@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/external-providers/provider-metadata.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,OAAO,aAAa,WAAW,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,YAuBX;AAvBD,WAAY,YAAY;IACtB;;;;;;OAMG;IACH,6BAAa,CAAA;IACb;;;;;OAKG;IACH,uCAAuB,CAAA;IACvB;;;;;OAKG;IACH,uCAAuB,CAAA;AACzB,CAAC,EAvBW,YAAY,KAAZ,YAAY,QAuBvB;AAED,iDAAiD;AACjD,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,yDAAyD;IACzD,uCAAiB,CAAA;IACjB,yEAAyE;IACzE,iDAA2B,CAAA;IAC3B;;;;OAIG;IACH,6CAAuB,CAAA;AACzB,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,wDAA6B,CAAA;IAC7B,sCAAW,CAAA;IACX,gEAAqC,CAAA;AACvC,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,wCAAwC;IACxC,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,iEAAiE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC,CAAC,CAAC;AAML,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;OAIG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,qEAAqE;IACrE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC1B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,wCAAwC;IACxC,MAAM,EAAE,oBAAoB;IAC5B;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC;IAChE,WAAW,EAAE,IAAI;IACjB,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAcH;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACnE,CAAqB,CAAC;AACzB,CAAC","sourcesContent":["/**\n * `ProviderMetadata` — shared, frontend-safe header carried by every\n * provider module across every facet (backend, frontend-app, techdoc,\n * website).\n *\n * Intentionally **frontend-safe**: holds no secrets, no protocol\n * contracts, no backend behavior. The fields are exactly what a UI needs\n * to render a provider entry (translation-ready display-name key, optional\n * legacy fallback label, optional icon ref) plus the stable `ref` used as\n * the join key between facet modules — and, since #328, the provider's\n * IDENTITY: which package ships it, which tier it belongs to, which vendor\n * groups it, and where it came from.\n *\n * ## Why identity lives here and not on the ref\n *\n * A bare `ref` string cannot say whether a provider is one the engine\n * REQUIRES (a MAIN provider binding an `EngineCapability` slot), one that\n * merely MAY bind a slot as a substitute (EXTENSION), or one of the bulk\n * loaded on demand that must never claim a slot (CATALOGUE). Nor can it say\n * that `microsoft-graph-mail` and `microsoft-teams` are two packages of one\n * vendor sharing an OAuth client. Encoding any of that in the ref's\n * spelling is invisible to the compiler and to every consumer; encoding it\n * as fields is what lets composition ENFORCE the tier rule\n * (`assertProviderTierCoherence`) and lets tooling display and group.\n *\n * The identity fields are REQUIRED. A provider without a tier is a provider\n * nobody has decided about, and \"undecided\" must not parse as \"fine\".\n */\n\nimport { z } from 'zod';\n\n\n/**\n * Translation key builder for provider display names.\n *\n * Provider modules stay locale-neutral by exporting this stable label key;\n * consuming frontend surfaces resolve it via the app i18n service at render\n * time instead of freezing human copy into generated/runtime artifacts.\n */\nexport function buildProviderDisplayNameLabelKey(providerRef: string): string {\n  return `providers.${providerRef}.displayName`;\n}\n\n/**\n * The three provider tiers (decided 2026-09-05, epic #337).\n *\n * The tier is a DECISION recorded on the module, never inferred from its\n * capabilities at runtime — inference is silent and wrong for a provider\n * such as Odoo, whose empty capability list says nothing about whether the\n * engine depends on it.\n */\nexport enum ProviderTier {\n  /**\n   * Mandatory, engine-shipped. Binds an `EngineCapability` slot the engine\n   * itself consumes (email, billing, SMS, the AI slots) or is an SSO login\n   * provider the auth subsystem consumes. MAIN is the engine's own set:\n   * its origin is always `ENGINE`, and it is what stays in the static\n   * engine registry when everything else loads on demand.\n   */\n  MAIN = 'MAIN',\n  /**\n   * May ALSO bind an engine slot, as a substitute for a MAIN provider\n   * (a second email sink, a telemetry sink, an audit sink). Kept distinct\n   * from MAIN so the engine's floor is not confused with what happens to\n   * be installed.\n   */\n  EXTENSION = 'EXTENSION',\n  /**\n   * The bulk: integrations with no engine slot, loaded on demand when an\n   * application declares them. A CATALOGUE provider may claim only OPEN\n   * `ProviderCapability` tokens — never one that maps to an engine slot —\n   * which composition enforces.\n   */\n  CATALOGUE = 'CATALOGUE',\n}\n\n/** Where a provider module's code comes from. */\nexport enum ProviderOriginKind {\n  /** Shipped by the framework's own connector packages. */\n  ENGINE = 'ENGINE',\n  /** Authored inside an application (its own `provider-contributions`). */\n  APPLICATION = 'APPLICATION',\n  /**\n   * Emitted by the framework packager from an external catalogue source;\n   * carries the catalogue provenance so the wrapped upstream artifact can\n   * be named, attributed and re-generated.\n   */\n  GENERATED = 'GENERATED',\n}\n\n/**\n * External catalogues a build-time MAPPER reads to emit a native Wildo provider package.\n *\n * Every member is a SOURCE that is read, never a runtime the application depends on: the mapper\n * extracts each operation's method, URL template, parameters and auth shape as DATA, and Wildo's\n * own HTTP client executes them. Nothing third-party is installed or executed by a generated\n * application. (An earlier revision of this enum described Activepieces as a set of executable\n * bundles Wildo would WRAP; that model was built, measured and deleted on 2026-09-06 — see\n * `providers-are-scraped-never-wrapped`.)\n *\n * - `ACTIVEPIECES` — the community pieces monorepo. Each piece's actions and triggers call\n *   `httpClient.sendRequest({ method, url, body })` in plain TypeScript an AST pass can read.\n *   Note the PUBLISHED bundle is NOT a usable input: its metadata carries name, inputs and auth\n *   but not the endpoint, which lives inside the compiled `run`.\n * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.\n *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response\n *   shaping stays Wildo's.\n * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the\n *   same output shape. Authoritative where it exists, since it is the vendor's own description.\n */\nexport enum ProviderCatalogueSource {\n  ACTIVEPIECES = 'ACTIVEPIECES',\n  SIM = 'SIM',\n  OPENAPI_DOCUMENT = 'OPENAPI_DOCUMENT',\n}\n\nexport const ProviderCatalogueProvenanceSchema = z.object({\n  source: z.enum(ProviderCatalogueSource),\n  /**\n   * The upstream artifact read, addressed the way its catalogue addresses it: the piece's\n   * directory or package name, the Sim tool's module, the OpenAPI document's path.\n   */\n  sourceRef: z.string().min(1),\n  /**\n   * The exact upstream revision read — a source-control revision for a monorepo catalogue, a\n   * document version for an OpenAPI input. A re-generation pins a new one, which is what makes a\n   * regenerated package's diff attributable to a specific upstream movement.\n   */\n  sourceVersion: z.string().min(1),\n});\nexport type ProviderCatalogueProvenance = z.infer<typeof ProviderCatalogueProvenanceSchema>;\n\n/**\n * Origin as ONE object with a `kind` and a provenance that is REQUIRED exactly when the kind is\n * `GENERATED` (and forbidden otherwise), enforced by the refinement below.\n *\n * Not a `z.discriminatedUnion`, deliberately: under `strictNullChecks: false` — how the engine\n * packages compile — Zod 4 infers a union-typed object key as OPTIONAL (the members' `optout`\n * collapses to `\"optional\"` once `undefined` is erased), so `metadata.origin` would type as\n * omittable in every engine consumer while the runtime refused its absence. A plain object\n * infers as required in both modes; the invariant the union expressed lives in the refinement\n * and in the `ProviderOrigin` type below.\n */\nexport const ProviderOriginSchema = z\n  .object({\n    kind: z.enum(ProviderOriginKind),\n    /** Present iff `kind === GENERATED`. */\n    catalogue: ProviderCatalogueProvenanceSchema.optional(),\n  })\n  .superRefine((origin, ctx) => {\n    if (origin.kind === ProviderOriginKind.GENERATED && origin.catalogue === undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: 'A GENERATED origin must carry its catalogue provenance.' });\n    }\n    if (origin.kind !== ProviderOriginKind.GENERATED && origin.catalogue !== undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: `Only a GENERATED origin carries catalogue provenance (kind is ${origin.kind}).` });\n    }\n  });\nexport type ProviderOrigin =\n  | { kind: ProviderOriginKind.ENGINE; catalogue?: undefined }\n  | { kind: ProviderOriginKind.APPLICATION; catalogue?: undefined }\n  | { kind: ProviderOriginKind.GENERATED; catalogue: ProviderCatalogueProvenance };\n\n/** The one engine origin value, so 22 modules do not each spell it. */\nexport const ENGINE_PROVIDER_ORIGIN: ProviderOrigin = Object.freeze({ kind: ProviderOriginKind.ENGINE });\n\nexport const ProviderMetadataSchema = z.object({\n  /**\n   * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,\n   * `'openai'`. Used as the join key across facet modules and as the\n   * map key inside `BackendProviderRegistry.modules`.\n   */\n  ref: z.string().min(1),\n  /**\n   * The npm package that ships this provider's module(s), e.g.\n   * `@wildo-ai/external-connectors-private` for an engine provider or\n   * `@wildo-ai/provider-slack` for a per-provider package. One package,\n   * several facet barrels — this is the package, not a barrel.\n   */\n  packageName: z.string().min(1),\n  /** See {@link ProviderTier}. A recorded decision, never inferred. */\n  tier: z.enum(ProviderTier),\n  /**\n   * Vendor grouping. Equal to `ref` for a single-package vendor; the shared\n   * name for a sub-cut vendor (`vendor: 'microsoft'` on both\n   * `microsoft-graph-mail` and `microsoft-teams`), which is what lets an\n   * OAuth client or a secret be shared by reference across sub-packages.\n   */\n  vendor: z.string().min(1),\n  /** See {@link ProviderOriginSchema}. */\n  origin: ProviderOriginSchema,\n  /**\n   * Translation-ready key for the provider display name.\n   *\n   * Frontend/public surfaces should prefer this field over embedding\n   * locale-bound copy in provider modules or runtime artifacts.\n   */\n  displayNameLabelKey: z.string().optional(),\n  /**\n   * Legacy human-readable fallback label for non-i18n-aware consumers.\n   * When absent, consumers fall back to the `ref`.\n   */\n  displayName: z.string().optional(),\n  /**\n   * Optional icon reference resolved through the frontend icon registry.\n   * Stays a string (not a URL or component reference) to keep this type\n   * frontend-safe AND portable to non-React surfaces.\n   */\n  iconRef: z.string().optional(),\n});\n\nexport type ProviderMetadata = Omit<z.infer<typeof ProviderMetadataSchema>, 'origin'> & { origin: ProviderOrigin };\n\n/**\n * The identity half of {@link ProviderMetadataSchema} on its own — what a\n * companion contribution carries so tooling can display tiers and group\n * vendors without loading a provider's runtime module.\n */\nexport const ProviderIdentitySchema = ProviderMetadataSchema.pick({\n  packageName: true,\n  tier: true,\n  vendor: true,\n  origin: true,\n});\nexport type ProviderIdentity = Omit<z.infer<typeof ProviderIdentitySchema>, 'origin'> & { origin: ProviderOrigin };\n\nexport interface DefineProviderMetadataInput {\n  ref: string;\n  packageName: string;\n  tier: ProviderTier;\n  origin: ProviderOrigin;\n  /** Defaults to `ref` — the single-package vendor case. */\n  vendor?: string;\n  displayName?: string;\n  iconRef?: string;\n}\n\n/**\n * The one way a provider module authors its metadata.\n *\n * Derives `displayNameLabelKey` from the ref (every module used to call\n * `buildProviderDisplayNameLabelKey` by hand), defaults `vendor` to the ref,\n * and parses the result so an incomplete identity fails at MODULE LOAD —\n * in the package that owns the module — rather than at the first consumer\n * that reads a field which is not there.\n */\nexport function defineProviderMetadata(input: DefineProviderMetadataInput): ProviderMetadata {\n  return ProviderMetadataSchema.parse({\n    ref: input.ref,\n    packageName: input.packageName,\n    tier: input.tier,\n    vendor: input.vendor ?? input.ref,\n    origin: input.origin,\n    displayNameLabelKey: buildProviderDisplayNameLabelKey(input.ref),\n    ...(input.displayName === undefined ? {} : { displayName: input.displayName }),\n    ...(input.iconRef === undefined ? {} : { iconRef: input.iconRef }),\n  }) as ProviderMetadata;\n}\n"]}
+{"version":3,"file":"provider-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,OAAO,aAAa,WAAW,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,YAuBX;AAvBD,WAAY,YAAY;IACtB;;;;;;OAMG;IACH,6BAAa,CAAA;IACb;;;;;OAKG;IACH,uCAAuB,CAAA;IACvB;;;;;OAKG;IACH,uCAAuB,CAAA;AACzB,CAAC,EAvBW,YAAY,KAAZ,YAAY,QAuBvB;AAED,iDAAiD;AACjD,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,yDAAyD;IACzD,uCAAiB,CAAA;IACjB,yEAAyE;IACzE,iDAA2B,CAAA;IAC3B;;;;OAIG;IACH,6CAAuB,CAAA;AACzB,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,wDAA6B,CAAA;IAC7B,sCAAW,CAAA;IACX,gEAAqC,CAAA;AACvC,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,wCAAwC;IACxC,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,iEAAiE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC,CAAC,CAAC;AAML,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;OAIG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,qEAAqE;IACrE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC1B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,wCAAwC;IACxC,MAAM,EAAE,oBAAoB;IAC5B;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC;IAChE,WAAW,EAAE,IAAI;IACjB,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAcH;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACnE,CAAqB,CAAC;AACzB,CAAC","sourcesContent":["/**\n * `ProviderMetadata` — shared, frontend-safe header carried by every\n * provider module across every facet (backend, frontend-app, techdoc,\n * website).\n *\n * Intentionally **frontend-safe**: holds no secrets, no protocol\n * contracts, no backend behavior. The fields are exactly what a UI needs\n * to render a provider entry (translation-ready display-name key, optional\n * legacy fallback label, optional icon ref) plus the stable `ref` used as\n * the join key between facet modules — and, since #328, the provider's\n * IDENTITY: which package ships it, which tier it belongs to, which vendor\n * groups it, and where it came from.\n *\n * ## Why identity lives here and not on the ref\n *\n * A bare `ref` string cannot say whether a provider is one the engine\n * REQUIRES (a MAIN provider binding an `EngineCapability` slot), one that\n * merely MAY bind a slot as a substitute (EXTENSION), or one of the bulk\n * loaded on demand that must never claim a slot (CATALOGUE). Nor can it say\n * that `microsoft-graph-mail` and `microsoft-teams` are two packages of one\n * vendor sharing an OAuth client. Encoding any of that in the ref's\n * spelling is invisible to the compiler and to every consumer; encoding it\n * as fields is what lets composition ENFORCE the tier rule\n * (`assertProviderTierCoherence`) and lets tooling display and group.\n *\n * The identity fields are REQUIRED. A provider without a tier is a provider\n * nobody has decided about, and \"undecided\" must not parse as \"fine\".\n */\n\nimport { z } from 'zod';\n\n\n/**\n * Translation key builder for provider display names.\n *\n * Provider modules stay locale-neutral by exporting this stable label key;\n * consuming frontend surfaces resolve it via the app i18n service at render\n * time instead of freezing human copy into generated/runtime artifacts.\n */\nexport function buildProviderDisplayNameLabelKey(providerRef: string): string {\n  return `providers.${providerRef}.displayName`;\n}\n\n/**\n * The three provider tiers (decided 2026-09-05, epic #337).\n *\n * The tier is a DECISION recorded on the module, never inferred from its\n * capabilities at runtime — inference is silent and wrong for a provider\n * such as Odoo, whose empty capability list says nothing about whether the\n * engine depends on it.\n */\nexport enum ProviderTier {\n  /**\n   * Mandatory, engine-shipped. Binds an `EngineCapability` slot the engine\n   * itself consumes (email, billing, SMS, the AI slots) or is an SSO login\n   * provider the auth subsystem consumes. MAIN is the engine's own set:\n   * its origin is always `ENGINE`, and it is what stays in the static\n   * engine registry when everything else loads on demand.\n   */\n  MAIN = 'MAIN',\n  /**\n   * May ALSO bind an engine slot, as a substitute for a MAIN provider\n   * (a second email sink, a telemetry sink, an audit sink). Kept distinct\n   * from MAIN so the engine's floor is not confused with what happens to\n   * be installed.\n   */\n  EXTENSION = 'EXTENSION',\n  /**\n   * The bulk: integrations with no engine slot, loaded on demand when an\n   * application declares them. A CATALOGUE provider may claim only OPEN\n   * `ProviderCapability` tokens — never one that maps to an engine slot —\n   * which composition enforces.\n   */\n  CATALOGUE = 'CATALOGUE',\n}\n\n/** Where a provider module's code comes from. */\nexport enum ProviderOriginKind {\n  /** Shipped by the framework's own connector packages. */\n  ENGINE = 'ENGINE',\n  /** Authored inside an application (its own `provider-contributions`). */\n  APPLICATION = 'APPLICATION',\n  /**\n   * Emitted by the framework packager from an external catalogue source;\n   * carries the catalogue provenance so the wrapped upstream artifact can\n   * be named, attributed and re-generated.\n   */\n  GENERATED = 'GENERATED',\n}\n\n/**\n * External catalogues a build-time MAPPER reads to emit a native Wildo provider package.\n *\n * Every member is a SOURCE that is read, never a runtime the application depends on: the mapper\n * extracts each operation's method, URL template, parameters and auth shape as DATA, and Wildo's\n * own HTTP client executes them. Nothing third-party is installed or executed by a generated\n * application. (An earlier revision of this enum described Activepieces as a set of executable\n * bundles Wildo would WRAP; that model was built, measured and deleted on 2026-09-06 — see\n * `providers-are-scraped-never-wrapped`.)\n *\n * - `ACTIVEPIECES` — the community pieces monorepo. Each piece's actions and triggers call\n *   `httpClient.sendRequest({ method, url, body })` in plain TypeScript an AST pass can read.\n *   Note the PUBLISHED bundle is NOT a usable input: its metadata carries name, inputs and auth\n *   but not the endpoint, which lives inside the compiled `run`.\n * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.\n *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response\n *   shaping stays Wildo's.\n * - `OPENAPI_DOCUMENT` — a vendor's OpenAPI document, read as an ORACLE rather than as a catalogue:\n *   it never decides WHICH operations exist, and answers questions about the operations the two\n *   catalogues chose — the response shape, and the names of path holes a catalogue could only name\n *   by position (#1572). Consulted on every full batch, from a public corpus or from a URL a\n *   provider decision pins.\n */\nexport enum ProviderCatalogueSource {\n  ACTIVEPIECES = 'ACTIVEPIECES',\n  SIM = 'SIM',\n  OPENAPI_DOCUMENT = 'OPENAPI_DOCUMENT',\n}\n\nexport const ProviderCatalogueProvenanceSchema = z.object({\n  source: z.enum(ProviderCatalogueSource),\n  /**\n   * The upstream artifact read, addressed the way its catalogue addresses it: the piece's\n   * directory or package name, the Sim tool's module, the OpenAPI document's path.\n   */\n  sourceRef: z.string().min(1),\n  /**\n   * The exact upstream revision read — a source-control revision for a monorepo catalogue, a\n   * document version for an OpenAPI input. A re-generation pins a new one, which is what makes a\n   * regenerated package's diff attributable to a specific upstream movement.\n   */\n  sourceVersion: z.string().min(1),\n});\nexport type ProviderCatalogueProvenance = z.infer<typeof ProviderCatalogueProvenanceSchema>;\n\n/**\n * Origin as ONE object with a `kind` and a provenance that is REQUIRED exactly when the kind is\n * `GENERATED` (and forbidden otherwise), enforced by the refinement below.\n *\n * Not a `z.discriminatedUnion`, deliberately: under `strictNullChecks: false` — how the engine\n * packages compile — Zod 4 infers a union-typed object key as OPTIONAL (the members' `optout`\n * collapses to `\"optional\"` once `undefined` is erased), so `metadata.origin` would type as\n * omittable in every engine consumer while the runtime refused its absence. A plain object\n * infers as required in both modes; the invariant the union expressed lives in the refinement\n * and in the `ProviderOrigin` type below.\n */\nexport const ProviderOriginSchema = z\n  .object({\n    kind: z.enum(ProviderOriginKind),\n    /** Present iff `kind === GENERATED`. */\n    catalogue: ProviderCatalogueProvenanceSchema.optional(),\n  })\n  .superRefine((origin, ctx) => {\n    if (origin.kind === ProviderOriginKind.GENERATED && origin.catalogue === undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: 'A GENERATED origin must carry its catalogue provenance.' });\n    }\n    if (origin.kind !== ProviderOriginKind.GENERATED && origin.catalogue !== undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: `Only a GENERATED origin carries catalogue provenance (kind is ${origin.kind}).` });\n    }\n  });\nexport type ProviderOrigin =\n  | { kind: ProviderOriginKind.ENGINE; catalogue?: undefined }\n  | { kind: ProviderOriginKind.APPLICATION; catalogue?: undefined }\n  | { kind: ProviderOriginKind.GENERATED; catalogue: ProviderCatalogueProvenance };\n\n/** The one engine origin value, so 22 modules do not each spell it. */\nexport const ENGINE_PROVIDER_ORIGIN: ProviderOrigin = Object.freeze({ kind: ProviderOriginKind.ENGINE });\n\nexport const ProviderMetadataSchema = z.object({\n  /**\n   * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,\n   * `'openai'`. Used as the join key across facet modules and as the\n   * map key inside `BackendProviderRegistry.modules`.\n   */\n  ref: z.string().min(1),\n  /**\n   * The npm package that ships this provider's module(s), e.g.\n   * `@wildo-ai/external-connectors-private` for an engine provider or\n   * `@wildo-ai/provider-slack` for a per-provider package. One package,\n   * several facet barrels — this is the package, not a barrel.\n   */\n  packageName: z.string().min(1),\n  /** See {@link ProviderTier}. A recorded decision, never inferred. */\n  tier: z.enum(ProviderTier),\n  /**\n   * Vendor grouping. Equal to `ref` for a single-package vendor; the shared\n   * name for a sub-cut vendor (`vendor: 'microsoft'` on both\n   * `microsoft-graph-mail` and `microsoft-teams`), which is what lets an\n   * OAuth client or a secret be shared by reference across sub-packages.\n   */\n  vendor: z.string().min(1),\n  /** See {@link ProviderOriginSchema}. */\n  origin: ProviderOriginSchema,\n  /**\n   * Translation-ready key for the provider display name.\n   *\n   * Frontend/public surfaces should prefer this field over embedding\n   * locale-bound copy in provider modules or runtime artifacts.\n   */\n  displayNameLabelKey: z.string().optional(),\n  /**\n   * Legacy human-readable fallback label for non-i18n-aware consumers.\n   * When absent, consumers fall back to the `ref`.\n   */\n  displayName: z.string().optional(),\n  /**\n   * Optional icon reference resolved through the frontend icon registry.\n   * Stays a string (not a URL or component reference) to keep this type\n   * frontend-safe AND portable to non-React surfaces.\n   */\n  iconRef: z.string().optional(),\n});\n\nexport type ProviderMetadata = Omit<z.infer<typeof ProviderMetadataSchema>, 'origin'> & { origin: ProviderOrigin };\n\n/**\n * The identity half of {@link ProviderMetadataSchema} on its own — what a\n * companion contribution carries so tooling can display tiers and group\n * vendors without loading a provider's runtime module.\n */\nexport const ProviderIdentitySchema = ProviderMetadataSchema.pick({\n  packageName: true,\n  tier: true,\n  vendor: true,\n  origin: true,\n});\nexport type ProviderIdentity = Omit<z.infer<typeof ProviderIdentitySchema>, 'origin'> & { origin: ProviderOrigin };\n\nexport interface DefineProviderMetadataInput {\n  ref: string;\n  packageName: string;\n  tier: ProviderTier;\n  origin: ProviderOrigin;\n  /** Defaults to `ref` — the single-package vendor case. */\n  vendor?: string;\n  displayName?: string;\n  iconRef?: string;\n}\n\n/**\n * The one way a provider module authors its metadata.\n *\n * Derives `displayNameLabelKey` from the ref (every module used to call\n * `buildProviderDisplayNameLabelKey` by hand), defaults `vendor` to the ref,\n * and parses the result so an incomplete identity fails at MODULE LOAD —\n * in the package that owns the module — rather than at the first consumer\n * that reads a field which is not there.\n */\nexport function defineProviderMetadata(input: DefineProviderMetadataInput): ProviderMetadata {\n  return ProviderMetadataSchema.parse({\n    ref: input.ref,\n    packageName: input.packageName,\n    tier: input.tier,\n    vendor: input.vendor ?? input.ref,\n    origin: input.origin,\n    displayNameLabelKey: buildProviderDisplayNameLabelKey(input.ref),\n    ...(input.displayName === undefined ? {} : { displayName: input.displayName }),\n    ...(input.iconRef === undefined ? {} : { iconRef: input.iconRef }),\n  }) as ProviderMetadata;\n}\n"]}

package/dist/esm/external-providers/provider-package-allow-list.shared.schemas.d.ts

@@ -0,0 +1,42 @@
+import { z } from 'zod';
+/** @wildo_source:part:start saas.config.providers.packages facet:layer:shared facet:family:provider-config facet:audience:app-developer */
+/**
+ * Provider packages this application admits to discovery from OUTSIDE the names discovery walks by itself (#1676).
+ *
+ * ```ts
+ * providers: {
+ *   scopes: { backend: { providers: { teams: { protocols: ['REST_API'] } } } },
+ *   packages: ['@acme/wildo-provider-teams'],
+ * }
+ * ```
+ *
+ * Discovery walks, on its own, only the framework's names (`@wildo-ai/provider-*`, the engine's own provider barrel,
+ * the system-of-record facet library `@wildo-ai/systems-of-record`) and packages of the application's own scope named
+ * `<application-scope>/provider-*` — which is how a registry provider an install copied into the application is
+ * found. Any other
+ * package — from anybody else's scope, or an own-scope one not named `provider-*` — is never executed by the walk
+ * unless it is named here: a dependency cannot contribute providers merely by being installed.
+ *
+ * ## Admission is not activation
+ *
+ * A listed package is WALKED: its provider contributions, its browser facets and its provider augmentations are
+ * discovered exactly as a framework package's are. Nothing it ships is used until the application uses it in the
+ * ordinary way — a provider through `scopes`, an augmentation through `augmentations`. Its system-of-record facet
+ * module goes one step further: it is not even recorded until an instance names the package in `facetAugmentations`
+ * (#2013); only the framework's own facet library is recorded without being asked for.
+ *
+ * ## What `wildo config sync` refuses
+ *
+ * A listed package that no runtime owner (nor the application root) depends on, one that is declared but not
+ * installed, one whose companion entry cannot be read, one that ships nothing — no provider contribution, no
+ * augmentation and no `./systems-of-record` module — one discovery already walks by its name, and one of the
+ * application's own runtime packages. Each refusal names the package. Every admitted package is
+ * printed by `config sync` and recorded in the provider lock with its installed version, so a reviewer sees
+ * third-party code entering the application.
+ *
+ * Absent means none.
+ */
+export declare const ProviderPackageAllowListSchema: z.ZodArray<z.ZodString>;
+export type ProviderPackageAllowList = z.infer<typeof ProviderPackageAllowListSchema>;
+/** @wildo_source:part:end saas.config.providers.packages */
+//# sourceMappingURL=provider-package-allow-list.shared.schemas.d.ts.map

package/dist/esm/external-providers/provider-package-allow-list.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-package-allow-list.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-package-allow-list.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,2IAA2I;AAC3I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,8BAA8B,yBASvC,CAAC;AACL,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,4DAA4D"}

package/dist/esm/external-providers/provider-package-allow-list.shared.schemas.js

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+/**
+ * An npm package name, scoped or not, as npm itself accepts one: lower-case, no leading dot or underscore, and never
+ * a `.` or `..` segment. Checked here because discovery splices the name into a `node_modules` path and EXECUTES the
+ * package's companion entry, so a name that walks out of `node_modules` must be refused where it is authored.
+ */
+const NPM_PACKAGE_NAME_PATTERN = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+/** @wildo_source:part:start saas.config.providers.packages facet:layer:shared facet:family:provider-config facet:audience:app-developer */
+/**
+ * Provider packages this application admits to discovery from OUTSIDE the names discovery walks by itself (#1676).
+ *
+ * ```ts
+ * providers: {
+ *   scopes: { backend: { providers: { teams: { protocols: ['REST_API'] } } } },
+ *   packages: ['@acme/wildo-provider-teams'],
+ * }
+ * ```
+ *
+ * Discovery walks, on its own, only the framework's names (`@wildo-ai/provider-*`, the engine's own provider barrel,
+ * the system-of-record facet library `@wildo-ai/systems-of-record`) and packages of the application's own scope named
+ * `<application-scope>/provider-*` — which is how a registry provider an install copied into the application is
+ * found. Any other
+ * package — from anybody else's scope, or an own-scope one not named `provider-*` — is never executed by the walk
+ * unless it is named here: a dependency cannot contribute providers merely by being installed.
+ *
+ * ## Admission is not activation
+ *
+ * A listed package is WALKED: its provider contributions, its browser facets and its provider augmentations are
+ * discovered exactly as a framework package's are. Nothing it ships is used until the application uses it in the
+ * ordinary way — a provider through `scopes`, an augmentation through `augmentations`. Its system-of-record facet
+ * module goes one step further: it is not even recorded until an instance names the package in `facetAugmentations`
+ * (#2013); only the framework's own facet library is recorded without being asked for.
+ *
+ * ## What `wildo config sync` refuses
+ *
+ * A listed package that no runtime owner (nor the application root) depends on, one that is declared but not
+ * installed, one whose companion entry cannot be read, one that ships nothing — no provider contribution, no
+ * augmentation and no `./systems-of-record` module — one discovery already walks by its name, and one of the
+ * application's own runtime packages. Each refusal names the package. Every admitted package is
+ * printed by `config sync` and recorded in the provider lock with its installed version, so a reviewer sees
+ * third-party code entering the application.
+ *
+ * Absent means none.
+ */
+export const ProviderPackageAllowListSchema = z
+    .array(z.string().regex(NPM_PACKAGE_NAME_PATTERN, 'A provider package is named by its npm package name.'))
+    .min(1)
+    .superRefine((packageNames, ctx) => {
+    const seen = new Set();
+    for (const [index, packageName] of packageNames.entries()) {
+        if (seen.has(packageName))
+            ctx.addIssue({ code: 'custom', path: [index], message: `"${packageName}" is listed twice.` });
+        seen.add(packageName);
+    }
+});
+/** @wildo_source:part:end saas.config.providers.packages */
+//# sourceMappingURL=provider-package-allow-list.shared.schemas.js.map

package/dist/esm/external-providers/provider-package-allow-list.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-package-allow-list.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-package-allow-list.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,0DAA0D,CAAC;AAE5F,2IAA2I;AAC3I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,EAAE,sDAAsD,CAAC,CAAC;KACzG,GAAG,CAAC,CAAC,CAAC;KACN,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,WAAW,oBAAoB,EAAE,CAAC,CAAC;QACzH,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,4DAA4D","sourcesContent":["import { z } from 'zod';\n\n/**\n * An npm package name, scoped or not, as npm itself accepts one: lower-case, no leading dot or underscore, and never\n * a `.` or `..` segment. Checked here because discovery splices the name into a `node_modules` path and EXECUTES the\n * package's companion entry, so a name that walks out of `node_modules` must be refused where it is authored.\n */\nconst NPM_PACKAGE_NAME_PATTERN = /^(?:@[a-z0-9-~][a-z0-9-._~]*\\/)?[a-z0-9-~][a-z0-9-._~]*$/;\n\n/** @wildo_source:part:start saas.config.providers.packages facet:layer:shared facet:family:provider-config facet:audience:app-developer */\n/**\n * Provider packages this application admits to discovery from OUTSIDE the names discovery walks by itself (#1676).\n *\n * ```ts\n * providers: {\n *   scopes: { backend: { providers: { teams: { protocols: ['REST_API'] } } } },\n *   packages: ['@acme/wildo-provider-teams'],\n * }\n * ```\n *\n * Discovery walks, on its own, only the framework's names (`@wildo-ai/provider-*`, the engine's own provider barrel,\n * the system-of-record facet library `@wildo-ai/systems-of-record`) and packages of the application's own scope named\n * `<application-scope>/provider-*` — which is how a registry provider an install copied into the application is\n * found. Any other\n * package — from anybody else's scope, or an own-scope one not named `provider-*` — is never executed by the walk\n * unless it is named here: a dependency cannot contribute providers merely by being installed.\n *\n * ## Admission is not activation\n *\n * A listed package is WALKED: its provider contributions, its browser facets and its provider augmentations are\n * discovered exactly as a framework package's are. Nothing it ships is used until the application uses it in the\n * ordinary way — a provider through `scopes`, an augmentation through `augmentations`. Its system-of-record facet\n * module goes one step further: it is not even recorded until an instance names the package in `facetAugmentations`\n * (#2013); only the framework's own facet library is recorded without being asked for.\n *\n * ## What `wildo config sync` refuses\n *\n * A listed package that no runtime owner (nor the application root) depends on, one that is declared but not\n * installed, one whose companion entry cannot be read, one that ships nothing — no provider contribution, no\n * augmentation and no `./systems-of-record` module — one discovery already walks by its name, and one of the\n * application's own runtime packages. Each refusal names the package. Every admitted package is\n * printed by `config sync` and recorded in the provider lock with its installed version, so a reviewer sees\n * third-party code entering the application.\n *\n * Absent means none.\n */\nexport const ProviderPackageAllowListSchema = z\n  .array(z.string().regex(NPM_PACKAGE_NAME_PATTERN, 'A provider package is named by its npm package name.'))\n  .min(1)\n  .superRefine((packageNames, ctx) => {\n    const seen = new Set<string>();\n    for (const [index, packageName] of packageNames.entries()) {\n      if (seen.has(packageName)) ctx.addIssue({ code: 'custom', path: [index], message: `\"${packageName}\" is listed twice.` });\n      seen.add(packageName);\n    }\n  });\nexport type ProviderPackageAllowList = z.infer<typeof ProviderPackageAllowListSchema>;\n/** @wildo_source:part:end saas.config.providers.packages */\n"]}

package/dist/esm/external-providers/provider-protocol.shared.schemas.d.ts

@@ -57,6 +57,12 @@ export declare const BUILTIN_PROVIDER_PROTOCOL: {
      */
     readonly DOCUMENT_EXTRACTION_PROVIDER: "DOCUMENT_EXTRACTION_PROVIDER";
     readonly EMAIL_PROVIDER: "EMAIL_PROVIDER";
+    /**
+     * Receiving email (#1630): the provider hosts a receiving domain, announces each message through
+     * its `WEBHOOK_ORIGINATOR` endpoint and serves the message on request. Fills
+     * `EngineCapability.EMAIL_INBOUND`, selected independently of the sending provider.
+     */
+    readonly EMAIL_INBOUND_PROVIDER: "EMAIL_INBOUND_PROVIDER";
     readonly SSO_OAUTH2: "SSO_OAUTH2";
     readonly BILLING_PROVIDER: "BILLING_PROVIDER";
     readonly SMS_PROVIDER: "SMS_PROVIDER";

package/dist/esm/external-providers/provider-protocol.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-protocol.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB;;;;;IAKpC;;;OAGG;;IAEH;;;;;;OAMG;;IAEH;;;;OAIG;;;;;;;CAOK,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}
+{"version":3,"file":"provider-protocol.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB;;;;;IAKpC;;;OAGG;;IAEH;;;;;;OAMG;;IAEH;;;;OAIG;;;IAGH;;;;OAIG;;;;;;CAMK,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}

package/dist/esm/external-providers/provider-protocol.shared.schemas.js

@@ -57,6 +57,12 @@ export const BUILTIN_PROVIDER_PROTOCOL = {
      */
     DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',
     EMAIL_PROVIDER: 'EMAIL_PROVIDER',
+    /**
+     * Receiving email (#1630): the provider hosts a receiving domain, announces each message through
+     * its `WEBHOOK_ORIGINATOR` endpoint and serves the message on request. Fills
+     * `EngineCapability.EMAIL_INBOUND`, selected independently of the sending provider.
+     */
+    EMAIL_INBOUND_PROVIDER: 'EMAIL_INBOUND_PROVIDER',
     SSO_OAUTH2: 'SSO_OAUTH2',
     BILLING_PROVIDER: 'BILLING_PROVIDER',
     SMS_PROVIDER: 'SMS_PROVIDER',

package/dist/esm/external-providers/provider-protocol.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-protocol.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C;;;OAGG;IACH,cAAc,EAAE,gBAAgB;IAChC;;;;;;OAMG;IACH,mBAAmB,EAAE,qBAAqB;IAC1C;;;;OAIG;IACH,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,YAAY;IACxB,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC","sourcesContent":["/**\n * Closed built-in provider protocol vocabulary used by app authoring and\n * runtime-provider declarations.\n *\n * This is intentionally a pure `as const` object + union type so browser-bound\n * packages can consume it through `@wildo-ai/saas-models/public-runtime`\n * without pulling decorators or broader config-authoring seams. Do NOT add an\n * import here — not even an `import type` of the engine enum this list mirrors.\n *\n * ## Relationship to `ExternalProvider_ExchangeProtocol_Kind`\n *\n * This list re-states a population the engine owns: every member of\n * `ExternalProvider_ExchangeProtocol_Kind`\n * (`@wildo-ai/external-connectors-models`) that an application may legally\n * WRITE in `wildo.saas.config.ts > providers.scopes.<scope>.providers.<ref>`.\n * Two hand-maintained enumerations of one population is the shape that drifts,\n * and this one did: `IMAGE_PROVIDER` and `EMBEDDINGS_PROVIDER` shipped as live\n * engine protocols — a provider module declares them, discovery reports them,\n * the backend registry resolves them — while this list had no legal value for\n * either, so no application could declare what those transports speak.\n *\n * The keys are therefore checked against the engine enum by\n * `__tests__/provider-protocol-vocabulary.drift.test.ts`, which also owns the\n * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and\n * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and\n * for the exact condition under which they are admitted.\n *\n * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,\n * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,\n * declared by no provider module, resolvable by no runtime arm. An application that still\n * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts\n * ONLY these keys (the engine's snake_case wire values were also accepted before, a second\n * spelling nothing else understood).\n */\nexport const BUILTIN_PROVIDER_PROTOCOL = {\n  REST_API: 'REST_API',\n  WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',\n  LLM_PROVIDER: 'LLM_PROVIDER',\n  AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',\n  /**\n   * Text-to-image generation (wired: gpt-image, via the OpenAI provider's\n   * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.\n   */\n  IMAGE_PROVIDER: 'IMAGE_PROVIDER',\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the\n   * RAG derived-data tier — corpus embedding in the `rag:embedding-drain`\n   * worker, query-time embedding in retrieval. Its own protocol rather than an\n   * `LLM_PROVIDER` operation so a provider can be selected for embeddings\n   * independently of chat.\n   */\n  EMBEDDINGS_PROVIDER: 'EMBEDDINGS_PROVIDER',\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves file text extraction and\n   * the `.ragSource()` corpus built on it, and fills `EngineCapability.AI_DOCUMENT_EXTRACTION` so\n   * an OCR provider is selected independently of chat and embeddings.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',\n  EMAIL_PROVIDER: 'EMAIL_PROVIDER',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  BILLING_PROVIDER: 'BILLING_PROVIDER',\n  SMS_PROVIDER: 'SMS_PROVIDER',\n  FRONTEND_SDK: 'FRONTEND_SDK',\n} as const;\n\nexport type BuiltinProviderProtocol =\n  (typeof BUILTIN_PROVIDER_PROTOCOL)[keyof typeof BUILTIN_PROVIDER_PROTOCOL];\n\nexport type ProviderProtocol = BuiltinProviderProtocol;\n"]}
+{"version":3,"file":"provider-protocol.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C;;;OAGG;IACH,cAAc,EAAE,gBAAgB;IAChC;;;;;;OAMG;IACH,mBAAmB,EAAE,qBAAqB;IAC1C;;;;OAIG;IACH,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC;;;;OAIG;IACH,sBAAsB,EAAE,wBAAwB;IAChD,UAAU,EAAE,YAAY;IACxB,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC","sourcesContent":["/**\n * Closed built-in provider protocol vocabulary used by app authoring and\n * runtime-provider declarations.\n *\n * This is intentionally a pure `as const` object + union type so browser-bound\n * packages can consume it through `@wildo-ai/saas-models/public-runtime`\n * without pulling decorators or broader config-authoring seams. Do NOT add an\n * import here — not even an `import type` of the engine enum this list mirrors.\n *\n * ## Relationship to `ExternalProvider_ExchangeProtocol_Kind`\n *\n * This list re-states a population the engine owns: every member of\n * `ExternalProvider_ExchangeProtocol_Kind`\n * (`@wildo-ai/external-connectors-models`) that an application may legally\n * WRITE in `wildo.saas.config.ts > providers.scopes.<scope>.providers.<ref>`.\n * Two hand-maintained enumerations of one population is the shape that drifts,\n * and this one did: `IMAGE_PROVIDER` and `EMBEDDINGS_PROVIDER` shipped as live\n * engine protocols — a provider module declares them, discovery reports them,\n * the backend registry resolves them — while this list had no legal value for\n * either, so no application could declare what those transports speak.\n *\n * The keys are therefore checked against the engine enum by\n * `__tests__/provider-protocol-vocabulary.drift.test.ts`, which also owns the\n * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and\n * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and\n * for the exact condition under which they are admitted.\n *\n * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,\n * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,\n * declared by no provider module, resolvable by no runtime arm. An application that still\n * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts\n * ONLY these keys (the engine's snake_case wire values were also accepted before, a second\n * spelling nothing else understood).\n */\nexport const BUILTIN_PROVIDER_PROTOCOL = {\n  REST_API: 'REST_API',\n  WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',\n  LLM_PROVIDER: 'LLM_PROVIDER',\n  AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',\n  /**\n   * Text-to-image generation (wired: gpt-image, via the OpenAI provider's\n   * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.\n   */\n  IMAGE_PROVIDER: 'IMAGE_PROVIDER',\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the\n   * RAG derived-data tier — corpus embedding in the `rag:embedding-drain`\n   * worker, query-time embedding in retrieval. Its own protocol rather than an\n   * `LLM_PROVIDER` operation so a provider can be selected for embeddings\n   * independently of chat.\n   */\n  EMBEDDINGS_PROVIDER: 'EMBEDDINGS_PROVIDER',\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves file text extraction and\n   * the `.ragSource()` corpus built on it, and fills `EngineCapability.AI_DOCUMENT_EXTRACTION` so\n   * an OCR provider is selected independently of chat and embeddings.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',\n  EMAIL_PROVIDER: 'EMAIL_PROVIDER',\n  /**\n   * Receiving email (#1630): the provider hosts a receiving domain, announces each message through\n   * its `WEBHOOK_ORIGINATOR` endpoint and serves the message on request. Fills\n   * `EngineCapability.EMAIL_INBOUND`, selected independently of the sending provider.\n   */\n  EMAIL_INBOUND_PROVIDER: 'EMAIL_INBOUND_PROVIDER',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  BILLING_PROVIDER: 'BILLING_PROVIDER',\n  SMS_PROVIDER: 'SMS_PROVIDER',\n  FRONTEND_SDK: 'FRONTEND_SDK',\n} as const;\n\nexport type BuiltinProviderProtocol =\n  (typeof BUILTIN_PROVIDER_PROTOCOL)[keyof typeof BUILTIN_PROVIDER_PROTOCOL];\n\nexport type ProviderProtocol = BuiltinProviderProtocol;\n"]}

package/dist/esm/external-providers/provider-scope-reauthorization.shared.schemas.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The re-authorization OFFER a provider operation refused for a missing scope carries, and why a scope may not be
+ * requestable on a connection (#1671) — shared, because the backend composes it and a frontend component acts on it
+ * (the browser door answers it in `409 PROVIDER_OPERATION_SCOPE_NOT_GRANTED`).
+ *
+ * How the ceiling behind it is computed is the backend's (`provider-connection-scope-ceiling.backend.ts`); this is the
+ * vocabulary both sides read.
+ */
+/** @wildo_source:part:start saas.models.providers.scope-reauthorization facet:layer:shared facet:family:provider facet:audience:app-developer */
+/** Why a scope cannot be requested on a connection. */
+export declare enum ProviderConnectionScopeRefusal {
+    /** No declared ref and no opted-in augmentation of the connection declares it. An author declares it first. */
+    NOT_DECLARED_BY_CONNECTION = "NOT_DECLARED_BY_CONNECTION",
+    /** It names a resource none of the connection's declared audiences covers. */
+    OUTSIDE_CONNECTION_AUDIENCES = "OUTSIDE_CONNECTION_AUDIENCES",
+    /**
+     * A member or augmentation scope carrying a `{placeholder}`: it can be resolved only against its own declaring ref's
+     * allowances, which are inert inside a connection, so it is never a value a request could carry.
+     */
+    CARRIES_PLACEHOLDER = "CARRIES_PLACEHOLDER",
+    /** Only an administrator of the account can grant it; a person is never sent to consent to it. */
+    ADMINISTRATOR_CONSENT_REQUIRED = "ADMINISTRATOR_CONSENT_REQUIRED",
+    /**
+     * It names a declared audience OTHER than the primary one (a Dataverse environment, Business Central, Power BI on a
+     * Graph-primary Microsoft connection). A vendor that mints one resource per request answers an authorization with a
+     * token for the resource the request names, and the stored grant holds the PRIMARY audience's token — so growing the
+     * grant with another resource's scope would put that resource's token where every primary call reads it. Such a
+     * permission is consented statically (the operator lists it on the registration, and the person reconnects); the
+     * audience's token is then minted from the refresh token as before.
+     */
+    NOT_PRIMARY_AUDIENCE = "NOT_PRIMARY_AUDIENCE"
+}
+/**
+ * What a refused call hands back so the person can grow the grant (#1671) — carried by `ProviderOperationScopeError`
+ * and the browser door's `409 PROVIDER_OPERATION_SCOPE_NOT_GRANTED`.
+ *
+ * `requestableScopes` is exactly what `POST /connections/:providerRef/start` accepts as `addScopes`; the other two
+ * lists are what no re-authorization can obtain, each with its own remedy.
+ */
+export interface ProviderScopeReauthorizationOffer {
+    /** The connection whose grant grows. */
+    readonly connectionRef: string;
+    /** The ref to start the re-authorization through — the one the refused call used. */
+    readonly providerRef: string;
+    /** The operation that needs them, echoed as `forOperationId` so the grant's audit row names its cause. */
+    readonly operationId: string;
+    /** The missing scopes a person may grant now. Empty when none can be. */
+    readonly requestableScopes: readonly string[];
+    /** Missing scopes only an administrator of the account can grant. */
+    readonly administratorConsentScopes: readonly string[];
+    /** Missing scopes no re-authorization of this connection can ask for, with why. */
+    readonly unrequestableScopes: readonly {
+        readonly scope: string;
+        readonly refusal: ProviderConnectionScopeRefusal;
+    }[];
+}
+/** @wildo_source:part:end saas.models.providers.scope-reauthorization */
+//# sourceMappingURL=provider-scope-reauthorization.shared.schemas.d.ts.map

package/dist/esm/external-providers/provider-scope-reauthorization.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-scope-reauthorization.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-scope-reauthorization.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iJAAiJ;AACjJ,uDAAuD;AACvD,oBAAY,8BAA8B;IACxC,+GAA+G;IAC/G,0BAA0B,+BAA+B;IACzD,8EAA8E;IAC9E,4BAA4B,iCAAiC;IAC7D;;;OAGG;IACH,mBAAmB,wBAAwB;IAC3C,kGAAkG;IAClG,8BAA8B,mCAAmC;IACjE;;;;;;;OAOG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iCAAiC;IAChD,wCAAwC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0GAA0G;IAC1G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,qEAAqE;IACrE,QAAQ,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,mFAAmF;IACnF,QAAQ,CAAC,mBAAmB,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAA;KAAE,EAAE,CAAC;CACvH;AACD,yEAAyE"}

package/dist/esm/external-providers/provider-scope-reauthorization.shared.schemas.js

@@ -0,0 +1,35 @@
+/**
+ * The re-authorization OFFER a provider operation refused for a missing scope carries, and why a scope may not be
+ * requestable on a connection (#1671) — shared, because the backend composes it and a frontend component acts on it
+ * (the browser door answers it in `409 PROVIDER_OPERATION_SCOPE_NOT_GRANTED`).
+ *
+ * How the ceiling behind it is computed is the backend's (`provider-connection-scope-ceiling.backend.ts`); this is the
+ * vocabulary both sides read.
+ */
+/** @wildo_source:part:start saas.models.providers.scope-reauthorization facet:layer:shared facet:family:provider facet:audience:app-developer */
+/** Why a scope cannot be requested on a connection. */
+export var ProviderConnectionScopeRefusal;
+(function (ProviderConnectionScopeRefusal) {
+    /** No declared ref and no opted-in augmentation of the connection declares it. An author declares it first. */
+    ProviderConnectionScopeRefusal["NOT_DECLARED_BY_CONNECTION"] = "NOT_DECLARED_BY_CONNECTION";
+    /** It names a resource none of the connection's declared audiences covers. */
+    ProviderConnectionScopeRefusal["OUTSIDE_CONNECTION_AUDIENCES"] = "OUTSIDE_CONNECTION_AUDIENCES";
+    /**
+     * A member or augmentation scope carrying a `{placeholder}`: it can be resolved only against its own declaring ref's
+     * allowances, which are inert inside a connection, so it is never a value a request could carry.
+     */
+    ProviderConnectionScopeRefusal["CARRIES_PLACEHOLDER"] = "CARRIES_PLACEHOLDER";
+    /** Only an administrator of the account can grant it; a person is never sent to consent to it. */
+    ProviderConnectionScopeRefusal["ADMINISTRATOR_CONSENT_REQUIRED"] = "ADMINISTRATOR_CONSENT_REQUIRED";
+    /**
+     * It names a declared audience OTHER than the primary one (a Dataverse environment, Business Central, Power BI on a
+     * Graph-primary Microsoft connection). A vendor that mints one resource per request answers an authorization with a
+     * token for the resource the request names, and the stored grant holds the PRIMARY audience's token — so growing the
+     * grant with another resource's scope would put that resource's token where every primary call reads it. Such a
+     * permission is consented statically (the operator lists it on the registration, and the person reconnects); the
+     * audience's token is then minted from the refresh token as before.
+     */
+    ProviderConnectionScopeRefusal["NOT_PRIMARY_AUDIENCE"] = "NOT_PRIMARY_AUDIENCE";
+})(ProviderConnectionScopeRefusal || (ProviderConnectionScopeRefusal = {}));
+/** @wildo_source:part:end saas.models.providers.scope-reauthorization */
+//# sourceMappingURL=provider-scope-reauthorization.shared.schemas.js.map

package/dist/esm/external-providers/provider-scope-reauthorization.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-scope-reauthorization.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-scope-reauthorization.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iJAAiJ;AACjJ,uDAAuD;AACvD,MAAM,CAAN,IAAY,8BAqBX;AArBD,WAAY,8BAA8B;IACxC,+GAA+G;IAC/G,2FAAyD,CAAA;IACzD,8EAA8E;IAC9E,+FAA6D,CAAA;IAC7D;;;OAGG;IACH,6EAA2C,CAAA;IAC3C,kGAAkG;IAClG,mGAAiE,CAAA;IACjE;;;;;;;OAOG;IACH,+EAA6C,CAAA;AAC/C,CAAC,EArBW,8BAA8B,KAA9B,8BAA8B,QAqBzC;AAuBD,yEAAyE","sourcesContent":["/**\n * The re-authorization OFFER a provider operation refused for a missing scope carries, and why a scope may not be\n * requestable on a connection (#1671) — shared, because the backend composes it and a frontend component acts on it\n * (the browser door answers it in `409 PROVIDER_OPERATION_SCOPE_NOT_GRANTED`).\n *\n * How the ceiling behind it is computed is the backend's (`provider-connection-scope-ceiling.backend.ts`); this is the\n * vocabulary both sides read.\n */\n\n/** @wildo_source:part:start saas.models.providers.scope-reauthorization facet:layer:shared facet:family:provider facet:audience:app-developer */\n/** Why a scope cannot be requested on a connection. */\nexport enum ProviderConnectionScopeRefusal {\n  /** No declared ref and no opted-in augmentation of the connection declares it. An author declares it first. */\n  NOT_DECLARED_BY_CONNECTION = 'NOT_DECLARED_BY_CONNECTION',\n  /** It names a resource none of the connection's declared audiences covers. */\n  OUTSIDE_CONNECTION_AUDIENCES = 'OUTSIDE_CONNECTION_AUDIENCES',\n  /**\n   * A member or augmentation scope carrying a `{placeholder}`: it can be resolved only against its own declaring ref's\n   * allowances, which are inert inside a connection, so it is never a value a request could carry.\n   */\n  CARRIES_PLACEHOLDER = 'CARRIES_PLACEHOLDER',\n  /** Only an administrator of the account can grant it; a person is never sent to consent to it. */\n  ADMINISTRATOR_CONSENT_REQUIRED = 'ADMINISTRATOR_CONSENT_REQUIRED',\n  /**\n   * It names a declared audience OTHER than the primary one (a Dataverse environment, Business Central, Power BI on a\n   * Graph-primary Microsoft connection). A vendor that mints one resource per request answers an authorization with a\n   * token for the resource the request names, and the stored grant holds the PRIMARY audience's token — so growing the\n   * grant with another resource's scope would put that resource's token where every primary call reads it. Such a\n   * permission is consented statically (the operator lists it on the registration, and the person reconnects); the\n   * audience's token is then minted from the refresh token as before.\n   */\n  NOT_PRIMARY_AUDIENCE = 'NOT_PRIMARY_AUDIENCE',\n}\n\n/**\n * What a refused call hands back so the person can grow the grant (#1671) — carried by `ProviderOperationScopeError`\n * and the browser door's `409 PROVIDER_OPERATION_SCOPE_NOT_GRANTED`.\n *\n * `requestableScopes` is exactly what `POST /connections/:providerRef/start` accepts as `addScopes`; the other two\n * lists are what no re-authorization can obtain, each with its own remedy.\n */\nexport interface ProviderScopeReauthorizationOffer {\n  /** The connection whose grant grows. */\n  readonly connectionRef: string;\n  /** The ref to start the re-authorization through — the one the refused call used. */\n  readonly providerRef: string;\n  /** The operation that needs them, echoed as `forOperationId` so the grant's audit row names its cause. */\n  readonly operationId: string;\n  /** The missing scopes a person may grant now. Empty when none can be. */\n  readonly requestableScopes: readonly string[];\n  /** Missing scopes only an administrator of the account can grant. */\n  readonly administratorConsentScopes: readonly string[];\n  /** Missing scopes no re-authorization of this connection can ask for, with why. */\n  readonly unrequestableScopes: readonly { readonly scope: string; readonly refusal: ProviderConnectionScopeRefusal }[];\n}\n/** @wildo_source:part:end saas.models.providers.scope-reauthorization */\n"]}

package/dist/esm/external-providers/provider-shared-connections.shared.schemas.d.ts

@@ -0,0 +1,115 @@
+import { z } from 'zod';
+/** @wildo_source:part:start saas.config.providers.shared-connections facet:layer:shared facet:family:provider-config facet:audience:app-developer */
+/**
+ * One declared SHARED CONNECTION (#1725): the provider refs that spend ONE vendor grant, keyed in
+ * {@link ProviderSharedConnectionsSchema} by the BASE ref that owns the connection's OAuth client.
+ *
+ * ```ts
+ * providers: {
+ *   scopes: { backend: { providers: { microsoft: {}, 'microsoft-teams': {}, 'microsoft-dataverse': {} } } },
+ *   sharedConnections: {
+ *     microsoft: { refs: ['microsoft-teams', 'microsoft-dataverse'] },
+ *   },
+ * }
+ * ```
+ *
+ * A person connects Microsoft ONCE, through any of the three refs, and every one of them spends the same
+ * stored grant. Without a declaration every ref is its own connection — which is the default and changes
+ * nothing for an application that declares none.
+ *
+ * ## The base alone owns the client
+ *
+ * The BASE ref's OAuth2 block is the connection's: its authorize and token endpoints, its client-id and
+ * client-secret slots, its connection parameters (`{tenantId}`), and the AUDIENCES its tokens may be sent to.
+ * A member ref brings operations — never a client. A member's own OAuth2 block and client slots become inert
+ * while it is a member: they are reported by `wildo config sync`, never required.
+ *
+ * ## Membership is this LIST, never the vendor string
+ *
+ * `vendor` on a provider's metadata is display and compliance grouping only. Two refs that both say
+ * `vendor: 'microsoft'` are two connections until they are listed here, because spending one grant from a
+ * second package is a trust decision the application makes explicitly, never one inferred from a label.
+ */
+export declare const ProviderSharedConnectionSchema: z.ZodObject<{
+    /**
+     * The member refs, besides the base. Every runtime scope that declares a member must declare the base too,
+     * because the base's module is what connects, refreshes and revokes the grant.
+     */
+    refs: z.ZodArray<z.ZodString>;
+    /**
+     * `true` makes the connection use the base's SIGN-IN registration (the `OAUTH2_SSO` client) instead of its
+     * own connected-account client. `false`, the default, keeps sign-in and data access on two registrations.
+     *
+     * Why separate is the default, stated where the choice is made:
+     * - one client secret then authorizes both sign-in and data access, so its compromise exposes both;
+     * - a tenant administrator's admin consent covers every permission statically configured on a registration,
+     *   so data permissions listed statically on a sign-in registration would be granted at sign-in;
+     * - a vendor that reviews sensitive scopes (Google's app verification) reviews the sign-in client too once
+     *   it carries them.
+     *
+     * With `true`, data permissions must be requested dynamically at connect time and never listed statically
+     * on the sign-in registration.
+     */
+    sharedWithSignIn: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type ProviderSharedConnection = z.infer<typeof ProviderSharedConnectionSchema>;
+/**
+ * `providers.sharedConnections` — `baseRef` → the connection that ref owns (#1725). See
+ * {@link ProviderSharedConnectionSchema}.
+ *
+ * Refused at parse time, naming both sides: a ref listed in two connections (two bases would each own its
+ * client, so which grant it spends would depend on lookup order), a base listed as a member of its own or
+ * another connection, and a ref listed twice in one connection.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — which refs may spend one delegated grant is the
+ * application's explicit, reviewable declaration, never inferred from a vendor label.
+ */
+export declare const ProviderSharedConnectionsSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    /**
+     * The member refs, besides the base. Every runtime scope that declares a member must declare the base too,
+     * because the base's module is what connects, refreshes and revokes the grant.
+     */
+    refs: z.ZodArray<z.ZodString>;
+    /**
+     * `true` makes the connection use the base's SIGN-IN registration (the `OAUTH2_SSO` client) instead of its
+     * own connected-account client. `false`, the default, keeps sign-in and data access on two registrations.
+     *
+     * Why separate is the default, stated where the choice is made:
+     * - one client secret then authorizes both sign-in and data access, so its compromise exposes both;
+     * - a tenant administrator's admin consent covers every permission statically configured on a registration,
+     *   so data permissions listed statically on a sign-in registration would be granted at sign-in;
+     * - a vendor that reviews sensitive scopes (Google's app verification) reviews the sign-in client too once
+     *   it carries them.
+     *
+     * With `true`, data permissions must be requested dynamically at connect time and never listed statically
+     * on the sign-in registration.
+     */
+    sharedWithSignIn: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>>;
+export type ProviderSharedConnections = z.infer<typeof ProviderSharedConnectionsSchema>;
+/** @wildo_source:part:end saas.config.providers.shared-connections */
+/** One conflict {@link findProviderSharedConnectionConflicts} reports, located in the declaration. */
+export interface ProviderSharedConnectionConflict {
+    readonly path: (string | number)[];
+    readonly message: string;
+}
+/**
+ * Every membership conflict in a declaration — empty when the declaration is coherent.
+ *
+ * Exported (rather than living only inside the schema) so the registry can assert the same predicate over a
+ * configuration that reached it without passing through this schema, and so a test pins the messages.
+ */
+export declare function findProviderSharedConnectionConflicts(connections: Readonly<Record<string, {
+    readonly refs: readonly string[];
+}>>): ProviderSharedConnectionConflict[];
+/**
+ * The CONNECTION each ref spends: a declared member → its base, a declared base → itself, and any other ref →
+ * itself (the #1670 default, where every undeclared ref is its own connection).
+ *
+ * ONE function, used by `wildo config sync` (lock entries, refusals) and by the running registry
+ * (`resolveCredentialConnectionRef`), so the two cannot disagree about which grant a ref spends.
+ */
+export declare function resolveProviderConnectionRef(connections: Readonly<Record<string, {
+    readonly refs: readonly string[];
+}>> | undefined, providerRef: string): string;
+//# sourceMappingURL=provider-shared-connections.shared.schemas.d.ts.map

package/dist/esm/external-providers/provider-shared-connections.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-shared-connections.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-shared-connections.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qJAAqJ;AACrJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,8BAA8B;IACzC;;;OAGG;;IAEH;;;;;;;;;;;;;OAaG;;kBAEH,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B;IAlC1C;;;OAGG;;IAEH;;;;;;;;;;;;;OAaG;;mBAqBD,CAAC;AACL,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,sEAAsE;AAEtE,sGAAsG;AACtG,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,GAC1E,gCAAgC,EAAE,CAwCpC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EACvF,WAAW,EAAE,MAAM,GAClB,MAAM,CAOR"}

package/dist/esm/external-providers/provider-shared-connections.shared.schemas.js

@@ -0,0 +1,137 @@
+import { z } from 'zod';
+/** @wildo_source:part:start saas.config.providers.shared-connections facet:layer:shared facet:family:provider-config facet:audience:app-developer */
+/**
+ * One declared SHARED CONNECTION (#1725): the provider refs that spend ONE vendor grant, keyed in
+ * {@link ProviderSharedConnectionsSchema} by the BASE ref that owns the connection's OAuth client.
+ *
+ * ```ts
+ * providers: {
+ *   scopes: { backend: { providers: { microsoft: {}, 'microsoft-teams': {}, 'microsoft-dataverse': {} } } },
+ *   sharedConnections: {
+ *     microsoft: { refs: ['microsoft-teams', 'microsoft-dataverse'] },
+ *   },
+ * }
+ * ```
+ *
+ * A person connects Microsoft ONCE, through any of the three refs, and every one of them spends the same
+ * stored grant. Without a declaration every ref is its own connection — which is the default and changes
+ * nothing for an application that declares none.
+ *
+ * ## The base alone owns the client
+ *
+ * The BASE ref's OAuth2 block is the connection's: its authorize and token endpoints, its client-id and
+ * client-secret slots, its connection parameters (`{tenantId}`), and the AUDIENCES its tokens may be sent to.
+ * A member ref brings operations — never a client. A member's own OAuth2 block and client slots become inert
+ * while it is a member: they are reported by `wildo config sync`, never required.
+ *
+ * ## Membership is this LIST, never the vendor string
+ *
+ * `vendor` on a provider's metadata is display and compliance grouping only. Two refs that both say
+ * `vendor: 'microsoft'` are two connections until they are listed here, because spending one grant from a
+ * second package is a trust decision the application makes explicitly, never one inferred from a label.
+ */
+export const ProviderSharedConnectionSchema = z.strictObject({
+    /**
+     * The member refs, besides the base. Every runtime scope that declares a member must declare the base too,
+     * because the base's module is what connects, refreshes and revokes the grant.
+     */
+    refs: z.array(z.string().min(1)).min(1),
+    /**
+     * `true` makes the connection use the base's SIGN-IN registration (the `OAUTH2_SSO` client) instead of its
+     * own connected-account client. `false`, the default, keeps sign-in and data access on two registrations.
+     *
+     * Why separate is the default, stated where the choice is made:
+     * - one client secret then authorizes both sign-in and data access, so its compromise exposes both;
+     * - a tenant administrator's admin consent covers every permission statically configured on a registration,
+     *   so data permissions listed statically on a sign-in registration would be granted at sign-in;
+     * - a vendor that reviews sensitive scopes (Google's app verification) reviews the sign-in client too once
+     *   it carries them.
+     *
+     * With `true`, data permissions must be requested dynamically at connect time and never listed statically
+     * on the sign-in registration.
+     */
+    sharedWithSignIn: z.boolean().optional(),
+});
+/**
+ * `providers.sharedConnections` — `baseRef` → the connection that ref owns (#1725). See
+ * {@link ProviderSharedConnectionSchema}.
+ *
+ * Refused at parse time, naming both sides: a ref listed in two connections (two bases would each own its
+ * client, so which grant it spends would depend on lookup order), a base listed as a member of its own or
+ * another connection, and a ref listed twice in one connection.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — which refs may spend one delegated grant is the
+ * application's explicit, reviewable declaration, never inferred from a vendor label.
+ */
+export const ProviderSharedConnectionsSchema = z.record(z.string().min(1), ProviderSharedConnectionSchema)
+    .superRefine((connections, ctx) => {
+    for (const problem of findProviderSharedConnectionConflicts(connections)) {
+        ctx.addIssue({ code: 'custom', path: problem.path, message: problem.message });
+    }
+});
+/**
+ * Every membership conflict in a declaration — empty when the declaration is coherent.
+ *
+ * Exported (rather than living only inside the schema) so the registry can assert the same predicate over a
+ * configuration that reached it without passing through this schema, and so a test pins the messages.
+ */
+export function findProviderSharedConnectionConflicts(connections) {
+    const problems = [];
+    const bases = new Set(Object.keys(connections));
+    const memberOf = new Map();
+    for (const [baseRef, connection] of Object.entries(connections).sort(([left], [right]) => left.localeCompare(right))) {
+        const seen = new Set();
+        for (const [index, ref] of connection.refs.entries()) {
+            if (seen.has(ref)) {
+                problems.push({ path: [baseRef, 'refs', index], message: `"${ref}" is listed twice in the shared connection "${baseRef}".` });
+                continue;
+            }
+            seen.add(ref);
+            if (ref === baseRef) {
+                problems.push({
+                    path: [baseRef, 'refs', index],
+                    message: `"${baseRef}" lists itself as a member. The base ref is the connection's owner already; list only the other refs.`,
+                });
+                continue;
+            }
+            if (bases.has(ref)) {
+                problems.push({
+                    path: [baseRef, 'refs', index],
+                    message: `"${ref}" is a member of the shared connection "${baseRef}" and also the base of its own shared connection. `
+                        + 'A ref spends exactly one grant; declare one connection that lists both.',
+                });
+                continue;
+            }
+            const earlier = memberOf.get(ref);
+            if (earlier !== undefined) {
+                problems.push({
+                    path: [baseRef, 'refs', index],
+                    message: `"${ref}" is listed in two shared connections, "${earlier}" and "${baseRef}". A ref spends exactly one grant; `
+                        + 'remove it from one of them.',
+                });
+                continue;
+            }
+            memberOf.set(ref, baseRef);
+        }
+    }
+    return problems;
+}
+/**
+ * The CONNECTION each ref spends: a declared member → its base, a declared base → itself, and any other ref →
+ * itself (the #1670 default, where every undeclared ref is its own connection).
+ *
+ * ONE function, used by `wildo config sync` (lock entries, refusals) and by the running registry
+ * (`resolveCredentialConnectionRef`), so the two cannot disagree about which grant a ref spends.
+ */
+export function resolveProviderConnectionRef(connections, providerRef) {
+    if (connections === undefined)
+        return providerRef;
+    if (Object.hasOwn(connections, providerRef))
+        return providerRef;
+    for (const [baseRef, connection] of Object.entries(connections)) {
+        if (connection.refs.includes(providerRef))
+            return baseRef;
+    }
+    return providerRef;
+}
+//# sourceMappingURL=provider-shared-connections.shared.schemas.js.map