@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/external-providers/engine-capabilities.shared.schemas.js

@@ -17,16 +17,15 @@ export var EngineCapability;
     EngineCapability["BILLING"] = "BILLING";
     EngineCapability["MULTI_LANGUAGE"] = "MULTI_LANGUAGE";
     /**
-     * Durable, provider-backed audit trail — and the capability with the widest reach into what the
-     * application is able to CLAIM about itself.
+     * Durable, provider-backed audit trail: every audit event the application records is ALSO sent to
+     * each configured audit provider (an immutable ledger, a SIEM).
      *
-     * Leaving it out is a legitimate choice, but it is not a small one, and the cost is invisible
-     * until much later. The assurance surface attests roughly half its control objectives through the
-     * audit trail: with this capability absent, about a third of them cannot be claimed AT ALL — every
-     * objective whose only attesting capability is the audit trail — and several more resolve to
-     * "undetermined", meaning the application may genuinely operate the control while being unable to
-     * evidence it. Enabling it typically moves an application from partial to complete coverage in one
-     * step.
+     * Whether to enable it is a question of where the trail must live, not of what the application may
+     * claim. The assurance surface attests roughly half its control objectives through audit rows, and
+     * those rows are read from the application's OWN audit store, which exists whether or not this
+     * capability is on. So leaving it out removes no control objective an application can claim. Until
+     * 2026-09-14 the assurance basis wrongly treated this capability as the precondition for those
+     * claims, and this comment said leaving it out left about a third of them unclaimable.
      *
      * Two things this does NOT mean, because both are easy to assume:
      *
@@ -38,9 +37,9 @@ export var EngineCapability;
      *   furnish evidence for the period it was off, and a control's evidence cannot begin before its
      *   evidence store does.
      *
-     * So decide it with the compliance posture rather than as an infrastructure detail: if the
-     * application intends to claim access, audit, identity or privacy control objectives to anyone
-     * outside itself, this is the capability those claims rest on.
+     * So decide it with the compliance posture rather than as an infrastructure detail: enable it when
+     * the trail must also exist OUTSIDE the application — a store its own operators cannot rewrite, or a
+     * security team's SIEM. The application's own store stays the authoritative record either way.
      */
     EngineCapability["COMPLIANCE_AUDIT_TRAIL"] = "COMPLIANCE_AUDIT_TRAIL";
     EngineCapability["EMAIL_TRANSACTIONAL"] = "EMAIL_TRANSACTIONAL";

package/dist/esm/external-providers/engine-capabilities.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capabilities.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAkC,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,gBAyKX;AAzKD,WAAY,gBAAgB;IAC1B,mDAA+B,CAAA;IAC/B,uCAAmB,CAAA;IACnB,qDAAiC,CAAA;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,qEAAiD,CAAA;IAEjD,+DAA2C,CAAA;IAC3C,uDAAmC,CAAA;IACnC,+BAAW,CAAA;IAEX,qCAAiB,CAAA;IACjB,+DAA2C,CAAA;IAC3C;;;;;;;;OAQG;IACH,mDAA+B,CAAA;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,qEAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uDAAmC,CAAA;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IAEH,2EAAuD,CAAA;IACvD,6EAAyD,CAAA;IAEzD;;;;;OAKG;IACH,2DAAuC,CAAA;IAEvC;;;;;;;;OAQG;IACH,uEAAmD,CAAA;AACrD,CAAC,EAzKW,gBAAgB,KAAhB,gBAAgB,QAyK3B;AACD,6DAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,gDAAgD,GAAG;IACvD,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACvF,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC/E,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,GAAG;IACvD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,OAAO;IAC/D,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,MAAM;IAC/D;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,aAAa;IAC5E;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;IAC/F,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC5E,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACpF,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,yBAAyB;IACnG,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,0BAA0B;IACrG,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,iBAAiB;IACnF,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,uBAAuB;IAC/F,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;CACd,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAEjD,gDAAgD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D;;;OAGG;IACH,gBAAgB,CAAC,aAAa;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,cAAc;CACe,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAkC,IAAI,GAAG,CAAC;IAC1G,gBAAgB,CAAC,mBAAmB;IACpC,gBAAgB,CAAC,OAAO;IACxB,gBAAgB,CAAC,GAAG;CACrB,CAAC,CAAC;AACH,qFAAqF","sourcesContent":["import { BUILTIN_PROVIDER_CAPABILITY, type BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** @wildo_source:part:start saas.models.engine-capabilities facet:kind:api facet:audience:app-developer\n *\n * Closed application capability vocabulary used to declare what the\n * application needs from its configured providers.\n *\n * `EngineCapability` no longer means \"feature gate id\" and no longer\n * carries provider routing by itself. Provider-backed fulfillment is selected\n * by the application's provider configuration; entitlement/billing features\n * remain application feature decisions. Import this enum from\n * `@wildo-ai/saas-models` and declare only capabilities the application\n * actually intends to configure and operate.\n */\nexport enum EngineCapability {\n  ORGANIZATIONS = 'ORGANIZATIONS',\n  BILLING = 'BILLING',\n  MULTI_LANGUAGE = 'MULTI_LANGUAGE',\n  /**\n   * Durable, provider-backed audit trail — and the capability with the widest reach into what the\n   * application is able to CLAIM about itself.\n   *\n   * Leaving it out is a legitimate choice, but it is not a small one, and the cost is invisible\n   * until much later. The assurance surface attests roughly half its control objectives through the\n   * audit trail: with this capability absent, about a third of them cannot be claimed AT ALL — every\n   * objective whose only attesting capability is the audit trail — and several more resolve to\n   * \"undetermined\", meaning the application may genuinely operate the control while being unable to\n   * evidence it. Enabling it typically moves an application from partial to complete coverage in one\n   * step.\n   *\n   * Two things this does NOT mean, because both are easy to assume:\n   *\n   * - It is not what makes security events happen. Authentication, authorization, privilege and\n   *   credential events are recorded in the application's own database regardless. What this\n   *   capability adds is the provider-backed fan-out — the durable, external, tamper-evident\n   *   destination an assurance reader can be pointed at.\n   * - It is not retroactive. Turning it on later starts a trail from that moment; it does not\n   *   furnish evidence for the period it was off, and a control's evidence cannot begin before its\n   *   evidence store does.\n   *\n   * So decide it with the compliance posture rather than as an infrastructure detail: if the\n   * application intends to claim access, audit, identity or privacy control objectives to anyone\n   * outside itself, this is the capability those claims rest on.\n   */\n  COMPLIANCE_AUDIT_TRAIL = 'COMPLIANCE_AUDIT_TRAIL',\n\n  EMAIL_TRANSACTIONAL = 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING = 'EMAIL_MARKETING',\n  SMS = 'SMS',\n\n  AI_LLM = 'AI_LLM',\n  AI_IMAGE_GENERATION = 'AI_IMAGE_GENERATION',\n  /**\n   * Text → vector embeddings (the RAG derived-data tier: `.ragSource()` corpus embedding by the\n   * `rag:embedding-drain` worker, and query-time embedding in retrieval). A slot of its OWN,\n   * deliberately separate from `AI_LLM` (RAG plan DL2/H4): while `LLM_EMBEDDINGS` mapped into the\n   * `AI_LLM` slot, an application structurally could not pick Anthropic for chat and a different\n   * provider for embeddings — one `selection[AI_LLM].primary` decided both. Embeddings resolve\n   * through `EMBEDDINGS_PROVIDER` protocol bindings and are selected by applicability class\n   * (`Embeddings_Applicability`), never by a concrete model id at a call site.\n   */\n  AI_EMBEDDINGS = 'AI_EMBEDDINGS',\n  /**\n   * Document bytes → text: provider-backed extraction (OCR) for uploaded documents, serving\n   * `FileTextExtractionBackendService` and, through it, `.ragSource()` corpus ingestion.\n   *\n   * ## Why a slot of its own\n   *\n   * Three unrelated procurement decisions were otherwise fused. A deployment may well want one\n   * vendor for chat, another for embeddings, and a third for OCR — vendors are not equally good\n   * at all three, and their pricing models do not even share a unit (tokens vs. pages). Mapping\n   * extraction into `AI_LLM` would have made one `selection[AI_LLM].primary` decide all three,\n   * which is exactly the defect that split `AI_EMBEDDINGS` out of `AI_LLM`.\n   *\n   * ## Not to be confused with PDF GENERATION\n   *\n   * PDF generation — templates and data become bytes — is the `pdfTemplates` surface, done\n   * in-process and with no provider slot of its own. This is the opposite direction: bytes become\n   * text. The two are unrelated and nothing routes between them. (There WAS an\n   * `EngineCapability.DOCUMENT_GENERATION` that this paragraph used to name; it was withdrawn\n   * because no provider capability could ever fill it.)\n   *\n   * ## Absence is benign, and that is load-bearing\n   *\n   * With no provider selected, extraction falls back to the local `pdfjs-dist` text-layer read.\n   * That is a real answer for a born-digital PDF and returns nothing for a SCAN — so this\n   * capability is what makes scanned documents answerable, never what makes extraction work at\n   * all. An application that ingests only born-digital documents may leave it unset deliberately.\n   */\n  AI_DOCUMENT_EXTRACTION = 'AI_DOCUMENT_EXTRACTION',\n  /**\n   * An autonomous coding agent that mutates the application workspace.\n   *\n   * Its own slot rather than `AI_LLM`, for exactly the reason `AI_EMBEDDINGS`\n   * was split out of it: one `selection[AI_LLM].primary` decides every provider\n   * mapped into that slot. While the coding transport mapped to `AI_LLM`, an\n   * application structurally could NOT choose one vendor's coding agent and a\n   * different vendor for chat — picking a chat provider silently picked the\n   * agent that would be allowed to edit its source.\n   *\n   * The stakes differ too, which is why fusing them was wrong beyond the\n   * ergonomics: selecting a chat model is a quality and cost decision, while\n   * selecting the agent that writes your code is those things AND an\n   * authorisation decision. They deserve separate, deliberate answers.\n   */\n  AI_CODING_AGENT = 'AI_CODING_AGENT',\n\n  /*\n   * WITHDRAWN 2026-09-03: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` were members here and are\n   * not any more. Neither could ever be filled — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` had no\n   * entry pointing at either, so no provider capability token could claim the slot — while both were\n   * classified `SELECT_ONE`, which asserts that exactly one provider must be selected. Selecting one\n   * of zero candidates is not a resolution mode.\n   *\n   * Both capabilities are real and both are delivered elsewhere, which is why withdrawing the slots\n   * costs nothing: antivirus scanning is `InfraCapability.ANTIVIRUS_SCANNING`, fulfilled by ClamAV\n   * and consumed by `FileScanningBackendService`; PDF generation is the in-process `pdfTemplates`\n   * surface, rendered by `@react-pdf/renderer` inside the backend. Neither has an external\n   * provider, and neither is planned to.\n   *\n   * `InfraCapability.DOCUMENT_RENDERING` (Gotenberg) was provisioned beside the PDF surface and\n   * consumed by nothing; it was withdrawn on 2026-09-08 (#477) because in-process rendering had\n   * superseded it. Note the two are not interchangeable if it is ever reconsidered:\n   * `@react-pdf/renderer` composes a document from React primitives, while Gotenberg converts\n   * EXISTING HTML and Office documents — that is a different capability, not a second\n   * implementation of this one.\n   *\n   * Removing `ANTIVIRUS_SCANNING` also removes a collision: the identical spelling named an engine\n   * slot nothing could fill AND a live infra capability, in two packages, so a reader grepping the\n   * word landed in whichever they searched first.\n   *\n   * If a hosted AV or document-rendering vendor is ever adopted, the member comes back WITH its\n   * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` entry and its own JSDoc in the same change.\n   *\n   * WITHDRAWN 2026-09-09: `BILLING_PAYMENTS`, the third member of exactly that shape, and the one\n   * this paragraph's own closing rule should have caught. It was never withdrawn with the other two\n   * because it had been left behind DELIBERATELY — as a \"reserved slot\" — which reads as a decision\n   * and is why nobody re-examined it. Measured before removing, across the whole repository outside\n   * `node_modules` / `dist`: it appeared in live source at exactly THREE sites, and none of them was\n   * a use — the enum declaration itself, its row in the compile-forced\n   * `ENGINE_CAPABILITY_RESOLUTION_MODE` record, and a comment in a test naming it as a slot the\n   * billing provider must NOT be registered under. Zero applications enabled it, zero scaffolds\n   * wrote it, zero consumers queried it, and no provider capability token mapped to it.\n   *\n   * The capability it names is real and is already delivered: a billing provider (Stripe) declares\n   * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills `EngineCapability.BILLING`, which is the slot\n   * applications enable and `getProvidersForEngineCapability` gates on. Payment EXECUTION is served\n   * through that same provider's `BILLING_PROVIDER` protocol; splitting it into a second engine slot\n   * was a plan-era intention (`provider-registry-materialization-workflow.md`) that the shipped\n   * model settled the other way. So the withdrawal removes a name, not a capability.\n   *\n   * The reason a reserved slot is worse than no slot is `EngineCapabilityResolutionMode`: every\n   * member must be classified, `BILLING_PAYMENTS` was classified `SELECT_ONE`, and `SELECT_ONE`\n   * asserts that exactly one provider is selected from the candidates. There were zero candidates\n   * and there could never be one. A vocabulary member that no configuration can satisfy is not a\n   * reservation, it is a false statement the compiler is forced to carry.\n   *\n   * If a payments vendor is ever selected independently of the billing vendor, the member comes back\n   * with its provider-capability token and its map entry in the same change — the same rule as\n   * above, now with three instances behind it.\n   */\n\n  FRONTEND_ERROR_MONITORING = 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS = 'FRONTEND_PRODUCT_ANALYTICS',\n\n  /**\n   * Backend LLM-call observability (model/tokens/cost/latency per `invokeAgent`),\n   * platform-scoped. This enables model-call observability when the selected\n   * provider configuration supplies that capability; it does not itself\n   * configure a provider or make telemetry operational.\n   */\n  LLM_OBSERVABILITY = 'LLM_OBSERVABILITY',\n\n  /**\n   * Operational telemetry (traces/metrics/logs) shipped via the OpenTelemetry\n   * SDK over OTLP to a provider (for example, BetterStack). Unlike\n   * `LLM_OBSERVABILITY`, the connection is preloaded from\n   * `OTEL_*` env vars (the CLI translates the saas-config selection + per-env\n   * infra config into them) BEFORE app config — not resolved through the runtime\n   * registry. Author the corresponding infrastructure/provider settings in\n   * the application environment before relying on telemetry.\n   */\n  OBSERVABILITY_TELEMETRY = 'OBSERVABILITY_TELEMETRY',\n}\n/** @wildo_source:part:end saas.models.engine-capabilities */\n\n/**\n * Canonical, single-source-of-truth mapping from the open\n * `ProviderCapability` vocabulary (the built-in subset) to the closed\n * `EngineCapability` slots the engine actually fulfills.\n *\n * A provider declares which `providerCapabilities` it satisfies (e.g.\n * Stripe → `BILLING`, Resend → `EMAIL_TRANSACTIONAL`, Anthropic →\n * `LLM_CHAT`/`CODING_AGENT`). This map projects each built-in\n * capability onto the engine slot it fills, so a provider's\n * `engineCapabilities` set can be derived mechanically. Multiple\n * provider capabilities may share one engine slot (every `LLM_*`\n * capability maps to `AI_LLM`); de-duplicate after projecting.\n *\n * **Why this lives here (one map, three consumers).** The projection\n * used to be hand-copied in three places that silently drifted:\n *   1. The runtime registry projection in `saas-backend-lib`\n *      (`ExternalProvidersRegistryBackendService.buildRuntimeRegistryFromProviderModules`),\n *      which decides which provider answers `getProvidersForEngineCapability`.\n *   2. The backend companion-discovery export in\n *      `@wildo-ai/external-connectors-private` (feeds the generated\n *      `provider-catalog.types.ts` autocomplete via `wildo config sync`).\n *   3. The frontend companion-discovery export in\n *      `@wildo-ai/external-connectors-public` (same, for browser-bound\n *      provider modules).\n * A missing/wrong entry in any copy silently breaks a different surface\n * (a registry resolution, or the catalog autocomplete). It is co-located\n * with the `EngineCapability` enum it projects onto, and every consumer\n * imports it from the `@wildo-ai/saas-models` package root barrel.\n *\n * **Bundle boundary — why here and not beside `BUILTIN_PROVIDER_CAPABILITY`.**\n * This map references `EngineCapability`, which is deliberately kept off\n * the browser-safe `@wildo-ai/saas-models/public-runtime` seam. So it must\n * live in a full-only module. `engine-capabilities.shared.schemas.ts` is\n * exactly that (exported from the root barrel, never from\n * `public-runtime/index.ts`), whereas `provider-capability.shared.schemas.ts`\n * — the other natural home — IS on the public seam and would drag\n * `EngineCapability` into the browser bundle. The frontend discovery\n * consumer (#3) imports this map through its Node-only `./companion`\n * subpath, which already pulls the full root barrel; the browser-shipped\n * `./app`/`./techdoc`/`./website` subpaths never reach it.\n *\n * **BILLING → BILLING.** A billing provider (Stripe) declares\n * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills the\n * `EngineCapability.BILLING` slot — the SAME slot apps enable in\n * `defineSaaSProviders`/`engineCapabilities` activation config and that\n * `getProvidersForEngineCapability` gates resolution on. The runtime copy\n * of this projection historically mapped it onto a distinct\n * `EngineCapability.BILLING_PAYMENTS` slot instead, registering Stripe\n * under something no activation config enables and no consumer queries,\n * which made it unreachable through the registry. That second slot was\n * withdrawn from the enum on 2026-09-09 (see the WITHDRAWN block beside\n * the enum) — it had no producer and no consumer other than the bug.\n *\n * **Intentionally unmapped.** `SSO_OAUTH2`, `SSO_SAML`, `FRONTEND_SEARCH`,\n * `FRONTEND_FILE_PICKER`, and `FRONTEND_CAPTCHA` have no closed engine\n * slot today — they are fulfilled by provider protocols / app wiring, not\n * by an `EngineCapability`. Their absence here is by construction, not an\n * oversight: a `Partial<Record<…>>` lookup returns `undefined` and the\n * capability contributes nothing to a provider's `engineCapabilities`.\n *\n * There are no app-extended provider capabilities: the augmentation point was\n * removed as an extension point with no resolver (#502), so this map covers the\n * whole vocabulary rather than the built-in half of it.\n */\nconst PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: EngineCapability.EMAIL_TRANSACTIONAL,\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: EngineCapability.EMAIL_MARKETING,\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: EngineCapability.SMS,\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: EngineCapability.BILLING,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: EngineCapability.AI_LLM,\n  /**\n   * REPOINTED 2026-08-27 (RAG plan DL2/H4): `LLM_EMBEDDINGS` used to map into `AI_LLM`, which\n   * fused the chat and embeddings provider selections into one slot. The TOKEN keeps its name —\n   * it correctly says \"this provider can produce embeddings\", and it sits inside the anchored\n   * `saas.models.provider-capabilities` block compiled into shipped skills — only the slot it\n   * fills changed. Exactly one token claims the embeddings slot.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: EngineCapability.AI_EMBEDDINGS,\n  /**\n   * EXACTLY ONE token claims the document-extraction slot, and it is a new one. Checked rather\n   * than assumed before adding it: `IMAGE_GENERATION` maps to `AI_IMAGE_GENERATION` (output),\n   * `LLM_CHAT` to `AI_LLM`, `LLM_EMBEDDINGS` to `AI_EMBEDDINGS`, and no built-in token mapped\n   * anywhere near document INPUT. Repointing an existing token — the move that kept\n   * `LLM_EMBEDDINGS` alive — was not available here because none of them meant this.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: EngineCapability.AI_DOCUMENT_EXTRACTION,\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: EngineCapability.AI_CODING_AGENT,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: EngineCapability.AI_IMAGE_GENERATION,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: EngineCapability.FRONTEND_ERROR_MONITORING,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: EngineCapability.FRONTEND_PRODUCT_ANALYTICS,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: EngineCapability.LLM_OBSERVABILITY,\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: EngineCapability.OBSERVABILITY_TELEMETRY,\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n} as const satisfies Partial<Record<BuiltinProviderCapability, EngineCapability>>;\n\n/**\n * The projection every consumer uses, with the WIDE type it has always had.\n *\n * **Why the literal above and the widened alias here are two declarations.** Consumers index this\n * map with a `BuiltinProviderCapability` VARIABLE — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[cap]`\n * in the runtime registry, in both companion-discovery exports, in `defineSaaSProviders` and in the\n * tier rule — and that only type-checks against `Partial<Record<…>>`, which admits every token in\n * the vocabulary and answers `undefined` for the five that map nowhere. Annotating the literal that\n * way is what USED to be written here, and it is also what erased the information the totality\n * check below needs: an annotation discards the per-property literal types, so\n * `(typeof MAP)[keyof typeof MAP]` collapsed to `EngineCapability | undefined` and could not say\n * WHICH slots are filled.\n *\n * `as const satisfies` on the literal keeps both: the compiler still rejects a wrong key or a\n * non-`EngineCapability` value at the site where it is written, and the exact filled set survives\n * into the type system. The widening then happens once, here, so no consumer changes and nobody has\n * to know the literal exists.\n */\nexport const PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY: Partial<\n  Record<BuiltinProviderCapability, EngineCapability>\n> = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES;\n\n/**\n * Engine capabilities that DELIBERATELY have no provider capability pointing at them, each named\n * with the reason it is an empty slot rather than a hole.\n *\n * This exists so the two states can never be confused. Before it, an `EngineCapability` member with\n * no entry in the map above looked exactly like one whose entry someone forgot — the absence WAS the\n * record — and that indistinguishability is the whole mechanism behind three separate slots shipping\n * unfillable: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` (withdrawn 2026-09-03) and\n * `BILLING_PAYMENTS` (withdrawn 2026-09-09, and left standing for six days precisely because\n * \"reserved\" reads like a decision). A capability listed here has been looked at; one that is\n * neither listed here nor mapped above does not compile.\n *\n * **Both members are ACTIVATION capabilities, and that is the criterion.** Each is a real, live,\n * enabled-or-not decision an application makes in `wildo.saas.config.ts` (`ORGANIZATIONS` is\n * enabled by both dogfood applications, `MULTI_LANGUAGE` is written by the scaffold and by the\n * application-creation composition step), and each is implemented BY THE ENGINE — multi-tenancy is\n * the engine's own organization model and scoping, translation is the engine's own i18n pipeline.\n * There is no external party to select, so there is nothing for a provider capability to say. That\n * is categorically different from a withdrawn slot, which named work an external party WOULD do and\n * had no external party able to do it.\n *\n * **Adding a member here is a decision that must be argued, not a way to make a compile error go\n * away.** The test beside this file pins the set to exactly these two, so a third one cannot arrive\n * as a silent edit — see `__tests__/engine-capability-provider-coverage.shared.test.ts`.\n */\nexport const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY = [\n  /**\n   * Multi-tenancy: organizations, memberships, roles and organization scoping are engine resources\n   * and engine authorization. Nothing about them is procured.\n   */\n  EngineCapability.ORGANIZATIONS,\n  /**\n   * Application-wide i18n: the label tree, the locale negotiation and the translation pipeline are\n   * the engine's. Where translation is MODEL-backed it reaches a provider through `AI_LLM`, which is\n   * its own slot with its own selection — so even that path is not this capability's producer.\n   */\n  EngineCapability.MULTI_LANGUAGE,\n] as const satisfies readonly EngineCapability[];\n\n/**\n * COMPILE-TIME TOTALITY: every `EngineCapability` is either filled by a provider capability or\n * declared an empty slot above. Adding a member to the enum without doing one of the two is a\n * TypeScript error at this line, not a test failure and not a runtime surprise.\n *\n * A compile error is the right instrument here because both inputs are static literals in this one\n * file — there is no runtime state to consult, so nothing is gained by deferring the question to\n * execution, and a great deal is lost: a test only fails for someone who runs it, while this fails\n * for whoever adds the member, in the editor, before the commit.\n *\n * The error a violation produces is `TS2344` on `EngineCapabilityAccountedFor`, reading\n * `Type 'EngineCapability.X' does not satisfy the constraint 'never'` — X being the exact member\n * that is neither mapped nor declared. Measured rather than asserted: deleting the\n * `BUILTIN_PROVIDER_CAPABILITY.SMS` row from the literal above produced exactly that diagnostic,\n * naming `EngineCapability.SMS`, and the row was restored.\n *\n * The two declarations below are unused by design — the assertion IS the declaration, and it is\n * evaluated the moment the file is type-checked. `noUnusedLocals` is off in this package's\n * tsconfig, so nothing objects; do not \"clean them up\".\n */\ntype EngineCapabilityFilledByAProviderCapability =\n  (typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES)[keyof typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES];\n\ntype EngineCapabilityDeclaredEmpty = (typeof ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY)[number];\n\n/** Resolves to `never` when the two sets above cover the enum, and to the offending member(s) when they do not. */\ntype EngineCapabilityAccountedFor<Unaccounted extends never> = Unaccounted;\n\ntype _EveryEngineCapabilityIsMappedOrDeclaredEmpty = EngineCapabilityAccountedFor<\n  Exclude<EngineCapability, EngineCapabilityFilledByAProviderCapability | EngineCapabilityDeclaredEmpty>\n>;\n\n/**\n * The mirror assertion: a capability may not be BOTH mapped and declared empty.\n *\n * Without it the totality check is satisfiable by lying in the easier direction — list a mapped\n * capability as an empty slot and the union still covers the enum, so a genuinely missing mapping\n * elsewhere could be hidden by a bogus declaration here. `TS2344` again, naming the member that\n * appears on both sides.\n */\ntype _NoEngineCapabilityIsBothMappedAndDeclaredEmpty = EngineCapabilityAccountedFor<\n  Extract<EngineCapabilityDeclaredEmpty, EngineCapabilityFilledByAProviderCapability>\n>;\n\n/** @wildo_source:part:start saas.models.engine-capabilities.required-provider-floor facet:layer:shared facet:audience:app-developer */\n/**\n * Engine capabilities that REQUIRE a resolved provider the moment an\n * application ENABLES them — the engine-level MAIN floor (#328).\n *\n * The asymmetry is the thing to carry away: **enabling a capability with nothing serving it fails at\n * BOOT for these three and at the point of USE for every other slot.** So an author who tries one\n * unserved slot, sees the application come up, and concludes that an unserved capability degrades\n * gracefully has learned the wrong rule from the larger half of the vocabulary.\n *\n * `EngineCapabilityActivation.required` is the application's decision;\n * this set is the ENGINE's: for each member, an enabled capability with no\n * provider is not a degraded mode but a boot-time misconfiguration, because\n * an engine flow the application already relies on fails at first use:\n *\n * - `EMAIL_TRANSACTIONAL` — invitations, address verification and password\n *   reset are engine flows that send mail; with no provider they fail\n *   silently at the moment a user needs them.\n * - `BILLING` — `initializeBillingServices` already fails loud with no\n *   provider; the floor names it in the same place as the others.\n * - `SMS` — phone verification and MFA-by-SMS are engine flows.\n *\n * DELIBERATELY ABSENT, with the reason each would need to overturn:\n * - the `AI_*` slots — consumed per feature (an agent, the logo generator)\n *   and legitimately served on a DIFFERENT host (the companion reaches image\n *   generation; the backend need not), so \"enabled with no backend provider\"\n *   is a normal topology, not a fault. A feature that needs one refuses at\n *   its own site.\n * - the sinks (`COMPLIANCE_AUDIT_TRAIL`, `LLM_OBSERVABILITY`,\n *   `OBSERVABILITY_TELEMETRY`) — fail-OPEN by design (the G4 reconcile\n *   warns), because Layer-1 persistence is unaffected.\n * - `EMAIL_MARKETING` — a campaign feature, not an engine flow.\n * - the `FRONTEND_*` slots — resolved by the frontend facet, invisible to\n *   the backend registry that evaluates this floor.\n * - `ORGANIZATIONS` and `MULTI_LANGUAGE` — no provider token maps to them,\n *   deliberately and by declaration; see\n *   `ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`. A floor requiring a\n *   resolved provider for a slot nothing can fill would refuse every boot that\n *   enabled them. (`BILLING_PAYMENTS` was named here too until it was withdrawn\n *   from the enum on 2026-09-09.)\n *\n * The floor runs only on a host expected to SERVE these slots (see\n * `ApplicationRuntimeProfileBootAssertions.assertsEngineCapabilityProviderFloor`);\n * a minion's scope-filtered registry legitimately resolves none of them.\n */\nexport const ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED: ReadonlySet<EngineCapability> = new Set([\n  EngineCapability.EMAIL_TRANSACTIONAL,\n  EngineCapability.BILLING,\n  EngineCapability.SMS,\n]);\n/** @wildo_source:part:end saas.models.engine-capabilities.required-provider-floor */\n"]}
+{"version":3,"file":"engine-capabilities.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAkC,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,gBAwKX;AAxKD,WAAY,gBAAgB;IAC1B,mDAA+B,CAAA;IAC/B,uCAAmB,CAAA;IACnB,qDAAiC,CAAA;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,qEAAiD,CAAA;IAEjD,+DAA2C,CAAA;IAC3C,uDAAmC,CAAA;IACnC,+BAAW,CAAA;IAEX,qCAAiB,CAAA;IACjB,+DAA2C,CAAA;IAC3C;;;;;;;;OAQG;IACH,mDAA+B,CAAA;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,qEAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uDAAmC,CAAA;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IAEH,2EAAuD,CAAA;IACvD,6EAAyD,CAAA;IAEzD;;;;;OAKG;IACH,2DAAuC,CAAA;IAEvC;;;;;;;;OAQG;IACH,uEAAmD,CAAA;AACrD,CAAC,EAxKW,gBAAgB,KAAhB,gBAAgB,QAwK3B;AACD,6DAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,gDAAgD,GAAG;IACvD,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACvF,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC/E,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,GAAG;IACvD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,OAAO;IAC/D,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,MAAM;IAC/D;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,aAAa;IAC5E;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;IAC/F,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC5E,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACpF,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,yBAAyB;IACnG,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,0BAA0B;IACrG,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,iBAAiB;IACnF,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,uBAAuB;IAC/F,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;CACd,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAEjD,gDAAgD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D;;;OAGG;IACH,gBAAgB,CAAC,aAAa;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,cAAc;CACe,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAkC,IAAI,GAAG,CAAC;IAC1G,gBAAgB,CAAC,mBAAmB;IACpC,gBAAgB,CAAC,OAAO;IACxB,gBAAgB,CAAC,GAAG;CACrB,CAAC,CAAC;AACH,qFAAqF","sourcesContent":["import { BUILTIN_PROVIDER_CAPABILITY, type BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** @wildo_source:part:start saas.models.engine-capabilities facet:kind:api facet:audience:app-developer\n *\n * Closed application capability vocabulary used to declare what the\n * application needs from its configured providers.\n *\n * `EngineCapability` no longer means \"feature gate id\" and no longer\n * carries provider routing by itself. Provider-backed fulfillment is selected\n * by the application's provider configuration; entitlement/billing features\n * remain application feature decisions. Import this enum from\n * `@wildo-ai/saas-models` and declare only capabilities the application\n * actually intends to configure and operate.\n */\nexport enum EngineCapability {\n  ORGANIZATIONS = 'ORGANIZATIONS',\n  BILLING = 'BILLING',\n  MULTI_LANGUAGE = 'MULTI_LANGUAGE',\n  /**\n   * Durable, provider-backed audit trail: every audit event the application records is ALSO sent to\n   * each configured audit provider (an immutable ledger, a SIEM).\n   *\n   * Whether to enable it is a question of where the trail must live, not of what the application may\n   * claim. The assurance surface attests roughly half its control objectives through audit rows, and\n   * those rows are read from the application's OWN audit store, which exists whether or not this\n   * capability is on. So leaving it out removes no control objective an application can claim. Until\n   * 2026-09-14 the assurance basis wrongly treated this capability as the precondition for those\n   * claims, and this comment said leaving it out left about a third of them unclaimable.\n   *\n   * Two things this does NOT mean, because both are easy to assume:\n   *\n   * - It is not what makes security events happen. Authentication, authorization, privilege and\n   *   credential events are recorded in the application's own database regardless. What this\n   *   capability adds is the provider-backed fan-out — the durable, external, tamper-evident\n   *   destination an assurance reader can be pointed at.\n   * - It is not retroactive. Turning it on later starts a trail from that moment; it does not\n   *   furnish evidence for the period it was off, and a control's evidence cannot begin before its\n   *   evidence store does.\n   *\n   * So decide it with the compliance posture rather than as an infrastructure detail: enable it when\n   * the trail must also exist OUTSIDE the application — a store its own operators cannot rewrite, or a\n   * security team's SIEM. The application's own store stays the authoritative record either way.\n   */\n  COMPLIANCE_AUDIT_TRAIL = 'COMPLIANCE_AUDIT_TRAIL',\n\n  EMAIL_TRANSACTIONAL = 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING = 'EMAIL_MARKETING',\n  SMS = 'SMS',\n\n  AI_LLM = 'AI_LLM',\n  AI_IMAGE_GENERATION = 'AI_IMAGE_GENERATION',\n  /**\n   * Text → vector embeddings (the RAG derived-data tier: `.ragSource()` corpus embedding by the\n   * `rag:embedding-drain` worker, and query-time embedding in retrieval). A slot of its OWN,\n   * deliberately separate from `AI_LLM` (RAG plan DL2/H4): while `LLM_EMBEDDINGS` mapped into the\n   * `AI_LLM` slot, an application structurally could not pick Anthropic for chat and a different\n   * provider for embeddings — one `selection[AI_LLM].primary` decided both. Embeddings resolve\n   * through `EMBEDDINGS_PROVIDER` protocol bindings and are selected by applicability class\n   * (`Embeddings_Applicability`), never by a concrete model id at a call site.\n   */\n  AI_EMBEDDINGS = 'AI_EMBEDDINGS',\n  /**\n   * Document bytes → text: provider-backed extraction (OCR) for uploaded documents, serving\n   * `FileTextExtractionBackendService` and, through it, `.ragSource()` corpus ingestion.\n   *\n   * ## Why a slot of its own\n   *\n   * Three unrelated procurement decisions were otherwise fused. A deployment may well want one\n   * vendor for chat, another for embeddings, and a third for OCR — vendors are not equally good\n   * at all three, and their pricing models do not even share a unit (tokens vs. pages). Mapping\n   * extraction into `AI_LLM` would have made one `selection[AI_LLM].primary` decide all three,\n   * which is exactly the defect that split `AI_EMBEDDINGS` out of `AI_LLM`.\n   *\n   * ## Not to be confused with PDF GENERATION\n   *\n   * PDF generation — templates and data become bytes — is the `pdfTemplates` surface, done\n   * in-process and with no provider slot of its own. This is the opposite direction: bytes become\n   * text. The two are unrelated and nothing routes between them. (There WAS an\n   * `EngineCapability.DOCUMENT_GENERATION` that this paragraph used to name; it was withdrawn\n   * because no provider capability could ever fill it.)\n   *\n   * ## Absence is benign, and that is load-bearing\n   *\n   * With no provider selected, extraction falls back to the local `pdfjs-dist` text-layer read.\n   * That is a real answer for a born-digital PDF and returns nothing for a SCAN — so this\n   * capability is what makes scanned documents answerable, never what makes extraction work at\n   * all. An application that ingests only born-digital documents may leave it unset deliberately.\n   */\n  AI_DOCUMENT_EXTRACTION = 'AI_DOCUMENT_EXTRACTION',\n  /**\n   * An autonomous coding agent that mutates the application workspace.\n   *\n   * Its own slot rather than `AI_LLM`, for exactly the reason `AI_EMBEDDINGS`\n   * was split out of it: one `selection[AI_LLM].primary` decides every provider\n   * mapped into that slot. While the coding transport mapped to `AI_LLM`, an\n   * application structurally could NOT choose one vendor's coding agent and a\n   * different vendor for chat — picking a chat provider silently picked the\n   * agent that would be allowed to edit its source.\n   *\n   * The stakes differ too, which is why fusing them was wrong beyond the\n   * ergonomics: selecting a chat model is a quality and cost decision, while\n   * selecting the agent that writes your code is those things AND an\n   * authorisation decision. They deserve separate, deliberate answers.\n   */\n  AI_CODING_AGENT = 'AI_CODING_AGENT',\n\n  /*\n   * WITHDRAWN 2026-09-03: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` were members here and are\n   * not any more. Neither could ever be filled — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` had no\n   * entry pointing at either, so no provider capability token could claim the slot — while both were\n   * classified `SELECT_ONE`, which asserts that exactly one provider must be selected. Selecting one\n   * of zero candidates is not a resolution mode.\n   *\n   * Both capabilities are real and both are delivered elsewhere, which is why withdrawing the slots\n   * costs nothing: antivirus scanning is `InfraCapability.ANTIVIRUS_SCANNING`, fulfilled by ClamAV\n   * and consumed by `FileScanningBackendService`; PDF generation is the in-process `pdfTemplates`\n   * surface, rendered by `@react-pdf/renderer` inside the backend. Neither has an external\n   * provider, and neither is planned to.\n   *\n   * `InfraCapability.DOCUMENT_RENDERING` (Gotenberg) was provisioned beside the PDF surface and\n   * consumed by nothing; it was withdrawn on 2026-09-08 (#477) because in-process rendering had\n   * superseded it. Note the two are not interchangeable if it is ever reconsidered:\n   * `@react-pdf/renderer` composes a document from React primitives, while Gotenberg converts\n   * EXISTING HTML and Office documents — that is a different capability, not a second\n   * implementation of this one.\n   *\n   * Removing `ANTIVIRUS_SCANNING` also removes a collision: the identical spelling named an engine\n   * slot nothing could fill AND a live infra capability, in two packages, so a reader grepping the\n   * word landed in whichever they searched first.\n   *\n   * If a hosted AV or document-rendering vendor is ever adopted, the member comes back WITH its\n   * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` entry and its own JSDoc in the same change.\n   *\n   * WITHDRAWN 2026-09-09: `BILLING_PAYMENTS`, the third member of exactly that shape, and the one\n   * this paragraph's own closing rule should have caught. It was never withdrawn with the other two\n   * because it had been left behind DELIBERATELY — as a \"reserved slot\" — which reads as a decision\n   * and is why nobody re-examined it. Measured before removing, across the whole repository outside\n   * `node_modules` / `dist`: it appeared in live source at exactly THREE sites, and none of them was\n   * a use — the enum declaration itself, its row in the compile-forced\n   * `ENGINE_CAPABILITY_RESOLUTION_MODE` record, and a comment in a test naming it as a slot the\n   * billing provider must NOT be registered under. Zero applications enabled it, zero scaffolds\n   * wrote it, zero consumers queried it, and no provider capability token mapped to it.\n   *\n   * The capability it names is real and is already delivered: a billing provider (Stripe) declares\n   * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills `EngineCapability.BILLING`, which is the slot\n   * applications enable and `getProvidersForEngineCapability` gates on. Payment EXECUTION is served\n   * through that same provider's `BILLING_PROVIDER` protocol; splitting it into a second engine slot\n   * was a plan-era intention (`provider-registry-materialization-workflow.md`) that the shipped\n   * model settled the other way. So the withdrawal removes a name, not a capability.\n   *\n   * The reason a reserved slot is worse than no slot is `EngineCapabilityResolutionMode`: every\n   * member must be classified, `BILLING_PAYMENTS` was classified `SELECT_ONE`, and `SELECT_ONE`\n   * asserts that exactly one provider is selected from the candidates. There were zero candidates\n   * and there could never be one. A vocabulary member that no configuration can satisfy is not a\n   * reservation, it is a false statement the compiler is forced to carry.\n   *\n   * If a payments vendor is ever selected independently of the billing vendor, the member comes back\n   * with its provider-capability token and its map entry in the same change — the same rule as\n   * above, now with three instances behind it.\n   */\n\n  FRONTEND_ERROR_MONITORING = 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS = 'FRONTEND_PRODUCT_ANALYTICS',\n\n  /**\n   * Backend LLM-call observability (model/tokens/cost/latency per `invokeAgent`),\n   * platform-scoped. This enables model-call observability when the selected\n   * provider configuration supplies that capability; it does not itself\n   * configure a provider or make telemetry operational.\n   */\n  LLM_OBSERVABILITY = 'LLM_OBSERVABILITY',\n\n  /**\n   * Operational telemetry (traces/metrics/logs) shipped via the OpenTelemetry\n   * SDK over OTLP to a provider (for example, BetterStack). Unlike\n   * `LLM_OBSERVABILITY`, the connection is preloaded from\n   * `OTEL_*` env vars (the CLI translates the saas-config selection + per-env\n   * infra config into them) BEFORE app config — not resolved through the runtime\n   * registry. Author the corresponding infrastructure/provider settings in\n   * the application environment before relying on telemetry.\n   */\n  OBSERVABILITY_TELEMETRY = 'OBSERVABILITY_TELEMETRY',\n}\n/** @wildo_source:part:end saas.models.engine-capabilities */\n\n/**\n * Canonical, single-source-of-truth mapping from the open\n * `ProviderCapability` vocabulary (the built-in subset) to the closed\n * `EngineCapability` slots the engine actually fulfills.\n *\n * A provider declares which `providerCapabilities` it satisfies (e.g.\n * Stripe → `BILLING`, Resend → `EMAIL_TRANSACTIONAL`, Anthropic →\n * `LLM_CHAT`/`CODING_AGENT`). This map projects each built-in\n * capability onto the engine slot it fills, so a provider's\n * `engineCapabilities` set can be derived mechanically. Multiple\n * provider capabilities may share one engine slot (every `LLM_*`\n * capability maps to `AI_LLM`); de-duplicate after projecting.\n *\n * **Why this lives here (one map, three consumers).** The projection\n * used to be hand-copied in three places that silently drifted:\n *   1. The runtime registry projection in `saas-backend-lib`\n *      (`ExternalProvidersRegistryBackendService.buildRuntimeRegistryFromProviderModules`),\n *      which decides which provider answers `getProvidersForEngineCapability`.\n *   2. The backend companion-discovery export in\n *      `@wildo-ai/external-connectors-private` (feeds the generated\n *      `provider-catalog.types.ts` autocomplete via `wildo config sync`).\n *   3. The frontend companion-discovery export in\n *      `@wildo-ai/external-connectors-public` (same, for browser-bound\n *      provider modules).\n * A missing/wrong entry in any copy silently breaks a different surface\n * (a registry resolution, or the catalog autocomplete). It is co-located\n * with the `EngineCapability` enum it projects onto, and every consumer\n * imports it from the `@wildo-ai/saas-models` package root barrel.\n *\n * **Bundle boundary — why here and not beside `BUILTIN_PROVIDER_CAPABILITY`.**\n * This map references `EngineCapability`, which is deliberately kept off\n * the browser-safe `@wildo-ai/saas-models/public-runtime` seam. So it must\n * live in a full-only module. `engine-capabilities.shared.schemas.ts` is\n * exactly that (exported from the root barrel, never from\n * `public-runtime/index.ts`), whereas `provider-capability.shared.schemas.ts`\n * — the other natural home — IS on the public seam and would drag\n * `EngineCapability` into the browser bundle. The frontend discovery\n * consumer (#3) imports this map through its Node-only `./companion`\n * subpath, which already pulls the full root barrel; the browser-shipped\n * `./app`/`./techdoc`/`./website` subpaths never reach it.\n *\n * **BILLING → BILLING.** A billing provider (Stripe) declares\n * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills the\n * `EngineCapability.BILLING` slot — the SAME slot apps enable in\n * `defineSaaSProviders`/`engineCapabilities` activation config and that\n * `getProvidersForEngineCapability` gates resolution on. The runtime copy\n * of this projection historically mapped it onto a distinct\n * `EngineCapability.BILLING_PAYMENTS` slot instead, registering Stripe\n * under something no activation config enables and no consumer queries,\n * which made it unreachable through the registry. That second slot was\n * withdrawn from the enum on 2026-09-09 (see the WITHDRAWN block beside\n * the enum) — it had no producer and no consumer other than the bug.\n *\n * **Intentionally unmapped.** `SSO_OAUTH2`, `SSO_SAML`, `FRONTEND_SEARCH`,\n * `FRONTEND_FILE_PICKER`, and `FRONTEND_CAPTCHA` have no closed engine\n * slot today — they are fulfilled by provider protocols / app wiring, not\n * by an `EngineCapability`. Their absence here is by construction, not an\n * oversight: a `Partial<Record<…>>` lookup returns `undefined` and the\n * capability contributes nothing to a provider's `engineCapabilities`.\n *\n * There are no app-extended provider capabilities: the augmentation point was\n * removed as an extension point with no resolver (#502), so this map covers the\n * whole vocabulary rather than the built-in half of it.\n */\nconst PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: EngineCapability.EMAIL_TRANSACTIONAL,\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: EngineCapability.EMAIL_MARKETING,\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: EngineCapability.SMS,\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: EngineCapability.BILLING,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: EngineCapability.AI_LLM,\n  /**\n   * REPOINTED 2026-08-27 (RAG plan DL2/H4): `LLM_EMBEDDINGS` used to map into `AI_LLM`, which\n   * fused the chat and embeddings provider selections into one slot. The TOKEN keeps its name —\n   * it correctly says \"this provider can produce embeddings\", and it sits inside the anchored\n   * `saas.models.provider-capabilities` block compiled into shipped skills — only the slot it\n   * fills changed. Exactly one token claims the embeddings slot.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: EngineCapability.AI_EMBEDDINGS,\n  /**\n   * EXACTLY ONE token claims the document-extraction slot, and it is a new one. Checked rather\n   * than assumed before adding it: `IMAGE_GENERATION` maps to `AI_IMAGE_GENERATION` (output),\n   * `LLM_CHAT` to `AI_LLM`, `LLM_EMBEDDINGS` to `AI_EMBEDDINGS`, and no built-in token mapped\n   * anywhere near document INPUT. Repointing an existing token — the move that kept\n   * `LLM_EMBEDDINGS` alive — was not available here because none of them meant this.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: EngineCapability.AI_DOCUMENT_EXTRACTION,\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: EngineCapability.AI_CODING_AGENT,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: EngineCapability.AI_IMAGE_GENERATION,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: EngineCapability.FRONTEND_ERROR_MONITORING,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: EngineCapability.FRONTEND_PRODUCT_ANALYTICS,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: EngineCapability.LLM_OBSERVABILITY,\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: EngineCapability.OBSERVABILITY_TELEMETRY,\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n} as const satisfies Partial<Record<BuiltinProviderCapability, EngineCapability>>;\n\n/**\n * The projection every consumer uses, with the WIDE type it has always had.\n *\n * **Why the literal above and the widened alias here are two declarations.** Consumers index this\n * map with a `BuiltinProviderCapability` VARIABLE — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[cap]`\n * in the runtime registry, in both companion-discovery exports, in `defineSaaSProviders` and in the\n * tier rule — and that only type-checks against `Partial<Record<…>>`, which admits every token in\n * the vocabulary and answers `undefined` for the five that map nowhere. Annotating the literal that\n * way is what USED to be written here, and it is also what erased the information the totality\n * check below needs: an annotation discards the per-property literal types, so\n * `(typeof MAP)[keyof typeof MAP]` collapsed to `EngineCapability | undefined` and could not say\n * WHICH slots are filled.\n *\n * `as const satisfies` on the literal keeps both: the compiler still rejects a wrong key or a\n * non-`EngineCapability` value at the site where it is written, and the exact filled set survives\n * into the type system. The widening then happens once, here, so no consumer changes and nobody has\n * to know the literal exists.\n */\nexport const PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY: Partial<\n  Record<BuiltinProviderCapability, EngineCapability>\n> = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES;\n\n/**\n * Engine capabilities that DELIBERATELY have no provider capability pointing at them, each named\n * with the reason it is an empty slot rather than a hole.\n *\n * This exists so the two states can never be confused. Before it, an `EngineCapability` member with\n * no entry in the map above looked exactly like one whose entry someone forgot — the absence WAS the\n * record — and that indistinguishability is the whole mechanism behind three separate slots shipping\n * unfillable: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` (withdrawn 2026-09-03) and\n * `BILLING_PAYMENTS` (withdrawn 2026-09-09, and left standing for six days precisely because\n * \"reserved\" reads like a decision). A capability listed here has been looked at; one that is\n * neither listed here nor mapped above does not compile.\n *\n * **Both members are ACTIVATION capabilities, and that is the criterion.** Each is a real, live,\n * enabled-or-not decision an application makes in `wildo.saas.config.ts` (`ORGANIZATIONS` is\n * enabled by both dogfood applications, `MULTI_LANGUAGE` is written by the scaffold and by the\n * application-creation composition step), and each is implemented BY THE ENGINE — multi-tenancy is\n * the engine's own organization model and scoping, translation is the engine's own i18n pipeline.\n * There is no external party to select, so there is nothing for a provider capability to say. That\n * is categorically different from a withdrawn slot, which named work an external party WOULD do and\n * had no external party able to do it.\n *\n * **Adding a member here is a decision that must be argued, not a way to make a compile error go\n * away.** The test beside this file pins the set to exactly these two, so a third one cannot arrive\n * as a silent edit — see `__tests__/engine-capability-provider-coverage.shared.test.ts`.\n */\nexport const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY = [\n  /**\n   * Multi-tenancy: organizations, memberships, roles and organization scoping are engine resources\n   * and engine authorization. Nothing about them is procured.\n   */\n  EngineCapability.ORGANIZATIONS,\n  /**\n   * Application-wide i18n: the label tree, the locale negotiation and the translation pipeline are\n   * the engine's. Where translation is MODEL-backed it reaches a provider through `AI_LLM`, which is\n   * its own slot with its own selection — so even that path is not this capability's producer.\n   */\n  EngineCapability.MULTI_LANGUAGE,\n] as const satisfies readonly EngineCapability[];\n\n/**\n * COMPILE-TIME TOTALITY: every `EngineCapability` is either filled by a provider capability or\n * declared an empty slot above. Adding a member to the enum without doing one of the two is a\n * TypeScript error at this line, not a test failure and not a runtime surprise.\n *\n * A compile error is the right instrument here because both inputs are static literals in this one\n * file — there is no runtime state to consult, so nothing is gained by deferring the question to\n * execution, and a great deal is lost: a test only fails for someone who runs it, while this fails\n * for whoever adds the member, in the editor, before the commit.\n *\n * The error a violation produces is `TS2344` on `EngineCapabilityAccountedFor`, reading\n * `Type 'EngineCapability.X' does not satisfy the constraint 'never'` — X being the exact member\n * that is neither mapped nor declared. Measured rather than asserted: deleting the\n * `BUILTIN_PROVIDER_CAPABILITY.SMS` row from the literal above produced exactly that diagnostic,\n * naming `EngineCapability.SMS`, and the row was restored.\n *\n * The two declarations below are unused by design — the assertion IS the declaration, and it is\n * evaluated the moment the file is type-checked. `noUnusedLocals` is off in this package's\n * tsconfig, so nothing objects; do not \"clean them up\".\n */\ntype EngineCapabilityFilledByAProviderCapability =\n  (typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES)[keyof typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES];\n\ntype EngineCapabilityDeclaredEmpty = (typeof ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY)[number];\n\n/** Resolves to `never` when the two sets above cover the enum, and to the offending member(s) when they do not. */\ntype EngineCapabilityAccountedFor<Unaccounted extends never> = Unaccounted;\n\ntype _EveryEngineCapabilityIsMappedOrDeclaredEmpty = EngineCapabilityAccountedFor<\n  Exclude<EngineCapability, EngineCapabilityFilledByAProviderCapability | EngineCapabilityDeclaredEmpty>\n>;\n\n/**\n * The mirror assertion: a capability may not be BOTH mapped and declared empty.\n *\n * Without it the totality check is satisfiable by lying in the easier direction — list a mapped\n * capability as an empty slot and the union still covers the enum, so a genuinely missing mapping\n * elsewhere could be hidden by a bogus declaration here. `TS2344` again, naming the member that\n * appears on both sides.\n */\ntype _NoEngineCapabilityIsBothMappedAndDeclaredEmpty = EngineCapabilityAccountedFor<\n  Extract<EngineCapabilityDeclaredEmpty, EngineCapabilityFilledByAProviderCapability>\n>;\n\n/** @wildo_source:part:start saas.models.engine-capabilities.required-provider-floor facet:layer:shared facet:audience:app-developer */\n/**\n * Engine capabilities that REQUIRE a resolved provider the moment an\n * application ENABLES them — the engine-level MAIN floor (#328).\n *\n * The asymmetry is the thing to carry away: **enabling a capability with nothing serving it fails at\n * BOOT for these three and at the point of USE for every other slot.** So an author who tries one\n * unserved slot, sees the application come up, and concludes that an unserved capability degrades\n * gracefully has learned the wrong rule from the larger half of the vocabulary.\n *\n * `EngineCapabilityActivation.required` is the application's decision;\n * this set is the ENGINE's: for each member, an enabled capability with no\n * provider is not a degraded mode but a boot-time misconfiguration, because\n * an engine flow the application already relies on fails at first use:\n *\n * - `EMAIL_TRANSACTIONAL` — invitations, address verification and password\n *   reset are engine flows that send mail; with no provider they fail\n *   silently at the moment a user needs them.\n * - `BILLING` — `initializeBillingServices` already fails loud with no\n *   provider; the floor names it in the same place as the others.\n * - `SMS` — phone verification and MFA-by-SMS are engine flows.\n *\n * DELIBERATELY ABSENT, with the reason each would need to overturn:\n * - the `AI_*` slots — consumed per feature (an agent, the logo generator)\n *   and legitimately served on a DIFFERENT host (the companion reaches image\n *   generation; the backend need not), so \"enabled with no backend provider\"\n *   is a normal topology, not a fault. A feature that needs one refuses at\n *   its own site.\n * - the sinks (`COMPLIANCE_AUDIT_TRAIL`, `LLM_OBSERVABILITY`,\n *   `OBSERVABILITY_TELEMETRY`) — fail-OPEN by design (the G4 reconcile\n *   warns), because Layer-1 persistence is unaffected.\n * - `EMAIL_MARKETING` — a campaign feature, not an engine flow.\n * - the `FRONTEND_*` slots — resolved by the frontend facet, invisible to\n *   the backend registry that evaluates this floor.\n * - `ORGANIZATIONS` and `MULTI_LANGUAGE` — no provider token maps to them,\n *   deliberately and by declaration; see\n *   `ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`. A floor requiring a\n *   resolved provider for a slot nothing can fill would refuse every boot that\n *   enabled them. (`BILLING_PAYMENTS` was named here too until it was withdrawn\n *   from the enum on 2026-09-09.)\n *\n * The floor runs only on a host expected to SERVE these slots (see\n * `ApplicationRuntimeProfileBootAssertions.assertsEngineCapabilityProviderFloor`);\n * a minion's scope-filtered registry legitimately resolves none of them.\n */\nexport const ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED: ReadonlySet<EngineCapability> = new Set([\n  EngineCapability.EMAIL_TRANSACTIONAL,\n  EngineCapability.BILLING,\n  EngineCapability.SMS,\n]);\n/** @wildo_source:part:end saas.models.engine-capabilities.required-provider-floor */\n"]}

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.d.ts

@@ -14,13 +14,15 @@ import { EngineCapability } from './engine-capabilities.shared.schemas';
  */
 export declare enum EngineCapabilityResolutionMode {
     /**
-     * Exactly one active provider: `selection.<capability>.primary`. The default for every capability
+     * At most one active provider: the first eligible ref after selection ordering. The default for every capability
      * (billing, email, observability, …), and a request is served by that one provider.
      *
      * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on
      * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a
-     * primary that is not AVAILABLE at resolution time — undeclared in the scope, disabled, or
-     * unconfigured — and it decides which provider ends up first in the resolved list. Nothing
+     * primary that is not eligible in the active runtime scope. Eligible policy refs come first;
+     * remaining eligible providers follow, so an invalid primary does not empty that set.
+     * Eligibility requires a registered module declaring the capability and an active scope
+     * declaration for it; resolution does not validate credentials or vendor health. Nothing
      * retries a second provider when a call to the first one FAILS: the send raises the primary's
      * error and stops.
      *

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-resolution-mode.shared.d.ts","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC;;;;;;;;;;;;;;OAcG;IACH,UAAU,eAAe;IACzB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AA4DD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,gBAAgB,GAC3B,8BAA8B,CAEhC"}
+{"version":3,"file":"engine-capability-resolution-mode.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,eAAe;IACzB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AA4DD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,gBAAgB,GAC3B,8BAA8B,CAEhC"}

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.js

@@ -15,13 +15,15 @@ import { EngineCapability } from './engine-capabilities.shared.schemas.js';
 export var EngineCapabilityResolutionMode;
 (function (EngineCapabilityResolutionMode) {
     /**
-     * Exactly one active provider: `selection.<capability>.primary`. The default for every capability
+     * At most one active provider: the first eligible ref after selection ordering. The default for every capability
      * (billing, email, observability, …), and a request is served by that one provider.
      *
      * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on
      * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a
-     * primary that is not AVAILABLE at resolution time — undeclared in the scope, disabled, or
-     * unconfigured — and it decides which provider ends up first in the resolved list. Nothing
+     * primary that is not eligible in the active runtime scope. Eligible policy refs come first;
+     * remaining eligible providers follow, so an invalid primary does not empty that set.
+     * Eligibility requires a registered module declaring the capability and an active scope
+     * declaration for it; resolution does not validate credentials or vendor health. Nothing
      * retries a second provider when a call to the first one FAILS: the send raises the primary's
      * error and stops.
      *

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-resolution-mode.shared.js","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BAwBX;AAxBD,WAAY,8BAA8B;IACxC;;;;;;;;;;;;;;OAcG;IACH,2DAAyB,CAAA;IACzB;;;;;OAKG;IACH,qDAAmB,CAAA;AACrB,CAAC,EAxBW,8BAA8B,KAA9B,8BAA8B,QAwBzC;AACD,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,iCAAiC,GAA6D;IAClG,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,OAAO;IAEjF;;;;;;;;;;;;;;OAcG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACrE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC5E,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,8FAA8F;IAC9F,8FAA8F;IAC9F,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,oBAAoB;IACpB,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACvF,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACxF,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC/E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,UAAU;CACtF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA4B;IAE5B,OAAO,iCAAiC,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-resolution-mode facet:layer:shared facet:audience:app-developer\n *\n * How the engine resolves the provider(s) fulfilling an `EngineCapability`\n * when more than one is declared for the same scope.\n *\n * This is a FIRST-CLASS, declared property of a capability — NOT an implicit\n * per-consumer convention. A reader can tell whether a capability picks one\n * provider or writes to all of them; a new capability author declares it\n * here; and both the runtime registry resolver and the `defineSaaSProviders`\n * config validators branch on it (so a `FAN_OUT` capability is validated by\n * DECLARATION and never keyed off `selection`).\n */\nexport enum EngineCapabilityResolutionMode {\n  /**\n   * Exactly one active provider: `selection.<capability>.primary`. The default for every capability\n   * (billing, email, observability, …), and a request is served by that one provider.\n   *\n   * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on\n   * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a\n   * primary that is not AVAILABLE at resolution time — undeclared in the scope, disabled, or\n   * unconfigured — and it decides which provider ends up first in the resolved list. Nothing\n   * retries a second provider when a call to the first one FAILS: the send raises the primary's\n   * error and stops.\n   *\n   * So do not read a declared `whenUnavailable` entry as redundancy, and do not size an\n   * availability argument on it. An application that wants call-time failover builds it at its own\n   * call site, per capability — a deliberate framework boundary, not an omission.\n   */\n  SELECT_ONE = 'SELECT_ONE',\n  /**\n   * ALL declared providers are active simultaneously — every one receives\n   * every emission (no primary, no failover). For sinks whose nature is\n   * additive rather than substitutable: `COMPLIANCE_AUDIT_TRAIL` writes each\n   * audit event to every configured destination.\n   */\n  FAN_OUT = 'FAN_OUT',\n}\n/** @wildo_source:part:end saas.models.providers.capability-resolution-mode */\n\n/**\n * The DECLARED resolution mode for EVERY engine capability. Exhaustive by\n * construction: because this is a `Record<EngineCapability, …>`, adding a new\n * member to the `EngineCapability` enum WITHOUT classifying it here is a COMPILE\n * error. That is deliberate — a bare \"default to SELECT_ONE\" would let a future\n * additive/fan-out capability silently collapse to single-provider resolution\n * (dropping emissions to every non-primary destination) just because its author\n * forgot a one-line edit. The compiler now forces the decision.\n *\n * Only `COMPLIANCE_AUDIT_TRAIL` is `FAN_OUT` today (audit events are additive —\n * every declared destination receives every event). Everything else is\n * `SELECT_ONE`: one active provider, and no failover to a second one.\n */\nconst ENGINE_CAPABILITY_RESOLUTION_MODE: Record<EngineCapability, EngineCapabilityResolutionMode> = {\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: EngineCapabilityResolutionMode.FAN_OUT,\n\n  /**\n   * NOMINAL for the two ACTIVATION capabilities below, and worth stating because the next reader\n   * will otherwise ask the right question. `BILLING_PAYMENTS` was withdrawn from the enum on\n   * 2026-09-09 for being classified `SELECT_ONE` with no provider capability able to fill it —\n   * \"select one of zero candidates\" is not a resolution mode. `ORGANIZATIONS` and `MULTI_LANGUAGE`\n   * have no provider capability either, so why do they stand?\n   *\n   * Because nothing ever RESOLVES them. They are engine-implemented activations (multi-tenancy, the\n   * i18n pipeline): an application enables them, the engine serves them, and no code path asks this\n   * record which provider fulfills them — where the withdrawn slot's whole purpose was to be\n   * resolved and it could not be. Their absence from `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` is a\n   * DECLARATION (`ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`), not a gap, and the row here\n   * exists only because this record is total over the enum by construction — which is the property\n   * that makes a genuinely resolvable new capability impossible to leave unclassified.\n   */\n  [EngineCapability.ORGANIZATIONS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.BILLING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.SMS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_LLM]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_IMAGE_GENERATION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Embeddings are substitutable, not additive: one provider serves a vector space, and writing\n  // the same chunk through two providers would produce two incompatible spaces, not redundancy.\n  [EngineCapability.AI_EMBEDDINGS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Extraction is substitutable, not additive: one provider reads a document, and running the\n  // same bytes through two OCR services would produce two divergent transcriptions of one page\n  // with no principled way to merge them — plus a second egress of the same private content.\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One agent per task, and emphatically not fan-out: two coding agents given the same task\n  // against the same worktree do not produce redundancy, they produce a merge conflict nobody\n  // asked for — and the change attribution that follows a run could no longer say which agent\n  // wrote which file.\n  [EngineCapability.AI_CODING_AGENT]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.LLM_OBSERVABILITY]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: EngineCapabilityResolutionMode.SELECT_ONE,\n};\n\n/**\n * The declared resolution mode for an engine capability. A TOTAL lookup — every\n * capability is explicitly classified in `ENGINE_CAPABILITY_RESOLUTION_MODE`\n * (no silent default).\n *\n * Consumers: the runtime registry (`ExternalProvidersRegistryBackendService`\n * — `FAN_OUT` uses the full provider list, `SELECT_ONE` uses the primary) and\n * the `defineSaaSProviders` validators (a `FAN_OUT` capability is validated by\n * declaration and rejects a `selection` entry).\n */\nexport function getEngineCapabilityResolutionMode(\n  capability: EngineCapability,\n): EngineCapabilityResolutionMode {\n  return ENGINE_CAPABILITY_RESOLUTION_MODE[capability];\n}\n"]}
+{"version":3,"file":"engine-capability-resolution-mode.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BA0BX;AA1BD,WAAY,8BAA8B;IACxC;;;;;;;;;;;;;;;;OAgBG;IACH,2DAAyB,CAAA;IACzB;;;;;OAKG;IACH,qDAAmB,CAAA;AACrB,CAAC,EA1BW,8BAA8B,KAA9B,8BAA8B,QA0BzC;AACD,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,iCAAiC,GAA6D;IAClG,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,OAAO;IAEjF;;;;;;;;;;;;;;OAcG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACrE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC5E,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,8FAA8F;IAC9F,8FAA8F;IAC9F,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,oBAAoB;IACpB,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACvF,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACxF,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC/E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,UAAU;CACtF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA4B;IAE5B,OAAO,iCAAiC,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-resolution-mode facet:layer:shared facet:audience:app-developer\n *\n * How the engine resolves the provider(s) fulfilling an `EngineCapability`\n * when more than one is declared for the same scope.\n *\n * This is a FIRST-CLASS, declared property of a capability — NOT an implicit\n * per-consumer convention. A reader can tell whether a capability picks one\n * provider or writes to all of them; a new capability author declares it\n * here; and both the runtime registry resolver and the `defineSaaSProviders`\n * config validators branch on it (so a `FAN_OUT` capability is validated by\n * DECLARATION and never keyed off `selection`).\n */\nexport enum EngineCapabilityResolutionMode {\n  /**\n   * At most one active provider: the first eligible ref after selection ordering. The default for every capability\n   * (billing, email, observability, …), and a request is served by that one provider.\n   *\n   * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on\n   * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a\n   * primary that is not eligible in the active runtime scope. Eligible policy refs come first;\n   * remaining eligible providers follow, so an invalid primary does not empty that set.\n   * Eligibility requires a registered module declaring the capability and an active scope\n   * declaration for it; resolution does not validate credentials or vendor health. Nothing\n   * retries a second provider when a call to the first one FAILS: the send raises the primary's\n   * error and stops.\n   *\n   * So do not read a declared `whenUnavailable` entry as redundancy, and do not size an\n   * availability argument on it. An application that wants call-time failover builds it at its own\n   * call site, per capability — a deliberate framework boundary, not an omission.\n   */\n  SELECT_ONE = 'SELECT_ONE',\n  /**\n   * ALL declared providers are active simultaneously — every one receives\n   * every emission (no primary, no failover). For sinks whose nature is\n   * additive rather than substitutable: `COMPLIANCE_AUDIT_TRAIL` writes each\n   * audit event to every configured destination.\n   */\n  FAN_OUT = 'FAN_OUT',\n}\n/** @wildo_source:part:end saas.models.providers.capability-resolution-mode */\n\n/**\n * The DECLARED resolution mode for EVERY engine capability. Exhaustive by\n * construction: because this is a `Record<EngineCapability, …>`, adding a new\n * member to the `EngineCapability` enum WITHOUT classifying it here is a COMPILE\n * error. That is deliberate — a bare \"default to SELECT_ONE\" would let a future\n * additive/fan-out capability silently collapse to single-provider resolution\n * (dropping emissions to every non-primary destination) just because its author\n * forgot a one-line edit. The compiler now forces the decision.\n *\n * Only `COMPLIANCE_AUDIT_TRAIL` is `FAN_OUT` today (audit events are additive —\n * every declared destination receives every event). Everything else is\n * `SELECT_ONE`: one active provider, and no failover to a second one.\n */\nconst ENGINE_CAPABILITY_RESOLUTION_MODE: Record<EngineCapability, EngineCapabilityResolutionMode> = {\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: EngineCapabilityResolutionMode.FAN_OUT,\n\n  /**\n   * NOMINAL for the two ACTIVATION capabilities below, and worth stating because the next reader\n   * will otherwise ask the right question. `BILLING_PAYMENTS` was withdrawn from the enum on\n   * 2026-09-09 for being classified `SELECT_ONE` with no provider capability able to fill it —\n   * \"select one of zero candidates\" is not a resolution mode. `ORGANIZATIONS` and `MULTI_LANGUAGE`\n   * have no provider capability either, so why do they stand?\n   *\n   * Because nothing ever RESOLVES them. They are engine-implemented activations (multi-tenancy, the\n   * i18n pipeline): an application enables them, the engine serves them, and no code path asks this\n   * record which provider fulfills them — where the withdrawn slot's whole purpose was to be\n   * resolved and it could not be. Their absence from `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` is a\n   * DECLARATION (`ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`), not a gap, and the row here\n   * exists only because this record is total over the enum by construction — which is the property\n   * that makes a genuinely resolvable new capability impossible to leave unclassified.\n   */\n  [EngineCapability.ORGANIZATIONS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.BILLING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.SMS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_LLM]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_IMAGE_GENERATION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Embeddings are substitutable, not additive: one provider serves a vector space, and writing\n  // the same chunk through two providers would produce two incompatible spaces, not redundancy.\n  [EngineCapability.AI_EMBEDDINGS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Extraction is substitutable, not additive: one provider reads a document, and running the\n  // same bytes through two OCR services would produce two divergent transcriptions of one page\n  // with no principled way to merge them — plus a second egress of the same private content.\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One agent per task, and emphatically not fan-out: two coding agents given the same task\n  // against the same worktree do not produce redundancy, they produce a merge conflict nobody\n  // asked for — and the change attribution that follows a run could no longer say which agent\n  // wrote which file.\n  [EngineCapability.AI_CODING_AGENT]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.LLM_OBSERVABILITY]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: EngineCapabilityResolutionMode.SELECT_ONE,\n};\n\n/**\n * The declared resolution mode for an engine capability. A TOTAL lookup — every\n * capability is explicitly classified in `ENGINE_CAPABILITY_RESOLUTION_MODE`\n * (no silent default).\n *\n * Consumers: the runtime registry (`ExternalProvidersRegistryBackendService`\n * — `FAN_OUT` uses the full provider list, `SELECT_ONE` uses the primary) and\n * the `defineSaaSProviders` validators (a `FAN_OUT` capability is validated by\n * declaration and rejects a `selection` entry).\n */\nexport function getEngineCapabilityResolutionMode(\n  capability: EngineCapability,\n): EngineCapabilityResolutionMode {\n  return ENGINE_CAPABILITY_RESOLUTION_MODE[capability];\n}\n"]}

package/dist/esm/external-providers/engine-capability-surface.shared.d.ts

@@ -0,0 +1,77 @@
+import { EngineCapability } from './engine-capabilities.shared.schemas';
+/**
+ * @wildo_source:part:start saas.models.providers.capability-surface facet:layer:shared facet:audience:app-developer
+ *
+ * WHICH SURFACE of the system reaches an `EngineCapability` — the deployed
+ * application serving its users, the development companion building that
+ * application, or both.
+ *
+ * This exists because compliance is not one question. A privacy notice, a
+ * record of processing and a processor agreement all describe what the
+ * CONTRACTED SERVICE does with a data subject's personal data; a
+ * secure-development or supply-chain control describes how the software was
+ * BUILT. An application that answers the first honestly — "my product performs
+ * no AI processing of customer content" — may still have been authored with an
+ * AI coding agent, and until this axis existed it had no way to say so: one
+ * `engineCapabilities` field answered both questions at once, so declaring the
+ * build-time tool silently made the product claim a runtime feature.
+ *
+ * **A capability may serve BOTH, and that is the common case for the `AI_*`
+ * slots.** The axis is therefore a SET, not a choice. What narrows a particular
+ * declaration to one surface is the provider SCOPE it is declared in
+ * (`companion` versus the runtime scopes) — this map says what the capability
+ * CAN serve, the scope says what a given declaration DOES serve.
+ */
+export declare enum EngineCapabilitySurface {
+    /**
+     * Reached by the DEPLOYED application while it serves its users.
+     *
+     * This is the surface every customer-facing compliance statement is about:
+     * GDPR Art. 13/14 notices, Art. 30 records, Art. 28 processor terms, EU AI
+     * Act Art. 50 transparency, and service terms. If a capability is not on this
+     * surface, it processes no data subject's personal data through the
+     * contracted service, and a document about that service must not describe it.
+     */
+    RUNTIME_SERVICE = "RUNTIME_SERVICE",
+    /**
+     * Reached by the DEVELOPMENT COMPANION while the application is being built.
+     *
+     * Operates on the application's own source, specifications and generated
+     * artifacts — never on a customer's data. Not exempt from compliance, and
+     * saying so is the point of the axis rather than a caveat to it: this is the
+     * surface NIST SP 800-53 SA-3/SA-8/SA-11/SA-15 and the SR supply-chain family
+     * are about, as are the secure-development and change-management controls of
+     * the commercial certification frameworks. It is simply a
+     * DIFFERENT set of obligations from the runtime ones, asked of a different
+     * artifact.
+     */
+    AUTHORING_COMPANION = "AUTHORING_COMPANION"
+}
+/**
+ * The surfaces a capability may be reached on.
+ *
+ * Returns the declared set; never empty, because a capability nothing reaches
+ * on either surface would have no reason to exist in the vocabulary.
+ */
+export declare function getEngineCapabilitySurfaces(capability: EngineCapability): readonly EngineCapabilitySurface[];
+/**
+ * Does this capability reach the DEPLOYED application serving its users?
+ *
+ * The predicate a customer-facing compliance statement asks. A capability for
+ * which this is `false` processes no data subject's personal data through the
+ * contracted service, so a privacy notice, a record of processing or a set of
+ * service terms must not describe it as a feature of that service.
+ */
+export declare function engineCapabilityReachesRuntimeService(capability: EngineCapability): boolean;
+/**
+ * Is this capability reached ONLY while the application is being built?
+ *
+ * Deliberately not the negation of the predicate above: a capability that is
+ * BOTH is reached at authoring time too, and a statement about how the software
+ * is developed should include it. This names the narrower population — the
+ * capabilities that are invisible to the running product — which is the set a
+ * runtime-scoped document must exclude and a secure-development document must
+ * not.
+ */
+export declare function engineCapabilityIsAuthoringOnly(capability: EngineCapability): boolean;
+//# sourceMappingURL=engine-capability-surface.shared.d.ts.map

package/dist/esm/external-providers/engine-capability-surface.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-capability-surface.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-surface.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;;OAQG;IACH,eAAe,oBAAoB;IACnC;;;;;;;;;;;OAWG;IACH,mBAAmB,wBAAwB;CAC5C;AA+FD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,uBAAuB,EAAE,CAE5G;AAED;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAE3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAGrF"}

package/dist/esm/external-providers/engine-capability-surface.shared.js

@@ -0,0 +1,173 @@
+import { EngineCapability } from './engine-capabilities.shared.schemas.js';
+/**
+ * @wildo_source:part:start saas.models.providers.capability-surface facet:layer:shared facet:audience:app-developer
+ *
+ * WHICH SURFACE of the system reaches an `EngineCapability` — the deployed
+ * application serving its users, the development companion building that
+ * application, or both.
+ *
+ * This exists because compliance is not one question. A privacy notice, a
+ * record of processing and a processor agreement all describe what the
+ * CONTRACTED SERVICE does with a data subject's personal data; a
+ * secure-development or supply-chain control describes how the software was
+ * BUILT. An application that answers the first honestly — "my product performs
+ * no AI processing of customer content" — may still have been authored with an
+ * AI coding agent, and until this axis existed it had no way to say so: one
+ * `engineCapabilities` field answered both questions at once, so declaring the
+ * build-time tool silently made the product claim a runtime feature.
+ *
+ * **A capability may serve BOTH, and that is the common case for the `AI_*`
+ * slots.** The axis is therefore a SET, not a choice. What narrows a particular
+ * declaration to one surface is the provider SCOPE it is declared in
+ * (`companion` versus the runtime scopes) — this map says what the capability
+ * CAN serve, the scope says what a given declaration DOES serve.
+ */
+export var EngineCapabilitySurface;
+(function (EngineCapabilitySurface) {
+    /**
+     * Reached by the DEPLOYED application while it serves its users.
+     *
+     * This is the surface every customer-facing compliance statement is about:
+     * GDPR Art. 13/14 notices, Art. 30 records, Art. 28 processor terms, EU AI
+     * Act Art. 50 transparency, and service terms. If a capability is not on this
+     * surface, it processes no data subject's personal data through the
+     * contracted service, and a document about that service must not describe it.
+     */
+    EngineCapabilitySurface["RUNTIME_SERVICE"] = "RUNTIME_SERVICE";
+    /**
+     * Reached by the DEVELOPMENT COMPANION while the application is being built.
+     *
+     * Operates on the application's own source, specifications and generated
+     * artifacts — never on a customer's data. Not exempt from compliance, and
+     * saying so is the point of the axis rather than a caveat to it: this is the
+     * surface NIST SP 800-53 SA-3/SA-8/SA-11/SA-15 and the SR supply-chain family
+     * are about, as are the secure-development and change-management controls of
+     * the commercial certification frameworks. It is simply a
+     * DIFFERENT set of obligations from the runtime ones, asked of a different
+     * artifact.
+     */
+    EngineCapabilitySurface["AUTHORING_COMPANION"] = "AUTHORING_COMPANION";
+})(EngineCapabilitySurface || (EngineCapabilitySurface = {}));
+/** @wildo_source:part:end saas.models.providers.capability-surface */
+/** Both surfaces, named once so the common `AI_*` answer is not retyped per member. */
+const BOTH_SURFACES = [
+    EngineCapabilitySurface.RUNTIME_SERVICE,
+    EngineCapabilitySurface.AUTHORING_COMPANION,
+];
+/** Runtime only — the answer for every capability the companion does not reach. */
+const RUNTIME_ONLY = [EngineCapabilitySurface.RUNTIME_SERVICE];
+/**
+ * The DECLARED surfaces of EVERY engine capability. Exhaustive by construction:
+ * because this is a `Record<EngineCapability, …>`, adding a member to the
+ * `EngineCapability` enum WITHOUT classifying it here is a COMPILE error.
+ *
+ * That is the whole reason it is a Record rather than a lookup with a default,
+ * and it is the same argument `ENGINE_CAPABILITY_RESOLUTION_MODE` makes beside
+ * it: a bare "default to RUNTIME_SERVICE" would let a future build-time
+ * capability silently enter a privacy notice as a product feature, which is
+ * exactly the defect this map was created to close.
+ *
+ * **Every classification below is MEASURED against what reaches the capability
+ * today, not against what plausibly might.** A capability whose companion
+ * consumer is added later becomes a compile-visible decision at that moment,
+ * which is better than a speculative `AUTHORING_COMPANION` nothing serves. A
+ * per-host grep of the enum members was tried as the basis for this map and
+ * REJECTED — it reports `AI_CODING_AGENT` as unreferenced on every host while
+ * that capability is plainly companion-reached, because naming the enum and
+ * reaching the capability are different things.
+ */
+const ENGINE_CAPABILITY_SURFACES = {
+    /*
+     * The four AI slots split two-and-two, and the split is the reason this map exists.
+     */
+    /**
+     * BOTH. An application may expose LLM features to its users, and the companion
+     * reaches an LLM for its own work: the meta-workflows structured-generation
+     * agent and the playbook judge (`META_WORKFLOWS_PROVIDER_REF`), and the
+     * brief-adequacy agent. Neither of those touches customer data.
+     */
+    [EngineCapability.AI_LLM]: BOTH_SURFACES,
+    /**
+     * BOTH. The companion's brand step generates and judges a logo through an
+     * IMAGE-modality agent; an application may equally offer image generation to
+     * its users. `engine-capabilities.shared.schemas.ts` already recorded this
+     * topology in prose — "legitimately served on a DIFFERENT host (the companion
+     * reaches image generation; the backend need not)" — one file before anything
+     * could read it.
+     */
+    [EngineCapability.AI_IMAGE_GENERATION]: BOTH_SURFACES,
+    /**
+     * AUTHORING ONLY, and this is the member the axis was written for. The coding
+     * agent writes the application's SOURCE. It is never reached while the
+     * application serves a user, so it belongs in a secure-development statement
+     * and must never appear in a statement about the contracted service.
+     */
+    [EngineCapability.AI_CODING_AGENT]: [EngineCapabilitySurface.AUTHORING_COMPANION],
+    /**
+     * RUNTIME ONLY. Embeddings are produced for `.ragSource()` fields as the
+     * application writes rows — a runtime feature over customer content. The
+     * companion has no embeddings consumer today; the only companion-side mention
+     * is a test asserting how an ABSENT capability is reported.
+     */
+    [EngineCapability.AI_EMBEDDINGS]: RUNTIME_ONLY,
+    /** RUNTIME ONLY. Extraction runs over content an application's users supply. */
+    [EngineCapability.AI_DOCUMENT_EXTRACTION]: RUNTIME_ONLY,
+    /*
+     * The two observability sinks are BOTH, because what they observe happens on
+     * both surfaces. The companion binds them itself: its container comments that
+     * the instrumentation "must be installed in any runtime that binds
+     * LLM_OBSERVABILITY (this companion …)", and its startup initializes for the
+     * LLM_OBSERVABILITY / OBSERVABILITY_TELEMETRY selection.
+     */
+    [EngineCapability.LLM_OBSERVABILITY]: BOTH_SURFACES,
+    [EngineCapability.OBSERVABILITY_TELEMETRY]: BOTH_SURFACES,
+    /*
+     * Everything below is RUNTIME ONLY: each is an engine flow of the deployed
+     * application, reached while it serves a user, and none has a companion
+     * consumer.
+     */
+    [EngineCapability.ORGANIZATIONS]: RUNTIME_ONLY,
+    [EngineCapability.BILLING]: RUNTIME_ONLY,
+    [EngineCapability.MULTI_LANGUAGE]: RUNTIME_ONLY,
+    [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: RUNTIME_ONLY,
+    [EngineCapability.EMAIL_TRANSACTIONAL]: RUNTIME_ONLY,
+    [EngineCapability.EMAIL_MARKETING]: RUNTIME_ONLY,
+    [EngineCapability.SMS]: RUNTIME_ONLY,
+    [EngineCapability.FRONTEND_ERROR_MONITORING]: RUNTIME_ONLY,
+    [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: RUNTIME_ONLY,
+};
+/**
+ * The surfaces a capability may be reached on.
+ *
+ * Returns the declared set; never empty, because a capability nothing reaches
+ * on either surface would have no reason to exist in the vocabulary.
+ */
+export function getEngineCapabilitySurfaces(capability) {
+    return ENGINE_CAPABILITY_SURFACES[capability];
+}
+/**
+ * Does this capability reach the DEPLOYED application serving its users?
+ *
+ * The predicate a customer-facing compliance statement asks. A capability for
+ * which this is `false` processes no data subject's personal data through the
+ * contracted service, so a privacy notice, a record of processing or a set of
+ * service terms must not describe it as a feature of that service.
+ */
+export function engineCapabilityReachesRuntimeService(capability) {
+    return getEngineCapabilitySurfaces(capability).includes(EngineCapabilitySurface.RUNTIME_SERVICE);
+}
+/**
+ * Is this capability reached ONLY while the application is being built?
+ *
+ * Deliberately not the negation of the predicate above: a capability that is
+ * BOTH is reached at authoring time too, and a statement about how the software
+ * is developed should include it. This names the narrower population — the
+ * capabilities that are invisible to the running product — which is the set a
+ * runtime-scoped document must exclude and a secure-development document must
+ * not.
+ */
+export function engineCapabilityIsAuthoringOnly(capability) {
+    const surfaces = getEngineCapabilitySurfaces(capability);
+    return surfaces.includes(EngineCapabilitySurface.AUTHORING_COMPANION) && !surfaces.includes(EngineCapabilitySurface.RUNTIME_SERVICE);
+}
+//# sourceMappingURL=engine-capability-surface.shared.js.map

package/dist/esm/external-providers/engine-capability-surface.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-capability-surface.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-surface.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC;;;;;;;;OAQG;IACH,8DAAmC,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,sEAA2C,CAAA;AAC7C,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AACD,sEAAsE;AAEtE,uFAAuF;AACvF,MAAM,aAAa,GAAuC;IACxD,uBAAuB,CAAC,eAAe;IACvC,uBAAuB,CAAC,mBAAmB;CAC5C,CAAC;AACF,mFAAmF;AACnF,MAAM,YAAY,GAAuC,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,0BAA0B,GAAiE;IAC/F;;OAEG;IAEH;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,aAAa;IACxC;;;;;;;OAOG;IACH,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,aAAa;IACrD;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,CAAC,uBAAuB,CAAC,mBAAmB,CAAC;IACjF;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,gFAAgF;IAChF,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IAEvD;;;;;;OAMG;IACH,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,aAAa;IACnD,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,aAAa;IAEzD;;;;OAIG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,YAAY;IACxC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,YAAY;IAC/C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IACvD,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,YAAY;IACpD,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,YAAY;IAChD,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY;IACpC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,YAAY;IAC1D,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,YAAY;CAC5D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAA4B;IACtE,OAAO,0BAA0B,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qCAAqC,CAAC,UAA4B;IAChF,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,UAA4B;IAC1E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACvI,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-surface facet:layer:shared facet:audience:app-developer\n *\n * WHICH SURFACE of the system reaches an `EngineCapability` — the deployed\n * application serving its users, the development companion building that\n * application, or both.\n *\n * This exists because compliance is not one question. A privacy notice, a\n * record of processing and a processor agreement all describe what the\n * CONTRACTED SERVICE does with a data subject's personal data; a\n * secure-development or supply-chain control describes how the software was\n * BUILT. An application that answers the first honestly — \"my product performs\n * no AI processing of customer content\" — may still have been authored with an\n * AI coding agent, and until this axis existed it had no way to say so: one\n * `engineCapabilities` field answered both questions at once, so declaring the\n * build-time tool silently made the product claim a runtime feature.\n *\n * **A capability may serve BOTH, and that is the common case for the `AI_*`\n * slots.** The axis is therefore a SET, not a choice. What narrows a particular\n * declaration to one surface is the provider SCOPE it is declared in\n * (`companion` versus the runtime scopes) — this map says what the capability\n * CAN serve, the scope says what a given declaration DOES serve.\n */\nexport enum EngineCapabilitySurface {\n  /**\n   * Reached by the DEPLOYED application while it serves its users.\n   *\n   * This is the surface every customer-facing compliance statement is about:\n   * GDPR Art. 13/14 notices, Art. 30 records, Art. 28 processor terms, EU AI\n   * Act Art. 50 transparency, and service terms. If a capability is not on this\n   * surface, it processes no data subject's personal data through the\n   * contracted service, and a document about that service must not describe it.\n   */\n  RUNTIME_SERVICE = 'RUNTIME_SERVICE',\n  /**\n   * Reached by the DEVELOPMENT COMPANION while the application is being built.\n   *\n   * Operates on the application's own source, specifications and generated\n   * artifacts — never on a customer's data. Not exempt from compliance, and\n   * saying so is the point of the axis rather than a caveat to it: this is the\n   * surface NIST SP 800-53 SA-3/SA-8/SA-11/SA-15 and the SR supply-chain family\n   * are about, as are the secure-development and change-management controls of\n   * the commercial certification frameworks. It is simply a\n   * DIFFERENT set of obligations from the runtime ones, asked of a different\n   * artifact.\n   */\n  AUTHORING_COMPANION = 'AUTHORING_COMPANION',\n}\n/** @wildo_source:part:end saas.models.providers.capability-surface */\n\n/** Both surfaces, named once so the common `AI_*` answer is not retyped per member. */\nconst BOTH_SURFACES: readonly EngineCapabilitySurface[] = [\n  EngineCapabilitySurface.RUNTIME_SERVICE,\n  EngineCapabilitySurface.AUTHORING_COMPANION,\n];\n/** Runtime only — the answer for every capability the companion does not reach. */\nconst RUNTIME_ONLY: readonly EngineCapabilitySurface[] = [EngineCapabilitySurface.RUNTIME_SERVICE];\n\n/**\n * The DECLARED surfaces of EVERY engine capability. Exhaustive by construction:\n * because this is a `Record<EngineCapability, …>`, adding a member to the\n * `EngineCapability` enum WITHOUT classifying it here is a COMPILE error.\n *\n * That is the whole reason it is a Record rather than a lookup with a default,\n * and it is the same argument `ENGINE_CAPABILITY_RESOLUTION_MODE` makes beside\n * it: a bare \"default to RUNTIME_SERVICE\" would let a future build-time\n * capability silently enter a privacy notice as a product feature, which is\n * exactly the defect this map was created to close.\n *\n * **Every classification below is MEASURED against what reaches the capability\n * today, not against what plausibly might.** A capability whose companion\n * consumer is added later becomes a compile-visible decision at that moment,\n * which is better than a speculative `AUTHORING_COMPANION` nothing serves. A\n * per-host grep of the enum members was tried as the basis for this map and\n * REJECTED — it reports `AI_CODING_AGENT` as unreferenced on every host while\n * that capability is plainly companion-reached, because naming the enum and\n * reaching the capability are different things.\n */\nconst ENGINE_CAPABILITY_SURFACES: Record<EngineCapability, readonly EngineCapabilitySurface[]> = {\n  /*\n   * The four AI slots split two-and-two, and the split is the reason this map exists.\n   */\n\n  /**\n   * BOTH. An application may expose LLM features to its users, and the companion\n   * reaches an LLM for its own work: the meta-workflows structured-generation\n   * agent and the playbook judge (`META_WORKFLOWS_PROVIDER_REF`), and the\n   * brief-adequacy agent. Neither of those touches customer data.\n   */\n  [EngineCapability.AI_LLM]: BOTH_SURFACES,\n  /**\n   * BOTH. The companion's brand step generates and judges a logo through an\n   * IMAGE-modality agent; an application may equally offer image generation to\n   * its users. `engine-capabilities.shared.schemas.ts` already recorded this\n   * topology in prose — \"legitimately served on a DIFFERENT host (the companion\n   * reaches image generation; the backend need not)\" — one file before anything\n   * could read it.\n   */\n  [EngineCapability.AI_IMAGE_GENERATION]: BOTH_SURFACES,\n  /**\n   * AUTHORING ONLY, and this is the member the axis was written for. The coding\n   * agent writes the application's SOURCE. It is never reached while the\n   * application serves a user, so it belongs in a secure-development statement\n   * and must never appear in a statement about the contracted service.\n   */\n  [EngineCapability.AI_CODING_AGENT]: [EngineCapabilitySurface.AUTHORING_COMPANION],\n  /**\n   * RUNTIME ONLY. Embeddings are produced for `.ragSource()` fields as the\n   * application writes rows — a runtime feature over customer content. The\n   * companion has no embeddings consumer today; the only companion-side mention\n   * is a test asserting how an ABSENT capability is reported.\n   */\n  [EngineCapability.AI_EMBEDDINGS]: RUNTIME_ONLY,\n  /** RUNTIME ONLY. Extraction runs over content an application's users supply. */\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: RUNTIME_ONLY,\n\n  /*\n   * The two observability sinks are BOTH, because what they observe happens on\n   * both surfaces. The companion binds them itself: its container comments that\n   * the instrumentation \"must be installed in any runtime that binds\n   * LLM_OBSERVABILITY (this companion …)\", and its startup initializes for the\n   * LLM_OBSERVABILITY / OBSERVABILITY_TELEMETRY selection.\n   */\n  [EngineCapability.LLM_OBSERVABILITY]: BOTH_SURFACES,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: BOTH_SURFACES,\n\n  /*\n   * Everything below is RUNTIME ONLY: each is an engine flow of the deployed\n   * application, reached while it serves a user, and none has a companion\n   * consumer.\n   */\n  [EngineCapability.ORGANIZATIONS]: RUNTIME_ONLY,\n  [EngineCapability.BILLING]: RUNTIME_ONLY,\n  [EngineCapability.MULTI_LANGUAGE]: RUNTIME_ONLY,\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_MARKETING]: RUNTIME_ONLY,\n  [EngineCapability.SMS]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: RUNTIME_ONLY,\n};\n\n/**\n * The surfaces a capability may be reached on.\n *\n * Returns the declared set; never empty, because a capability nothing reaches\n * on either surface would have no reason to exist in the vocabulary.\n */\nexport function getEngineCapabilitySurfaces(capability: EngineCapability): readonly EngineCapabilitySurface[] {\n  return ENGINE_CAPABILITY_SURFACES[capability];\n}\n\n/**\n * Does this capability reach the DEPLOYED application serving its users?\n *\n * The predicate a customer-facing compliance statement asks. A capability for\n * which this is `false` processes no data subject's personal data through the\n * contracted service, so a privacy notice, a record of processing or a set of\n * service terms must not describe it as a feature of that service.\n */\nexport function engineCapabilityReachesRuntimeService(capability: EngineCapability): boolean {\n  return getEngineCapabilitySurfaces(capability).includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n\n/**\n * Is this capability reached ONLY while the application is being built?\n *\n * Deliberately not the negation of the predicate above: a capability that is\n * BOTH is reached at authoring time too, and a statement about how the software\n * is developed should include it. This names the narrower population — the\n * capabilities that are invisible to the running product — which is the set a\n * runtime-scoped document must exclude and a secure-development document must\n * not.\n */\nexport function engineCapabilityIsAuthoringOnly(capability: EngineCapability): boolean {\n  const surfaces = getEngineCapabilitySurfaces(capability);\n  return surfaces.includes(EngineCapabilitySurface.AUTHORING_COMPANION) && !surfaces.includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n"]}

package/dist/esm/external-providers/external-providers.shared.schemas.d.ts

@@ -229,6 +229,7 @@ export declare const OAuth2EnabledProviderConfigSchema: z.ZodObject<{
     displayName: z.ZodOptional<z.ZodString>;
     iconUrl: z.ZodOptional<z.ZodURL>;
     additionalScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    reAuthenticationEnabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type OAuth2EnabledProviderConfig = z.infer<typeof OAuth2EnabledProviderConfigSchema>;
 /**
@@ -243,6 +244,7 @@ export declare const OAuth2ProvidersConfigSchema: z.ZodRecord<z.ZodString, z.Zod
     displayName: z.ZodOptional<z.ZodString>;
     iconUrl: z.ZodOptional<z.ZodURL>;
     additionalScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    reAuthenticationEnabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>>;
 export type OAuth2ProvidersConfig = z.infer<typeof OAuth2ProvidersConfigSchema>;
 //# sourceMappingURL=external-providers.shared.schemas.d.ts.map

package/dist/esm/external-providers/external-providers.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-providers.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EAEf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE;;;;;;;;GAQG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAehD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9C,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM7F;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;iBAqB5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;kBAGvC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}
+{"version":3,"file":"external-providers.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EAEf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE;;;;;;;;GAQG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAehD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9C,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM7F;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;iBA2C5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;kBAGvC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/esm/external-providers/external-providers.shared.schemas.js

@@ -61,6 +61,27 @@ export const OAuth2EnabledProviderConfigSchema = z.object({
     iconUrl: z.url().optional(),
     /** Additional scopes to request */
     additionalScopes: z.array(z.string()).optional(),
+    /**
+     * May an account re-prove who it is through this identity provider (#1441)?
+     *
+     * When on, an account whose link to this provider is an OIDC link can answer a re-authentication
+     * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in
+     * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`
+     * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the
+     * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is
+     * refused, never trusted.
+     *
+     * OFF by default, and it should be switched on only for a provider that honours those parameters.
+     * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`
+     * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value
+     * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security
+     * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.
+     * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from
+     * https://openid.net/specs/openid-connect-core-1_0.html
+     * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched
+     * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect
+     */
+    reAuthenticationEnabled: z.boolean().default(false),
 });
 /**
  * OAuth2 Providers Configuration Map