@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/external-providers/provider-package-allow-list.shared.schemas.js

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+/**
+ * An npm package name, scoped or not, as npm itself accepts one: lower-case, no leading dot or underscore, and never
+ * a `.` or `..` segment. Checked here because discovery splices the name into a `node_modules` path and EXECUTES the
+ * package's companion entry, so a name that walks out of `node_modules` must be refused where it is authored.
+ */
+const NPM_PACKAGE_NAME_PATTERN = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+/** @wildo_source:part:start saas.config.providers.packages facet:layer:shared facet:family:provider-config facet:audience:app-developer */
+/**
+ * Provider packages this application admits to discovery from OUTSIDE the names discovery walks by itself (#1676).
+ *
+ * ```ts
+ * providers: {
+ *   scopes: { backend: { providers: { teams: { protocols: ['REST_API'] } } } },
+ *   packages: ['@acme/wildo-provider-teams'],
+ * }
+ * ```
+ *
+ * Discovery walks, on its own, only the framework's names (`@wildo-ai/provider-*`, the engine's own provider barrel,
+ * the system-of-record facet library `@wildo-ai/systems-of-record`) and packages of the application's own scope named
+ * `<application-scope>/provider-*` — which is how a registry provider an install copied into the application is
+ * found. Any other
+ * package — from anybody else's scope, or an own-scope one not named `provider-*` — is never executed by the walk
+ * unless it is named here: a dependency cannot contribute providers merely by being installed.
+ *
+ * ## Admission is not activation
+ *
+ * A listed package is WALKED: its provider contributions, its browser facets and its provider augmentations are
+ * discovered exactly as a framework package's are. Nothing it ships is used until the application uses it in the
+ * ordinary way — a provider through `scopes`, an augmentation through `augmentations`. Its system-of-record facet
+ * module goes one step further: it is not even recorded until an instance names the package in `facetAugmentations`
+ * (#2013); only the framework's own facet library is recorded without being asked for.
+ *
+ * ## What `wildo config sync` refuses
+ *
+ * A listed package that no runtime owner (nor the application root) depends on, one that is declared but not
+ * installed, one whose companion entry cannot be read, one that ships nothing — no provider contribution, no
+ * augmentation and no `./systems-of-record` module — one discovery already walks by its name, and one of the
+ * application's own runtime packages. Each refusal names the package. Every admitted package is
+ * printed by `config sync` and recorded in the provider lock with its installed version, so a reviewer sees
+ * third-party code entering the application.
+ *
+ * Absent means none.
+ */
+export const ProviderPackageAllowListSchema = z
+    .array(z.string().regex(NPM_PACKAGE_NAME_PATTERN, 'A provider package is named by its npm package name.'))
+    .min(1)
+    .superRefine((packageNames, ctx) => {
+    const seen = new Set();
+    for (const [index, packageName] of packageNames.entries()) {
+        if (seen.has(packageName))
+            ctx.addIssue({ code: 'custom', path: [index], message: `"${packageName}" is listed twice.` });
+        seen.add(packageName);
+    }
+});
+/** @wildo_source:part:end saas.config.providers.packages */
+//# sourceMappingURL=provider-package-allow-list.shared.schemas.js.map

package/dist/esm/external-providers/provider-package-allow-list.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-package-allow-list.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-package-allow-list.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,0DAA0D,CAAC;AAE5F,2IAA2I;AAC3I;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC;KAC5C,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,EAAE,sDAAsD,CAAC,CAAC;KACzG,GAAG,CAAC,CAAC,CAAC;KACN,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,WAAW,oBAAoB,EAAE,CAAC,CAAC;QACzH,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,4DAA4D","sourcesContent":["import { z } from 'zod';\n\n/**\n * An npm package name, scoped or not, as npm itself accepts one: lower-case, no leading dot or underscore, and never\n * a `.` or `..` segment. Checked here because discovery splices the name into a `node_modules` path and EXECUTES the\n * package's companion entry, so a name that walks out of `node_modules` must be refused where it is authored.\n */\nconst NPM_PACKAGE_NAME_PATTERN = /^(?:@[a-z0-9-~][a-z0-9-._~]*\\/)?[a-z0-9-~][a-z0-9-._~]*$/;\n\n/** @wildo_source:part:start saas.config.providers.packages facet:layer:shared facet:family:provider-config facet:audience:app-developer */\n/**\n * Provider packages this application admits to discovery from OUTSIDE the names discovery walks by itself (#1676).\n *\n * ```ts\n * providers: {\n *   scopes: { backend: { providers: { teams: { protocols: ['REST_API'] } } } },\n *   packages: ['@acme/wildo-provider-teams'],\n * }\n * ```\n *\n * Discovery walks, on its own, only the framework's names (`@wildo-ai/provider-*`, the engine's own provider barrel,\n * the system-of-record facet library `@wildo-ai/systems-of-record`) and packages of the application's own scope named\n * `<application-scope>/provider-*` — which is how a registry provider an install copied into the application is\n * found. Any other\n * package — from anybody else's scope, or an own-scope one not named `provider-*` — is never executed by the walk\n * unless it is named here: a dependency cannot contribute providers merely by being installed.\n *\n * ## Admission is not activation\n *\n * A listed package is WALKED: its provider contributions, its browser facets and its provider augmentations are\n * discovered exactly as a framework package's are. Nothing it ships is used until the application uses it in the\n * ordinary way — a provider through `scopes`, an augmentation through `augmentations`. Its system-of-record facet\n * module goes one step further: it is not even recorded until an instance names the package in `facetAugmentations`\n * (#2013); only the framework's own facet library is recorded without being asked for.\n *\n * ## What `wildo config sync` refuses\n *\n * A listed package that no runtime owner (nor the application root) depends on, one that is declared but not\n * installed, one whose companion entry cannot be read, one that ships nothing — no provider contribution, no\n * augmentation and no `./systems-of-record` module — one discovery already walks by its name, and one of the\n * application's own runtime packages. Each refusal names the package. Every admitted package is\n * printed by `config sync` and recorded in the provider lock with its installed version, so a reviewer sees\n * third-party code entering the application.\n *\n * Absent means none.\n */\nexport const ProviderPackageAllowListSchema = z\n  .array(z.string().regex(NPM_PACKAGE_NAME_PATTERN, 'A provider package is named by its npm package name.'))\n  .min(1)\n  .superRefine((packageNames, ctx) => {\n    const seen = new Set<string>();\n    for (const [index, packageName] of packageNames.entries()) {\n      if (seen.has(packageName)) ctx.addIssue({ code: 'custom', path: [index], message: `\"${packageName}\" is listed twice.` });\n      seen.add(packageName);\n    }\n  });\nexport type ProviderPackageAllowList = z.infer<typeof ProviderPackageAllowListSchema>;\n/** @wildo_source:part:end saas.config.providers.packages */\n"]}

package/dist/esm/external-providers/provider-protocol.shared.schemas.d.ts

@@ -57,6 +57,12 @@ export declare const BUILTIN_PROVIDER_PROTOCOL: {
      */
     readonly DOCUMENT_EXTRACTION_PROVIDER: "DOCUMENT_EXTRACTION_PROVIDER";
     readonly EMAIL_PROVIDER: "EMAIL_PROVIDER";
+    /**
+     * Receiving email (#1630): the provider hosts a receiving domain, announces each message through
+     * its `WEBHOOK_ORIGINATOR` endpoint and serves the message on request. Fills
+     * `EngineCapability.EMAIL_INBOUND`, selected independently of the sending provider.
+     */
+    readonly EMAIL_INBOUND_PROVIDER: "EMAIL_INBOUND_PROVIDER";
     readonly SSO_OAUTH2: "SSO_OAUTH2";
     readonly BILLING_PROVIDER: "BILLING_PROVIDER";
     readonly SMS_PROVIDER: "SMS_PROVIDER";

package/dist/esm/external-providers/provider-protocol.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-protocol.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB;;;;;IAKpC;;;OAGG;;IAEH;;;;;;OAMG;;IAEH;;;;OAIG;;;;;;;CAOK,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}
+{"version":3,"file":"provider-protocol.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB;;;;;IAKpC;;;OAGG;;IAEH;;;;;;OAMG;;IAEH;;;;OAIG;;;IAGH;;;;OAIG;;;;;;CAMK,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}

package/dist/esm/external-providers/provider-protocol.shared.schemas.js

@@ -57,6 +57,12 @@ export const BUILTIN_PROVIDER_PROTOCOL = {
      */
     DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',
     EMAIL_PROVIDER: 'EMAIL_PROVIDER',
+    /**
+     * Receiving email (#1630): the provider hosts a receiving domain, announces each message through
+     * its `WEBHOOK_ORIGINATOR` endpoint and serves the message on request. Fills
+     * `EngineCapability.EMAIL_INBOUND`, selected independently of the sending provider.
+     */
+    EMAIL_INBOUND_PROVIDER: 'EMAIL_INBOUND_PROVIDER',
     SSO_OAUTH2: 'SSO_OAUTH2',
     BILLING_PROVIDER: 'BILLING_PROVIDER',
     SMS_PROVIDER: 'SMS_PROVIDER',

package/dist/esm/external-providers/provider-protocol.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-protocol.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C;;;OAGG;IACH,cAAc,EAAE,gBAAgB;IAChC;;;;;;OAMG;IACH,mBAAmB,EAAE,qBAAqB;IAC1C;;;;OAIG;IACH,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,YAAY;IACxB,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC","sourcesContent":["/**\n * Closed built-in provider protocol vocabulary used by app authoring and\n * runtime-provider declarations.\n *\n * This is intentionally a pure `as const` object + union type so browser-bound\n * packages can consume it through `@wildo-ai/saas-models/public-runtime`\n * without pulling decorators or broader config-authoring seams. Do NOT add an\n * import here — not even an `import type` of the engine enum this list mirrors.\n *\n * ## Relationship to `ExternalProvider_ExchangeProtocol_Kind`\n *\n * This list re-states a population the engine owns: every member of\n * `ExternalProvider_ExchangeProtocol_Kind`\n * (`@wildo-ai/external-connectors-models`) that an application may legally\n * WRITE in `wildo.saas.config.ts > providers.scopes.<scope>.providers.<ref>`.\n * Two hand-maintained enumerations of one population is the shape that drifts,\n * and this one did: `IMAGE_PROVIDER` and `EMBEDDINGS_PROVIDER` shipped as live\n * engine protocols — a provider module declares them, discovery reports them,\n * the backend registry resolves them — while this list had no legal value for\n * either, so no application could declare what those transports speak.\n *\n * The keys are therefore checked against the engine enum by\n * `__tests__/provider-protocol-vocabulary.drift.test.ts`, which also owns the\n * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and\n * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and\n * for the exact condition under which they are admitted.\n *\n * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,\n * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,\n * declared by no provider module, resolvable by no runtime arm. An application that still\n * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts\n * ONLY these keys (the engine's snake_case wire values were also accepted before, a second\n * spelling nothing else understood).\n */\nexport const BUILTIN_PROVIDER_PROTOCOL = {\n  REST_API: 'REST_API',\n  WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',\n  LLM_PROVIDER: 'LLM_PROVIDER',\n  AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',\n  /**\n   * Text-to-image generation (wired: gpt-image, via the OpenAI provider's\n   * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.\n   */\n  IMAGE_PROVIDER: 'IMAGE_PROVIDER',\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the\n   * RAG derived-data tier — corpus embedding in the `rag:embedding-drain`\n   * worker, query-time embedding in retrieval. Its own protocol rather than an\n   * `LLM_PROVIDER` operation so a provider can be selected for embeddings\n   * independently of chat.\n   */\n  EMBEDDINGS_PROVIDER: 'EMBEDDINGS_PROVIDER',\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves file text extraction and\n   * the `.ragSource()` corpus built on it, and fills `EngineCapability.AI_DOCUMENT_EXTRACTION` so\n   * an OCR provider is selected independently of chat and embeddings.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',\n  EMAIL_PROVIDER: 'EMAIL_PROVIDER',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  BILLING_PROVIDER: 'BILLING_PROVIDER',\n  SMS_PROVIDER: 'SMS_PROVIDER',\n  FRONTEND_SDK: 'FRONTEND_SDK',\n} as const;\n\nexport type BuiltinProviderProtocol =\n  (typeof BUILTIN_PROVIDER_PROTOCOL)[keyof typeof BUILTIN_PROVIDER_PROTOCOL];\n\nexport type ProviderProtocol = BuiltinProviderProtocol;\n"]}
+{"version":3,"file":"provider-protocol.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C;;;OAGG;IACH,cAAc,EAAE,gBAAgB;IAChC;;;;;;OAMG;IACH,mBAAmB,EAAE,qBAAqB;IAC1C;;;;OAIG;IACH,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC;;;;OAIG;IACH,sBAAsB,EAAE,wBAAwB;IAChD,UAAU,EAAE,YAAY;IACxB,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC","sourcesContent":["/**\n * Closed built-in provider protocol vocabulary used by app authoring and\n * runtime-provider declarations.\n *\n * This is intentionally a pure `as const` object + union type so browser-bound\n * packages can consume it through `@wildo-ai/saas-models/public-runtime`\n * without pulling decorators or broader config-authoring seams. Do NOT add an\n * import here — not even an `import type` of the engine enum this list mirrors.\n *\n * ## Relationship to `ExternalProvider_ExchangeProtocol_Kind`\n *\n * This list re-states a population the engine owns: every member of\n * `ExternalProvider_ExchangeProtocol_Kind`\n * (`@wildo-ai/external-connectors-models`) that an application may legally\n * WRITE in `wildo.saas.config.ts > providers.scopes.<scope>.providers.<ref>`.\n * Two hand-maintained enumerations of one population is the shape that drifts,\n * and this one did: `IMAGE_PROVIDER` and `EMBEDDINGS_PROVIDER` shipped as live\n * engine protocols — a provider module declares them, discovery reports them,\n * the backend registry resolves them — while this list had no legal value for\n * either, so no application could declare what those transports speak.\n *\n * The keys are therefore checked against the engine enum by\n * `__tests__/provider-protocol-vocabulary.drift.test.ts`, which also owns the\n * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and\n * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and\n * for the exact condition under which they are admitted.\n *\n * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,\n * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,\n * declared by no provider module, resolvable by no runtime arm. An application that still\n * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts\n * ONLY these keys (the engine's snake_case wire values were also accepted before, a second\n * spelling nothing else understood).\n */\nexport const BUILTIN_PROVIDER_PROTOCOL = {\n  REST_API: 'REST_API',\n  WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',\n  LLM_PROVIDER: 'LLM_PROVIDER',\n  AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',\n  /**\n   * Text-to-image generation (wired: gpt-image, via the OpenAI provider's\n   * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.\n   */\n  IMAGE_PROVIDER: 'IMAGE_PROVIDER',\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the\n   * RAG derived-data tier — corpus embedding in the `rag:embedding-drain`\n   * worker, query-time embedding in retrieval. Its own protocol rather than an\n   * `LLM_PROVIDER` operation so a provider can be selected for embeddings\n   * independently of chat.\n   */\n  EMBEDDINGS_PROVIDER: 'EMBEDDINGS_PROVIDER',\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves file text extraction and\n   * the `.ragSource()` corpus built on it, and fills `EngineCapability.AI_DOCUMENT_EXTRACTION` so\n   * an OCR provider is selected independently of chat and embeddings.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',\n  EMAIL_PROVIDER: 'EMAIL_PROVIDER',\n  /**\n   * Receiving email (#1630): the provider hosts a receiving domain, announces each message through\n   * its `WEBHOOK_ORIGINATOR` endpoint and serves the message on request. Fills\n   * `EngineCapability.EMAIL_INBOUND`, selected independently of the sending provider.\n   */\n  EMAIL_INBOUND_PROVIDER: 'EMAIL_INBOUND_PROVIDER',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  BILLING_PROVIDER: 'BILLING_PROVIDER',\n  SMS_PROVIDER: 'SMS_PROVIDER',\n  FRONTEND_SDK: 'FRONTEND_SDK',\n} as const;\n\nexport type BuiltinProviderProtocol =\n  (typeof BUILTIN_PROVIDER_PROTOCOL)[keyof typeof BUILTIN_PROVIDER_PROTOCOL];\n\nexport type ProviderProtocol = BuiltinProviderProtocol;\n"]}

package/dist/esm/external-providers/provider-scope-reauthorization.shared.schemas.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The re-authorization OFFER a provider operation refused for a missing scope carries, and why a scope may not be
+ * requestable on a connection (#1671) — shared, because the backend composes it and a frontend component acts on it
+ * (the browser door answers it in `409 PROVIDER_OPERATION_SCOPE_NOT_GRANTED`).
+ *
+ * How the ceiling behind it is computed is the backend's (`provider-connection-scope-ceiling.backend.ts`); this is the
+ * vocabulary both sides read.
+ */
+/** @wildo_source:part:start saas.models.providers.scope-reauthorization facet:layer:shared facet:family:provider facet:audience:app-developer */
+/** Why a scope cannot be requested on a connection. */
+export declare enum ProviderConnectionScopeRefusal {
+    /** No declared ref and no opted-in augmentation of the connection declares it. An author declares it first. */
+    NOT_DECLARED_BY_CONNECTION = "NOT_DECLARED_BY_CONNECTION",
+    /** It names a resource none of the connection's declared audiences covers. */
+    OUTSIDE_CONNECTION_AUDIENCES = "OUTSIDE_CONNECTION_AUDIENCES",
+    /**
+     * A member or augmentation scope carrying a `{placeholder}`: it can be resolved only against its own declaring ref's
+     * allowances, which are inert inside a connection, so it is never a value a request could carry.
+     */
+    CARRIES_PLACEHOLDER = "CARRIES_PLACEHOLDER",
+    /** Only an administrator of the account can grant it; a person is never sent to consent to it. */
+    ADMINISTRATOR_CONSENT_REQUIRED = "ADMINISTRATOR_CONSENT_REQUIRED",
+    /**
+     * It names a declared audience OTHER than the primary one (a Dataverse environment, Business Central, Power BI on a
+     * Graph-primary Microsoft connection). A vendor that mints one resource per request answers an authorization with a
+     * token for the resource the request names, and the stored grant holds the PRIMARY audience's token — so growing the
+     * grant with another resource's scope would put that resource's token where every primary call reads it. Such a
+     * permission is consented statically (the operator lists it on the registration, and the person reconnects); the
+     * audience's token is then minted from the refresh token as before.
+     */
+    NOT_PRIMARY_AUDIENCE = "NOT_PRIMARY_AUDIENCE"
+}
+/**
+ * What a refused call hands back so the person can grow the grant (#1671) — carried by `ProviderOperationScopeError`
+ * and the browser door's `409 PROVIDER_OPERATION_SCOPE_NOT_GRANTED`.
+ *
+ * `requestableScopes` is exactly what `POST /connections/:providerRef/start` accepts as `addScopes`; the other two
+ * lists are what no re-authorization can obtain, each with its own remedy.
+ */
+export interface ProviderScopeReauthorizationOffer {
+    /** The connection whose grant grows. */
+    readonly connectionRef: string;
+    /** The ref to start the re-authorization through — the one the refused call used. */
+    readonly providerRef: string;
+    /** The operation that needs them, echoed as `forOperationId` so the grant's audit row names its cause. */
+    readonly operationId: string;
+    /** The missing scopes a person may grant now. Empty when none can be. */
+    readonly requestableScopes: readonly string[];
+    /** Missing scopes only an administrator of the account can grant. */
+    readonly administratorConsentScopes: readonly string[];
+    /** Missing scopes no re-authorization of this connection can ask for, with why. */
+    readonly unrequestableScopes: readonly {
+        readonly scope: string;
+        readonly refusal: ProviderConnectionScopeRefusal;
+    }[];
+}
+/** @wildo_source:part:end saas.models.providers.scope-reauthorization */
+//# sourceMappingURL=provider-scope-reauthorization.shared.schemas.d.ts.map

package/dist/esm/external-providers/provider-scope-reauthorization.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-scope-reauthorization.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-scope-reauthorization.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iJAAiJ;AACjJ,uDAAuD;AACvD,oBAAY,8BAA8B;IACxC,+GAA+G;IAC/G,0BAA0B,+BAA+B;IACzD,8EAA8E;IAC9E,4BAA4B,iCAAiC;IAC7D;;;OAGG;IACH,mBAAmB,wBAAwB;IAC3C,kGAAkG;IAClG,8BAA8B,mCAAmC;IACjE;;;;;;;OAOG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iCAAiC;IAChD,wCAAwC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0GAA0G;IAC1G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,qEAAqE;IACrE,QAAQ,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,mFAAmF;IACnF,QAAQ,CAAC,mBAAmB,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAA;KAAE,EAAE,CAAC;CACvH;AACD,yEAAyE"}

package/dist/esm/external-providers/provider-scope-reauthorization.shared.schemas.js

@@ -0,0 +1,35 @@
+/**
+ * The re-authorization OFFER a provider operation refused for a missing scope carries, and why a scope may not be
+ * requestable on a connection (#1671) — shared, because the backend composes it and a frontend component acts on it
+ * (the browser door answers it in `409 PROVIDER_OPERATION_SCOPE_NOT_GRANTED`).
+ *
+ * How the ceiling behind it is computed is the backend's (`provider-connection-scope-ceiling.backend.ts`); this is the
+ * vocabulary both sides read.
+ */
+/** @wildo_source:part:start saas.models.providers.scope-reauthorization facet:layer:shared facet:family:provider facet:audience:app-developer */
+/** Why a scope cannot be requested on a connection. */
+export var ProviderConnectionScopeRefusal;
+(function (ProviderConnectionScopeRefusal) {
+    /** No declared ref and no opted-in augmentation of the connection declares it. An author declares it first. */
+    ProviderConnectionScopeRefusal["NOT_DECLARED_BY_CONNECTION"] = "NOT_DECLARED_BY_CONNECTION";
+    /** It names a resource none of the connection's declared audiences covers. */
+    ProviderConnectionScopeRefusal["OUTSIDE_CONNECTION_AUDIENCES"] = "OUTSIDE_CONNECTION_AUDIENCES";
+    /**
+     * A member or augmentation scope carrying a `{placeholder}`: it can be resolved only against its own declaring ref's
+     * allowances, which are inert inside a connection, so it is never a value a request could carry.
+     */
+    ProviderConnectionScopeRefusal["CARRIES_PLACEHOLDER"] = "CARRIES_PLACEHOLDER";
+    /** Only an administrator of the account can grant it; a person is never sent to consent to it. */
+    ProviderConnectionScopeRefusal["ADMINISTRATOR_CONSENT_REQUIRED"] = "ADMINISTRATOR_CONSENT_REQUIRED";
+    /**
+     * It names a declared audience OTHER than the primary one (a Dataverse environment, Business Central, Power BI on a
+     * Graph-primary Microsoft connection). A vendor that mints one resource per request answers an authorization with a
+     * token for the resource the request names, and the stored grant holds the PRIMARY audience's token — so growing the
+     * grant with another resource's scope would put that resource's token where every primary call reads it. Such a
+     * permission is consented statically (the operator lists it on the registration, and the person reconnects); the
+     * audience's token is then minted from the refresh token as before.
+     */
+    ProviderConnectionScopeRefusal["NOT_PRIMARY_AUDIENCE"] = "NOT_PRIMARY_AUDIENCE";
+})(ProviderConnectionScopeRefusal || (ProviderConnectionScopeRefusal = {}));
+/** @wildo_source:part:end saas.models.providers.scope-reauthorization */
+//# sourceMappingURL=provider-scope-reauthorization.shared.schemas.js.map

package/dist/esm/external-providers/provider-scope-reauthorization.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-scope-reauthorization.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-scope-reauthorization.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,iJAAiJ;AACjJ,uDAAuD;AACvD,MAAM,CAAN,IAAY,8BAqBX;AArBD,WAAY,8BAA8B;IACxC,+GAA+G;IAC/G,2FAAyD,CAAA;IACzD,8EAA8E;IAC9E,+FAA6D,CAAA;IAC7D;;;OAGG;IACH,6EAA2C,CAAA;IAC3C,kGAAkG;IAClG,mGAAiE,CAAA;IACjE;;;;;;;OAOG;IACH,+EAA6C,CAAA;AAC/C,CAAC,EArBW,8BAA8B,KAA9B,8BAA8B,QAqBzC;AAuBD,yEAAyE","sourcesContent":["/**\n * The re-authorization OFFER a provider operation refused for a missing scope carries, and why a scope may not be\n * requestable on a connection (#1671) — shared, because the backend composes it and a frontend component acts on it\n * (the browser door answers it in `409 PROVIDER_OPERATION_SCOPE_NOT_GRANTED`).\n *\n * How the ceiling behind it is computed is the backend's (`provider-connection-scope-ceiling.backend.ts`); this is the\n * vocabulary both sides read.\n */\n\n/** @wildo_source:part:start saas.models.providers.scope-reauthorization facet:layer:shared facet:family:provider facet:audience:app-developer */\n/** Why a scope cannot be requested on a connection. */\nexport enum ProviderConnectionScopeRefusal {\n  /** No declared ref and no opted-in augmentation of the connection declares it. An author declares it first. */\n  NOT_DECLARED_BY_CONNECTION = 'NOT_DECLARED_BY_CONNECTION',\n  /** It names a resource none of the connection's declared audiences covers. */\n  OUTSIDE_CONNECTION_AUDIENCES = 'OUTSIDE_CONNECTION_AUDIENCES',\n  /**\n   * A member or augmentation scope carrying a `{placeholder}`: it can be resolved only against its own declaring ref's\n   * allowances, which are inert inside a connection, so it is never a value a request could carry.\n   */\n  CARRIES_PLACEHOLDER = 'CARRIES_PLACEHOLDER',\n  /** Only an administrator of the account can grant it; a person is never sent to consent to it. */\n  ADMINISTRATOR_CONSENT_REQUIRED = 'ADMINISTRATOR_CONSENT_REQUIRED',\n  /**\n   * It names a declared audience OTHER than the primary one (a Dataverse environment, Business Central, Power BI on a\n   * Graph-primary Microsoft connection). A vendor that mints one resource per request answers an authorization with a\n   * token for the resource the request names, and the stored grant holds the PRIMARY audience's token — so growing the\n   * grant with another resource's scope would put that resource's token where every primary call reads it. Such a\n   * permission is consented statically (the operator lists it on the registration, and the person reconnects); the\n   * audience's token is then minted from the refresh token as before.\n   */\n  NOT_PRIMARY_AUDIENCE = 'NOT_PRIMARY_AUDIENCE',\n}\n\n/**\n * What a refused call hands back so the person can grow the grant (#1671) — carried by `ProviderOperationScopeError`\n * and the browser door's `409 PROVIDER_OPERATION_SCOPE_NOT_GRANTED`.\n *\n * `requestableScopes` is exactly what `POST /connections/:providerRef/start` accepts as `addScopes`; the other two\n * lists are what no re-authorization can obtain, each with its own remedy.\n */\nexport interface ProviderScopeReauthorizationOffer {\n  /** The connection whose grant grows. */\n  readonly connectionRef: string;\n  /** The ref to start the re-authorization through — the one the refused call used. */\n  readonly providerRef: string;\n  /** The operation that needs them, echoed as `forOperationId` so the grant's audit row names its cause. */\n  readonly operationId: string;\n  /** The missing scopes a person may grant now. Empty when none can be. */\n  readonly requestableScopes: readonly string[];\n  /** Missing scopes only an administrator of the account can grant. */\n  readonly administratorConsentScopes: readonly string[];\n  /** Missing scopes no re-authorization of this connection can ask for, with why. */\n  readonly unrequestableScopes: readonly { readonly scope: string; readonly refusal: ProviderConnectionScopeRefusal }[];\n}\n/** @wildo_source:part:end saas.models.providers.scope-reauthorization */\n"]}

package/dist/esm/external-providers/provider-shared-connections.shared.schemas.d.ts

@@ -0,0 +1,115 @@
+import { z } from 'zod';
+/** @wildo_source:part:start saas.config.providers.shared-connections facet:layer:shared facet:family:provider-config facet:audience:app-developer */
+/**
+ * One declared SHARED CONNECTION (#1725): the provider refs that spend ONE vendor grant, keyed in
+ * {@link ProviderSharedConnectionsSchema} by the BASE ref that owns the connection's OAuth client.
+ *
+ * ```ts
+ * providers: {
+ *   scopes: { backend: { providers: { microsoft: {}, 'microsoft-teams': {}, 'microsoft-dataverse': {} } } },
+ *   sharedConnections: {
+ *     microsoft: { refs: ['microsoft-teams', 'microsoft-dataverse'] },
+ *   },
+ * }
+ * ```
+ *
+ * A person connects Microsoft ONCE, through any of the three refs, and every one of them spends the same
+ * stored grant. Without a declaration every ref is its own connection — which is the default and changes
+ * nothing for an application that declares none.
+ *
+ * ## The base alone owns the client
+ *
+ * The BASE ref's OAuth2 block is the connection's: its authorize and token endpoints, its client-id and
+ * client-secret slots, its connection parameters (`{tenantId}`), and the AUDIENCES its tokens may be sent to.
+ * A member ref brings operations — never a client. A member's own OAuth2 block and client slots become inert
+ * while it is a member: they are reported by `wildo config sync`, never required.
+ *
+ * ## Membership is this LIST, never the vendor string
+ *
+ * `vendor` on a provider's metadata is display and compliance grouping only. Two refs that both say
+ * `vendor: 'microsoft'` are two connections until they are listed here, because spending one grant from a
+ * second package is a trust decision the application makes explicitly, never one inferred from a label.
+ */
+export declare const ProviderSharedConnectionSchema: z.ZodObject<{
+    /**
+     * The member refs, besides the base. Every runtime scope that declares a member must declare the base too,
+     * because the base's module is what connects, refreshes and revokes the grant.
+     */
+    refs: z.ZodArray<z.ZodString>;
+    /**
+     * `true` makes the connection use the base's SIGN-IN registration (the `OAUTH2_SSO` client) instead of its
+     * own connected-account client. `false`, the default, keeps sign-in and data access on two registrations.
+     *
+     * Why separate is the default, stated where the choice is made:
+     * - one client secret then authorizes both sign-in and data access, so its compromise exposes both;
+     * - a tenant administrator's admin consent covers every permission statically configured on a registration,
+     *   so data permissions listed statically on a sign-in registration would be granted at sign-in;
+     * - a vendor that reviews sensitive scopes (Google's app verification) reviews the sign-in client too once
+     *   it carries them.
+     *
+     * With `true`, data permissions must be requested dynamically at connect time and never listed statically
+     * on the sign-in registration.
+     */
+    sharedWithSignIn: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type ProviderSharedConnection = z.infer<typeof ProviderSharedConnectionSchema>;
+/**
+ * `providers.sharedConnections` — `baseRef` → the connection that ref owns (#1725). See
+ * {@link ProviderSharedConnectionSchema}.
+ *
+ * Refused at parse time, naming both sides: a ref listed in two connections (two bases would each own its
+ * client, so which grant it spends would depend on lookup order), a base listed as a member of its own or
+ * another connection, and a ref listed twice in one connection.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — which refs may spend one delegated grant is the
+ * application's explicit, reviewable declaration, never inferred from a vendor label.
+ */
+export declare const ProviderSharedConnectionsSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    /**
+     * The member refs, besides the base. Every runtime scope that declares a member must declare the base too,
+     * because the base's module is what connects, refreshes and revokes the grant.
+     */
+    refs: z.ZodArray<z.ZodString>;
+    /**
+     * `true` makes the connection use the base's SIGN-IN registration (the `OAUTH2_SSO` client) instead of its
+     * own connected-account client. `false`, the default, keeps sign-in and data access on two registrations.
+     *
+     * Why separate is the default, stated where the choice is made:
+     * - one client secret then authorizes both sign-in and data access, so its compromise exposes both;
+     * - a tenant administrator's admin consent covers every permission statically configured on a registration,
+     *   so data permissions listed statically on a sign-in registration would be granted at sign-in;
+     * - a vendor that reviews sensitive scopes (Google's app verification) reviews the sign-in client too once
+     *   it carries them.
+     *
+     * With `true`, data permissions must be requested dynamically at connect time and never listed statically
+     * on the sign-in registration.
+     */
+    sharedWithSignIn: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>>;
+export type ProviderSharedConnections = z.infer<typeof ProviderSharedConnectionsSchema>;
+/** @wildo_source:part:end saas.config.providers.shared-connections */
+/** One conflict {@link findProviderSharedConnectionConflicts} reports, located in the declaration. */
+export interface ProviderSharedConnectionConflict {
+    readonly path: (string | number)[];
+    readonly message: string;
+}
+/**
+ * Every membership conflict in a declaration — empty when the declaration is coherent.
+ *
+ * Exported (rather than living only inside the schema) so the registry can assert the same predicate over a
+ * configuration that reached it without passing through this schema, and so a test pins the messages.
+ */
+export declare function findProviderSharedConnectionConflicts(connections: Readonly<Record<string, {
+    readonly refs: readonly string[];
+}>>): ProviderSharedConnectionConflict[];
+/**
+ * The CONNECTION each ref spends: a declared member → its base, a declared base → itself, and any other ref →
+ * itself (the #1670 default, where every undeclared ref is its own connection).
+ *
+ * ONE function, used by `wildo config sync` (lock entries, refusals) and by the running registry
+ * (`resolveCredentialConnectionRef`), so the two cannot disagree about which grant a ref spends.
+ */
+export declare function resolveProviderConnectionRef(connections: Readonly<Record<string, {
+    readonly refs: readonly string[];
+}>> | undefined, providerRef: string): string;
+//# sourceMappingURL=provider-shared-connections.shared.schemas.d.ts.map

package/dist/esm/external-providers/provider-shared-connections.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-shared-connections.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-shared-connections.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qJAAqJ;AACrJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,8BAA8B;IACzC;;;OAGG;;IAEH;;;;;;;;;;;;;OAaG;;kBAEH,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B;IAlC1C;;;OAGG;;IAEH;;;;;;;;;;;;;OAaG;;mBAqBD,CAAC;AACL,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,sEAAsE;AAEtE,sGAAsG;AACtG,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,GAC1E,gCAAgC,EAAE,CAwCpC;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,GAAG,SAAS,EACvF,WAAW,EAAE,MAAM,GAClB,MAAM,CAOR"}

package/dist/esm/external-providers/provider-shared-connections.shared.schemas.js

@@ -0,0 +1,137 @@
+import { z } from 'zod';
+/** @wildo_source:part:start saas.config.providers.shared-connections facet:layer:shared facet:family:provider-config facet:audience:app-developer */
+/**
+ * One declared SHARED CONNECTION (#1725): the provider refs that spend ONE vendor grant, keyed in
+ * {@link ProviderSharedConnectionsSchema} by the BASE ref that owns the connection's OAuth client.
+ *
+ * ```ts
+ * providers: {
+ *   scopes: { backend: { providers: { microsoft: {}, 'microsoft-teams': {}, 'microsoft-dataverse': {} } } },
+ *   sharedConnections: {
+ *     microsoft: { refs: ['microsoft-teams', 'microsoft-dataverse'] },
+ *   },
+ * }
+ * ```
+ *
+ * A person connects Microsoft ONCE, through any of the three refs, and every one of them spends the same
+ * stored grant. Without a declaration every ref is its own connection — which is the default and changes
+ * nothing for an application that declares none.
+ *
+ * ## The base alone owns the client
+ *
+ * The BASE ref's OAuth2 block is the connection's: its authorize and token endpoints, its client-id and
+ * client-secret slots, its connection parameters (`{tenantId}`), and the AUDIENCES its tokens may be sent to.
+ * A member ref brings operations — never a client. A member's own OAuth2 block and client slots become inert
+ * while it is a member: they are reported by `wildo config sync`, never required.
+ *
+ * ## Membership is this LIST, never the vendor string
+ *
+ * `vendor` on a provider's metadata is display and compliance grouping only. Two refs that both say
+ * `vendor: 'microsoft'` are two connections until they are listed here, because spending one grant from a
+ * second package is a trust decision the application makes explicitly, never one inferred from a label.
+ */
+export const ProviderSharedConnectionSchema = z.strictObject({
+    /**
+     * The member refs, besides the base. Every runtime scope that declares a member must declare the base too,
+     * because the base's module is what connects, refreshes and revokes the grant.
+     */
+    refs: z.array(z.string().min(1)).min(1),
+    /**
+     * `true` makes the connection use the base's SIGN-IN registration (the `OAUTH2_SSO` client) instead of its
+     * own connected-account client. `false`, the default, keeps sign-in and data access on two registrations.
+     *
+     * Why separate is the default, stated where the choice is made:
+     * - one client secret then authorizes both sign-in and data access, so its compromise exposes both;
+     * - a tenant administrator's admin consent covers every permission statically configured on a registration,
+     *   so data permissions listed statically on a sign-in registration would be granted at sign-in;
+     * - a vendor that reviews sensitive scopes (Google's app verification) reviews the sign-in client too once
+     *   it carries them.
+     *
+     * With `true`, data permissions must be requested dynamically at connect time and never listed statically
+     * on the sign-in registration.
+     */
+    sharedWithSignIn: z.boolean().optional(),
+});
+/**
+ * `providers.sharedConnections` — `baseRef` → the connection that ref owns (#1725). See
+ * {@link ProviderSharedConnectionSchema}.
+ *
+ * Refused at parse time, naming both sides: a ref listed in two connections (two bases would each own its
+ * client, so which grant it spends would depend on lookup order), a base listed as a member of its own or
+ * another connection, and a ref listed twice in one connection.
+ *
+ * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — which refs may spend one delegated grant is the
+ * application's explicit, reviewable declaration, never inferred from a vendor label.
+ */
+export const ProviderSharedConnectionsSchema = z.record(z.string().min(1), ProviderSharedConnectionSchema)
+    .superRefine((connections, ctx) => {
+    for (const problem of findProviderSharedConnectionConflicts(connections)) {
+        ctx.addIssue({ code: 'custom', path: problem.path, message: problem.message });
+    }
+});
+/**
+ * Every membership conflict in a declaration — empty when the declaration is coherent.
+ *
+ * Exported (rather than living only inside the schema) so the registry can assert the same predicate over a
+ * configuration that reached it without passing through this schema, and so a test pins the messages.
+ */
+export function findProviderSharedConnectionConflicts(connections) {
+    const problems = [];
+    const bases = new Set(Object.keys(connections));
+    const memberOf = new Map();
+    for (const [baseRef, connection] of Object.entries(connections).sort(([left], [right]) => left.localeCompare(right))) {
+        const seen = new Set();
+        for (const [index, ref] of connection.refs.entries()) {
+            if (seen.has(ref)) {
+                problems.push({ path: [baseRef, 'refs', index], message: `"${ref}" is listed twice in the shared connection "${baseRef}".` });
+                continue;
+            }
+            seen.add(ref);
+            if (ref === baseRef) {
+                problems.push({
+                    path: [baseRef, 'refs', index],
+                    message: `"${baseRef}" lists itself as a member. The base ref is the connection's owner already; list only the other refs.`,
+                });
+                continue;
+            }
+            if (bases.has(ref)) {
+                problems.push({
+                    path: [baseRef, 'refs', index],
+                    message: `"${ref}" is a member of the shared connection "${baseRef}" and also the base of its own shared connection. `
+                        + 'A ref spends exactly one grant; declare one connection that lists both.',
+                });
+                continue;
+            }
+            const earlier = memberOf.get(ref);
+            if (earlier !== undefined) {
+                problems.push({
+                    path: [baseRef, 'refs', index],
+                    message: `"${ref}" is listed in two shared connections, "${earlier}" and "${baseRef}". A ref spends exactly one grant; `
+                        + 'remove it from one of them.',
+                });
+                continue;
+            }
+            memberOf.set(ref, baseRef);
+        }
+    }
+    return problems;
+}
+/**
+ * The CONNECTION each ref spends: a declared member → its base, a declared base → itself, and any other ref →
+ * itself (the #1670 default, where every undeclared ref is its own connection).
+ *
+ * ONE function, used by `wildo config sync` (lock entries, refusals) and by the running registry
+ * (`resolveCredentialConnectionRef`), so the two cannot disagree about which grant a ref spends.
+ */
+export function resolveProviderConnectionRef(connections, providerRef) {
+    if (connections === undefined)
+        return providerRef;
+    if (Object.hasOwn(connections, providerRef))
+        return providerRef;
+    for (const [baseRef, connection] of Object.entries(connections)) {
+        if (connection.refs.includes(providerRef))
+            return baseRef;
+    }
+    return providerRef;
+}
+//# sourceMappingURL=provider-shared-connections.shared.schemas.js.map

package/dist/esm/external-providers/provider-shared-connections.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-shared-connections.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-shared-connections.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qJAAqJ;AACrJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3D;;;OAGG;IACH,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC;;;;;;;;;;;;;OAaG;IACH,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,8BAA8B,CAAC;KACvG,WAAW,CAAC,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE;IAChC,KAAK,MAAM,OAAO,IAAI,qCAAqC,CAAC,WAAW,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC,CAAC,CAAC;AAUL;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAA2E;IAE3E,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACrH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,+CAA+C,OAAO,IAAI,EAAE,CAAC,CAAC;gBAC9H,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;oBAC9B,OAAO,EAAE,IAAI,OAAO,uGAAuG;iBAC5H,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;oBAC9B,OAAO,EAAE,IAAI,GAAG,2CAA2C,OAAO,oDAAoD;0BAClH,yEAAyE;iBAC9E,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;oBAC9B,OAAO,EAAE,IAAI,GAAG,2CAA2C,OAAO,UAAU,OAAO,qCAAqC;0BACpH,6BAA6B;iBAClC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAuF,EACvF,WAAmB;IAEnB,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAChE,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAChE,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,OAAO,CAAC;IAC5D,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC","sourcesContent":["import { z } from 'zod';\n\n/** @wildo_source:part:start saas.config.providers.shared-connections facet:layer:shared facet:family:provider-config facet:audience:app-developer */\n/**\n * One declared SHARED CONNECTION (#1725): the provider refs that spend ONE vendor grant, keyed in\n * {@link ProviderSharedConnectionsSchema} by the BASE ref that owns the connection's OAuth client.\n *\n * ```ts\n * providers: {\n *   scopes: { backend: { providers: { microsoft: {}, 'microsoft-teams': {}, 'microsoft-dataverse': {} } } },\n *   sharedConnections: {\n *     microsoft: { refs: ['microsoft-teams', 'microsoft-dataverse'] },\n *   },\n * }\n * ```\n *\n * A person connects Microsoft ONCE, through any of the three refs, and every one of them spends the same\n * stored grant. Without a declaration every ref is its own connection — which is the default and changes\n * nothing for an application that declares none.\n *\n * ## The base alone owns the client\n *\n * The BASE ref's OAuth2 block is the connection's: its authorize and token endpoints, its client-id and\n * client-secret slots, its connection parameters (`{tenantId}`), and the AUDIENCES its tokens may be sent to.\n * A member ref brings operations — never a client. A member's own OAuth2 block and client slots become inert\n * while it is a member: they are reported by `wildo config sync`, never required.\n *\n * ## Membership is this LIST, never the vendor string\n *\n * `vendor` on a provider's metadata is display and compliance grouping only. Two refs that both say\n * `vendor: 'microsoft'` are two connections until they are listed here, because spending one grant from a\n * second package is a trust decision the application makes explicitly, never one inferred from a label.\n */\nexport const ProviderSharedConnectionSchema = z.strictObject({\n  /**\n   * The member refs, besides the base. Every runtime scope that declares a member must declare the base too,\n   * because the base's module is what connects, refreshes and revokes the grant.\n   */\n  refs: z.array(z.string().min(1)).min(1),\n  /**\n   * `true` makes the connection use the base's SIGN-IN registration (the `OAUTH2_SSO` client) instead of its\n   * own connected-account client. `false`, the default, keeps sign-in and data access on two registrations.\n   *\n   * Why separate is the default, stated where the choice is made:\n   * - one client secret then authorizes both sign-in and data access, so its compromise exposes both;\n   * - a tenant administrator's admin consent covers every permission statically configured on a registration,\n   *   so data permissions listed statically on a sign-in registration would be granted at sign-in;\n   * - a vendor that reviews sensitive scopes (Google's app verification) reviews the sign-in client too once\n   *   it carries them.\n   *\n   * With `true`, data permissions must be requested dynamically at connect time and never listed statically\n   * on the sign-in registration.\n   */\n  sharedWithSignIn: z.boolean().optional(),\n});\nexport type ProviderSharedConnection = z.infer<typeof ProviderSharedConnectionSchema>;\n\n/**\n * `providers.sharedConnections` — `baseRef` → the connection that ref owns (#1725). See\n * {@link ProviderSharedConnectionSchema}.\n *\n * Refused at parse time, naming both sides: a ref listed in two connections (two bases would each own its\n * client, so which grant it spends would depend on lookup order), a base listed as a member of its own or\n * another connection, and a ref listed twice in one connection.\n *\n * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — which refs may spend one delegated grant is the\n * application's explicit, reviewable declaration, never inferred from a vendor label.\n */\nexport const ProviderSharedConnectionsSchema = z.record(z.string().min(1), ProviderSharedConnectionSchema)\n  .superRefine((connections, ctx) => {\n    for (const problem of findProviderSharedConnectionConflicts(connections)) {\n      ctx.addIssue({ code: 'custom', path: problem.path, message: problem.message });\n    }\n  });\nexport type ProviderSharedConnections = z.infer<typeof ProviderSharedConnectionsSchema>;\n/** @wildo_source:part:end saas.config.providers.shared-connections */\n\n/** One conflict {@link findProviderSharedConnectionConflicts} reports, located in the declaration. */\nexport interface ProviderSharedConnectionConflict {\n  readonly path: (string | number)[];\n  readonly message: string;\n}\n\n/**\n * Every membership conflict in a declaration — empty when the declaration is coherent.\n *\n * Exported (rather than living only inside the schema) so the registry can assert the same predicate over a\n * configuration that reached it without passing through this schema, and so a test pins the messages.\n */\nexport function findProviderSharedConnectionConflicts(\n  connections: Readonly<Record<string, { readonly refs: readonly string[] }>>,\n): ProviderSharedConnectionConflict[] {\n  const problems: ProviderSharedConnectionConflict[] = [];\n  const bases = new Set(Object.keys(connections));\n  const memberOf = new Map<string, string>();\n  for (const [baseRef, connection] of Object.entries(connections).sort(([left], [right]) => left.localeCompare(right))) {\n    const seen = new Set<string>();\n    for (const [index, ref] of connection.refs.entries()) {\n      if (seen.has(ref)) {\n        problems.push({ path: [baseRef, 'refs', index], message: `\"${ref}\" is listed twice in the shared connection \"${baseRef}\".` });\n        continue;\n      }\n      seen.add(ref);\n      if (ref === baseRef) {\n        problems.push({\n          path: [baseRef, 'refs', index],\n          message: `\"${baseRef}\" lists itself as a member. The base ref is the connection's owner already; list only the other refs.`,\n        });\n        continue;\n      }\n      if (bases.has(ref)) {\n        problems.push({\n          path: [baseRef, 'refs', index],\n          message: `\"${ref}\" is a member of the shared connection \"${baseRef}\" and also the base of its own shared connection. `\n            + 'A ref spends exactly one grant; declare one connection that lists both.',\n        });\n        continue;\n      }\n      const earlier = memberOf.get(ref);\n      if (earlier !== undefined) {\n        problems.push({\n          path: [baseRef, 'refs', index],\n          message: `\"${ref}\" is listed in two shared connections, \"${earlier}\" and \"${baseRef}\". A ref spends exactly one grant; `\n            + 'remove it from one of them.',\n        });\n        continue;\n      }\n      memberOf.set(ref, baseRef);\n    }\n  }\n  return problems;\n}\n\n/**\n * The CONNECTION each ref spends: a declared member → its base, a declared base → itself, and any other ref →\n * itself (the #1670 default, where every undeclared ref is its own connection).\n *\n * ONE function, used by `wildo config sync` (lock entries, refusals) and by the running registry\n * (`resolveCredentialConnectionRef`), so the two cannot disagree about which grant a ref spends.\n */\nexport function resolveProviderConnectionRef(\n  connections: Readonly<Record<string, { readonly refs: readonly string[] }>> | undefined,\n  providerRef: string,\n): string {\n  if (connections === undefined) return providerRef;\n  if (Object.hasOwn(connections, providerRef)) return providerRef;\n  for (const [baseRef, connection] of Object.entries(connections)) {\n    if (connection.refs.includes(providerRef)) return baseRef;\n  }\n  return providerRef;\n}\n"]}

package/dist/esm/external-providers/provider-usage-cost.shared.d.ts

@@ -0,0 +1,73 @@
+/**
+ * # Provider-usage cost: pricing one call exactly, and rounding a total once
+ *
+ * The arithmetic half of #1598's cost calculator. Pure and adapter-free, so the backend recorder, the
+ * `summarize` read and the period close use ONE implementation and cannot disagree about a cost.
+ *
+ * ## Exact per call, rounded once per total (review F11)
+ *
+ * A call's cost is stored as an exact fraction of a minor currency unit
+ * (`callCostMinorNumerator / callCostUnitsDenominator`). A total is the exact sum of those fractions (each
+ * multiplied by its row's share), rounded UP to a whole minor unit once, at the moment a total is reported.
+ * Rounding each call would overstate a case made of many small embedding calls by up to one minor unit
+ * per call. Currencies are never converted and never mixed: an accumulator holds one currency.
+ *
+ * ## Quantities (#1598 §7)
+ *
+ * - Input: with a reported split, `noCacheTokens` → `INPUT_TOKEN`, `cacheReadTokens` →
+ *   `CACHED_INPUT_TOKEN`, `cacheWriteTokens` → `CACHE_WRITE_INPUT_TOKEN`; without one, every prompt token is
+ *   `INPUT_TOKEN`. A cache category the authority prices no rate for is priced at the input rate: a missing
+ *   rate never makes tokens free.
+ * - Output: `completionTokens` → `OUTPUT_TOKEN`. When the authority declares a `REASONING_TOKEN` rate and the
+ *   provider reported the reasoning split, the reasoning quantity is priced at that rate and SUBTRACTED from
+ *   the output quantity, so it is never billed twice (Paul, Q3).
+ * - Tiers are per request: the highest threshold the call's whole input quantity exceeds applies its
+ *   multipliers to the input categories and to output/reasoning respectively.
+ */
+import { type ProviderUsageCostResult, type ProviderUsagePricingAuthority } from './provider-usage-pricing.shared.schemas';
+import { ReasoningUsageReporting } from '../flows-actors/work-attribution.shared.schemas';
+/** The token counts one call reported, as the provider-call record stores them. Absent means not reported. */
+export interface ProviderUsageQuantities {
+    readonly promptTokens?: number;
+    readonly completionTokens?: number;
+    readonly noCacheTokens?: number;
+    readonly cacheReadTokens?: number;
+    readonly cacheWriteTokens?: number;
+    readonly reasoningTokens?: number;
+}
+/**
+ * Pick the authority that prices a call: same provider and model, `effectiveFrom` not after the call, the
+ * highest version among those. `undefined` means the call is UNPRICED.
+ */
+export declare function selectProviderUsagePricingAuthority(authorities: readonly ProviderUsagePricingAuthority[], call: {
+    provider?: string | null;
+    model?: string | null;
+    calledAt: Date;
+}): ProviderUsagePricingAuthority | undefined;
+/**
+ * Refuse a registered list that names one `ref@version` twice (#1598 §7). Two entries under one identity
+ * would make "the price used" ambiguous in every row and aggregate that names it. Throws with every
+ * duplicated identity named.
+ */
+export declare function assertUniqueProviderUsagePricingAuthorities(authorities: readonly ProviderUsagePricingAuthority[]): void;
+/** Whether a call's usage reports the reasoning split. */
+export declare function reasoningUsageReportingOf(usage: ProviderUsageQuantities): ReasoningUsageReporting;
+/**
+ * The exact cost of one call under `authority`, unrounded. See the file header for the quantity rules.
+ */
+export declare function computeProviderUsageCallCost(authority: ProviderUsagePricingAuthority, usage: ProviderUsageQuantities): ProviderUsageCostResult;
+/**
+ * An exact running total of minor-unit fractions in ONE currency, rounded up once when read.
+ *
+ * `add` takes a call's exact cost and the attribution row's share of it (`shareNumerator / shareDenominator`,
+ * 1/1 for a whole call). The sum stays a reduced fraction of bigints, so no precision is lost however many
+ * rows are added.
+ */
+export declare class ExactMinorCostTotal {
+    private numerator;
+    private denominator;
+    add(callCostMinorNumerator: string, callCostUnitsDenominator: number, shareNumerator?: number, shareDenominator?: number): void;
+    /** The total, rounded UP to a whole minor unit: `CEILING_AGGREGATE_TO_MINOR_UNIT`, applied once. */
+    ceilMinor(): bigint;
+}
+//# sourceMappingURL=provider-usage-cost.shared.d.ts.map

package/dist/esm/external-providers/provider-usage-cost.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-usage-cost.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-usage-cost.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAE1F,8GAA8G;AAC9G,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAoBD;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,SAAS,6BAA6B,EAAE,EACrD,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GACxE,6BAA6B,GAAG,SAAS,CAS3C;AAED;;;;GAIG;AACH,wBAAgB,2CAA2C,CAAC,WAAW,EAAE,SAAS,6BAA6B,EAAE,GAAG,IAAI,CAcvH;AAED,0DAA0D;AAC1D,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,uBAAuB,GAAG,uBAAuB,CAIjG;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,6BAA6B,EAAE,KAAK,EAAE,uBAAuB,GAAG,uBAAuB,CAyD9I;AAED;;;;;;GAMG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,WAAW,CAAO;IAEnB,GAAG,CAAC,sBAAsB,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,cAAc,SAAI,EAAE,gBAAgB,SAAI,GAAG,IAAI;IAW5H,oGAAoG;IAC7F,SAAS,IAAI,MAAM;CAI3B"}