@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/external-providers/engine-capability-surface.shared.js

@@ -0,0 +1,175 @@
+import { EngineCapability } from './engine-capabilities.shared.schemas.js';
+/**
+ * @wildo_source:part:start saas.models.providers.capability-surface facet:layer:shared facet:audience:app-developer
+ *
+ * WHICH SURFACE of the system reaches an `EngineCapability` — the deployed
+ * application serving its users, the development companion building that
+ * application, or both.
+ *
+ * This exists because compliance is not one question. A privacy notice, a
+ * record of processing and a processor agreement all describe what the
+ * CONTRACTED SERVICE does with a data subject's personal data; a
+ * secure-development or supply-chain control describes how the software was
+ * BUILT. An application that answers the first honestly — "my product performs
+ * no AI processing of customer content" — may still have been authored with an
+ * AI coding agent, and until this axis existed it had no way to say so: one
+ * `engineCapabilities` field answered both questions at once, so declaring the
+ * build-time tool silently made the product claim a runtime feature.
+ *
+ * **A capability may serve BOTH, and that is the common case for the `AI_*`
+ * slots.** The axis is therefore a SET, not a choice. What narrows a particular
+ * declaration to one surface is the provider SCOPE it is declared in
+ * (`companion` versus the runtime scopes) — this map says what the capability
+ * CAN serve, the scope says what a given declaration DOES serve.
+ */
+export var EngineCapabilitySurface;
+(function (EngineCapabilitySurface) {
+    /**
+     * Reached by the DEPLOYED application while it serves its users.
+     *
+     * This is the surface every customer-facing compliance statement is about:
+     * GDPR Art. 13/14 notices, Art. 30 records, Art. 28 processor terms, EU AI
+     * Act Art. 50 transparency, and service terms. If a capability is not on this
+     * surface, it processes no data subject's personal data through the
+     * contracted service, and a document about that service must not describe it.
+     */
+    EngineCapabilitySurface["RUNTIME_SERVICE"] = "RUNTIME_SERVICE";
+    /**
+     * Reached by the DEVELOPMENT COMPANION while the application is being built.
+     *
+     * Operates on the application's own source, specifications and generated
+     * artifacts — never on a customer's data. Not exempt from compliance, and
+     * saying so is the point of the axis rather than a caveat to it: this is the
+     * surface NIST SP 800-53 SA-3/SA-8/SA-11/SA-15 and the SR supply-chain family
+     * are about, as are the secure-development and change-management controls of
+     * the commercial certification frameworks. It is simply a
+     * DIFFERENT set of obligations from the runtime ones, asked of a different
+     * artifact.
+     */
+    EngineCapabilitySurface["AUTHORING_COMPANION"] = "AUTHORING_COMPANION";
+})(EngineCapabilitySurface || (EngineCapabilitySurface = {}));
+/** @wildo_source:part:end saas.models.providers.capability-surface */
+/** Both surfaces, named once so the common `AI_*` answer is not retyped per member. */
+const BOTH_SURFACES = [
+    EngineCapabilitySurface.RUNTIME_SERVICE,
+    EngineCapabilitySurface.AUTHORING_COMPANION,
+];
+/** Runtime only — the answer for every capability the companion does not reach. */
+const RUNTIME_ONLY = [EngineCapabilitySurface.RUNTIME_SERVICE];
+/**
+ * The DECLARED surfaces of EVERY engine capability. Exhaustive by construction:
+ * because this is a `Record<EngineCapability, …>`, adding a member to the
+ * `EngineCapability` enum WITHOUT classifying it here is a COMPILE error.
+ *
+ * That is the whole reason it is a Record rather than a lookup with a default,
+ * and it is the same argument `ENGINE_CAPABILITY_RESOLUTION_MODE` makes beside
+ * it: a bare "default to RUNTIME_SERVICE" would let a future build-time
+ * capability silently enter a privacy notice as a product feature, which is
+ * exactly the defect this map was created to close.
+ *
+ * **Every classification below is MEASURED against what reaches the capability
+ * today, not against what plausibly might.** A capability whose companion
+ * consumer is added later becomes a compile-visible decision at that moment,
+ * which is better than a speculative `AUTHORING_COMPANION` nothing serves. A
+ * per-host grep of the enum members was tried as the basis for this map and
+ * REJECTED — it reports `AI_CODING_AGENT` as unreferenced on every host while
+ * that capability is plainly companion-reached, because naming the enum and
+ * reaching the capability are different things.
+ */
+const ENGINE_CAPABILITY_SURFACES = {
+    /*
+     * The four AI slots split two-and-two, and the split is the reason this map exists.
+     */
+    /**
+     * BOTH. An application may expose LLM features to its users, and the companion
+     * reaches an LLM for its own work: the meta-workflows structured-generation
+     * agent and the playbook judge (`META_WORKFLOWS_PROVIDER_REF`), and the
+     * brief-adequacy agent. Neither of those touches customer data.
+     */
+    [EngineCapability.AI_LLM]: BOTH_SURFACES,
+    /**
+     * BOTH. The companion's brand step generates and judges a logo through an
+     * IMAGE-modality agent; an application may equally offer image generation to
+     * its users. `engine-capabilities.shared.schemas.ts` already recorded this
+     * topology in prose — "legitimately served on a DIFFERENT host (the companion
+     * reaches image generation; the backend need not)" — one file before anything
+     * could read it.
+     */
+    [EngineCapability.AI_IMAGE_GENERATION]: BOTH_SURFACES,
+    /**
+     * AUTHORING ONLY, and this is the member the axis was written for. The coding
+     * agent writes the application's SOURCE. It is never reached while the
+     * application serves a user, so it belongs in a secure-development statement
+     * and must never appear in a statement about the contracted service.
+     */
+    [EngineCapability.AI_CODING_AGENT]: [EngineCapabilitySurface.AUTHORING_COMPANION],
+    /**
+     * RUNTIME ONLY. Embeddings are produced for `.ragSource()` fields as the
+     * application writes rows — a runtime feature over customer content. The
+     * companion has no embeddings consumer today; the only companion-side mention
+     * is a test asserting how an ABSENT capability is reported.
+     */
+    [EngineCapability.AI_EMBEDDINGS]: RUNTIME_ONLY,
+    /** RUNTIME ONLY. Extraction runs over content an application's users supply. */
+    [EngineCapability.AI_DOCUMENT_EXTRACTION]: RUNTIME_ONLY,
+    /*
+     * The two observability sinks are BOTH, because what they observe happens on
+     * both surfaces. The companion binds them itself: its container comments that
+     * the instrumentation "must be installed in any runtime that binds
+     * LLM_OBSERVABILITY (this companion …)", and its startup initializes for the
+     * LLM_OBSERVABILITY / OBSERVABILITY_TELEMETRY selection.
+     */
+    [EngineCapability.LLM_OBSERVABILITY]: BOTH_SURFACES,
+    [EngineCapability.OBSERVABILITY_TELEMETRY]: BOTH_SURFACES,
+    /*
+     * Everything below is RUNTIME ONLY: each is an engine flow of the deployed
+     * application, reached while it serves a user, and none has a companion
+     * consumer.
+     */
+    [EngineCapability.ORGANIZATIONS]: RUNTIME_ONLY,
+    [EngineCapability.BILLING]: RUNTIME_ONLY,
+    [EngineCapability.MULTI_LANGUAGE]: RUNTIME_ONLY,
+    [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: RUNTIME_ONLY,
+    [EngineCapability.EMAIL_TRANSACTIONAL]: RUNTIME_ONLY,
+    [EngineCapability.EMAIL_MARKETING]: RUNTIME_ONLY,
+    /** RUNTIME ONLY. Mail to the deployed application's organizations; the companion receives none (#1630). */
+    [EngineCapability.EMAIL_INBOUND]: RUNTIME_ONLY,
+    [EngineCapability.SMS]: RUNTIME_ONLY,
+    [EngineCapability.FRONTEND_ERROR_MONITORING]: RUNTIME_ONLY,
+    [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: RUNTIME_ONLY,
+};
+/**
+ * The surfaces a capability may be reached on.
+ *
+ * Returns the declared set; never empty, because a capability nothing reaches
+ * on either surface would have no reason to exist in the vocabulary.
+ */
+export function getEngineCapabilitySurfaces(capability) {
+    return ENGINE_CAPABILITY_SURFACES[capability];
+}
+/**
+ * Does this capability reach the DEPLOYED application serving its users?
+ *
+ * The predicate a customer-facing compliance statement asks. A capability for
+ * which this is `false` processes no data subject's personal data through the
+ * contracted service, so a privacy notice, a record of processing or a set of
+ * service terms must not describe it as a feature of that service.
+ */
+export function engineCapabilityReachesRuntimeService(capability) {
+    return getEngineCapabilitySurfaces(capability).includes(EngineCapabilitySurface.RUNTIME_SERVICE);
+}
+/**
+ * Is this capability reached ONLY while the application is being built?
+ *
+ * Deliberately not the negation of the predicate above: a capability that is
+ * BOTH is reached at authoring time too, and a statement about how the software
+ * is developed should include it. This names the narrower population — the
+ * capabilities that are invisible to the running product — which is the set a
+ * runtime-scoped document must exclude and a secure-development document must
+ * not.
+ */
+export function engineCapabilityIsAuthoringOnly(capability) {
+    const surfaces = getEngineCapabilitySurfaces(capability);
+    return surfaces.includes(EngineCapabilitySurface.AUTHORING_COMPANION) && !surfaces.includes(EngineCapabilitySurface.RUNTIME_SERVICE);
+}
+//# sourceMappingURL=engine-capability-surface.shared.js.map

package/dist/esm/external-providers/engine-capability-surface.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-capability-surface.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-surface.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC;;;;;;;;OAQG;IACH,8DAAmC,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,sEAA2C,CAAA;AAC7C,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AACD,sEAAsE;AAEtE,uFAAuF;AACvF,MAAM,aAAa,GAAuC;IACxD,uBAAuB,CAAC,eAAe;IACvC,uBAAuB,CAAC,mBAAmB;CAC5C,CAAC;AACF,mFAAmF;AACnF,MAAM,YAAY,GAAuC,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,0BAA0B,GAAiE;IAC/F;;OAEG;IAEH;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,aAAa;IACxC;;;;;;;OAOG;IACH,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,aAAa;IACrD;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,CAAC,uBAAuB,CAAC,mBAAmB,CAAC;IACjF;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,gFAAgF;IAChF,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IAEvD;;;;;;OAMG;IACH,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,aAAa;IACnD,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,aAAa;IAEzD;;;;OAIG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,YAAY;IACxC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,YAAY;IAC/C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IACvD,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,YAAY;IACpD,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,YAAY;IAChD,2GAA2G;IAC3G,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY;IACpC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,YAAY;IAC1D,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,YAAY;CAC5D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAA4B;IACtE,OAAO,0BAA0B,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qCAAqC,CAAC,UAA4B;IAChF,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,UAA4B;IAC1E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACvI,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-surface facet:layer:shared facet:audience:app-developer\n *\n * WHICH SURFACE of the system reaches an `EngineCapability` — the deployed\n * application serving its users, the development companion building that\n * application, or both.\n *\n * This exists because compliance is not one question. A privacy notice, a\n * record of processing and a processor agreement all describe what the\n * CONTRACTED SERVICE does with a data subject's personal data; a\n * secure-development or supply-chain control describes how the software was\n * BUILT. An application that answers the first honestly — \"my product performs\n * no AI processing of customer content\" — may still have been authored with an\n * AI coding agent, and until this axis existed it had no way to say so: one\n * `engineCapabilities` field answered both questions at once, so declaring the\n * build-time tool silently made the product claim a runtime feature.\n *\n * **A capability may serve BOTH, and that is the common case for the `AI_*`\n * slots.** The axis is therefore a SET, not a choice. What narrows a particular\n * declaration to one surface is the provider SCOPE it is declared in\n * (`companion` versus the runtime scopes) — this map says what the capability\n * CAN serve, the scope says what a given declaration DOES serve.\n */\nexport enum EngineCapabilitySurface {\n  /**\n   * Reached by the DEPLOYED application while it serves its users.\n   *\n   * This is the surface every customer-facing compliance statement is about:\n   * GDPR Art. 13/14 notices, Art. 30 records, Art. 28 processor terms, EU AI\n   * Act Art. 50 transparency, and service terms. If a capability is not on this\n   * surface, it processes no data subject's personal data through the\n   * contracted service, and a document about that service must not describe it.\n   */\n  RUNTIME_SERVICE = 'RUNTIME_SERVICE',\n  /**\n   * Reached by the DEVELOPMENT COMPANION while the application is being built.\n   *\n   * Operates on the application's own source, specifications and generated\n   * artifacts — never on a customer's data. Not exempt from compliance, and\n   * saying so is the point of the axis rather than a caveat to it: this is the\n   * surface NIST SP 800-53 SA-3/SA-8/SA-11/SA-15 and the SR supply-chain family\n   * are about, as are the secure-development and change-management controls of\n   * the commercial certification frameworks. It is simply a\n   * DIFFERENT set of obligations from the runtime ones, asked of a different\n   * artifact.\n   */\n  AUTHORING_COMPANION = 'AUTHORING_COMPANION',\n}\n/** @wildo_source:part:end saas.models.providers.capability-surface */\n\n/** Both surfaces, named once so the common `AI_*` answer is not retyped per member. */\nconst BOTH_SURFACES: readonly EngineCapabilitySurface[] = [\n  EngineCapabilitySurface.RUNTIME_SERVICE,\n  EngineCapabilitySurface.AUTHORING_COMPANION,\n];\n/** Runtime only — the answer for every capability the companion does not reach. */\nconst RUNTIME_ONLY: readonly EngineCapabilitySurface[] = [EngineCapabilitySurface.RUNTIME_SERVICE];\n\n/**\n * The DECLARED surfaces of EVERY engine capability. Exhaustive by construction:\n * because this is a `Record<EngineCapability, …>`, adding a member to the\n * `EngineCapability` enum WITHOUT classifying it here is a COMPILE error.\n *\n * That is the whole reason it is a Record rather than a lookup with a default,\n * and it is the same argument `ENGINE_CAPABILITY_RESOLUTION_MODE` makes beside\n * it: a bare \"default to RUNTIME_SERVICE\" would let a future build-time\n * capability silently enter a privacy notice as a product feature, which is\n * exactly the defect this map was created to close.\n *\n * **Every classification below is MEASURED against what reaches the capability\n * today, not against what plausibly might.** A capability whose companion\n * consumer is added later becomes a compile-visible decision at that moment,\n * which is better than a speculative `AUTHORING_COMPANION` nothing serves. A\n * per-host grep of the enum members was tried as the basis for this map and\n * REJECTED — it reports `AI_CODING_AGENT` as unreferenced on every host while\n * that capability is plainly companion-reached, because naming the enum and\n * reaching the capability are different things.\n */\nconst ENGINE_CAPABILITY_SURFACES: Record<EngineCapability, readonly EngineCapabilitySurface[]> = {\n  /*\n   * The four AI slots split two-and-two, and the split is the reason this map exists.\n   */\n\n  /**\n   * BOTH. An application may expose LLM features to its users, and the companion\n   * reaches an LLM for its own work: the meta-workflows structured-generation\n   * agent and the playbook judge (`META_WORKFLOWS_PROVIDER_REF`), and the\n   * brief-adequacy agent. Neither of those touches customer data.\n   */\n  [EngineCapability.AI_LLM]: BOTH_SURFACES,\n  /**\n   * BOTH. The companion's brand step generates and judges a logo through an\n   * IMAGE-modality agent; an application may equally offer image generation to\n   * its users. `engine-capabilities.shared.schemas.ts` already recorded this\n   * topology in prose — \"legitimately served on a DIFFERENT host (the companion\n   * reaches image generation; the backend need not)\" — one file before anything\n   * could read it.\n   */\n  [EngineCapability.AI_IMAGE_GENERATION]: BOTH_SURFACES,\n  /**\n   * AUTHORING ONLY, and this is the member the axis was written for. The coding\n   * agent writes the application's SOURCE. It is never reached while the\n   * application serves a user, so it belongs in a secure-development statement\n   * and must never appear in a statement about the contracted service.\n   */\n  [EngineCapability.AI_CODING_AGENT]: [EngineCapabilitySurface.AUTHORING_COMPANION],\n  /**\n   * RUNTIME ONLY. Embeddings are produced for `.ragSource()` fields as the\n   * application writes rows — a runtime feature over customer content. The\n   * companion has no embeddings consumer today; the only companion-side mention\n   * is a test asserting how an ABSENT capability is reported.\n   */\n  [EngineCapability.AI_EMBEDDINGS]: RUNTIME_ONLY,\n  /** RUNTIME ONLY. Extraction runs over content an application's users supply. */\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: RUNTIME_ONLY,\n\n  /*\n   * The two observability sinks are BOTH, because what they observe happens on\n   * both surfaces. The companion binds them itself: its container comments that\n   * the instrumentation \"must be installed in any runtime that binds\n   * LLM_OBSERVABILITY (this companion …)\", and its startup initializes for the\n   * LLM_OBSERVABILITY / OBSERVABILITY_TELEMETRY selection.\n   */\n  [EngineCapability.LLM_OBSERVABILITY]: BOTH_SURFACES,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: BOTH_SURFACES,\n\n  /*\n   * Everything below is RUNTIME ONLY: each is an engine flow of the deployed\n   * application, reached while it serves a user, and none has a companion\n   * consumer.\n   */\n  [EngineCapability.ORGANIZATIONS]: RUNTIME_ONLY,\n  [EngineCapability.BILLING]: RUNTIME_ONLY,\n  [EngineCapability.MULTI_LANGUAGE]: RUNTIME_ONLY,\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_MARKETING]: RUNTIME_ONLY,\n  /** RUNTIME ONLY. Mail to the deployed application's organizations; the companion receives none (#1630). */\n  [EngineCapability.EMAIL_INBOUND]: RUNTIME_ONLY,\n  [EngineCapability.SMS]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: RUNTIME_ONLY,\n};\n\n/**\n * The surfaces a capability may be reached on.\n *\n * Returns the declared set; never empty, because a capability nothing reaches\n * on either surface would have no reason to exist in the vocabulary.\n */\nexport function getEngineCapabilitySurfaces(capability: EngineCapability): readonly EngineCapabilitySurface[] {\n  return ENGINE_CAPABILITY_SURFACES[capability];\n}\n\n/**\n * Does this capability reach the DEPLOYED application serving its users?\n *\n * The predicate a customer-facing compliance statement asks. A capability for\n * which this is `false` processes no data subject's personal data through the\n * contracted service, so a privacy notice, a record of processing or a set of\n * service terms must not describe it as a feature of that service.\n */\nexport function engineCapabilityReachesRuntimeService(capability: EngineCapability): boolean {\n  return getEngineCapabilitySurfaces(capability).includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n\n/**\n * Is this capability reached ONLY while the application is being built?\n *\n * Deliberately not the negation of the predicate above: a capability that is\n * BOTH is reached at authoring time too, and a statement about how the software\n * is developed should include it. This names the narrower population — the\n * capabilities that are invisible to the running product — which is the set a\n * runtime-scoped document must exclude and a secure-development document must\n * not.\n */\nexport function engineCapabilityIsAuthoringOnly(capability: EngineCapability): boolean {\n  const surfaces = getEngineCapabilitySurfaces(capability);\n  return surfaces.includes(EngineCapabilitySurface.AUTHORING_COMPANION) && !surfaces.includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n"]}

package/dist/esm/external-providers/external-providers.shared.schemas.d.ts

@@ -229,6 +229,7 @@ export declare const OAuth2EnabledProviderConfigSchema: z.ZodObject<{
     displayName: z.ZodOptional<z.ZodString>;
     iconUrl: z.ZodOptional<z.ZodURL>;
     additionalScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    reAuthenticationEnabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type OAuth2EnabledProviderConfig = z.infer<typeof OAuth2EnabledProviderConfigSchema>;
 /**
@@ -243,6 +244,7 @@ export declare const OAuth2ProvidersConfigSchema: z.ZodRecord<z.ZodString, z.Zod
     displayName: z.ZodOptional<z.ZodString>;
     iconUrl: z.ZodOptional<z.ZodURL>;
     additionalScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    reAuthenticationEnabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>>;
 export type OAuth2ProvidersConfig = z.infer<typeof OAuth2ProvidersConfigSchema>;
 //# sourceMappingURL=external-providers.shared.schemas.d.ts.map

package/dist/esm/external-providers/external-providers.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-providers.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EAEf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE;;;;;;;;GAQG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAehD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9C,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM7F;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;iBAqB5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;kBAGvC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}
+{"version":3,"file":"external-providers.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EAEf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE;;;;;;;;GAQG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAehD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9C,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM7F;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;iBA2C5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;kBAGvC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/esm/external-providers/external-providers.shared.schemas.js

@@ -61,6 +61,27 @@ export const OAuth2EnabledProviderConfigSchema = z.object({
     iconUrl: z.url().optional(),
     /** Additional scopes to request */
     additionalScopes: z.array(z.string()).optional(),
+    /**
+     * May an account re-prove who it is through this identity provider (#1441)?
+     *
+     * When on, an account whose link to this provider is an OIDC link can answer a re-authentication
+     * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in
+     * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`
+     * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the
+     * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is
+     * refused, never trusted.
+     *
+     * OFF by default, and it should be switched on only for a provider that honours those parameters.
+     * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`
+     * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value
+     * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security
+     * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.
+     * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from
+     * https://openid.net/specs/openid-connect-core-1_0.html
+     * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched
+     * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect
+     */
+    reAuthenticationEnabled: z.boolean().default(false),
 });
 /**
  * OAuth2 Providers Configuration Map

package/dist/esm/external-providers/external-providers.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-providers.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EACd,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,uCAAuC;IACvC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAElE,oDAAoD;IACpD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjE,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,4EAA4E;IAC5E,kBAAkB,EAAE,+BAA+B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,MAAM,EAAE,EACV,qCAAqC,CACtC,CAAC;AAGF,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAEpB,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,8CAA8C;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;IAE9D,8CAA8C;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,mCAAmC;IACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,MAAM,EAAE,EACV,iCAAiC,CAClC,CAAC","sourcesContent":["/**\n * External Providers Shared Schemas\n *\n * Provides application-level registry schemas for external providers.\n * OAuth2 configurations are defined per-provider in @wildo-ai/external-connectors-models.\n */\n\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  OAuth2_Purpose,\n  OAuth2_ProviderDefinitionSchema,\n} from \"@wildo-ai/external-connectors-models\";\nimport { z } from \"zod\";\nimport { EngineCapability } from \"./engine-capabilities.shared.schemas\";\n\n// =============================================================================\n// EXTERNAL PROVIDERS REGISTRY\n// =============================================================================\n\n/**\n * External Providers Registry Item\n * Defines what protocols and capabilities a provider supports\n *\n * Note: This is a COMPUTED structure populated from:\n * - BackendProviderModule.providerCapabilities (what provider actually supports)\n * - Materialized provider scope selection (what capabilities are assigned to this provider)\n * - Capability requirements validation\n */\nexport const External_Providers_RegistryItemSchema = z.object({\n  /** Reference to the provider (string identifier) */\n  providerRef: z.string(),\n\n  /** Protocols this provider supports */\n  protocols: z.array(z.enum(ExternalProvider_ExchangeProtocol_Kind)),\n\n  /** Engine capabilities enabled for this provider */\n  engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n\n  /** Does this provider support OAuth2? */\n  supportsOAuth2: z.boolean().optional(),\n\n  /** Custom OAuth2 configuration (if needed to override provider defaults) */\n  customOAuth2Config: OAuth2_ProviderDefinitionSchema.partial().optional(),\n});\nexport type External_Providers_RegistryItem = z.infer<typeof External_Providers_RegistryItemSchema>;\n\n/**\n * External Providers Registry\n * Maps provider references to their configurations\n */\nexport const External_Providers_Registry_Schema = z.record(\n  z.string(),\n  External_Providers_RegistryItemSchema\n);\nexport type External_Providers_Registry = z.infer<typeof External_Providers_Registry_Schema>;\n\n// =============================================================================\n// OAUTH2 ENABLED PROVIDERS CONFIGURATION\n// =============================================================================\n\n/**\n * OAuth2 Enabled Provider Configuration\n * For configuring OAuth2 providers at the application level\n *\n * Note: OAuth2 protocol definitions are in each provider folder in external-connectors.\n * This schema is for application-level enabling/customization of OAuth2 providers.\n */\nexport const OAuth2EnabledProviderConfigSchema = z.object({\n  /** Provider reference (string identifier) */\n  provider: z.string(),\n\n  /** Is this provider enabled? */\n  enabled: z.boolean().default(true),\n\n  /** Allowed email domains for this provider */\n  allowedDomains: z.array(z.string()).optional(),\n\n  /** Purpose: SSO only, API only, or both */\n  purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.HYBRID),\n\n  /** Custom display name (overrides default) */\n  displayName: z.string().optional(),\n\n  /** Custom icon URL (overrides default) */\n  iconUrl: z.url().optional(),\n\n  /** Additional scopes to request */\n  additionalScopes: z.array(z.string()).optional(),\n});\nexport type OAuth2EnabledProviderConfig = z.infer<typeof OAuth2EnabledProviderConfigSchema>;\n\n/**\n * OAuth2 Providers Configuration Map\n * Application-level configuration for all enabled OAuth2 providers\n */\nexport const OAuth2ProvidersConfigSchema = z.record(\n  z.string(),\n  OAuth2EnabledProviderConfigSchema\n);\nexport type OAuth2ProvidersConfig = z.infer<typeof OAuth2ProvidersConfigSchema>;\n"]}
+{"version":3,"file":"external-providers.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EACd,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,uCAAuC;IACvC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAElE,oDAAoD;IACpD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjE,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,4EAA4E;IAC5E,kBAAkB,EAAE,+BAA+B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,MAAM,EAAE,EACV,qCAAqC,CACtC,CAAC;AAGF,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAEpB,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,8CAA8C;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;IAE9D,8CAA8C;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,mCAAmC;IACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,MAAM,EAAE,EACV,iCAAiC,CAClC,CAAC","sourcesContent":["/**\n * External Providers Shared Schemas\n *\n * Provides application-level registry schemas for external providers.\n * OAuth2 configurations are defined per-provider in @wildo-ai/external-connectors-models.\n */\n\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  OAuth2_Purpose,\n  OAuth2_ProviderDefinitionSchema,\n} from \"@wildo-ai/external-connectors-models\";\nimport { z } from \"zod\";\nimport { EngineCapability } from \"./engine-capabilities.shared.schemas\";\n\n// =============================================================================\n// EXTERNAL PROVIDERS REGISTRY\n// =============================================================================\n\n/**\n * External Providers Registry Item\n * Defines what protocols and capabilities a provider supports\n *\n * Note: This is a COMPUTED structure populated from:\n * - BackendProviderModule.providerCapabilities (what provider actually supports)\n * - Materialized provider scope selection (what capabilities are assigned to this provider)\n * - Capability requirements validation\n */\nexport const External_Providers_RegistryItemSchema = z.object({\n  /** Reference to the provider (string identifier) */\n  providerRef: z.string(),\n\n  /** Protocols this provider supports */\n  protocols: z.array(z.enum(ExternalProvider_ExchangeProtocol_Kind)),\n\n  /** Engine capabilities enabled for this provider */\n  engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n\n  /** Does this provider support OAuth2? */\n  supportsOAuth2: z.boolean().optional(),\n\n  /** Custom OAuth2 configuration (if needed to override provider defaults) */\n  customOAuth2Config: OAuth2_ProviderDefinitionSchema.partial().optional(),\n});\nexport type External_Providers_RegistryItem = z.infer<typeof External_Providers_RegistryItemSchema>;\n\n/**\n * External Providers Registry\n * Maps provider references to their configurations\n */\nexport const External_Providers_Registry_Schema = z.record(\n  z.string(),\n  External_Providers_RegistryItemSchema\n);\nexport type External_Providers_Registry = z.infer<typeof External_Providers_Registry_Schema>;\n\n// =============================================================================\n// OAUTH2 ENABLED PROVIDERS CONFIGURATION\n// =============================================================================\n\n/**\n * OAuth2 Enabled Provider Configuration\n * For configuring OAuth2 providers at the application level\n *\n * Note: OAuth2 protocol definitions are in each provider folder in external-connectors.\n * This schema is for application-level enabling/customization of OAuth2 providers.\n */\nexport const OAuth2EnabledProviderConfigSchema = z.object({\n  /** Provider reference (string identifier) */\n  provider: z.string(),\n\n  /** Is this provider enabled? */\n  enabled: z.boolean().default(true),\n\n  /** Allowed email domains for this provider */\n  allowedDomains: z.array(z.string()).optional(),\n\n  /** Purpose: SSO only, API only, or both */\n  purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.HYBRID),\n\n  /** Custom display name (overrides default) */\n  displayName: z.string().optional(),\n\n  /** Custom icon URL (overrides default) */\n  iconUrl: z.url().optional(),\n\n  /** Additional scopes to request */\n  additionalScopes: z.array(z.string()).optional(),\n\n  /**\n   * May an account re-prove who it is through this identity provider (#1441)?\n   *\n   * When on, an account whose link to this provider is an OIDC link can answer a re-authentication\n   * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in\n   * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`\n   * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the\n   * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is\n   * refused, never trusted.\n   *\n   * OFF by default, and it should be switched on only for a provider that honours those parameters.\n   * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`\n   * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value\n   * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security\n   * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.\n   * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from\n   * https://openid.net/specs/openid-connect-core-1_0.html\n   * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched\n   * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect\n   */\n  reAuthenticationEnabled: z.boolean().default(false),\n});\nexport type OAuth2EnabledProviderConfig = z.infer<typeof OAuth2EnabledProviderConfigSchema>;\n\n/**\n * OAuth2 Providers Configuration Map\n * Application-level configuration for all enabled OAuth2 providers\n */\nexport const OAuth2ProvidersConfigSchema = z.record(\n  z.string(),\n  OAuth2EnabledProviderConfigSchema\n);\nexport type OAuth2ProvidersConfig = z.infer<typeof OAuth2ProvidersConfigSchema>;\n"]}