema rather than a convention.\n *\n * ## Why the capability owns this and not each provider\n *\n * `publicConfig` is `Record<string, unknown>`, so every consuming site was\n * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter\n * for strings, a Mb-to-bytes multiplication — and a renamed key produced\n * `undefined` and a silently wrong picker rather than an error. The keys were a\n * convention nobody had written down, which is the whole defect: three ad-hoc\n * readers agreeing by luck.\n *\n * What a FILE PICKER's constraints mean is framework knowledge — the framework\n * is what applies them to its own file fields — so the shape belongs to the\n * CAPABILITY. A provider is free to carry its own keys beside these (a client\n * id, an app key); it is not free to invent a different spelling of the ones\n * the framework reads, and now it cannot.\n *\n * A provider declaring `publicConfigSchema` should EXTEND the schema for the\n * capability it claims, so hydration validates the framework's fields and its\n * own in one pass.\n */\n\nimport { z } from 'zod';\n\n/**\n * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.\n *\n * Every field is optional: a provider that constrains nothing is legitimate,\n * and the field's own Zod file metadata always wins anyway — a provider only\n * fills the gaps the schema left open.\n *\n * LOOSE, because a provider's own keys live in the same object and must survive\n * a parse that is only looking for these.\n */\nexport const FrontendFilePickerPublicConfigSchema = z.looseObject({\n  /**\n   * MIME types the picker can return.\n   *\n   * An EMPTY list is normalized to absent, and that is behaviour rather than\n   * decoration: the framework turns this into an `accept=` attribute, and an\n   * empty `accept=\"\"` does not mean \"anything\" — it means the file dialog\n   * offers nothing. A provider that declares no types is unconstrained, so the\n   * normalization happens here, once, instead of at each reader that would have\n   * to remember it.\n   */\n  acceptedMimeTypes: z\n    .array(z.string().min(1))\n    .optional()\n    .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),\n  /**\n   * Largest file the picker will hand back, in MEGABYTES.\n   *\n   * The unit is in the name because the framework's own constraint is in BYTES\n   * and the conversion is the kind of thing that is wrong by a factor of 1024²\n   * exactly once, silently, in production.\n   */\n  maxFileSizeMb: z.number().positive().optional(),\n  /** How many files one selection may return. Applies only to a `multiple` field. */\n  maxSelectionCount: z.number().int().positive().optional(),\n});\nexport type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;\n"]}

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-runtime.shared.types.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAMpG"}
+{"version":3,"file":"frontend-capability-runtime.shared.types.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAMpG"}

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-runtime.shared.types.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;WACvB,MAAM,KAAK,IAAI;WACf,OAAQ,MAAsC,CAAC,WAAW,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The RUNTIME contract a built-in frontend capability expects of whichever\n * provider fills it — the code-half sibling of\n * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.\n *\n * ## Why the capability owns the shape, and not the framework's call site\n *\n * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider\n * package must not know any vendor's type, and \"a consumer that needs one narrows\n * it at the point where it also knows which provider it asked for.\"\n *\n * That reasoning holds for a picker, where the surface really did ask for Drive.\n * It inverts for an OBSERVABILITY capability: the framework reports a crash without\n * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted\n * collector is listening. Narrowing at the call site would mean a `switch` over\n * vendors inside the engine, which is precisely what the capability model exists to\n * prevent.\n *\n * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,\n * and the framework calls one method it owns the definition of.\n *\n * ## Bundle-safe by construction\n *\n * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from\n * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take\n * a handful of atoms without the decorator-bound schema graph.\n */\n\n/**\n * One crash, as the framework describes it to whichever provider is listening.\n *\n * ## What is in it, and why that is the whole list\n *\n * `name`, `message`, `stack` and `componentStack` are exactly what\n * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught\n * crash. Nothing new is collected to fill this shape; what changes is only that the\n * report can now leave the browser.\n *\n * **`message` is sent as authored, and that is a decision rather than an oversight.**\n * It is the field most likely to carry user content — `new Error(\\`Invalid value:\n * ${input}\\`)` — and it is also the field without which a crash report is close to\n * useless. Every mainstream crash reporter sends the exception message and scrubs by\n * KEY rather than by free-text inspection, because a scrubber over prose either\n * destroys the diagnostic or gives false assurance. An application that cannot accept\n * that should not declare `FRONTEND_ERROR_MONITORING`.\n *\n * ## What is deliberately NOT in it\n *\n * No user identity, no session or organisation id, no request or form payload, and no\n * resource content. A crash report is a diagnostic about CODE; attributing it to a\n * PERSON is a separate decision an application would have to take deliberately, and\n * there is no field here through which it could happen by accident.\n */\nexport interface FrontendCrashReport {\n  /** The error's class name — `TypeError`, `WildoFrontendError`. */\n  readonly name: string;\n  /** The error's own message, unmodified. See the note above before changing this. */\n  readonly message: string;\n  /** The JavaScript stack, when the runtime produced one. */\n  readonly stack?: string;\n  /**\n   * React's component stack for a crash a boundary caught. Component NAMES only —\n   * no props, no state — so it says which screen broke without saying what was on it.\n   */\n  readonly componentStack?: string;\n  /**\n   * Framework classification, flattened to strings at this boundary.\n   *\n   * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,\n   * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must\n   * not pull in, and every mainstream vendor models exactly this as string tags. The\n   * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one\n   * named runtime source and only its serialization is local to this contract.\n   */\n  readonly tags?: Readonly<Record<string, string>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated\n * handle.\n *\n * Synchronous and returning nothing, deliberately. Reporting a crash must never\n * become something a crashing surface has to await or handle: a vendor SDK queues and\n * flushes on its own schedule, and a rejected promise here would be a second error\n * raised from inside the first one's handler.\n */\nexport interface FrontendErrorMonitoringSink {\n  reportCrash(report: FrontendCrashReport): void;\n}\n\n/**\n * Whether an activated SDK handle can receive crash reports.\n *\n * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor\n * namespace that does not implement this contract — a mistake no type can catch,\n * because `handle` is `unknown` by design. Checked at the seam so the failure is a\n * reported diagnostic rather than a `TypeError` thrown while handling a crash.\n */\nexport function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink {\n  return (\n    typeof handle === 'object'\n    && handle !== null\n    && typeof (handle as FrontendErrorMonitoringSink).reportCrash === 'function'\n  );\n}\n"]}
+{"version":3,"file":"frontend-capability-runtime.shared.types.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;WACvB,MAAM,KAAK,IAAI;WACf,OAAQ,MAAsC,CAAC,WAAW,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The RUNTIME contract a built-in frontend capability expects of whichever\n * provider fills it — the code-half sibling of\n * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.\n *\n * ## Why the capability owns the shape, and not the framework's call site\n *\n * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider\n * package must not know any vendor's type, and \"a consumer that needs one narrows\n * it at the point where it also knows which provider it asked for.\"\n *\n * That reasoning holds for a picker, where the surface really did ask for Drive.\n * It inverts for an OBSERVABILITY capability: the framework reports a crash without\n * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted\n * collector is listening. Narrowing at the call site would mean a `switch` over\n * vendors inside the engine, which is precisely what the capability model exists to\n * prevent.\n *\n * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,\n * and the framework calls one method it owns the definition of.\n *\n * ## Bundle-safe by construction\n *\n * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from\n * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take\n * a handful of atoms without the decorator-bound schema graph.\n */\n\n/**\n * One crash, as the framework describes it to whichever provider is listening.\n *\n * ## What is in it, and why that is the whole list\n *\n * `name`, `message`, `stack` and `componentStack` are exactly what\n * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught\n * crash. Nothing new is collected to fill this shape; what changes is only that the\n * report can now leave the browser.\n *\n * **`message` is sent as authored, and that is a decision rather than an oversight.**\n * It is the field most likely to carry user content — `new Error(\\`Invalid value:\n * ${input}\\`)` — and it is also the field without which a crash report is close to\n * useless. Every mainstream crash reporter sends the exception message and scrubs by\n * KEY rather than by free-text inspection, because a scrubber over prose either\n * destroys the diagnostic or gives false assurance. An application that cannot accept\n * that should not declare `FRONTEND_ERROR_MONITORING`.\n *\n * ## What is deliberately NOT in it\n *\n * No user identity, no session or organisation id, no request or form payload, and no\n * resource content. A crash report is a diagnostic about CODE; attributing it to a\n * PERSON is a separate decision an application would have to take deliberately, and\n * there is no field here through which it could happen by accident.\n */\nexport interface FrontendCrashReport {\n  /** The error's class name — `TypeError`, `WildoFrontendError`. */\n  readonly name: string;\n  /** The error's own message, unmodified. See the note above before changing this. */\n  readonly message: string;\n  /** The JavaScript stack, when the runtime produced one. */\n  readonly stack?: string;\n  /**\n   * React's component stack for a crash a boundary caught. Component NAMES only —\n   * no props, no state — so it says which screen broke without saying what was on it.\n   */\n  readonly componentStack?: string;\n  /**\n   * Framework classification, flattened to strings at this boundary.\n   *\n   * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,\n   * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must\n   * not pull in, and every mainstream vendor models exactly this as string tags. The\n   * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one\n   * named runtime source and only its serialization is local to this contract.\n   */\n  readonly tags?: Readonly<Record<string, string>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated\n * handle.\n *\n * Synchronous and returning nothing, deliberately. Reporting a crash must never\n * become something a crashing surface has to await or handle: a vendor SDK queues and\n * flushes on its own schedule, and a rejected promise here would be a second error\n * raised from inside the first one's handler.\n */\nexport interface FrontendErrorMonitoringSink {\n  reportCrash(report: FrontendCrashReport): void;\n}\n\n/**\n * Whether an activated SDK handle can receive crash reports.\n *\n * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor\n * namespace that does not implement this contract — a mistake no type can catch,\n * because `handle` is `unknown` by design. Checked at the seam so the failure is a\n * reported diagnostic rather than a `TypeError` thrown while handling a crash.\n */\nexport function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink {\n  return (\n    typeof handle === 'object'\n    && handle !== null\n    && typeof (handle as FrontendErrorMonitoringSink).reportCrash === 'function'\n  );\n}\n"]}

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { FileStorageAccepted } from '@wildo-ai/zod-decorators';
 /**
  * Bundle-safe frontend provider atoms shared by every browser-bound runtime.
  *
@@ -103,6 +104,34 @@ export declare const FrontendProviderEntrySchema: z.ZodObject<{
     components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
     }, z.core.$strict>>>;
+    /**
+     * The public-config keys the provider module DECLARES it reads — the DATA
+     * half of its `publicConfigSchema`, mirrored here so the companion walk can
+     * refuse an application-supplied key the module never declared, without
+     * executing the module (#394 P3). Absent when the module's schema is not
+     * introspectable, which the overlay reads as "cannot enforce here", never as
+     * "declares nothing".
+     */
+    publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    /**
+     * The `z_file` storage this provider's file picker is the FRONT DOOR of — the
+     * join key between the provider vocabulary (`google-drive`) and the z_file
+     * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).
+     *
+     * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the
+     * vendor, so the FILES row it produces is stored in THAT storage, and a field
+     * may only receive it when its `storageAccepted` names that storage. The
+     * chooser therefore offers such a picker only to a field that accepts the
+     * storage, and the backend refuses the link otherwise — both read this
+     * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no
+     * storage: its bytes are ingested into whatever the field's own storage is,
+     * and it is offered to every field.
+     *
+     * DATA half only, like `components`: the backend storage provider that
+     * SERVES the storage is CODE, keyed by the same enum member and naming this
+     * provider back as its `connectedProviderRef`; a pin holds the two ends equal.
+     */
+    fileStorage: z.ZodOptional<z.ZodEnum<typeof FileStorageAccepted>>;
 }, z.core.$loose>;
 export type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;
 export declare const FrontendProvidersBlockSchema: z.ZodObject<{
@@ -175,6 +204,34 @@ export declare const FrontendProvidersBlockSchema: z.ZodObject<{
         components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
         }, z.core.$strict>>>;
+        /**
+         * The public-config keys the provider module DECLARES it reads — the DATA
+         * half of its `publicConfigSchema`, mirrored here so the companion walk can
+         * refuse an application-supplied key the module never declared, without
+         * executing the module (#394 P3). Absent when the module's schema is not
+         * introspectable, which the overlay reads as "cannot enforce here", never as
+         * "declares nothing".
+         */
+        publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        /**
+         * The `z_file` storage this provider's file picker is the FRONT DOOR of — the
+         * join key between the provider vocabulary (`google-drive`) and the z_file
+         * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).
+         *
+         * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the
+         * vendor, so the FILES row it produces is stored in THAT storage, and a field
+         * may only receive it when its `storageAccepted` names that storage. The
+         * chooser therefore offers such a picker only to a field that accepts the
+         * storage, and the backend refuses the link otherwise — both read this
+         * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no
+         * storage: its bytes are ingested into whatever the field's own storage is,
+         * and it is offered to every field.
+         *
+         * DATA half only, like `components`: the backend storage provider that
+         * SERVES the storage is CODE, keyed by the same enum member and naming this
+         * provider back as its `connectedProviderRef`; a pin holds the two ends equal.
+         */
+        fileStorage: z.ZodOptional<z.ZodEnum<typeof FileStorageAccepted>>;
     }, z.core.$loose>>>;
 }, z.core.$strip>;
 export type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-entry.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;IAKtC;;;;OAIG;;;;;;;;;;;;;IAEH;;;;;OAKG;;;;;IAEH,0EAA0E;;;;;;;;IAE1E;;;;;;;;;OASG;;;;iBAEH,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;QA7BvC;;;;WAIG;;;;;;;;;;;;;QAEH;;;;;WAKG;;;;;QAEH,0EAA0E;;;;;;;;QAE1E;;;;;;;;;WASG;;;;;iBAOH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"frontend-provider-entry.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAS/D;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;IAKtC;;;;OAIG;;;;;;;;;;;;;IAEH;;;;;OAKG;;;;;IAEH,0EAA0E;;;;;;;;IAE1E;;;;;;;;;OASG;;;;IAEH;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;;OAiBG;;iBAEH,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;QAzDvC;;;;WAIG;;;;;;;;;;;;;QAEH;;;;;WAKG;;;;;QAEH,0EAA0E;;;;;;;;QAE1E;;;;;;;;;WASG;;;;QAEH;;;;;;;WAOG;;QAEH;;;;;;;;;;;;;;;;;WAiBG;;;iBAOH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { FileStorageAccepted } from '@wildo-ai/zod-decorators';
 import { ProviderMetadataSchema } from './provider-metadata.shared.schemas.js';
 import { ProviderFrontendComponentDescriptorsSchema, ProviderFrontendCspFootprintSchema, ProviderFrontendScriptDeclarationSchema, ProviderFrontendSdkDescriptorSchema, } from './provider-frontend-surface.shared.schemas.js';
 /**
@@ -67,6 +68,34 @@ export const FrontendProviderEntrySchema = z.looseObject({
      * a selection will contain, BEFORE it downloads any provider's component.
      */
     components: ProviderFrontendComponentDescriptorsSchema.optional(),
+    /**
+     * The public-config keys the provider module DECLARES it reads — the DATA
+     * half of its `publicConfigSchema`, mirrored here so the companion walk can
+     * refuse an application-supplied key the module never declared, without
+     * executing the module (#394 P3). Absent when the module's schema is not
+     * introspectable, which the overlay reads as "cannot enforce here", never as
+     * "declares nothing".
+     */
+    publicConfigKeys: z.array(z.string().min(1)).optional(),
+    /**
+     * The `z_file` storage this provider's file picker is the FRONT DOOR of — the
+     * join key between the provider vocabulary (`google-drive`) and the z_file
+     * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).
+     *
+     * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the
+     * vendor, so the FILES row it produces is stored in THAT storage, and a field
+     * may only receive it when its `storageAccepted` names that storage. The
+     * chooser therefore offers such a picker only to a field that accepts the
+     * storage, and the backend refuses the link otherwise — both read this
+     * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no
+     * storage: its bytes are ingested into whatever the field's own storage is,
+     * and it is offered to every field.
+     *
+     * DATA half only, like `components`: the backend storage provider that
+     * SERVES the storage is CODE, keyed by the same enum member and naming this
+     * provider back as its `connectedProviderRef`; a pin holds the two ends equal.
+     */
+    fileStorage: z.enum(FileStorageAccepted).optional(),
 });
 export const FrontendProvidersBlockSchema = z.object({
     providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-entry.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACvD,QAAQ,EAAE,sBAAsB;IAChC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,GAAG,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACnD,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,QAAQ,EAAE;IACpE;;;;;;;;;OASG;IACH,UAAU,EAAE,0CAA0C,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { ProviderMetadataSchema } from './provider-metadata.shared.schemas';\nimport {\n  ProviderFrontendComponentDescriptorsSchema,\n  ProviderFrontendCspFootprintSchema,\n  ProviderFrontendScriptDeclarationSchema,\n  ProviderFrontendSdkDescriptorSchema,\n} from './provider-frontend-surface.shared.schemas';\n\n/**\n * Bundle-safe frontend provider atoms shared by every browser-bound runtime.\n *\n * This file intentionally stops at the provider-entry/block level so\n * `@wildo-ai/saas-models/public-runtime` can expose the types without pulling\n * the heavier application-config bootstrap contract into browser bundles.\n */\n\n/**\n * One provider as it crosses the DATA channel: authored on a facet module,\n * projected into a companion contribution, materialized into the generated\n * frontend-services artifact, served on `/application-config`, and parsed by the\n * app, the website and the technical doc.\n *\n * ## Why this is a LOOSE object\n *\n * It is a WIRE RECORD produced by one package version and read by another, and a\n * strict object silently STRIPS what a newer producer added — which is how a\n * provider's CSP footprint would vanish between the CLI that wrote it and the\n * runtime that needs it, leaving a policy that is correct in development\n * (report-only) and wrong in production (enforcing). #328 made\n * `ProviderCompanionContributionSchema` loose for exactly this reason, one file\n * over; the entry rides INSIDE that contribution, so leaving it strict left the\n * hole one layer down. Required fields stay required; unknown keys are kept\n * rather than dropped, so a re-emitting consumer cannot silently discard what it\n * did not understand.\n *\n * ## What may and may not be added here\n *\n * Only things a JSON channel can carry. A function-valued field would be\n * stripped by `JSON.stringify` with no error anywhere — the provider would look\n * declared and do nothing. Executable provider surface (`sdk.activate`,\n * `publicConfigSchema`, and, from S4b, `components`) belongs on the facet module\n * types in `@wildo-ai/external-connectors-public`, which reach a bundle through\n * the generated `frontend-providers.generated.ts` CODE channel instead.\n */\nexport const FrontendProviderEntrySchema = z.looseObject({\n  metadata: ProviderMetadataSchema,\n  providerCapabilities: z.array(z.string().min(1)),\n  protocols: z.array(z.string().min(1)),\n  publicConfig: z.record(z.string(), z.unknown()).optional(),\n  /**\n   * Origins this provider needs the composed CSP of its service to admit.\n   * Consumed by `resolveCspPolicy`'s provider layer; absent means the provider\n   * reaches nothing beyond the surface's own origin.\n   */\n  csp: ProviderFrontendCspFootprintSchema.optional(),\n  /**\n   * The vendor SDK package this provider loads on demand — the DATA half only.\n   * Its presence tells a surface that the provider HAS executable code to\n   * activate, which is the difference between \"declared\" and \"live\" once the\n   * CODE channel is consulted.\n   */\n  sdk: ProviderFrontendSdkDescriptorSchema.optional(),\n  /** Third-party `<script>` tags the surface must add for this provider. */\n  scripts: z.array(ProviderFrontendScriptDeclarationSchema).optional(),\n  /**\n   * The components this provider contributes, by capability — the DATA half\n   * only, exactly as `sdk` is. It says a component EXISTS and what contract it\n   * commits to; the loader stays on the CODE channel, because a function does\n   * not survive `JSON.stringify` and a field that vanishes silently is worse\n   * than a field that was never declared.\n   *\n   * A surface reads this to know a chooser is worth rendering, and to know what\n   * a selection will contain, BEFORE it downloads any provider's component.\n   */\n  components: ProviderFrontendComponentDescriptorsSchema.optional(),\n});\nexport type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;\n\nexport const FrontendProvidersBlockSchema = z.object({\n  providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),\n});\nexport type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;\n"]}
+{"version":3,"file":"frontend-provider-entry.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACvD,QAAQ,EAAE,sBAAsB;IAChC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,GAAG,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACnD,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,QAAQ,EAAE;IACpE;;;;;;;;;OASG;IACH,UAAU,EAAE,0CAA0C,CAAC,QAAQ,EAAE;IACjE;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { ProviderMetadataSchema } from './provider-metadata.shared.schemas';\nimport {\n  ProviderFrontendComponentDescriptorsSchema,\n  ProviderFrontendCspFootprintSchema,\n  ProviderFrontendScriptDeclarationSchema,\n  ProviderFrontendSdkDescriptorSchema,\n} from './provider-frontend-surface.shared.schemas';\n\n/**\n * Bundle-safe frontend provider atoms shared by every browser-bound runtime.\n *\n * This file intentionally stops at the provider-entry/block level so\n * `@wildo-ai/saas-models/public-runtime` can expose the types without pulling\n * the heavier application-config bootstrap contract into browser bundles.\n */\n\n/**\n * One provider as it crosses the DATA channel: authored on a facet module,\n * projected into a companion contribution, materialized into the generated\n * frontend-services artifact, served on `/application-config`, and parsed by the\n * app, the website and the technical doc.\n *\n * ## Why this is a LOOSE object\n *\n * It is a WIRE RECORD produced by one package version and read by another, and a\n * strict object silently STRIPS what a newer producer added — which is how a\n * provider's CSP footprint would vanish between the CLI that wrote it and the\n * runtime that needs it, leaving a policy that is correct in development\n * (report-only) and wrong in production (enforcing). #328 made\n * `ProviderCompanionContributionSchema` loose for exactly this reason, one file\n * over; the entry rides INSIDE that contribution, so leaving it strict left the\n * hole one layer down. Required fields stay required; unknown keys are kept\n * rather than dropped, so a re-emitting consumer cannot silently discard what it\n * did not understand.\n *\n * ## What may and may not be added here\n *\n * Only things a JSON channel can carry. A function-valued field would be\n * stripped by `JSON.stringify` with no error anywhere — the provider would look\n * declared and do nothing. Executable provider surface (`sdk.activate`,\n * `publicConfigSchema`, and, from S4b, `components`) belongs on the facet module\n * types in `@wildo-ai/external-connectors-public`, which reach a bundle through\n * the generated `frontend-providers.generated.ts` CODE channel instead.\n */\nexport const FrontendProviderEntrySchema = z.looseObject({\n  metadata: ProviderMetadataSchema,\n  providerCapabilities: z.array(z.string().min(1)),\n  protocols: z.array(z.string().min(1)),\n  publicConfig: z.record(z.string(), z.unknown()).optional(),\n  /**\n   * Origins this provider needs the composed CSP of its service to admit.\n   * Consumed by `resolveCspPolicy`'s provider layer; absent means the provider\n   * reaches nothing beyond the surface's own origin.\n   */\n  csp: ProviderFrontendCspFootprintSchema.optional(),\n  /**\n   * The vendor SDK package this provider loads on demand — the DATA half only.\n   * Its presence tells a surface that the provider HAS executable code to\n   * activate, which is the difference between \"declared\" and \"live\" once the\n   * CODE channel is consulted.\n   */\n  sdk: ProviderFrontendSdkDescriptorSchema.optional(),\n  /** Third-party `<script>` tags the surface must add for this provider. */\n  scripts: z.array(ProviderFrontendScriptDeclarationSchema).optional(),\n  /**\n   * The components this provider contributes, by capability — the DATA half\n   * only, exactly as `sdk` is. It says a component EXISTS and what contract it\n   * commits to; the loader stays on the CODE channel, because a function does\n   * not survive `JSON.stringify` and a field that vanishes silently is worse\n   * than a field that was never declared.\n   *\n   * A surface reads this to know a chooser is worth rendering, and to know what\n   * a selection will contain, BEFORE it downloads any provider's component.\n   */\n  components: ProviderFrontendComponentDescriptorsSchema.optional(),\n  /**\n   * The public-config keys the provider module DECLARES it reads — the DATA\n   * half of its `publicConfigSchema`, mirrored here so the companion walk can\n   * refuse an application-supplied key the module never declared, without\n   * executing the module (#394 P3). Absent when the module's schema is not\n   * introspectable, which the overlay reads as \"cannot enforce here\", never as\n   * \"declares nothing\".\n   */\n  publicConfigKeys: z.array(z.string().min(1)).optional(),\n  /**\n   * The `z_file` storage this provider's file picker is the FRONT DOOR of — the\n   * join key between the provider vocabulary (`google-drive`) and the z_file\n   * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).\n   *\n   * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the\n   * vendor, so the FILES row it produces is stored in THAT storage, and a field\n   * may only receive it when its `storageAccepted` names that storage. The\n   * chooser therefore offers such a picker only to a field that accepts the\n   * storage, and the backend refuses the link otherwise — both read this\n   * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no\n   * storage: its bytes are ingested into whatever the field's own storage is,\n   * and it is offered to every field.\n   *\n   * DATA half only, like `components`: the backend storage provider that\n   * SERVES the storage is CODE, keyed by the same enum member and naming this\n   * provider back as its `connectedProviderRef`; a pin holds the two ends equal.\n   */\n  fileStorage: z.enum(FileStorageAccepted).optional(),\n});\nexport type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;\n\nexport const FrontendProvidersBlockSchema = z.object({\n  providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),\n});\nexport type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;\n"]}