@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-surface.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,2DAAwB,CAAA;IACxB,6DAA0B,CAAA;IAC1B,yDAAsB,CAAA;IACtB,qDAAkB,CAAA;IAClB,yDAAsB,CAAA;IACtB,uDAAoB,CAAA;AACtB,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,8DAA8D;IAC9D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAyBH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAoD;IAEpD,OAAO,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,kEAAkE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,gIAAgI;IAChI,4DAAuB,CAAA;IACvB,kHAAkH;IAClH,wEAAmC,CAAA;AACrC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,mDAAmD;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACjE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mGAAmG;kBACjG,+EAA+E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,iCAuBX;AAvBD,WAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,0EAAqC,CAAA;IACrC;;;;;;OAMG;IACH,oFAA+C,CAAA;IAC/C;;;;;OAKG;IACH,kFAA6C,CAAA;AAC/C,CAAC,EAvBW,iCAAiC,KAAjC,iCAAiC,QAuB5C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,gCAAgC,GAGlC;IACF,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,gBAAgB;IAC3D,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,GAAG,CAAC,EAAE,YAAY;IACnD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,aAAa;CACtD,CAAC;AACF,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * Frontend-surface atoms a provider declares: what it needs the page to be\n * ALLOWED to reach (its CSP footprint), which vendor SDK package it loads, and\n * which third-party `<script>` tags it asks the surface to add.\n *\n * ## Why these are DATA and live here\n *\n * A frontend provider reaches its surface through TWO channels, and only one of\n * them can carry code:\n *\n *   - the **DATA** channel — `FrontendProviderEntry`, projected by the backend\n *     into `/application-config` and materialized into the generated\n *     frontend-services artifact. It is JSON end to end, so nothing\n *     function-valued survives it (it used to be cast to a module type anyway,\n *     which is the defect this split closes);\n *   - the **CODE** channel — the provider package's own facet barrel, imported\n *     by the bundle through the generated `frontend-providers.generated.ts`.\n *\n * Everything in this file is the DATA half. It is what the CLI, the CSP\n * composer and the bundle-isolation policy need to SEE without executing any\n * frontend module — and the CLI genuinely cannot execute one: it is a Node\n * process and these modules are browser-bound. The executable half (`sdk.activate`,\n * `publicConfigSchema`) lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this boundary.\n *\n * Added by slice S4a of epic #337 (issue #332).\n */\n\nimport { z } from 'zod';\n\n/**\n * The origins a provider needs the composed Content-Security-Policy to admit,\n * grouped by WHAT THE PROVIDER IS REACHING rather than by CSP directive name.\n *\n * ## Why semantic buckets and not directive names\n *\n * `CSP_DIRECTIVE_NAMES` is a closed vocabulary that already has one named\n * runtime source, in `@wildo-ai/platform-config-lib`. That package DEPENDS on\n * this one, so this file cannot reference it, and re-declaring the list here\n * would create a second source for one vocabulary — precisely what the\n * one-named-source rule exists to prevent, and the way the two copies would\n * drift the first time a directive is added.\n *\n * Keying on intent instead is also the better contract. A provider author knows\n * \"my SDK is fetched from `https://js.stripe.com` and it calls back to\n * `https://api.stripe.com`\"; which directive grades which fetch is framework\n * knowledge, and it lives in exactly one place — the bucket-to-directive\n * mapping in `platform-config-lib`'s `csp-emit.ts`.\n *\n * ## Why it is STRICT while the entry that carries it is loose\n *\n * The entry is a WIRE record read by a possibly-older consumer, so it tolerates\n * unknown keys (see `frontend-provider-entry.shared.schemas.ts`). This footprint\n * is AUTHORED, by a provider package, and validated where it is authored — so a\n * misspelled bucket must fail loudly rather than contribute nothing. That\n * distinction matters more here than anywhere else in the frontend surface:\n * CSP is enforced in production and report-only in development, so a bucket that\n * silently contributes nothing is invisible until the provider breaks in\n * production only.\n *\n * Adding a bucket is not a one-sided producer change either — a new bucket is\n * useless until `csp-emit.ts` maps it to a directive — so strictness costs no\n * version-skew tolerance that was ever available.\n *\n * Every field defaults to `[]`: a provider that declares a footprint at all is\n * making a complete statement about the buckets it did not name.\n */\n/**\n * Which bucket an origin lands in, as a value a provider can name.\n *\n * The bucket names are already the footprint's field names; this enum is what\n * lets a provider REFER to one — a derived origin has to say where it goes, and\n * a bare string there would be a second, unexplained spelling of a closed\n * vocabulary. A compile-time check below pins the two together.\n */\nexport enum ProviderFrontendCspOriginBucket {\n  SCRIPT = 'scriptOrigins',\n  CONNECT = 'connectOrigins',\n  FRAME = 'frameOrigins',\n  IMG = 'imgOrigins',\n  STYLE = 'styleOrigins',\n  FONT = 'fontOrigins',\n}\n\n/**\n * An origin the framework must READ OUT OF the provider's own public config,\n * because the provider cannot know it.\n *\n * The case that forced this: an error-monitoring provider sends to the host\n * inside its DSN, and a product-analytics provider to whatever `apiHost` the\n * application configured — including a self-hosted one. Both are per\n * APPLICATION, and often per ENVIRONMENT, so no static list on the provider\n * module can contain them. Without this the application would have to author\n * the same host twice — once as the provider's config and once in its CSP — and\n * the copy that drifts fails in production only, because development is\n * report-only.\n *\n * Resolution is data, not code: the CLI takes `publicConfig[publicConfigKey]`,\n * reads its URL origin, and adds it to `bucket`. An absent key contributes\n * nothing (the provider simply is not configured for that service); a key that\n * is present and is NOT a URL fails the sync loudly, because silently dropping\n * it is the exact failure this exists to prevent.\n */\nexport const ProviderFrontendCspDerivedOriginSchema = z.strictObject({\n  /** Key in this provider's `publicConfig` whose value is a URL. */\n  publicConfigKey: z.string().min(1),\n  bucket: z.enum(ProviderFrontendCspOriginBucket),\n});\nexport type ProviderFrontendCspDerivedOrigin = z.infer<typeof ProviderFrontendCspDerivedOriginSchema>;\n\nexport const ProviderFrontendCspFootprintSchema = z.strictObject({\n  /** Origins the surface loads executable script from (`script-src`). */\n  scriptOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider's code opens fetch / XHR / WebSocket connections to (`connect-src`). */\n  connectOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider embeds in an iframe — a picker, a checkout, a meeting (`frame-src`). */\n  frameOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads images or pixels from (`img-src`). */\n  imgOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads stylesheets from (`style-src`). */\n  styleOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads web fonts from (`font-src`). */\n  fontOrigins: z.array(z.string().min(1)).default([]),\n  /**\n   * Origins the framework reads out of this provider's own `publicConfig`,\n   * for the endpoints a provider cannot know in advance. See\n   * {@link ProviderFrontendCspDerivedOriginSchema}.\n   */\n  derivedOrigins: z.array(ProviderFrontendCspDerivedOriginSchema).default([]),\n});\nexport type ProviderFrontendCspFootprint = z.infer<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * The footprint as a provider AUTHORS it: name only the buckets you reach.\n *\n * Authoring and the wire are deliberately different shapes, and the asymmetry\n * is the point.\n *\n *   - **Authoring is partial.** A provider that only loads a script should write\n *     `{ scriptOrigins: ['https://js.acme.com'] }`, not that plus four empty\n *     arrays. Four empty arrays are noise at exactly the place the declaration\n *     should be readable, and noise is what stops a reviewer noticing the one\n *     line that grants an origin.\n *   - **The wire is total.** Every bucket is present by the time the footprint\n *     reaches an entry, so the CSP composer never branches on absence and the\n *     staleness comparison between a served footprint and its module's has two\n *     comparable shapes rather than a partial and a total that differ in every\n *     bucket nobody named.\n *\n * Derived as `z.input` rather than written as a `Partial<…>`, so it cannot drift\n * from the schema: adding a bucket makes it optional here automatically.\n */\nexport type ProviderFrontendCspFootprintDeclaration = z.input<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * Fills in the buckets a declaration did not name.\n *\n * The ONE place that normalization happens, used by the projection that builds\n * an entry and by the hydration join that compares one against a module. Two\n * copies would eventually disagree about whether an unnamed bucket is `[]` or\n * absent, and the join reads that difference as a stale artifact — a false\n * alarm on the diagnostic whose whole job is to be believed.\n */\nexport function normalizeProviderFrontendCspFootprint(\n  declaration: ProviderFrontendCspFootprintDeclaration,\n): ProviderFrontendCspFootprint {\n  return ProviderFrontendCspFootprintSchema.parse(declaration);\n}\n\n/**\n * The DATA half of a provider's `sdk` declaration: WHICH npm package carries the\n * vendor SDK, and at which range.\n *\n * The CODE half — the dynamic import and the vendor's initialization call — is\n * `ProviderFrontendSdk.activate` on the facet module type, and is deliberately\n * absent here: a function cannot cross a JSON channel, and a channel that\n * silently drops one is worse than a channel that never carried it.\n *\n * The descriptor is not decoration. It is what the bundle-isolation policy reads\n * to decide whether a bare specifier a provider package imports was DECLARED,\n * what an application's dependency alignment needs in order to install the SDK\n * as an optional peer, and what a human reads when asking why a bundle grew.\n *\n * Who authors it, since the epic's bulk-integration model was reversed on\n * 2026-09-06: a FIRST-CLASS provider package or an application's own provider\n * module. The scraper-mapper that fills the catalogue emits identity, auth, a\n * secrets contract and an operation catalogue on the `rest` arm — a\n * backend-only package — so a scraped provider has no frontend facet to carry\n * this. That is a narrowing of the population, not of the contract: the pickers\n * and embeds this surface exists for were always the hand-authored kind.\n */\nexport const ProviderFrontendSdkDescriptorSchema = z.strictObject({\n  /** npm package name of the vendor SDK, e.g. `@sentry/browser`. */\n  packageName: z.string().min(1),\n  /**\n   * Semver range the provider was built against. Optional because a provider\n   * that pins its SDK as a direct dependency has already said so in its own\n   * manifest; stating it here as well would be a second copy of that pin.\n   */\n  versionRange: z.string().min(1).optional(),\n});\nexport type ProviderFrontendSdkDescriptor = z.infer<typeof ProviderFrontendSdkDescriptorSchema>;\n\n/**\n * `crossorigin` attribute values for a provider-declared `<script>`.\n *\n * A closed vocabulary with a named runtime source rather than a bare literal\n * union, so each member can carry why it exists — and there are exactly two\n * reasons to pick one over the other.\n */\nexport enum ProviderFrontendScriptCrossOrigin {\n  /** No credentials are sent; the response must carry `Access-Control-Allow-Origin`. The right choice for a public CDN script. */\n  ANONYMOUS = 'anonymous',\n  /** Cookies and TLS client certificates are sent. Only for a vendor that authenticates the script fetch itself. */\n  USE_CREDENTIALS = 'use-credentials',\n}\n\n/**\n * A third-party `<script>` a provider asks its surface to add — the case a\n * dynamic `import()` cannot serve, because the vendor ships a global-installing\n * tag rather than an npm module (reCAPTCHA, most tag managers, several chat\n * widgets).\n *\n * `integrity` is Subresource Integrity. It is optional because a vendor that\n * versionless-serves a mutable URL (again, reCAPTCHA) cannot publish a stable\n * hash — but when it IS given the surface must also send `crossorigin`, or the\n * browser refuses the integrity check outright. That coupling is enforced below\n * rather than left to each surface to remember.\n */\nexport const ProviderFrontendScriptDeclarationSchema = z\n  .strictObject({\n    /** Absolute URL of the script. Its origin must also appear in `csp.scriptOrigins`. */\n    src: z.string().min(1),\n    /** Subresource-integrity hash, e.g. `sha384-…`. */\n    integrity: z.string().min(1).optional(),\n    crossOrigin: z.enum(ProviderFrontendScriptCrossOrigin).optional(),\n    async: z.boolean().optional(),\n    defer: z.boolean().optional(),\n  })\n  .superRefine((declaration, context) => {\n    if (declaration.integrity !== undefined && declaration.crossOrigin === undefined) {\n      context.addIssue({\n        code: 'custom',\n        path: ['crossOrigin'],\n        message:\n          'A script declaring `integrity` must also declare `crossOrigin`; without it the browser skips the '\n          + 'integrity check for a cross-origin script, so the hash would protect nothing.',\n      });\n    }\n  });\nexport type ProviderFrontendScriptDeclaration = z.infer<typeof ProviderFrontendScriptDeclarationSchema>;\n\n/**\n * WHAT a provider's component hands back, when what it hands back is a thing\n * rather than a value.\n *\n * ## The question this answers, and why it is a DECLARATION\n *\n * An application's objective is that it calls third-party APIs directly from\n * custom frontend components. On the backend that is unambiguous. In a browser\n * it is not, because a tenant credential must never get there — so a picker for\n * a credentialed vendor and a picker for a vendor with a browser-safe public\n * token cannot hand back the same thing, and the framework surface that\n * receives a selection has to know which before it mounts anything.\n *\n * Settled 2026-09-07 (issue #383, recorded as Q5 of the provider-architecture\n * plan): **per vendor, DECLARED.** Both shapes are real and both ship; which one\n * a provider emits is a static fact about that provider, stated here and\n * visible on the DATA channel without executing a line of its code.\n *\n * The word doing the work is *declared*. A discriminated union alone would let a\n * provider decide at runtime, which is the shape the decision explicitly\n * rejected — so the framework REFUSES a selection whose discriminant contradicts\n * this field. Without that refusal the declaration is decoration, and a reviewer\n * reading a provider's manifest would be reading a wish.\n *\n * ## Why a single value and not a set\n *\n * A provider that genuinely could emit either — Google's Picker hands back both\n * a file id and a URL, and which is usable depends on the granted OAuth scope —\n * was the argument for `selectionDelivery: [...]`. Rejected: an array puts the\n * choice back at runtime, which is the half of the decision that carries all the\n * weight. A vendor whose two modes are both wanted contributes two components,\n * and the chooser then shows them as what they are — two different things a user\n * can pick between — rather than one component whose behaviour a reader cannot\n * predict.\n *\n * ## What it means for CSP\n *\n * `REMOTE_REFERENCE` does NOT imply a provider needs no `connectOrigins`: a\n * picker still talks to its vendor to RENDER, even when the bytes it selects are\n * fetched later by the backend. So this field does not gate the CSP buckets, and\n * a guard inferring otherwise would break every real picker. What it does gate\n * is where the SELECTED OBJECT travels.\n */\nexport enum ProviderFrontendSelectionDelivery {\n  /**\n   * An opaque handle only the application backend can resolve — a Drive file id,\n   * a DAM asset key. The browser never holds the bytes and never authenticates\n   * to the vendor for them; the framework routes the reference to the\n   * application's executor door, which holds the tenant credential.\n   */\n  REMOTE_REFERENCE = 'REMOTE_REFERENCE',\n  /**\n   * Bytes the browser already holds, as a `File`. Available only to a vendor\n   * whose picker runs on a browser-safe grant — a publishable key, a\n   * user-consented OAuth token, a picker's own scoped grant — so nothing\n   * tenant-secret is involved. The framework uploads it exactly as it uploads a\n   * file chosen from disk.\n   */\n  BROWSER_READABLE_FILE = 'BROWSER_READABLE_FILE',\n  /**\n   * A URL the browser may fetch, under the same browser-safe-grant condition as\n   * `BROWSER_READABLE_FILE`. Distinct from it because the framework must fetch\n   * before it can upload, and that fetch is a network call the composed CSP has\n   * to admit — a difference the surface cannot discover from a `File`.\n   */\n  BROWSER_READABLE_URL = 'BROWSER_READABLE_URL',\n}\n\n/**\n * The DATA half of one component a provider contributes — everything about it\n * that a reviewer, the CLI or a build step can read without running a browser.\n *\n * The loader is the CODE half and stays on the facet module in\n * `@wildo-ai/external-connectors-public`, exactly as `sdk.activate` does. What\n * crosses the wire is the fact that a component EXISTS for this capability, plus\n * the contract it commits to.\n *\n * Strict, and for the same reason the CSP footprint is: this is AUTHORED by a\n * provider package rather than received from an older producer, so a misspelled\n * key must fail where it is written instead of contributing nothing.\n */\nexport const ProviderFrontendComponentDescriptorSchema = z.strictObject({\n  /**\n   * What a selection from this component contains. Absent for a capability whose\n   * component returns a plain value rather than a thing — a captcha widget hands\n   * back a token, and there is no delivery question to answer about a string.\n   */\n  selectionDelivery: z.enum(ProviderFrontendSelectionDelivery).optional(),\n});\nexport type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFrontendComponentDescriptorSchema>;\n\n/**\n * A provider's component descriptors, keyed by the CAPABILITY each fills.\n *\n * The key is a capability token rather than a member of a closed enum because\n * `ProviderCapability` is OPEN — an application extends it by module\n * augmentation — so a `z.enum` here would refuse an application's own\n * capability. The registry that consumes this makes the same choice for the same\n * reason.\n */\nexport const ProviderFrontendComponentDescriptorsSchema = z.record(\n  z.string().min(1),\n  ProviderFrontendComponentDescriptorSchema,\n);\nexport type ProviderFrontendComponentDescriptors = z.infer<typeof ProviderFrontendComponentDescriptorsSchema>;\n\n/**\n * Pins every bucket member to a real field of the footprint.\n *\n * A member whose value is not a footprint key would be authorable, would parse,\n * and would contribute nothing — in production only, because CSP is report-only\n * in development. This makes it a compile error instead.\n */\nconst _everyBucketNamesAFootprintField: Record<\n  ProviderFrontendCspOriginBucket,\n  keyof Omit<ProviderFrontendCspFootprint, 'derivedOrigins'>\n> = {\n  [ProviderFrontendCspOriginBucket.SCRIPT]: 'scriptOrigins',\n  [ProviderFrontendCspOriginBucket.CONNECT]: 'connectOrigins',\n  [ProviderFrontendCspOriginBucket.FRAME]: 'frameOrigins',\n  [ProviderFrontendCspOriginBucket.IMG]: 'imgOrigins',\n  [ProviderFrontendCspOriginBucket.STYLE]: 'styleOrigins',\n  [ProviderFrontendCspOriginBucket.FONT]: 'fontOrigins',\n};\nvoid _everyBucketNamesAFootprintField;\n"]}
+{"version":3,"file":"provider-frontend-surface.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,2DAAwB,CAAA;IACxB,6DAA0B,CAAA;IAC1B,yDAAsB,CAAA;IACtB,qDAAkB,CAAA;IAClB,yDAAsB,CAAA;IACtB,uDAAoB,CAAA;AACtB,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,8DAA8D;IAC9D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAyBH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAoD;IAEpD,OAAO,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,kEAAkE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,gIAAgI;IAChI,4DAAuB,CAAA;IACvB,kHAAkH;IAClH,wEAAmC,CAAA;AACrC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,mDAAmD;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACjE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mGAAmG;kBACjG,+EAA+E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,iCAuBX;AAvBD,WAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,0EAAqC,CAAA;IACrC;;;;;;OAMG;IACH,oFAA+C,CAAA;IAC/C;;;;;OAKG;IACH,kFAA6C,CAAA;AAC/C,CAAC,EAvBW,iCAAiC,KAAjC,iCAAiC,QAuB5C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,gCAAgC,GAGlC;IACF,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,gBAAgB;IAC3D,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,GAAG,CAAC,EAAE,YAAY;IACnD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,aAAa;CACtD,CAAC;AACF,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * Frontend-surface atoms a provider declares: what it needs the page to be\n * ALLOWED to reach (its CSP footprint), which vendor SDK package it loads, and\n * which third-party `<script>` tags it asks the surface to add.\n *\n * ## Why these are DATA and live here\n *\n * A frontend provider reaches its surface through TWO channels, and only one of\n * them can carry code:\n *\n *   - the **DATA** channel — `FrontendProviderEntry`, projected by the backend\n *     into `/application-config` and materialized into the generated\n *     frontend-services artifact. It is JSON end to end, so nothing\n *     function-valued survives it (it used to be cast to a module type anyway,\n *     which is the defect this split closes);\n *   - the **CODE** channel — the provider package's own facet barrel, imported\n *     by the bundle through the generated `frontend-providers.generated.ts`.\n *\n * Everything in this file is the DATA half. It is what the CLI, the CSP\n * composer and the bundle-isolation policy need to SEE without executing any\n * frontend module — and the CLI genuinely cannot execute one: it is a Node\n * process and these modules are browser-bound. The executable half (`sdk.activate`,\n * `publicConfigSchema`) lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this boundary.\n *\n * Added by slice S4a of epic #337 (issue #332).\n */\n\nimport { z } from 'zod';\n\n/**\n * The origins a provider needs the composed Content-Security-Policy to admit,\n * grouped by WHAT THE PROVIDER IS REACHING rather than by CSP directive name.\n *\n * ## Why semantic buckets and not directive names\n *\n * `CSP_DIRECTIVE_NAMES` is a closed vocabulary that already has one named\n * runtime source, in `@wildo-ai/platform-config-lib`. That package DEPENDS on\n * this one, so this file cannot reference it, and re-declaring the list here\n * would create a second source for one vocabulary — precisely what the\n * one-named-source rule exists to prevent, and the way the two copies would\n * drift the first time a directive is added.\n *\n * Keying on intent instead is also the better contract. A provider author knows\n * \"my SDK is fetched from `https://js.stripe.com` and it calls back to\n * `https://api.stripe.com`\"; which directive grades which fetch is framework\n * knowledge, and it lives in exactly one place — the bucket-to-directive\n * mapping in `platform-config-lib`'s `csp-emit.ts`.\n *\n * ## Why it is STRICT while the entry that carries it is loose\n *\n * The entry is a WIRE record read by a possibly-older consumer, so it tolerates\n * unknown keys (see `frontend-provider-entry.shared.schemas.ts`). This footprint\n * is AUTHORED, by a provider package, and validated where it is authored — so a\n * misspelled bucket must fail loudly rather than contribute nothing. That\n * distinction matters more here than anywhere else in the frontend surface:\n * CSP is enforced in production and report-only in development, so a bucket that\n * silently contributes nothing is invisible until the provider breaks in\n * production only.\n *\n * Adding a bucket is not a one-sided producer change either — a new bucket is\n * useless until `csp-emit.ts` maps it to a directive — so strictness costs no\n * version-skew tolerance that was ever available.\n *\n * Every field defaults to `[]`: a provider that declares a footprint at all is\n * making a complete statement about the buckets it did not name.\n */\n/**\n * Which bucket an origin lands in, as a value a provider can name.\n *\n * The bucket names are already the footprint's field names; this enum is what\n * lets a provider REFER to one — a derived origin has to say where it goes, and\n * a bare string there would be a second, unexplained spelling of a closed\n * vocabulary. A compile-time check below pins the two together.\n */\nexport enum ProviderFrontendCspOriginBucket {\n  SCRIPT = 'scriptOrigins',\n  CONNECT = 'connectOrigins',\n  FRAME = 'frameOrigins',\n  IMG = 'imgOrigins',\n  STYLE = 'styleOrigins',\n  FONT = 'fontOrigins',\n}\n\n/**\n * An origin the framework must READ OUT OF the provider's own public config,\n * because the provider cannot know it.\n *\n * The case that forced this: an error-monitoring provider sends to the host\n * inside its DSN, and a product-analytics provider to whatever `apiHost` the\n * application configured — including a self-hosted one. Both are per\n * APPLICATION, and often per ENVIRONMENT, so no static list on the provider\n * module can contain them. Without this the application would have to author\n * the same host twice — once as the provider's config and once in its CSP — and\n * the copy that drifts fails in production only, because development is\n * report-only.\n *\n * Resolution is data, not code: the CLI takes `publicConfig[publicConfigKey]`,\n * reads its URL origin, and adds it to `bucket`. An absent key contributes\n * nothing (the provider simply is not configured for that service); a key that\n * is present and is NOT a URL fails the sync loudly, because silently dropping\n * it is the exact failure this exists to prevent.\n */\nexport const ProviderFrontendCspDerivedOriginSchema = z.strictObject({\n  /** Key in this provider's `publicConfig` whose value is a URL. */\n  publicConfigKey: z.string().min(1),\n  bucket: z.enum(ProviderFrontendCspOriginBucket),\n});\nexport type ProviderFrontendCspDerivedOrigin = z.infer<typeof ProviderFrontendCspDerivedOriginSchema>;\n\nexport const ProviderFrontendCspFootprintSchema = z.strictObject({\n  /** Origins the surface loads executable script from (`script-src`). */\n  scriptOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider's code opens fetch / XHR / WebSocket connections to (`connect-src`). */\n  connectOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider embeds in an iframe — a picker, a checkout, a meeting (`frame-src`). */\n  frameOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads images or pixels from (`img-src`). */\n  imgOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads stylesheets from (`style-src`). */\n  styleOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads web fonts from (`font-src`). */\n  fontOrigins: z.array(z.string().min(1)).default([]),\n  /**\n   * Origins the framework reads out of this provider's own `publicConfig`,\n   * for the endpoints a provider cannot know in advance. See\n   * {@link ProviderFrontendCspDerivedOriginSchema}.\n   */\n  derivedOrigins: z.array(ProviderFrontendCspDerivedOriginSchema).default([]),\n});\nexport type ProviderFrontendCspFootprint = z.infer<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * The footprint as a provider AUTHORS it: name only the buckets you reach.\n *\n * Authoring and the wire are deliberately different shapes, and the asymmetry\n * is the point.\n *\n *   - **Authoring is partial.** A provider that only loads a script should write\n *     `{ scriptOrigins: ['https://js.acme.com'] }`, not that plus four empty\n *     arrays. Four empty arrays are noise at exactly the place the declaration\n *     should be readable, and noise is what stops a reviewer noticing the one\n *     line that grants an origin.\n *   - **The wire is total.** Every bucket is present by the time the footprint\n *     reaches an entry, so the CSP composer never branches on absence and the\n *     staleness comparison between a served footprint and its module's has two\n *     comparable shapes rather than a partial and a total that differ in every\n *     bucket nobody named.\n *\n * Derived as `z.input` rather than written as a `Partial<…>`, so it cannot drift\n * from the schema: adding a bucket makes it optional here automatically.\n */\nexport type ProviderFrontendCspFootprintDeclaration = z.input<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * Fills in the buckets a declaration did not name.\n *\n * The ONE place that normalization happens, used by the projection that builds\n * an entry and by the hydration join that compares one against a module. Two\n * copies would eventually disagree about whether an unnamed bucket is `[]` or\n * absent, and the join reads that difference as a stale artifact — a false\n * alarm on the diagnostic whose whole job is to be believed.\n */\nexport function normalizeProviderFrontendCspFootprint(\n  declaration: ProviderFrontendCspFootprintDeclaration,\n): ProviderFrontendCspFootprint {\n  return ProviderFrontendCspFootprintSchema.parse(declaration);\n}\n\n/**\n * The DATA half of a provider's `sdk` declaration: WHICH npm package carries the\n * vendor SDK, and at which range.\n *\n * The CODE half — the dynamic import and the vendor's initialization call — is\n * `ProviderFrontendSdk.activate` on the facet module type, and is deliberately\n * absent here: a function cannot cross a JSON channel, and a channel that\n * silently drops one is worse than a channel that never carried it.\n *\n * The descriptor is not decoration. It is what the bundle-isolation policy reads\n * to decide whether a bare specifier a provider package imports was DECLARED,\n * what an application's dependency alignment needs in order to install the SDK\n * as an optional peer, and what a human reads when asking why a bundle grew.\n *\n * Who authors it, since the epic's bulk-integration model was reversed on\n * 2026-09-06: a FIRST-CLASS provider package or an application's own provider\n * module. The scraper-mapper that fills the catalogue emits identity, auth, a\n * secrets contract and an operation catalogue on the `rest` arm — a\n * backend-only package — so a scraped provider has no frontend facet to carry\n * this. That is a narrowing of the population, not of the contract: the pickers\n * and embeds this surface exists for were always the hand-authored kind.\n */\nexport const ProviderFrontendSdkDescriptorSchema = z.strictObject({\n  /** npm package name of the vendor SDK, e.g. `@sentry/browser`. */\n  packageName: z.string().min(1),\n  /**\n   * Semver range the provider was built against. Optional because a provider\n   * that pins its SDK as a direct dependency has already said so in its own\n   * manifest; stating it here as well would be a second copy of that pin.\n   */\n  versionRange: z.string().min(1).optional(),\n});\nexport type ProviderFrontendSdkDescriptor = z.infer<typeof ProviderFrontendSdkDescriptorSchema>;\n\n/**\n * `crossorigin` attribute values for a provider-declared `<script>`.\n *\n * A closed vocabulary with a named runtime source rather than a bare literal\n * union, so each member can carry why it exists — and there are exactly two\n * reasons to pick one over the other.\n */\nexport enum ProviderFrontendScriptCrossOrigin {\n  /** No credentials are sent; the response must carry `Access-Control-Allow-Origin`. The right choice for a public CDN script. */\n  ANONYMOUS = 'anonymous',\n  /** Cookies and TLS client certificates are sent. Only for a vendor that authenticates the script fetch itself. */\n  USE_CREDENTIALS = 'use-credentials',\n}\n\n/**\n * A third-party `<script>` a provider asks its surface to add — the case a\n * dynamic `import()` cannot serve, because the vendor ships a global-installing\n * tag rather than an npm module (reCAPTCHA, most tag managers, several chat\n * widgets).\n *\n * `integrity` is Subresource Integrity. It is optional because a vendor that\n * versionless-serves a mutable URL (again, reCAPTCHA) cannot publish a stable\n * hash — but when it IS given the surface must also send `crossorigin`, or the\n * browser refuses the integrity check outright. That coupling is enforced below\n * rather than left to each surface to remember.\n */\nexport const ProviderFrontendScriptDeclarationSchema = z\n  .strictObject({\n    /** Absolute URL of the script. Its origin must also appear in `csp.scriptOrigins`. */\n    src: z.string().min(1),\n    /** Subresource-integrity hash, e.g. `sha384-…`. */\n    integrity: z.string().min(1).optional(),\n    crossOrigin: z.enum(ProviderFrontendScriptCrossOrigin).optional(),\n    async: z.boolean().optional(),\n    defer: z.boolean().optional(),\n  })\n  .superRefine((declaration, context) => {\n    if (declaration.integrity !== undefined && declaration.crossOrigin === undefined) {\n      context.addIssue({\n        code: 'custom',\n        path: ['crossOrigin'],\n        message:\n          'A script declaring `integrity` must also declare `crossOrigin`; without it the browser skips the '\n          + 'integrity check for a cross-origin script, so the hash would protect nothing.',\n      });\n    }\n  });\nexport type ProviderFrontendScriptDeclaration = z.infer<typeof ProviderFrontendScriptDeclarationSchema>;\n\n/**\n * WHAT a provider's component hands back, when what it hands back is a thing\n * rather than a value.\n *\n * ## The question this answers, and why it is a DECLARATION\n *\n * An application's objective is that it calls third-party APIs directly from\n * custom frontend components. On the backend that is unambiguous. In a browser\n * it is not, because a tenant credential must never get there — so a picker for\n * a credentialed vendor and a picker for a vendor with a browser-safe public\n * token cannot hand back the same thing, and the framework surface that\n * receives a selection has to know which before it mounts anything.\n *\n * Settled 2026-09-07 (issue #383, recorded as Q5 of the provider-architecture\n * plan): **per vendor, DECLARED.** Both shapes are real and both ship; which one\n * a provider emits is a static fact about that provider, stated here and\n * visible on the DATA channel without executing a line of its code.\n *\n * The word doing the work is *declared*. A discriminated union alone would let a\n * provider decide at runtime, which is the shape the decision explicitly\n * rejected — so the framework REFUSES a selection whose discriminant contradicts\n * this field. Without that refusal the declaration is decoration, and a reviewer\n * reading a provider's manifest would be reading a wish.\n *\n * ## Why a single value and not a set\n *\n * A provider that genuinely could emit either — Google's Picker hands back both\n * a file id and a URL, and which is usable depends on the granted OAuth scope —\n * was the argument for `selectionDelivery: [...]`. Rejected: an array puts the\n * choice back at runtime, which is the half of the decision that carries all the\n * weight. A vendor whose two modes are both wanted contributes two components,\n * and the chooser then shows them as what they are — two different things a user\n * can pick between — rather than one component whose behaviour a reader cannot\n * predict.\n *\n * ## What it means for CSP\n *\n * `REMOTE_REFERENCE` does NOT imply a provider needs no `connectOrigins`: a\n * picker still talks to its vendor to RENDER, even when the bytes it selects are\n * fetched later by the backend. So this field does not gate the CSP buckets, and\n * a guard inferring otherwise would break every real picker. What it does gate\n * is where the SELECTED OBJECT travels.\n */\nexport enum ProviderFrontendSelectionDelivery {\n  /**\n   * An opaque handle only the application backend can resolve — a Drive file id,\n   * a DAM asset key. The browser never holds the bytes and never authenticates\n   * to the vendor for them; the framework routes the reference to the\n   * application's executor door, which holds the tenant credential.\n   */\n  REMOTE_REFERENCE = 'REMOTE_REFERENCE',\n  /**\n   * Bytes the browser already holds, as a `File`. Available only to a vendor\n   * whose picker runs on a browser-safe grant — a publishable key, a\n   * user-consented OAuth token, a picker's own scoped grant — so nothing\n   * tenant-secret is involved. The framework uploads it exactly as it uploads a\n   * file chosen from disk.\n   */\n  BROWSER_READABLE_FILE = 'BROWSER_READABLE_FILE',\n  /**\n   * A URL the browser may fetch, under the same browser-safe-grant condition as\n   * `BROWSER_READABLE_FILE`. Distinct from it because the framework must fetch\n   * before it can upload, and that fetch is a network call the composed CSP has\n   * to admit — a difference the surface cannot discover from a `File`.\n   */\n  BROWSER_READABLE_URL = 'BROWSER_READABLE_URL',\n}\n\n/**\n * The DATA half of one component a provider contributes — everything about it\n * that a reviewer, the CLI or a build step can read without running a browser.\n *\n * The loader is the CODE half and stays on the facet module in\n * `@wildo-ai/external-connectors-public`, exactly as `sdk.activate` does. What\n * crosses the wire is the fact that a component EXISTS for this capability, plus\n * the contract it commits to.\n *\n * Strict, and for the same reason the CSP footprint is: this is AUTHORED by a\n * provider package rather than received from an older producer, so a misspelled\n * key must fail where it is written instead of contributing nothing.\n */\nexport const ProviderFrontendComponentDescriptorSchema = z.strictObject({\n  /**\n   * What a selection from this component contains. Absent for a capability whose\n   * component returns a plain value rather than a thing — a captcha widget hands\n   * back a token, and there is no delivery question to answer about a string.\n   */\n  selectionDelivery: z.enum(ProviderFrontendSelectionDelivery).optional(),\n});\nexport type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFrontendComponentDescriptorSchema>;\n\n/**\n * A provider's component descriptors, keyed by the CAPABILITY each fills.\n *\n * The key is validated as a non-empty string, not as a `ProviderCapability`\n * member. The reason this gave until 2026-09-12 — that `ProviderCapability` is\n * OPEN through module augmentation, so a `z.enum` would refuse an application's\n * own capability — stopped being true with #502: the vocabulary is the closed\n * built-in set. A member-checked key is now possible and has NOT been adopted;\n * until it is, an unknown capability key parses here and simply never matches a\n * surface that asks for a real one.\n */\nexport const ProviderFrontendComponentDescriptorsSchema = z.record(\n  z.string().min(1),\n  ProviderFrontendComponentDescriptorSchema,\n);\nexport type ProviderFrontendComponentDescriptors = z.infer<typeof ProviderFrontendComponentDescriptorsSchema>;\n\n/**\n * Pins every bucket member to a real field of the footprint.\n *\n * A member whose value is not a footprint key would be authorable, would parse,\n * and would contribute nothing — in production only, because CSP is report-only\n * in development. This makes it a compile error instead.\n */\nconst _everyBucketNamesAFootprintField: Record<\n  ProviderFrontendCspOriginBucket,\n  keyof Omit<ProviderFrontendCspFootprint, 'derivedOrigins'>\n> = {\n  [ProviderFrontendCspOriginBucket.SCRIPT]: 'scriptOrigins',\n  [ProviderFrontendCspOriginBucket.CONNECT]: 'connectOrigins',\n  [ProviderFrontendCspOriginBucket.FRAME]: 'frameOrigins',\n  [ProviderFrontendCspOriginBucket.IMG]: 'imgOrigins',\n  [ProviderFrontendCspOriginBucket.STYLE]: 'styleOrigins',\n  [ProviderFrontendCspOriginBucket.FONT]: 'fontOrigins',\n};\nvoid _everyBucketNamesAFootprintField;\n"]}

package/dist/esm/external-providers/provider-metadata.shared.schemas.d.ts

@@ -97,8 +97,11 @@ export declare enum ProviderOriginKind {
  * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.
  *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response
  *   shaping stays Wildo's.
- * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the
- *   same output shape. Authoritative where it exists, since it is the vendor's own description.
+ * - `OPENAPI_DOCUMENT` — a vendor's OpenAPI document, read as an ORACLE rather than as a catalogue:
+ *   it never decides WHICH operations exist, and answers questions about the operations the two
+ *   catalogues chose — the response shape, and the names of path holes a catalogue could only name
+ *   by position (#1572). Consulted on every full batch, from a public corpus or from a URL a
+ *   provider decision pins.
  */
 export declare enum ProviderCatalogueSource {
     ACTIVEPIECES = "ACTIVEPIECES",
@@ -168,6 +171,9 @@ export type ProviderMetadata = Omit<z.infer<typeof ProviderMetadataSchema>, 'ori
  * vendors without loading a provider's runtime module.
  */
 export declare const ProviderIdentitySchema: z.ZodObject<{
+    packageName: z.ZodString;
+    tier: z.ZodEnum<typeof ProviderTier>;
+    vendor: z.ZodString;
     origin: z.ZodObject<{
         kind: z.ZodEnum<typeof ProviderOriginKind>;
         catalogue: z.ZodOptional<z.ZodObject<{
@@ -176,9 +182,6 @@ export declare const ProviderIdentitySchema: z.ZodObject<{
             sourceVersion: z.ZodString;
         }, z.core.$strip>>;
     }, z.core.$strip>;
-    packageName: z.ZodString;
-    tier: z.ZodEnum<typeof ProviderTier>;
-    vendor: z.ZodString;
 }, z.core.$strip>;
 export type ProviderIdentity = Omit<z.infer<typeof ProviderIdentitySchema>, 'origin'> & {
     origin: ProviderOrigin;

package/dist/esm/external-providers/provider-metadata.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED,iDAAiD;AACjD,oBAAY,kBAAkB;IAC5B,yDAAyD;IACzD,MAAM,WAAW;IACjB,yEAAyE;IACzE,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,uBAAuB;IACjC,YAAY,iBAAiB;IAC7B,GAAG,QAAQ;IACX,gBAAgB,qBAAqB;CACtC;AAED,eAAO,MAAM,iCAAiC;;;;iBAa5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAa7B,CAAC;AACL,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEnF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,EAAE,cAAmE,CAAC;AAEzG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBA2CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAW3F"}
+{"version":3,"file":"provider-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED,iDAAiD;AACjD,oBAAY,kBAAkB;IAC5B,yDAAyD;IACzD,MAAM,WAAW;IACjB,yEAAyE;IACzE,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,uBAAuB;IACjC,YAAY,iBAAiB;IAC7B,GAAG,QAAQ;IACX,gBAAgB,qBAAqB;CACtC;AAED,eAAO,MAAM,iCAAiC;;;;iBAa5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAa7B,CAAC;AACL,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEnF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,EAAE,cAAmE,CAAC;AAEzG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBA2CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAW3F"}

package/dist/esm/external-providers/provider-metadata.shared.schemas.js

@@ -101,8 +101,11 @@ export var ProviderOriginKind;
  * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.
  *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response
  *   shaping stays Wildo's.
- * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the
- *   same output shape. Authoritative where it exists, since it is the vendor's own description.
+ * - `OPENAPI_DOCUMENT` — a vendor's OpenAPI document, read as an ORACLE rather than as a catalogue:
+ *   it never decides WHICH operations exist, and answers questions about the operations the two
+ *   catalogues chose — the response shape, and the names of path holes a catalogue could only name
+ *   by position (#1572). Consulted on every full batch, from a public corpus or from a URL a
+ *   provider decision pins.
  */
 export var ProviderCatalogueSource;
 (function (ProviderCatalogueSource) {

package/dist/esm/external-providers/provider-metadata.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,OAAO,aAAa,WAAW,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,YAuBX;AAvBD,WAAY,YAAY;IACtB;;;;;;OAMG;IACH,6BAAa,CAAA;IACb;;;;;OAKG;IACH,uCAAuB,CAAA;IACvB;;;;;OAKG;IACH,uCAAuB,CAAA;AACzB,CAAC,EAvBW,YAAY,KAAZ,YAAY,QAuBvB;AAED,iDAAiD;AACjD,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,yDAAyD;IACzD,uCAAiB,CAAA;IACjB,yEAAyE;IACzE,iDAA2B,CAAA;IAC3B;;;;OAIG;IACH,6CAAuB,CAAA;AACzB,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,wDAA6B,CAAA;IAC7B,sCAAW,CAAA;IACX,gEAAqC,CAAA;AACvC,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,wCAAwC;IACxC,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,iEAAiE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC,CAAC,CAAC;AAML,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;OAIG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,qEAAqE;IACrE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC1B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,wCAAwC;IACxC,MAAM,EAAE,oBAAoB;IAC5B;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC;IAChE,WAAW,EAAE,IAAI;IACjB,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAcH;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACnE,CAAqB,CAAC;AACzB,CAAC","sourcesContent":["/**\n * `ProviderMetadata` — shared, frontend-safe header carried by every\n * provider module across every facet (backend, frontend-app, techdoc,\n * website).\n *\n * Intentionally **frontend-safe**: holds no secrets, no protocol\n * contracts, no backend behavior. The fields are exactly what a UI needs\n * to render a provider entry (translation-ready display-name key, optional\n * legacy fallback label, optional icon ref) plus the stable `ref` used as\n * the join key between facet modules — and, since #328, the provider's\n * IDENTITY: which package ships it, which tier it belongs to, which vendor\n * groups it, and where it came from.\n *\n * ## Why identity lives here and not on the ref\n *\n * A bare `ref` string cannot say whether a provider is one the engine\n * REQUIRES (a MAIN provider binding an `EngineCapability` slot), one that\n * merely MAY bind a slot as a substitute (EXTENSION), or one of the bulk\n * loaded on demand that must never claim a slot (CATALOGUE). Nor can it say\n * that `microsoft-graph-mail` and `microsoft-teams` are two packages of one\n * vendor sharing an OAuth client. Encoding any of that in the ref's\n * spelling is invisible to the compiler and to every consumer; encoding it\n * as fields is what lets composition ENFORCE the tier rule\n * (`assertProviderTierCoherence`) and lets tooling display and group.\n *\n * The identity fields are REQUIRED. A provider without a tier is a provider\n * nobody has decided about, and \"undecided\" must not parse as \"fine\".\n */\n\nimport { z } from 'zod';\n\n\n/**\n * Translation key builder for provider display names.\n *\n * Provider modules stay locale-neutral by exporting this stable label key;\n * consuming frontend surfaces resolve it via the app i18n service at render\n * time instead of freezing human copy into generated/runtime artifacts.\n */\nexport function buildProviderDisplayNameLabelKey(providerRef: string): string {\n  return `providers.${providerRef}.displayName`;\n}\n\n/**\n * The three provider tiers (decided 2026-09-05, epic #337).\n *\n * The tier is a DECISION recorded on the module, never inferred from its\n * capabilities at runtime — inference is silent and wrong for a provider\n * such as Odoo, whose empty capability list says nothing about whether the\n * engine depends on it.\n */\nexport enum ProviderTier {\n  /**\n   * Mandatory, engine-shipped. Binds an `EngineCapability` slot the engine\n   * itself consumes (email, billing, SMS, the AI slots) or is an SSO login\n   * provider the auth subsystem consumes. MAIN is the engine's own set:\n   * its origin is always `ENGINE`, and it is what stays in the static\n   * engine registry when everything else loads on demand.\n   */\n  MAIN = 'MAIN',\n  /**\n   * May ALSO bind an engine slot, as a substitute for a MAIN provider\n   * (a second email sink, a telemetry sink, an audit sink). Kept distinct\n   * from MAIN so the engine's floor is not confused with what happens to\n   * be installed.\n   */\n  EXTENSION = 'EXTENSION',\n  /**\n   * The bulk: integrations with no engine slot, loaded on demand when an\n   * application declares them. A CATALOGUE provider may claim only OPEN\n   * `ProviderCapability` tokens — never one that maps to an engine slot —\n   * which composition enforces.\n   */\n  CATALOGUE = 'CATALOGUE',\n}\n\n/** Where a provider module's code comes from. */\nexport enum ProviderOriginKind {\n  /** Shipped by the framework's own connector packages. */\n  ENGINE = 'ENGINE',\n  /** Authored inside an application (its own `provider-contributions`). */\n  APPLICATION = 'APPLICATION',\n  /**\n   * Emitted by the framework packager from an external catalogue source;\n   * carries the catalogue provenance so the wrapped upstream artifact can\n   * be named, attributed and re-generated.\n   */\n  GENERATED = 'GENERATED',\n}\n\n/**\n * External catalogues a build-time MAPPER reads to emit a native Wildo provider package.\n *\n * Every member is a SOURCE that is read, never a runtime the application depends on: the mapper\n * extracts each operation's method, URL template, parameters and auth shape as DATA, and Wildo's\n * own HTTP client executes them. Nothing third-party is installed or executed by a generated\n * application. (An earlier revision of this enum described Activepieces as a set of executable\n * bundles Wildo would WRAP; that model was built, measured and deleted on 2026-09-06 — see\n * `providers-are-scraped-never-wrapped`.)\n *\n * - `ACTIVEPIECES` — the community pieces monorepo. Each piece's actions and triggers call\n *   `httpClient.sendRequest({ method, url, body })` in plain TypeScript an AST pass can read.\n *   Note the PUBLISHED bundle is NOT a usable input: its metadata carries name, inputs and auth\n *   but not the endpoint, which lives inside the compiled `run`.\n * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.\n *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response\n *   shaping stays Wildo's.\n * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the\n *   same output shape. Authoritative where it exists, since it is the vendor's own description.\n */\nexport enum ProviderCatalogueSource {\n  ACTIVEPIECES = 'ACTIVEPIECES',\n  SIM = 'SIM',\n  OPENAPI_DOCUMENT = 'OPENAPI_DOCUMENT',\n}\n\nexport const ProviderCatalogueProvenanceSchema = z.object({\n  source: z.enum(ProviderCatalogueSource),\n  /**\n   * The upstream artifact read, addressed the way its catalogue addresses it: the piece's\n   * directory or package name, the Sim tool's module, the OpenAPI document's path.\n   */\n  sourceRef: z.string().min(1),\n  /**\n   * The exact upstream revision read — a source-control revision for a monorepo catalogue, a\n   * document version for an OpenAPI input. A re-generation pins a new one, which is what makes a\n   * regenerated package's diff attributable to a specific upstream movement.\n   */\n  sourceVersion: z.string().min(1),\n});\nexport type ProviderCatalogueProvenance = z.infer<typeof ProviderCatalogueProvenanceSchema>;\n\n/**\n * Origin as ONE object with a `kind` and a provenance that is REQUIRED exactly when the kind is\n * `GENERATED` (and forbidden otherwise), enforced by the refinement below.\n *\n * Not a `z.discriminatedUnion`, deliberately: under `strictNullChecks: false` — how the engine\n * packages compile — Zod 4 infers a union-typed object key as OPTIONAL (the members' `optout`\n * collapses to `\"optional\"` once `undefined` is erased), so `metadata.origin` would type as\n * omittable in every engine consumer while the runtime refused its absence. A plain object\n * infers as required in both modes; the invariant the union expressed lives in the refinement\n * and in the `ProviderOrigin` type below.\n */\nexport const ProviderOriginSchema = z\n  .object({\n    kind: z.enum(ProviderOriginKind),\n    /** Present iff `kind === GENERATED`. */\n    catalogue: ProviderCatalogueProvenanceSchema.optional(),\n  })\n  .superRefine((origin, ctx) => {\n    if (origin.kind === ProviderOriginKind.GENERATED && origin.catalogue === undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: 'A GENERATED origin must carry its catalogue provenance.' });\n    }\n    if (origin.kind !== ProviderOriginKind.GENERATED && origin.catalogue !== undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: `Only a GENERATED origin carries catalogue provenance (kind is ${origin.kind}).` });\n    }\n  });\nexport type ProviderOrigin =\n  | { kind: ProviderOriginKind.ENGINE; catalogue?: undefined }\n  | { kind: ProviderOriginKind.APPLICATION; catalogue?: undefined }\n  | { kind: ProviderOriginKind.GENERATED; catalogue: ProviderCatalogueProvenance };\n\n/** The one engine origin value, so 22 modules do not each spell it. */\nexport const ENGINE_PROVIDER_ORIGIN: ProviderOrigin = Object.freeze({ kind: ProviderOriginKind.ENGINE });\n\nexport const ProviderMetadataSchema = z.object({\n  /**\n   * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,\n   * `'openai'`. Used as the join key across facet modules and as the\n   * map key inside `BackendProviderRegistry.modules`.\n   */\n  ref: z.string().min(1),\n  /**\n   * The npm package that ships this provider's module(s), e.g.\n   * `@wildo-ai/external-connectors-private` for an engine provider or\n   * `@wildo-ai/provider-slack` for a per-provider package. One package,\n   * several facet barrels — this is the package, not a barrel.\n   */\n  packageName: z.string().min(1),\n  /** See {@link ProviderTier}. A recorded decision, never inferred. */\n  tier: z.enum(ProviderTier),\n  /**\n   * Vendor grouping. Equal to `ref` for a single-package vendor; the shared\n   * name for a sub-cut vendor (`vendor: 'microsoft'` on both\n   * `microsoft-graph-mail` and `microsoft-teams`), which is what lets an\n   * OAuth client or a secret be shared by reference across sub-packages.\n   */\n  vendor: z.string().min(1),\n  /** See {@link ProviderOriginSchema}. */\n  origin: ProviderOriginSchema,\n  /**\n   * Translation-ready key for the provider display name.\n   *\n   * Frontend/public surfaces should prefer this field over embedding\n   * locale-bound copy in provider modules or runtime artifacts.\n   */\n  displayNameLabelKey: z.string().optional(),\n  /**\n   * Legacy human-readable fallback label for non-i18n-aware consumers.\n   * When absent, consumers fall back to the `ref`.\n   */\n  displayName: z.string().optional(),\n  /**\n   * Optional icon reference resolved through the frontend icon registry.\n   * Stays a string (not a URL or component reference) to keep this type\n   * frontend-safe AND portable to non-React surfaces.\n   */\n  iconRef: z.string().optional(),\n});\n\nexport type ProviderMetadata = Omit<z.infer<typeof ProviderMetadataSchema>, 'origin'> & { origin: ProviderOrigin };\n\n/**\n * The identity half of {@link ProviderMetadataSchema} on its own — what a\n * companion contribution carries so tooling can display tiers and group\n * vendors without loading a provider's runtime module.\n */\nexport const ProviderIdentitySchema = ProviderMetadataSchema.pick({\n  packageName: true,\n  tier: true,\n  vendor: true,\n  origin: true,\n});\nexport type ProviderIdentity = Omit<z.infer<typeof ProviderIdentitySchema>, 'origin'> & { origin: ProviderOrigin };\n\nexport interface DefineProviderMetadataInput {\n  ref: string;\n  packageName: string;\n  tier: ProviderTier;\n  origin: ProviderOrigin;\n  /** Defaults to `ref` — the single-package vendor case. */\n  vendor?: string;\n  displayName?: string;\n  iconRef?: string;\n}\n\n/**\n * The one way a provider module authors its metadata.\n *\n * Derives `displayNameLabelKey` from the ref (every module used to call\n * `buildProviderDisplayNameLabelKey` by hand), defaults `vendor` to the ref,\n * and parses the result so an incomplete identity fails at MODULE LOAD —\n * in the package that owns the module — rather than at the first consumer\n * that reads a field which is not there.\n */\nexport function defineProviderMetadata(input: DefineProviderMetadataInput): ProviderMetadata {\n  return ProviderMetadataSchema.parse({\n    ref: input.ref,\n    packageName: input.packageName,\n    tier: input.tier,\n    vendor: input.vendor ?? input.ref,\n    origin: input.origin,\n    displayNameLabelKey: buildProviderDisplayNameLabelKey(input.ref),\n    ...(input.displayName === undefined ? {} : { displayName: input.displayName }),\n    ...(input.iconRef === undefined ? {} : { iconRef: input.iconRef }),\n  }) as ProviderMetadata;\n}\n"]}
+{"version":3,"file":"provider-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,OAAO,aAAa,WAAW,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,YAuBX;AAvBD,WAAY,YAAY;IACtB;;;;;;OAMG;IACH,6BAAa,CAAA;IACb;;;;;OAKG;IACH,uCAAuB,CAAA;IACvB;;;;;OAKG;IACH,uCAAuB,CAAA;AACzB,CAAC,EAvBW,YAAY,KAAZ,YAAY,QAuBvB;AAED,iDAAiD;AACjD,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,yDAAyD;IACzD,uCAAiB,CAAA;IACjB,yEAAyE;IACzE,iDAA2B,CAAA;IAC3B;;;;OAIG;IACH,6CAAuB,CAAA;AACzB,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,wDAA6B,CAAA;IAC7B,sCAAW,CAAA;IACX,gEAAqC,CAAA;AACvC,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,wCAAwC;IACxC,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,iEAAiE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC,CAAC,CAAC;AAML,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;OAIG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,qEAAqE;IACrE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC1B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,wCAAwC;IACxC,MAAM,EAAE,oBAAoB;IAC5B;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC;IAChE,WAAW,EAAE,IAAI;IACjB,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAcH;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACnE,CAAqB,CAAC;AACzB,CAAC","sourcesContent":["/**\n * `ProviderMetadata` — shared, frontend-safe header carried by every\n * provider module across every facet (backend, frontend-app, techdoc,\n * website).\n *\n * Intentionally **frontend-safe**: holds no secrets, no protocol\n * contracts, no backend behavior. The fields are exactly what a UI needs\n * to render a provider entry (translation-ready display-name key, optional\n * legacy fallback label, optional icon ref) plus the stable `ref` used as\n * the join key between facet modules — and, since #328, the provider's\n * IDENTITY: which package ships it, which tier it belongs to, which vendor\n * groups it, and where it came from.\n *\n * ## Why identity lives here and not on the ref\n *\n * A bare `ref` string cannot say whether a provider is one the engine\n * REQUIRES (a MAIN provider binding an `EngineCapability` slot), one that\n * merely MAY bind a slot as a substitute (EXTENSION), or one of the bulk\n * loaded on demand that must never claim a slot (CATALOGUE). Nor can it say\n * that `microsoft-graph-mail` and `microsoft-teams` are two packages of one\n * vendor sharing an OAuth client. Encoding any of that in the ref's\n * spelling is invisible to the compiler and to every consumer; encoding it\n * as fields is what lets composition ENFORCE the tier rule\n * (`assertProviderTierCoherence`) and lets tooling display and group.\n *\n * The identity fields are REQUIRED. A provider without a tier is a provider\n * nobody has decided about, and \"undecided\" must not parse as \"fine\".\n */\n\nimport { z } from 'zod';\n\n\n/**\n * Translation key builder for provider display names.\n *\n * Provider modules stay locale-neutral by exporting this stable label key;\n * consuming frontend surfaces resolve it via the app i18n service at render\n * time instead of freezing human copy into generated/runtime artifacts.\n */\nexport function buildProviderDisplayNameLabelKey(providerRef: string): string {\n  return `providers.${providerRef}.displayName`;\n}\n\n/**\n * The three provider tiers (decided 2026-09-05, epic #337).\n *\n * The tier is a DECISION recorded on the module, never inferred from its\n * capabilities at runtime — inference is silent and wrong for a provider\n * such as Odoo, whose empty capability list says nothing about whether the\n * engine depends on it.\n */\nexport enum ProviderTier {\n  /**\n   * Mandatory, engine-shipped. Binds an `EngineCapability` slot the engine\n   * itself consumes (email, billing, SMS, the AI slots) or is an SSO login\n   * provider the auth subsystem consumes. MAIN is the engine's own set:\n   * its origin is always `ENGINE`, and it is what stays in the static\n   * engine registry when everything else loads on demand.\n   */\n  MAIN = 'MAIN',\n  /**\n   * May ALSO bind an engine slot, as a substitute for a MAIN provider\n   * (a second email sink, a telemetry sink, an audit sink). Kept distinct\n   * from MAIN so the engine's floor is not confused with what happens to\n   * be installed.\n   */\n  EXTENSION = 'EXTENSION',\n  /**\n   * The bulk: integrations with no engine slot, loaded on demand when an\n   * application declares them. A CATALOGUE provider may claim only OPEN\n   * `ProviderCapability` tokens — never one that maps to an engine slot —\n   * which composition enforces.\n   */\n  CATALOGUE = 'CATALOGUE',\n}\n\n/** Where a provider module's code comes from. */\nexport enum ProviderOriginKind {\n  /** Shipped by the framework's own connector packages. */\n  ENGINE = 'ENGINE',\n  /** Authored inside an application (its own `provider-contributions`). */\n  APPLICATION = 'APPLICATION',\n  /**\n   * Emitted by the framework packager from an external catalogue source;\n   * carries the catalogue provenance so the wrapped upstream artifact can\n   * be named, attributed and re-generated.\n   */\n  GENERATED = 'GENERATED',\n}\n\n/**\n * External catalogues a build-time MAPPER reads to emit a native Wildo provider package.\n *\n * Every member is a SOURCE that is read, never a runtime the application depends on: the mapper\n * extracts each operation's method, URL template, parameters and auth shape as DATA, and Wildo's\n * own HTTP client executes them. Nothing third-party is installed or executed by a generated\n * application. (An earlier revision of this enum described Activepieces as a set of executable\n * bundles Wildo would WRAP; that model was built, measured and deleted on 2026-09-06 — see\n * `providers-are-scraped-never-wrapped`.)\n *\n * - `ACTIVEPIECES` — the community pieces monorepo. Each piece's actions and triggers call\n *   `httpClient.sendRequest({ method, url, body })` in plain TypeScript an AST pass can read.\n *   Note the PUBLISHED bundle is NOT a usable input: its metadata carries name, inputs and auth\n *   but not the endpoint, which lives inside the compiled `run`.\n * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.\n *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response\n *   shaping stays Wildo's.\n * - `OPENAPI_DOCUMENT` — a vendor's OpenAPI document, read as an ORACLE rather than as a catalogue:\n *   it never decides WHICH operations exist, and answers questions about the operations the two\n *   catalogues chose — the response shape, and the names of path holes a catalogue could only name\n *   by position (#1572). Consulted on every full batch, from a public corpus or from a URL a\n *   provider decision pins.\n */\nexport enum ProviderCatalogueSource {\n  ACTIVEPIECES = 'ACTIVEPIECES',\n  SIM = 'SIM',\n  OPENAPI_DOCUMENT = 'OPENAPI_DOCUMENT',\n}\n\nexport const ProviderCatalogueProvenanceSchema = z.object({\n  source: z.enum(ProviderCatalogueSource),\n  /**\n   * The upstream artifact read, addressed the way its catalogue addresses it: the piece's\n   * directory or package name, the Sim tool's module, the OpenAPI document's path.\n   */\n  sourceRef: z.string().min(1),\n  /**\n   * The exact upstream revision read — a source-control revision for a monorepo catalogue, a\n   * document version for an OpenAPI input. A re-generation pins a new one, which is what makes a\n   * regenerated package's diff attributable to a specific upstream movement.\n   */\n  sourceVersion: z.string().min(1),\n});\nexport type ProviderCatalogueProvenance = z.infer<typeof ProviderCatalogueProvenanceSchema>;\n\n/**\n * Origin as ONE object with a `kind` and a provenance that is REQUIRED exactly when the kind is\n * `GENERATED` (and forbidden otherwise), enforced by the refinement below.\n *\n * Not a `z.discriminatedUnion`, deliberately: under `strictNullChecks: false` — how the engine\n * packages compile — Zod 4 infers a union-typed object key as OPTIONAL (the members' `optout`\n * collapses to `\"optional\"` once `undefined` is erased), so `metadata.origin` would type as\n * omittable in every engine consumer while the runtime refused its absence. A plain object\n * infers as required in both modes; the invariant the union expressed lives in the refinement\n * and in the `ProviderOrigin` type below.\n */\nexport const ProviderOriginSchema = z\n  .object({\n    kind: z.enum(ProviderOriginKind),\n    /** Present iff `kind === GENERATED`. */\n    catalogue: ProviderCatalogueProvenanceSchema.optional(),\n  })\n  .superRefine((origin, ctx) => {\n    if (origin.kind === ProviderOriginKind.GENERATED && origin.catalogue === undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: 'A GENERATED origin must carry its catalogue provenance.' });\n    }\n    if (origin.kind !== ProviderOriginKind.GENERATED && origin.catalogue !== undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: `Only a GENERATED origin carries catalogue provenance (kind is ${origin.kind}).` });\n    }\n  });\nexport type ProviderOrigin =\n  | { kind: ProviderOriginKind.ENGINE; catalogue?: undefined }\n  | { kind: ProviderOriginKind.APPLICATION; catalogue?: undefined }\n  | { kind: ProviderOriginKind.GENERATED; catalogue: ProviderCatalogueProvenance };\n\n/** The one engine origin value, so 22 modules do not each spell it. */\nexport const ENGINE_PROVIDER_ORIGIN: ProviderOrigin = Object.freeze({ kind: ProviderOriginKind.ENGINE });\n\nexport const ProviderMetadataSchema = z.object({\n  /**\n   * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,\n   * `'openai'`. Used as the join key across facet modules and as the\n   * map key inside `BackendProviderRegistry.modules`.\n   */\n  ref: z.string().min(1),\n  /**\n   * The npm package that ships this provider's module(s), e.g.\n   * `@wildo-ai/external-connectors-private` for an engine provider or\n   * `@wildo-ai/provider-slack` for a per-provider package. One package,\n   * several facet barrels — this is the package, not a barrel.\n   */\n  packageName: z.string().min(1),\n  /** See {@link ProviderTier}. A recorded decision, never inferred. */\n  tier: z.enum(ProviderTier),\n  /**\n   * Vendor grouping. Equal to `ref` for a single-package vendor; the shared\n   * name for a sub-cut vendor (`vendor: 'microsoft'` on both\n   * `microsoft-graph-mail` and `microsoft-teams`), which is what lets an\n   * OAuth client or a secret be shared by reference across sub-packages.\n   */\n  vendor: z.string().min(1),\n  /** See {@link ProviderOriginSchema}. */\n  origin: ProviderOriginSchema,\n  /**\n   * Translation-ready key for the provider display name.\n   *\n   * Frontend/public surfaces should prefer this field over embedding\n   * locale-bound copy in provider modules or runtime artifacts.\n   */\n  displayNameLabelKey: z.string().optional(),\n  /**\n   * Legacy human-readable fallback label for non-i18n-aware consumers.\n   * When absent, consumers fall back to the `ref`.\n   */\n  displayName: z.string().optional(),\n  /**\n   * Optional icon reference resolved through the frontend icon registry.\n   * Stays a string (not a URL or component reference) to keep this type\n   * frontend-safe AND portable to non-React surfaces.\n   */\n  iconRef: z.string().optional(),\n});\n\nexport type ProviderMetadata = Omit<z.infer<typeof ProviderMetadataSchema>, 'origin'> & { origin: ProviderOrigin };\n\n/**\n * The identity half of {@link ProviderMetadataSchema} on its own — what a\n * companion contribution carries so tooling can display tiers and group\n * vendors without loading a provider's runtime module.\n */\nexport const ProviderIdentitySchema = ProviderMetadataSchema.pick({\n  packageName: true,\n  tier: true,\n  vendor: true,\n  origin: true,\n});\nexport type ProviderIdentity = Omit<z.infer<typeof ProviderIdentitySchema>, 'origin'> & { origin: ProviderOrigin };\n\nexport interface DefineProviderMetadataInput {\n  ref: string;\n  packageName: string;\n  tier: ProviderTier;\n  origin: ProviderOrigin;\n  /** Defaults to `ref` — the single-package vendor case. */\n  vendor?: string;\n  displayName?: string;\n  iconRef?: string;\n}\n\n/**\n * The one way a provider module authors its metadata.\n *\n * Derives `displayNameLabelKey` from the ref (every module used to call\n * `buildProviderDisplayNameLabelKey` by hand), defaults `vendor` to the ref,\n * and parses the result so an incomplete identity fails at MODULE LOAD —\n * in the package that owns the module — rather than at the first consumer\n * that reads a field which is not there.\n */\nexport function defineProviderMetadata(input: DefineProviderMetadataInput): ProviderMetadata {\n  return ProviderMetadataSchema.parse({\n    ref: input.ref,\n    packageName: input.packageName,\n    tier: input.tier,\n    vendor: input.vendor ?? input.ref,\n    origin: input.origin,\n    displayNameLabelKey: buildProviderDisplayNameLabelKey(input.ref),\n    ...(input.displayName === undefined ? {} : { displayName: input.displayName }),\n    ...(input.iconRef === undefined ? {} : { iconRef: input.iconRef }),\n  }) as ProviderMetadata;\n}\n"]}

package/dist/esm/features/application-features.shared.resources-config.schemas.d.ts

@@ -34,6 +34,8 @@ export declare const applicationFeaturesResourceConfiguration_InitializationFact
         removedFeatures: z.ZodDefault<z.ZodArray<z.ZodString>>;
         limitOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>;
     }, z.core.$strip>>>;
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>>;
 }, z.core.$strip>>;
 export {};
 //# sourceMappingURL=application-features.shared.resources-config.schemas.d.ts.map

package/dist/esm/features/application-features.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-features.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/features/application-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,uDAAuD,CAAC;AAGpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8B,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAMzG,oBAAY,8BAA8B;IACxC,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;CAClC;AAED,eAAO,MAAM,gDAAgD;;;iBAG3D,CAAC;AAEH,eAAO,MAAM,iDAAiD;;;iBAG5D,CAAC;AAEH,eAAO,MAAM,gDAAgD;;iBAE3D,CAAC;AAEH,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;kBA8H3H,CAAC"}
+{"version":3,"file":"application-features.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/features/application-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,uDAAuD,CAAC;AAGpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAA8D,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAOzI,oBAAY,8BAA8B;IACxC,cAAc,mBAAmB;IACjC,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;CAClC;AAED,eAAO,MAAM,gDAAgD;;;iBAG3D,CAAC;AAEH,eAAO,MAAM,iDAAiD;;;iBAG5D,CAAC;AAEH,eAAO,MAAM,gDAAgD;;iBAE3D,CAAC;AAEH,KAAK,iCAAiC,GAClC,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,8DAA8D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;kBAoK3H,CAAC"}

package/dist/esm/features/application-features.shared.resources-config.schemas.js

@@ -7,11 +7,12 @@
  */
 import { z } from 'zod';
 import { CoreFeature } from '../organizations/organization-features.shared.schemas.js';
-import { ScopeFeaturesWithOverridesSchema } from './scope-features.shared.schemas.js';
+import { ApplicationFeaturesSchema, ScopeFeaturesWithOverridesSchema } from './scope-features.shared.schemas.js';
 import { CoreResourceOperation } from '../resources/resources.shared.core.definitions.js';
-import { ResourceOperationRiskLevel } from '../resources/resources.shared.schemas.js';
+import { ResourceOperationRiskLevel, ResourceOperationReversibility } from '../resources/resources.shared.schemas.js';
 import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
 import { ResourceOperationVariantType } from '../resources/resources.shared.schemas.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
 import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
 import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
 export var ApplicationFeatures_Operations;
@@ -32,11 +33,34 @@ export const ApplicationFeaturesResetFeaturesRequestDtoSchema = z.object({
     reason: z.string().min(1).max(500),
 });
 export const applicationFeaturesResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
-    mainSchema: ScopeFeaturesWithOverridesSchema,
+    mainSchema: ApplicationFeaturesSchema,
     resourceIdentifier: CoreResourceType.APPLICATION_FEATURES,
     resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_FEATURES],
     resourceRelationships: resourcesRelationships,
     isSystemResource: true,
+    /*
+     * The framework may materialise this scope's row on a caller's behalf.
+     *
+     * `systemAccessPolicy.create: ALLOWED` is what #1179's seam reads before materialising a
+     * context-addressed singleton the caller never named: an administrator can START configuring a
+     * scope that has no row yet, instead of being 404ed for the framework's own omission. Its three
+     * enterprise-config siblings (SSO / SCIM / SIEM) already declared it; this resource did not, so
+     * the same first write was refused here and nowhere else.
+     *
+     * The row written is the scope foreign key and nothing else — this resource's own schema fills
+     * the rest — so the seeding system keeps ownership of what a default MEANS and the seam decides
+     * only WHEN the row comes into existence.
+     *
+     * NOTE, because it was measured on 2026-09-19 and is easy to assume otherwise: this does NOT make
+     * a READ materialise. That seam is reached for UPDATE and DELETE only, and extending it to READ
+     * was tried and reverted — a probe of the running backend showed the read route never enters it.
+     * A scope whose row is still absent therefore still 404s on read; making that row EXIST is a
+     * seeding question, not an access-policy one.
+     */
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+    },
     coreOperations: [
         CoreResourceOperation.CREATE,
         CoreResourceOperation.READ,
@@ -48,6 +72,18 @@ export const applicationFeaturesResourceConfiguration_InitializationFactory = (r
         CoreResourceOperation.DELETE,
     ],
     customOperation: ApplicationFeatures_Operations,
+    // assurance-control: WILDO.ENTITLEMENT.NO_SELF_GRANT — the application-wide entitlement set is
+    // operator-gated on every operation, read included.
+    //
+    // This is the widest of the three feature ledgers: a write here changes what EVERY tenant is
+    // entitled to, so it is the one ledger where even READ and SEARCH are `APP_ADMIN_SUPER_ADMIN`
+    // rather than a tenant role. That asymmetry against the organization and user ledgers is the
+    // deliberate part — those two let a tenant see its own entitlements; this one is not a tenant's to
+    // see at all.
+    //
+    // As on the sibling ledgers the role is the entire control, because the super-admin path must write
+    // these fields and so they cannot be field-protected. Pinned by
+    // `security-sensitive-operation-reachability.backend.test.ts`.
     operationsConfiguration: {
         [CoreResourceOperation.CREATE]: {
             variants: [
@@ -137,6 +173,9 @@ export const applicationFeaturesResourceConfiguration_InitializationFactory = (r
                     isDefault: true,
                     roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                    // IRREVERSIBLE: Clears every override on the application. There is no backup of the list, and organizations relying on one lose access.
+                    // This is what admits it to the danger zone; risk alone no longer does.
+                    reversibility: ResourceOperationReversibility.IRREVERSIBLE,
                     resourceOperationLike: CoreResourceOperation.UPDATE_MANY,
                     requestDto: ApplicationFeaturesResetFeaturesRequestDtoSchema,
                 },

package/dist/esm/features/application-features.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-features.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/features/application-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,uDAAuD,CAAC;AACpF,OAAO,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAEnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAwB,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,mEAAiC,CAAA;IACjC,qEAAmC,CAAA;IACnC,mEAAiC,CAAA;AACnC,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AASH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI1K;IACA,UAAU,EAAE,gCAAgC;IAC5C,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,mFAAmF;QACnF,oFAAoF;QACpF,oFAAoF;QACpF,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,8BAA8B;IAE/C,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,UAAU,EAAE,gCAAgC,CAAC,OAAO,EAAE;iBACvD;aACF;SACF;QAED,kFAAkF;QAClF,4EAA4E;QAC5E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,cAAc,CAAC,EAAE;YAC/C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,gDAAgD;iBAC7D;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,eAAe,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,iDAAiD;iBAC9D;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,cAAc,CAAC,EAAE;YAC/C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,gDAAgD;iBAC7D;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application Features Shared Resource Configuration\n *\n * Application-scope entitlement ledger. This mirrors organization/user feature\n * ledgers so exact-scope gates such as `M2M_WEBHOOK_DELIVERY` can be enabled\n * for `WEBHOOK_APPLICATION` without leaking app enablement to every org.\n */\n\nimport { z } from 'zod';\nimport { CoreFeature } from '../organizations/organization-features.shared.schemas';\nimport { ScopeFeaturesWithOverridesSchema } from './scope-features.shared.schemas';\n\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\nexport enum ApplicationFeatures_Operations {\n  ENABLE_FEATURE = 'enable_feature',\n  DISABLE_FEATURE = 'disable_feature',\n  RESET_FEATURES = 'reset_features',\n}\n\nexport const ApplicationFeaturesEnableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().max(500).optional(),\n});\n\nexport const ApplicationFeaturesDisableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().min(1).max(500),\n});\n\nexport const ApplicationFeaturesResetFeaturesRequestDtoSchema = z.object({\n  reason: z.string().min(1).max(500),\n});\n\ntype ApplicationFeaturesCoreOperations =\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\nexport const applicationFeaturesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof ApplicationFeatures_Operations,\n  ApplicationFeaturesCoreOperations,\n  typeof ScopeFeaturesWithOverridesSchema\n>({\n  mainSchema: ScopeFeaturesWithOverridesSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_FEATURES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_FEATURES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition onParentDelete\n    // cascade so the row is physically removed when its application is deleted. Without\n    // it the cascade throws ErrorType.CONFIGURATION on any app that has a features row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: ApplicationFeatures_Operations,\n\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          requestDto: ScopeFeaturesWithOverridesSchema.partial(),\n        },\n      ],\n    },\n\n    // Internal-only (REPOSITORY_ONLY): powers the composition onParentDelete cascade,\n    // not a public API surface — the ledger is reset, never DELETEd, over HTTP.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.ENABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesEnableFeatureRequestDtoSchema,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.DISABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesDisableFeatureRequestDtoSchema,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.RESET_FEATURES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesResetFeaturesRequestDtoSchema,\n        },\n      ],\n    },\n  },\n});\n"]}
+{"version":3,"file":"application-features.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/features/application-features.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,uDAAuD,CAAC;AACpF,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,iCAAiC,CAAC;AAE9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,8BAA8B,EAAwB,MAAM,uCAAuC,CAAC;AACzI,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AACtH,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAEjF,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,mEAAiC,CAAA;IACjC,qEAAmC,CAAA;IACnC,mEAAiC,CAAA;AACnC,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAC;AASH,MAAM,CAAC,MAAM,8DAA8D,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAAC,0CAA0C,CAI1K;IACA,UAAU,EAAE,yBAAyB;IACrC,kBAAkB,EAAE,gBAAgB,CAAC,oBAAoB;IACzD,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,oBAAoB,CAAC;IAClG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED,cAAc,EAAE;QACd,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,mFAAmF;QACnF,oFAAoF;QACpF,oFAAoF;QACpF,qBAAqB,CAAC,MAAM;KAC7B;IAED,eAAe,EAAE,8BAA8B;IAE/C,+FAA+F;IAC/F,oDAAoD;IACpD,EAAE;IACF,6FAA6F;IAC7F,8FAA8F;IAC9F,6FAA6F;IAC7F,mGAAmG;IACnG,cAAc;IACd,EAAE;IACF,oGAAoG;IACpG,gEAAgE;IAChE,+DAA+D;IAC/D,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;iBAC7C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,KAAK;oBACnB,gBAAgB,EAAE,EAAE;oBACpB,iBAAiB,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE;oBACjE,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE;oBACd,8BAA8B,EAAE,EAAE;iBACnC,CAAC;SACH;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,UAAU,EAAE,gCAAgC,CAAC,OAAO,EAAE;iBACvD;aACF;SACF;QAED,kFAAkF;QAClF,4EAA4E;QAC5E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,cAAc,CAAC,EAAE;YAC/C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,gDAAgD;iBAC7D;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,eAAe,CAAC,EAAE;YAChD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,iDAAiD;iBAC9D;aACF;SACF;QAED,CAAC,8BAA8B,CAAC,cAAc,CAAC,EAAE;YAC/C,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;oBAC9C,wIAAwI;oBACxI,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,WAAW;oBACxD,UAAU,EAAE,gDAAgD;iBAC7D;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Application Features Shared Resource Configuration\n *\n * Application-scope entitlement ledger. This mirrors organization/user feature\n * ledgers so exact-scope gates such as `M2M_WEBHOOK_DELIVERY` can be enabled\n * for `WEBHOOK_APPLICATION` without leaking app enablement to every org.\n */\n\nimport { z } from 'zod';\nimport { CoreFeature } from '../organizations/organization-features.shared.schemas';\nimport { ApplicationFeaturesSchema, ScopeFeaturesWithOverridesSchema } from './scope-features.shared.schemas';\n\nimport { CoreResourceOperation } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourceRelationship } from '../resources/resources.shared.schemas';\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport { ResourceOperationVariantType } from '../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\n\nexport enum ApplicationFeatures_Operations {\n  ENABLE_FEATURE = 'enable_feature',\n  DISABLE_FEATURE = 'disable_feature',\n  RESET_FEATURES = 'reset_features',\n}\n\nexport const ApplicationFeaturesEnableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().max(500).optional(),\n});\n\nexport const ApplicationFeaturesDisableFeatureRequestDtoSchema = z.object({\n  featureId: z.enum(CoreFeature),\n  reason: z.string().min(1).max(500),\n});\n\nexport const ApplicationFeaturesResetFeaturesRequestDtoSchema = z.object({\n  reason: z.string().min(1).max(500),\n});\n\ntype ApplicationFeaturesCoreOperations =\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.SEARCH\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE;\n\nexport const applicationFeaturesResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) => createResourceConfiguration_Initialization<\n  typeof ApplicationFeatures_Operations,\n  ApplicationFeaturesCoreOperations,\n  typeof ApplicationFeaturesSchema\n>({\n  mainSchema: ApplicationFeaturesSchema,\n  resourceIdentifier: CoreResourceType.APPLICATION_FEATURES,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.APPLICATION_FEATURES],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n  /*\n   * The framework may materialise this scope's row on a caller's behalf.\n   *\n   * `systemAccessPolicy.create: ALLOWED` is what #1179's seam reads before materialising a\n   * context-addressed singleton the caller never named: an administrator can START configuring a\n   * scope that has no row yet, instead of being 404ed for the framework's own omission. Its three\n   * enterprise-config siblings (SSO / SCIM / SIEM) already declared it; this resource did not, so\n   * the same first write was refused here and nowhere else.\n   *\n   * The row written is the scope foreign key and nothing else — this resource's own schema fills\n   * the rest — so the seeding system keeps ownership of what a default MEANS and the seam decides\n   * only WHEN the row comes into existence.\n   *\n   * NOTE, because it was measured on 2026-09-19 and is easy to assume otherwise: this does NOT make\n   * a READ materialise. That seam is reached for UPDATE and DELETE only, and extending it to READ\n   * was tried and reverted — a probe of the running backend showed the read route never enters it.\n   * A scope whose row is still absent therefore still 404s on read; making that row EXIST is a\n   * seeding question, not an access-policy one.\n   */\n  systemAccessPolicy: {\n    read: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n  },\n\n  coreOperations: [\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.READ,\n    CoreResourceOperation.SEARCH,\n    CoreResourceOperation.UPDATE,\n    // DELETE is REPOSITORY_ONLY (no HTTP route): powers the composition onParentDelete\n    // cascade so the row is physically removed when its application is deleted. Without\n    // it the cascade throws ErrorType.CONFIGURATION on any app that has a features row.\n    CoreResourceOperation.DELETE,\n  ],\n\n  customOperation: ApplicationFeatures_Operations,\n\n  // assurance-control: WILDO.ENTITLEMENT.NO_SELF_GRANT — the application-wide entitlement set is\n  // operator-gated on every operation, read included.\n  //\n  // This is the widest of the three feature ledgers: a write here changes what EVERY tenant is\n  // entitled to, so it is the one ledger where even READ and SEARCH are `APP_ADMIN_SUPER_ADMIN`\n  // rather than a tenant role. That asymmetry against the organization and user ledgers is the\n  // deliberate part — those two let a tenant see its own entitlements; this one is not a tenant's to\n  // see at all.\n  //\n  // As on the sibling ledgers the role is the entire control, because the super-admin path must write\n  // these fields and so they cannot be field-protected. Pinned by\n  // `security-sensitive-operation-reachability.backend.test.ts`.\n  operationsConfiguration: {\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.SEARCH]: {\n      variants: [{\n        variantType: ResourceOperationVariantType.API_CALL,\n        isDefault: true,\n        roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n        riskLevel: ResourceOperationRiskLevel.LOW,\n        isSearchable: false,\n        searchableFields: [],\n        searchableOptions: { caseSensitive: false, fullMatchOnly: false },\n        filterFields: {},\n        sortFields: [],\n        maxPaginatedResultPerPageLimit: 50,\n      }],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          requestDto: ScopeFeaturesWithOverridesSchema.partial(),\n        },\n      ],\n    },\n\n    // Internal-only (REPOSITORY_ONLY): powers the composition onParentDelete cascade,\n    // not a public API surface — the ledger is reset, never DELETEd, over HTTP.\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.ENABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesEnableFeatureRequestDtoSchema,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.DISABLE_FEATURE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesDisableFeatureRequestDtoSchema,\n        },\n      ],\n    },\n\n    [ApplicationFeatures_Operations.RESET_FEATURES]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n          // IRREVERSIBLE: Clears every override on the application. There is no backup of the list, and organizations relying on one lose access.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          resourceOperationLike: CoreResourceOperation.UPDATE_MANY,\n          requestDto: ApplicationFeaturesResetFeaturesRequestDtoSchema,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/features/connected-feature.example.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Tier B usage example for the `engine-product-definitions` skill: ONE feature identifier followed
+ * from its declaration to the contract that sells it and the contract that enforces it.
+ *
+ * WHY TIER B (and not Tier A against the dogfood application):
+ *
+ *  1. What this teaches is the JOIN between four declarations that live in four different files —
+ *     a definition, a module contribution, a product grant and an operation requirement. In a real
+ *     application those are correctly far apart, so a Tier-A anchor would either span unrelated
+ *     code or need four separate spans the reader has to reassemble mentally. The shape is stable;
+ *     the product identity around it is not, which is exactly what Tier B is for.
+ *  2. Declaring a sellable feature in the dogfood application would change what that application
+ *     offers, which is a product decision rather than a documentation one.
+ *
+ * Imports are RELATIVE because this file lives inside `@wildo-ai/saas-models` itself and a package
+ * may not import its own name — that resolves against its own `dist/` and is a known compile-storm
+ * source. An application developer types the public specifier instead, which the anchored prose
+ * below states explicitly, because the compiled skill is read by someone with no access to this
+ * repository.
+ *
+ * This file is anchored but never imported by runtime code and never exported from the package
+ * barrel. It is typechecked by the package's ordinary program (`include: ["src"]`), so a change to
+ * any contract it names breaks the build here rather than silently rotting inside a shipped skill.
+ * When an authoring surface below changes, edit this file directly and the compiled skill picks the
+ * new shape up on the next `wildo fwk generate-docs`.
+ */
+import { type FeatureDefinitionWithAutoRegister } from './feature-builders.shared';
+import type { RequiredFeaturesConfig } from '../resources/resources-config.shared.schemas';
+/** @wildo_source:part:start example.features.connected-feature.declaration facet:kind:usage-example facet:audience:app-developer */
+/**
+ * The identifier is a NAMED ENUM MEMBER rather than a bare string, so the one place that explains
+ * what the feature means travels with every use of it.
+ */
+export declare enum ApplicationFeature {
+    /** Access the application's advanced reporting operation and interface. */
+    ADVANCED_REPORTS = "ADVANCED_REPORTS"
+}
+export declare const CUSTOM_FEATURE_DEFINITIONS: FeatureDefinitionWithAutoRegister[];
+export declare const reportingContribution: {
+    customFeatureDefinitions: FeatureDefinitionWithAutoRegister[];
+    customFeatureConfiguration: {
+        profiles: {
+            preview: {
+                features: ApplicationFeature[];
+                limits: {};
+            };
+        };
+        defaultProfile: string;
+    };
+};
+export declare const reportingProductGrant: {
+    grantedFeatures: ApplicationFeature[];
+};
+export declare const reportingRequirement: RequiredFeaturesConfig;
+export declare const reportingOperationGate: {
+    requiredFeatures: import("..").RequiredFeaturesFullConfig;
+};
+export declare enum BudgetFeature {
+    /** Upper bound measured by a token-consumption service, not a repository row count. */
+    MONTHLY_TOKEN_CAP = "MONTHLY_TOKEN_CAP"
+}
+export declare const tokenCapDefinition: FeatureDefinitionWithAutoRegister;
+/** @wildo_source:part:end example.features.connected-feature.declaration */
+//# sourceMappingURL=connected-feature.example.d.ts.map

package/dist/esm/features/connected-feature.example.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-feature.example.d.ts","sourceRoot":"","sources":["../../../../src/features/connected-feature.example.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAqC,KAAK,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AAGtH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8CAA8C,CAAC;AAI3F,oIAAoI;AAYpI;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,2EAA2E;IAC3E,gBAAgB,qBAAqB;CACtC;AAED,eAAO,MAAM,0BAA0B,EAAE,iCAAiC,EAMzE,CAAC;AAGF,eAAO,MAAM,qBAAqB;;;;;;;;;;;CAM2D,CAAC;AAG9F,eAAO,MAAM,qBAAqB;;CAEoB,CAAC;AAGvD,eAAO,MAAM,oBAAoB,EAAE,sBAElC,CAAC;AACF,eAAO,MAAM,sBAAsB;;CAA6C,CAAC;AAEjF,oBAAY,aAAa;IACvB,uFAAuF;IACvF,iBAAiB,sBAAsB;CACxC;AAGD,eAAO,MAAM,kBAAkB,mCAI7B,CAAC;AACH,4EAA4E"}

package/dist/esm/features/connected-feature.example.js

@@ -0,0 +1,86 @@
+/**
+ * Tier B usage example for the `engine-product-definitions` skill: ONE feature identifier followed
+ * from its declaration to the contract that sells it and the contract that enforces it.
+ *
+ * WHY TIER B (and not Tier A against the dogfood application):
+ *
+ *  1. What this teaches is the JOIN between four declarations that live in four different files —
+ *     a definition, a module contribution, a product grant and an operation requirement. In a real
+ *     application those are correctly far apart, so a Tier-A anchor would either span unrelated
+ *     code or need four separate spans the reader has to reassemble mentally. The shape is stable;
+ *     the product identity around it is not, which is exactly what Tier B is for.
+ *  2. Declaring a sellable feature in the dogfood application would change what that application
+ *     offers, which is a product decision rather than a documentation one.
+ *
+ * Imports are RELATIVE because this file lives inside `@wildo-ai/saas-models` itself and a package
+ * may not import its own name — that resolves against its own `dist/` and is a known compile-storm
+ * source. An application developer types the public specifier instead, which the anchored prose
+ * below states explicitly, because the compiled skill is read by someone with no access to this
+ * repository.
+ *
+ * This file is anchored but never imported by runtime code and never exported from the package
+ * barrel. It is typechecked by the package's ordinary program (`include: ["src"]`), so a change to
+ * any contract it names breaks the build here rather than silently rotting inside a shipped skill.
+ * When an authoring surface below changes, edit this file directly and the compiled skill picks the
+ * new shape up on the next `wildo fwk generate-docs`.
+ */
+import { defineFeature, defineLimitFeature } from './feature-builders.shared.js';
+import { FEATURES_UNLIMITED, FeatureLimitSemantic, FeatureUnavailabilityBehavior } from './feature-definition.shared.schemas.js';
+import { ResourcePrimaryScope } from '../resources/resources.shared.schemas.js';
+/** @wildo_source:part:start example.features.connected-feature.declaration facet:kind:usage-example facet:audience:app-developer */
+// One feature identifier, followed from declaration to enforcement.
+//
+// In an application every symbol below comes from the package root:
+//
+//   import {
+//     defineFeature, defineLimitFeature, FEATURES_UNLIMITED, FeatureLimitSemantic,
+//     FeatureUnavailabilityBehavior, ResourcePrimaryScope,
+//     type FeatureDefinitionWithAutoRegister, type ProductDefinition,
+//     type RequiredFeaturesConfig, type SharedSaaSModule,
+//   } from '@wildo-ai/saas-models';
+/**
+ * The identifier is a NAMED ENUM MEMBER rather than a bare string, so the one place that explains
+ * what the feature means travels with every use of it.
+ */
+export var ApplicationFeature;
+(function (ApplicationFeature) {
+    /** Access the application's advanced reporting operation and interface. */
+    ApplicationFeature["ADVANCED_REPORTS"] = "ADVANCED_REPORTS";
+})(ApplicationFeature || (ApplicationFeature = {}));
+export const CUSTOM_FEATURE_DEFINITIONS = [
+    defineFeature(ApplicationFeature.ADVANCED_REPORTS, {
+        scope: ResourcePrimaryScope.ORGANIZATIONS,
+        defaultEnabled: false,
+        unavailability: { behavior: FeatureUnavailabilityBehavior.UPGRADE_PROMPT },
+    }),
+];
+// Merge these hooks into the EXISTING engine contribution; do not register a second engine module.
+export const reportingContribution = {
+    customFeatureDefinitions: CUSTOM_FEATURE_DEFINITIONS,
+    customFeatureConfiguration: {
+        profiles: { preview: { features: [ApplicationFeature.ADVANCED_REPORTS], limits: {} } },
+        defaultProfile: 'preview',
+    },
+};
+// When billing is enabled, apply this fragment to the intended existing plan or add-on.
+export const reportingProductGrant = {
+    grantedFeatures: [ApplicationFeature.ADVANCED_REPORTS],
+};
+// Use this as requiredFeatures on EVERY externally reachable reporting operation variant.
+export const reportingRequirement = {
+    features: [ApplicationFeature.ADVANCED_REPORTS],
+};
+export const reportingOperationGate = { requiredFeatures: reportingRequirement };
+export var BudgetFeature;
+(function (BudgetFeature) {
+    /** Upper bound measured by a token-consumption service, not a repository row count. */
+    BudgetFeature["MONTHLY_TOKEN_CAP"] = "MONTHLY_TOKEN_CAP";
+})(BudgetFeature || (BudgetFeature = {}));
+// Contribute this definition alongside your other definitions only when a consumer enforces it.
+export const tokenCapDefinition = defineLimitFeature(BudgetFeature.MONTHLY_TOKEN_CAP, {
+    scope: ResourcePrimaryScope.ORGANIZATIONS,
+    default: FEATURES_UNLIMITED,
+    limitSemantic: FeatureLimitSemantic.CEILING,
+});
+/** @wildo_source:part:end example.features.connected-feature.declaration */
+//# sourceMappingURL=connected-feature.example.js.map

package/dist/esm/features/connected-feature.example.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connected-feature.example.js","sourceRoot":"","sources":["../../../../src/features/connected-feature.example.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAA0C,MAAM,2BAA2B,CAAC;AACtH,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAC9H,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAK7E,oIAAoI;AACpI,oEAAoE;AACpE,EAAE;AACF,oEAAoE;AACpE,EAAE;AACF,aAAa;AACb,mFAAmF;AACnF,2DAA2D;AAC3D,sEAAsE;AACtE,0DAA0D;AAC1D,oCAAoC;AAEpC;;;GAGG;AACH,MAAM,CAAN,IAAY,kBAGX;AAHD,WAAY,kBAAkB;IAC5B,2EAA2E;IAC3E,2DAAqC,CAAA;AACvC,CAAC,EAHW,kBAAkB,KAAlB,kBAAkB,QAG7B;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAwC;IAC7E,aAAa,CAAC,kBAAkB,CAAC,gBAAgB,EAAE;QACjD,KAAK,EAAE,oBAAoB,CAAC,aAAa;QACzC,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,EAAE,QAAQ,EAAE,6BAA6B,CAAC,cAAc,EAAE;KAC3E,CAAC;CACH,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,wBAAwB,EAAE,0BAA0B;IACpD,0BAA0B,EAAE;QAC1B,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE;QACtF,cAAc,EAAE,SAAS;KAC1B;CAC0F,CAAC;AAE9F,wFAAwF;AACxF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,eAAe,EAAE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;CACF,CAAC;AAEvD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,oBAAoB,GAA2B;IAC1D,QAAQ,EAAE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;CAChD,CAAC;AACF,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,CAAC;AAEjF,MAAM,CAAN,IAAY,aAGX;AAHD,WAAY,aAAa;IACvB,uFAAuF;IACvF,wDAAuC,CAAA;AACzC,CAAC,EAHW,aAAa,KAAb,aAAa,QAGxB;AAED,gGAAgG;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,aAAa,CAAC,iBAAiB,EAAE;IACpF,KAAK,EAAE,oBAAoB,CAAC,aAAa;IACzC,OAAO,EAAE,kBAAkB;IAC3B,aAAa,EAAE,oBAAoB,CAAC,OAAO;CAC5C,CAAC,CAAC;AACH,4EAA4E","sourcesContent":["/**\n * Tier B usage example for the `engine-product-definitions` skill: ONE feature identifier followed\n * from its declaration to the contract that sells it and the contract that enforces it.\n *\n * WHY TIER B (and not Tier A against the dogfood application):\n *\n *  1. What this teaches is the JOIN between four declarations that live in four different files —\n *     a definition, a module contribution, a product grant and an operation requirement. In a real\n *     application those are correctly far apart, so a Tier-A anchor would either span unrelated\n *     code or need four separate spans the reader has to reassemble mentally. The shape is stable;\n *     the product identity around it is not, which is exactly what Tier B is for.\n *  2. Declaring a sellable feature in the dogfood application would change what that application\n *     offers, which is a product decision rather than a documentation one.\n *\n * Imports are RELATIVE because this file lives inside `@wildo-ai/saas-models` itself and a package\n * may not import its own name — that resolves against its own `dist/` and is a known compile-storm\n * source. An application developer types the public specifier instead, which the anchored prose\n * below states explicitly, because the compiled skill is read by someone with no access to this\n * repository.\n *\n * This file is anchored but never imported by runtime code and never exported from the package\n * barrel. It is typechecked by the package's ordinary program (`include: [\"src\"]`), so a change to\n * any contract it names breaks the build here rather than silently rotting inside a shipped skill.\n * When an authoring surface below changes, edit this file directly and the compiled skill picks the\n * new shape up on the next `wildo fwk generate-docs`.\n */\n\nimport { defineFeature, defineLimitFeature, type FeatureDefinitionWithAutoRegister } from './feature-builders.shared';\nimport { FEATURES_UNLIMITED, FeatureLimitSemantic, FeatureUnavailabilityBehavior } from './feature-definition.shared.schemas';\nimport { ResourcePrimaryScope } from '../resources/resources.shared.schemas';\nimport type { RequiredFeaturesConfig } from '../resources/resources-config.shared.schemas';\nimport type { ProductDefinition } from '../billing/product-definition.shared.schemas';\nimport type { SharedSaaSModule } from '../runtime/domain-module.shared.definitions';\n\n/** @wildo_source:part:start example.features.connected-feature.declaration facet:kind:usage-example facet:audience:app-developer */\n// One feature identifier, followed from declaration to enforcement.\n//\n// In an application every symbol below comes from the package root:\n//\n//   import {\n//     defineFeature, defineLimitFeature, FEATURES_UNLIMITED, FeatureLimitSemantic,\n//     FeatureUnavailabilityBehavior, ResourcePrimaryScope,\n//     type FeatureDefinitionWithAutoRegister, type ProductDefinition,\n//     type RequiredFeaturesConfig, type SharedSaaSModule,\n//   } from '@wildo-ai/saas-models';\n\n/**\n * The identifier is a NAMED ENUM MEMBER rather than a bare string, so the one place that explains\n * what the feature means travels with every use of it.\n */\nexport enum ApplicationFeature {\n  /** Access the application's advanced reporting operation and interface. */\n  ADVANCED_REPORTS = 'ADVANCED_REPORTS',\n}\n\nexport const CUSTOM_FEATURE_DEFINITIONS: FeatureDefinitionWithAutoRegister[] = [\n  defineFeature(ApplicationFeature.ADVANCED_REPORTS, {\n    scope: ResourcePrimaryScope.ORGANIZATIONS,\n    defaultEnabled: false,\n    unavailability: { behavior: FeatureUnavailabilityBehavior.UPGRADE_PROMPT },\n  }),\n];\n\n// Merge these hooks into the EXISTING engine contribution; do not register a second engine module.\nexport const reportingContribution = {\n  customFeatureDefinitions: CUSTOM_FEATURE_DEFINITIONS,\n  customFeatureConfiguration: {\n    profiles: { preview: { features: [ApplicationFeature.ADVANCED_REPORTS], limits: {} } },\n    defaultProfile: 'preview',\n  },\n} satisfies Pick<SharedSaaSModule, 'customFeatureDefinitions' | 'customFeatureConfiguration'>;\n\n// When billing is enabled, apply this fragment to the intended existing plan or add-on.\nexport const reportingProductGrant = {\n  grantedFeatures: [ApplicationFeature.ADVANCED_REPORTS],\n} satisfies Pick<ProductDefinition, 'grantedFeatures'>;\n\n// Use this as requiredFeatures on EVERY externally reachable reporting operation variant.\nexport const reportingRequirement: RequiredFeaturesConfig = {\n  features: [ApplicationFeature.ADVANCED_REPORTS],\n};\nexport const reportingOperationGate = { requiredFeatures: reportingRequirement };\n\nexport enum BudgetFeature {\n  /** Upper bound measured by a token-consumption service, not a repository row count. */\n  MONTHLY_TOKEN_CAP = 'MONTHLY_TOKEN_CAP',\n}\n\n// Contribute this definition alongside your other definitions only when a consumer enforces it.\nexport const tokenCapDefinition = defineLimitFeature(BudgetFeature.MONTHLY_TOKEN_CAP, {\n  scope: ResourcePrimaryScope.ORGANIZATIONS,\n  default: FEATURES_UNLIMITED,\n  limitSemantic: FeatureLimitSemantic.CEILING,\n});\n/** @wildo_source:part:end example.features.connected-feature.declaration */\n"]}