@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/external-providers/compose-provider-registry.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"compose-provider-registry.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/compose-provider-registry.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA8BH,MAAM,OAAO,gCAAsD,SAAQ,KAAK;IAC9D,KAAK,CAAS;IACd,SAAS,CAAmD;IAE5E,YACE,KAAa,EACb,SAA2D;QAE3D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CACzB,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAC3B,YAAY,GAAG,4BAA4B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3E,CAAC;QACF,KAAK,CACH,WAAW,KAAK,2DAA2D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7F,8FAA8F,CACjG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAIrC,KAAa,EACb,SAAiE;IAEjE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAwC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gCAAgC,CAAO,KAAK,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IACvC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAiC,CAAC;IACtE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACvB,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA4C;QACxD,OAAO,EAAE,KAAK;QACd,gBAAgB,CAAC,GAAG;YAClB,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,gCAAgC,CAAC,kBAAkB;YACjD,OAAO,oBAAoB,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC5D,CAAC;QACD,gCAAgC,CAAC,kBAAkB;YACjD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC5D,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC;KACF,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC","sourcesContent":["/**\n * `composeProviderRegistry` — facet-agnostic registry composition core.\n *\n * Each facet (backend, frontend-app, frontend-techdoc, frontend-website)\n * exposes its own `compose<Facet>Providers` wrapper that delegates here\n * so the conflict-detection diagnostic, the index-building algorithm,\n * and the freeze semantics stay identical across the codebase.\n *\n * The helper is generic over the facet-brand `TRef` (each facet uses a\n * branded string for its `ref` to keep cross-facet leakage compile-blocked)\n * and over the facet module shape `TModule` (constrained to anything with\n * a `providerCapabilities: ReadonlyArray<ProviderCapability>` field, which\n * is the one cross-facet invariant — every provider declares what it can\n * do regardless of facet).\n *\n * Conflict policy (locked in analysis §6 / §10 Q4): same `ref` declared in\n * two or more fragments → THROW with a precise diagnostic listing every\n * fragment index that contributed the conflicting ref. NO silent override.\n *\n * Returned shape: a frozen `ComposedProviderRegistry<TRef, TModule>` with:\n *   - `modules`                              — direct ref→module map\n *   - `getProviderByRef(ref)`                — direct lookup\n *   - `getProvidersByProviderCapability(c)`  — capability fan-out (ordered\n *                                              by fragment index, then by\n *                                              insertion order within each\n *                                              fragment's `modules` Map)\n *   - `findProviderByProviderCapability(c)`  — first match (single-fulfiller)\n *\n * The returned object surface is `Object.freeze`d; the underlying `Map`\n * and array references are NOT defensively cloned on every read — the\n * `Readonly` typing at consumer sites is the contract, and the builder is\n * the sole writer.\n *\n * See `.cursor/plans/provider-registration-refactor-implementation-plan.md`\n * §Phase 1.e for the canonical contract.\n */\n\nimport type { ProviderCapability } from './provider-capability.shared.schemas';\n\nexport interface ProviderRegistryFragment<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n> {\n  readonly modules: ReadonlyMap<TRef, TModule>;\n}\n\nexport interface ComposedProviderRegistry<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n> {\n  readonly modules: ReadonlyMap<TRef, TModule>;\n  getProviderByRef(ref: TRef): TModule | undefined;\n  getProvidersByProviderCapability(\n    providerCapability: ProviderCapability,\n  ): ReadonlyArray<TModule>;\n  findProviderByProviderCapability(\n    providerCapability: ProviderCapability,\n  ): TModule | undefined;\n}\n\nexport interface ProviderCompositionConflict<TRef extends string> {\n  ref: TRef;\n  fragmentIndexes: ReadonlyArray<number>;\n}\n\nexport class ProviderCompositionConflictError<TRef extends string> extends Error {\n  public readonly facet: string;\n  public readonly conflicts: ReadonlyArray<ProviderCompositionConflict<TRef>>;\n\n  constructor(\n    facet: string,\n    conflicts: ReadonlyArray<ProviderCompositionConflict<TRef>>,\n  ) {\n    const lines = conflicts.map(\n      ({ ref, fragmentIndexes }) =>\n        `  - ref \"${ref}\" declared by fragments [${fragmentIndexes.join(', ')}]`,\n    );\n    super(\n      `[compose${facet}Providers] conflicting provider refs across fragments:\\n${lines.join('\\n')}\\n` +\n        'Resolution: pick a different ref OR drop the conflicting fragment from the composition call.',\n    );\n    this.name = 'ProviderCompositionConflictError';\n    this.facet = facet;\n    this.conflicts = conflicts;\n  }\n}\n\nexport function composeProviderRegistry<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n>(\n  facet: string,\n  fragments: ReadonlyArray<ProviderRegistryFragment<TRef, TModule>>,\n): ComposedProviderRegistry<TRef, TModule> {\n  const refOwners = new Map<TRef, number[]>();\n  for (let index = 0; index < fragments.length; index += 1) {\n    for (const ref of fragments[index].modules.keys()) {\n      const existing = refOwners.get(ref);\n      if (existing) {\n        existing.push(index);\n      } else {\n        refOwners.set(ref, [index]);\n      }\n    }\n  }\n\n  const conflicts: ProviderCompositionConflict<TRef>[] = [];\n  for (const [ref, indexes] of refOwners) {\n    if (indexes.length > 1) {\n      conflicts.push({ ref, fragmentIndexes: indexes });\n    }\n  }\n  if (conflicts.length > 0) {\n    throw new ProviderCompositionConflictError<TRef>(facet, conflicts);\n  }\n\n  const byRef = new Map<TRef, TModule>();\n  const byProviderCapability = new Map<ProviderCapability, TModule[]>();\n  for (const fragment of fragments) {\n    for (const [ref, module] of fragment.modules) {\n      byRef.set(ref, module);\n      for (const capability of module.providerCapabilities) {\n        const bucket = byProviderCapability.get(capability);\n        if (bucket) {\n          bucket.push(module);\n        } else {\n          byProviderCapability.set(capability, [module]);\n        }\n      }\n    }\n  }\n\n  const registry: ComposedProviderRegistry<TRef, TModule> = {\n    modules: byRef,\n    getProviderByRef(ref) {\n      return byRef.get(ref);\n    },\n    getProvidersByProviderCapability(providerCapability) {\n      return byProviderCapability.get(providerCapability) ?? [];\n    },\n    findProviderByProviderCapability(providerCapability) {\n      const bucket = byProviderCapability.get(providerCapability);\n      return bucket && bucket.length > 0 ? bucket[0] : undefined;\n    },\n  };\n\n  return Object.freeze(registry);\n}\n"]}
+{"version":3,"file":"compose-provider-registry.shared.js","sourceRoot":"","sources":["../../../src/external-providers/compose-provider-registry.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA8BH,MAAM,OAAO,gCAAsD,SAAQ,KAAK;IAC9D,KAAK,CAAS;IACd,SAAS,CAAmD;IAE5E,YACE,KAAa,EACb,SAA2D;QAE3D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CACzB,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAC3B,YAAY,GAAG,4BAA4B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3E,CAAC;QACF,KAAK,CACH,WAAW,KAAK,2DAA2D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7F,8FAA8F,CACjG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAIrC,KAAa,EACb,SAAiE;IAEjE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAwC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gCAAgC,CAAO,KAAK,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IACvC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAiC,CAAC;IACtE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACvB,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA4C;QACxD,OAAO,EAAE,KAAK;QACd,gBAAgB,CAAC,GAAG;YAClB,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,gCAAgC,CAAC,kBAAkB;YACjD,OAAO,oBAAoB,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC5D,CAAC;QACD,gCAAgC,CAAC,kBAAkB;YACjD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC5D,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC;KACF,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC","sourcesContent":["/**\n * `composeProviderRegistry` — facet-agnostic registry composition core.\n *\n * Each facet (backend, frontend-app, frontend-techdoc, frontend-website)\n * exposes its own `compose<Facet>Providers` wrapper that delegates here\n * so the conflict-detection diagnostic, the index-building algorithm,\n * and the freeze semantics stay identical across the codebase.\n *\n * The helper is generic over the facet-brand `TRef` (each facet uses a\n * branded string for its `ref` to keep cross-facet leakage compile-blocked)\n * and over the facet module shape `TModule` (constrained to anything with\n * a `providerCapabilities: ReadonlyArray<ProviderCapability>` field, which\n * is the one cross-facet invariant — every provider declares what it can\n * do regardless of facet).\n *\n * Conflict policy (locked in analysis §6 / §10 Q4): same `ref` declared in\n * two or more fragments → THROW with a precise diagnostic listing every\n * fragment index that contributed the conflicting ref. NO silent override.\n *\n * Returned shape: a frozen `ComposedProviderRegistry<TRef, TModule>` with:\n *   - `modules`                              — direct ref→module map\n *   - `getProviderByRef(ref)`                — direct lookup\n *   - `getProvidersByProviderCapability(c)`  — capability fan-out (ordered\n *                                              by fragment index, then by\n *                                              insertion order within each\n *                                              fragment's `modules` Map)\n *   - `findProviderByProviderCapability(c)`  — first match (single-fulfiller)\n *\n * The returned object surface is `Object.freeze`d; the underlying `Map`\n * and array references are NOT defensively cloned on every read — the\n * `Readonly` typing at consumer sites is the contract, and the builder is\n * the sole writer.\n *\n * See `.cursor/plans/provider-registration-refactor-implementation-plan.md`\n * §Phase 1.e for the canonical contract.\n */\n\nimport type { ProviderCapability } from './provider-capability.shared.schemas';\n\nexport interface ProviderRegistryFragment<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n> {\n  readonly modules: ReadonlyMap<TRef, TModule>;\n}\n\nexport interface ComposedProviderRegistry<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n> {\n  readonly modules: ReadonlyMap<TRef, TModule>;\n  getProviderByRef(ref: TRef): TModule | undefined;\n  getProvidersByProviderCapability(\n    providerCapability: ProviderCapability,\n  ): ReadonlyArray<TModule>;\n  findProviderByProviderCapability(\n    providerCapability: ProviderCapability,\n  ): TModule | undefined;\n}\n\nexport interface ProviderCompositionConflict<TRef extends string> {\n  ref: TRef;\n  fragmentIndexes: ReadonlyArray<number>;\n}\n\nexport class ProviderCompositionConflictError<TRef extends string> extends Error {\n  public readonly facet: string;\n  public readonly conflicts: ReadonlyArray<ProviderCompositionConflict<TRef>>;\n\n  constructor(\n    facet: string,\n    conflicts: ReadonlyArray<ProviderCompositionConflict<TRef>>,\n  ) {\n    const lines = conflicts.map(\n      ({ ref, fragmentIndexes }) =>\n        `  - ref \"${ref}\" declared by fragments [${fragmentIndexes.join(', ')}]`,\n    );\n    super(\n      `[compose${facet}Providers] conflicting provider refs across fragments:\\n${lines.join('\\n')}\\n` +\n        'Resolution: pick a different ref OR drop the conflicting fragment from the composition call.',\n    );\n    this.name = 'ProviderCompositionConflictError';\n    this.facet = facet;\n    this.conflicts = conflicts;\n  }\n}\n\nexport function composeProviderRegistry<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n>(\n  facet: string,\n  fragments: ReadonlyArray<ProviderRegistryFragment<TRef, TModule>>,\n): ComposedProviderRegistry<TRef, TModule> {\n  const refOwners = new Map<TRef, number[]>();\n  for (let index = 0; index < fragments.length; index += 1) {\n    for (const ref of fragments[index].modules.keys()) {\n      const existing = refOwners.get(ref);\n      if (existing) {\n        existing.push(index);\n      } else {\n        refOwners.set(ref, [index]);\n      }\n    }\n  }\n\n  const conflicts: ProviderCompositionConflict<TRef>[] = [];\n  for (const [ref, indexes] of refOwners) {\n    if (indexes.length > 1) {\n      conflicts.push({ ref, fragmentIndexes: indexes });\n    }\n  }\n  if (conflicts.length > 0) {\n    throw new ProviderCompositionConflictError<TRef>(facet, conflicts);\n  }\n\n  const byRef = new Map<TRef, TModule>();\n  const byProviderCapability = new Map<ProviderCapability, TModule[]>();\n  for (const fragment of fragments) {\n    for (const [ref, module] of fragment.modules) {\n      byRef.set(ref, module);\n      for (const capability of module.providerCapabilities) {\n        const bucket = byProviderCapability.get(capability);\n        if (bucket) {\n          bucket.push(module);\n        } else {\n          byProviderCapability.set(capability, [module]);\n        }\n      }\n    }\n  }\n\n  const registry: ComposedProviderRegistry<TRef, TModule> = {\n    modules: byRef,\n    getProviderByRef(ref) {\n      return byRef.get(ref);\n    },\n    getProvidersByProviderCapability(providerCapability) {\n      return byProviderCapability.get(providerCapability) ?? [];\n    },\n    findProviderByProviderCapability(providerCapability) {\n      const bucket = byProviderCapability.get(providerCapability);\n      return bucket && bucket.length > 0 ? bucket[0] : undefined;\n    },\n  };\n\n  return Object.freeze(registry);\n}\n"]}

package/dist/esm/external-providers/engine-capabilities.shared.schemas.d.ts

@@ -43,6 +43,18 @@ export declare enum EngineCapability {
     COMPLIANCE_AUDIT_TRAIL = "COMPLIANCE_AUDIT_TRAIL",
     EMAIL_TRANSACTIONAL = "EMAIL_TRANSACTIONAL",
     EMAIL_MARKETING = "EMAIL_MARKETING",
+    /**
+     * The application RECEIVES email: work arrives as messages to an address the application routes to
+     * an organization, and a channel handler decides what each message causes (#1630). The selected
+     * provider hosts the receiving domain, signs a notification per message and serves the message on
+     * request; the engine owns verification, deduplication, sender assurance, threads and replies.
+     *
+     * What it does NOT mean: a verified sender is identification, never authentication. A message's
+     * sender assurance gates what a handler accepts and grants no authority — the handler acts with
+     * the roles it declares, whoever wrote. Replies go out through `EMAIL_TRANSACTIONAL`, so the two
+     * slots may be served by different vendors.
+     */
+    EMAIL_INBOUND = "EMAIL_INBOUND",
     SMS = "SMS",
     AI_LLM = "AI_LLM",
     AI_IMAGE_GENERATION = "AI_IMAGE_GENERATION",
@@ -127,7 +139,7 @@ export declare enum EngineCapability {
  * map with a `BuiltinProviderCapability` VARIABLE — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[cap]`
  * in the runtime registry, in both companion-discovery exports, in `defineSaaSProviders` and in the
  * tier rule — and that only type-checks against `Partial<Record<…>>`, which admits every token in
- * the vocabulary and answers `undefined` for the five that map nowhere. Annotating the literal that
+ * the vocabulary and answers `undefined` for the six that map nowhere. Annotating the literal that
  * way is what USED to be written here, and it is also what erased the information the totality
  * check below needs: an annotation discards the per-property literal types, so
  * `(typeof MAP)[keyof typeof MAP]` collapsed to `EngineCapability | undefined` and could not say
@@ -171,7 +183,7 @@ export declare const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY: readonly [
  * application ENABLES them — the engine-level MAIN floor (#328).
  *
  * The asymmetry is the thing to carry away: **enabling a capability with nothing serving it fails at
- * BOOT for these three and at the point of USE for every other slot.** So an author who tries one
+ * BOOT for these four and at the point of USE for every other slot.** So an author who tries one
  * unserved slot, sees the application come up, and concludes that an unserved capability degrades
  * gracefully has learned the wrong rule from the larger half of the vocabulary.
  *
@@ -186,6 +198,9 @@ export declare const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY: readonly [
  * - `BILLING` — `initializeBillingServices` already fails loud with no
  *   provider; the floor names it in the same place as the others.
  * - `SMS` — phone verification and MFA-by-SMS are engine flows.
+ * - `EMAIL_INBOUND` — enabling it declares that work arrives by email; with no
+ *   provider nothing hosts the receiving domain, so every message is lost
+ *   before the engine sees it and nothing anywhere records that it was (#1630).
  *
  * DELIBERATELY ABSENT, with the reason each would need to overturn:
  * - the `AI_*` slots — consumed per feature (an agent, the logo generator)

package/dist/esm/external-providers/engine-capabilities.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capabilities.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,sBAAsB,2BAA2B;IAEjD,mBAAmB,wBAAwB;IAC3C,eAAe,oBAAoB;IACnC,GAAG,QAAQ;IAEX,MAAM,WAAW;IACjB,mBAAmB,wBAAwB;IAC3C;;;;;;;;OAQG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;;;;;OAcG;IACH,eAAe,oBAAoB;IAyDnC,yBAAyB,8BAA8B;IACvD,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,iBAAiB,sBAAsB;IAEvC;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;CACpD;AAkGD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wCAAwC,EAAE,OAAO,CAC5D,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CACD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,+CAA+C,4EAYZ,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,eAAO,MAAM,qDAAqD,EAAE,WAAW,CAAC,gBAAgB,CAI9F,CAAC;AACH,qFAAqF"}
+{"version":3,"file":"engine-capabilities.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,sBAAsB,2BAA2B;IAEjD,mBAAmB,wBAAwB;IAC3C,eAAe,oBAAoB;IACnC;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAC/B,GAAG,QAAQ;IAEX,MAAM,WAAW;IACjB,mBAAmB,wBAAwB;IAC3C;;;;;;;;OAQG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;;;;;OAcG;IACH,eAAe,oBAAoB;IAyDnC,yBAAyB,8BAA8B;IACvD,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,iBAAiB,sBAAsB;IAEvC;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;CACpD;AAoGD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wCAAwC,EAAE,OAAO,CAC5D,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CACD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,+CAA+C,4EAYZ,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,eAAO,MAAM,qDAAqD,EAAE,WAAW,CAAC,gBAAgB,CAK9F,CAAC;AACH,qFAAqF"}

package/dist/esm/external-providers/engine-capabilities.shared.schemas.js

@@ -44,6 +44,18 @@ export var EngineCapability;
     EngineCapability["COMPLIANCE_AUDIT_TRAIL"] = "COMPLIANCE_AUDIT_TRAIL";
     EngineCapability["EMAIL_TRANSACTIONAL"] = "EMAIL_TRANSACTIONAL";
     EngineCapability["EMAIL_MARKETING"] = "EMAIL_MARKETING";
+    /**
+     * The application RECEIVES email: work arrives as messages to an address the application routes to
+     * an organization, and a channel handler decides what each message causes (#1630). The selected
+     * provider hosts the receiving domain, signs a notification per message and serves the message on
+     * request; the engine owns verification, deduplication, sender assurance, threads and replies.
+     *
+     * What it does NOT mean: a verified sender is identification, never authentication. A message's
+     * sender assurance gates what a handler accepts and grants no authority — the handler acts with
+     * the roles it declares, whoever wrote. Replies go out through `EMAIL_TRANSACTIONAL`, so the two
+     * slots may be served by different vendors.
+     */
+    EngineCapability["EMAIL_INBOUND"] = "EMAIL_INBOUND";
     EngineCapability["SMS"] = "SMS";
     EngineCapability["AI_LLM"] = "AI_LLM";
     EngineCapability["AI_IMAGE_GENERATION"] = "AI_IMAGE_GENERATION";
@@ -230,8 +242,9 @@ export var EngineCapability;
  * the enum) — it had no producer and no consumer other than the bug.
  *
  * **Intentionally unmapped.** `SSO_OAUTH2`, `SSO_SAML`, `FRONTEND_SEARCH`,
- * `FRONTEND_FILE_PICKER`, and `FRONTEND_CAPTCHA` have no closed engine
- * slot today — they are fulfilled by provider protocols / app wiring, not
+ * `FRONTEND_FILE_PICKER`, `FRONTEND_CAPTCHA` and `FRONTEND_ADDRESS_LOOKUP`
+ * (#1702 — an address field works without one, so no engine slot requires it)
+ * have no closed engine slot today — they are fulfilled by provider protocols / app wiring, not
  * by an `EngineCapability`. Their absence here is by construction, not an
  * oversight: a `Partial<Record<…>>` lookup returns `undefined` and the
  * capability contributes nothing to a provider's `engineCapabilities`.
@@ -243,6 +256,7 @@ export var EngineCapability;
 const PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES = {
     [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: EngineCapability.EMAIL_TRANSACTIONAL,
     [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: EngineCapability.EMAIL_MARKETING,
+    [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: EngineCapability.EMAIL_INBOUND,
     [BUILTIN_PROVIDER_CAPABILITY.SMS]: EngineCapability.SMS,
     [BUILTIN_PROVIDER_CAPABILITY.BILLING]: EngineCapability.BILLING,
     [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: EngineCapability.AI_LLM,
@@ -277,7 +291,7 @@ const PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES = {
  * map with a `BuiltinProviderCapability` VARIABLE — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[cap]`
  * in the runtime registry, in both companion-discovery exports, in `defineSaaSProviders` and in the
  * tier rule — and that only type-checks against `Partial<Record<…>>`, which admits every token in
- * the vocabulary and answers `undefined` for the five that map nowhere. Annotating the literal that
+ * the vocabulary and answers `undefined` for the six that map nowhere. Annotating the literal that
  * way is what USED to be written here, and it is also what erased the information the totality
  * check below needs: an annotation discards the per-property literal types, so
  * `(typeof MAP)[keyof typeof MAP]` collapsed to `EngineCapability | undefined` and could not say
@@ -333,7 +347,7 @@ export const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY = [
  * application ENABLES them — the engine-level MAIN floor (#328).
  *
  * The asymmetry is the thing to carry away: **enabling a capability with nothing serving it fails at
- * BOOT for these three and at the point of USE for every other slot.** So an author who tries one
+ * BOOT for these four and at the point of USE for every other slot.** So an author who tries one
  * unserved slot, sees the application come up, and concludes that an unserved capability degrades
  * gracefully has learned the wrong rule from the larger half of the vocabulary.
  *
@@ -348,6 +362,9 @@ export const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY = [
  * - `BILLING` — `initializeBillingServices` already fails loud with no
  *   provider; the floor names it in the same place as the others.
  * - `SMS` — phone verification and MFA-by-SMS are engine flows.
+ * - `EMAIL_INBOUND` — enabling it declares that work arrives by email; with no
+ *   provider nothing hosts the receiving domain, so every message is lost
+ *   before the engine sees it and nothing anywhere records that it was (#1630).
  *
  * DELIBERATELY ABSENT, with the reason each would need to overturn:
  * - the `AI_*` slots — consumed per feature (an agent, the logo generator)
@@ -376,6 +393,7 @@ export const ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED = new Set([
     EngineCapability.EMAIL_TRANSACTIONAL,
     EngineCapability.BILLING,
     EngineCapability.SMS,
+    EngineCapability.EMAIL_INBOUND,
 ]);
 /** @wildo_source:part:end saas.models.engine-capabilities.required-provider-floor */
 //# sourceMappingURL=engine-capabilities.shared.schemas.js.map

package/dist/esm/external-providers/engine-capabilities.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capabilities.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAkC,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,gBAwKX;AAxKD,WAAY,gBAAgB;IAC1B,mDAA+B,CAAA;IAC/B,uCAAmB,CAAA;IACnB,qDAAiC,CAAA;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,qEAAiD,CAAA;IAEjD,+DAA2C,CAAA;IAC3C,uDAAmC,CAAA;IACnC,+BAAW,CAAA;IAEX,qCAAiB,CAAA;IACjB,+DAA2C,CAAA;IAC3C;;;;;;;;OAQG;IACH,mDAA+B,CAAA;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,qEAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uDAAmC,CAAA;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IAEH,2EAAuD,CAAA;IACvD,6EAAyD,CAAA;IAEzD;;;;;OAKG;IACH,2DAAuC,CAAA;IAEvC;;;;;;;;OAQG;IACH,uEAAmD,CAAA;AACrD,CAAC,EAxKW,gBAAgB,KAAhB,gBAAgB,QAwK3B;AACD,6DAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,MAAM,gDAAgD,GAAG;IACvD,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACvF,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC/E,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,GAAG;IACvD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,OAAO;IAC/D,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,MAAM;IAC/D;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,aAAa;IAC5E;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;IAC/F,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC5E,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACpF,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,yBAAyB;IACnG,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,0BAA0B;IACrG,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,iBAAiB;IACnF,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,uBAAuB;IAC/F,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;CACd,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAEjD,gDAAgD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D;;;OAGG;IACH,gBAAgB,CAAC,aAAa;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,cAAc;CACe,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAkC,IAAI,GAAG,CAAC;IAC1G,gBAAgB,CAAC,mBAAmB;IACpC,gBAAgB,CAAC,OAAO;IACxB,gBAAgB,CAAC,GAAG;CACrB,CAAC,CAAC;AACH,qFAAqF","sourcesContent":["import { BUILTIN_PROVIDER_CAPABILITY, type BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** @wildo_source:part:start saas.models.engine-capabilities facet:kind:api facet:audience:app-developer\n *\n * Closed application capability vocabulary used to declare what the\n * application needs from its configured providers.\n *\n * `EngineCapability` no longer means \"feature gate id\" and no longer\n * carries provider routing by itself. Provider-backed fulfillment is selected\n * by the application's provider configuration; entitlement/billing features\n * remain application feature decisions. Import this enum from\n * `@wildo-ai/saas-models` and declare only capabilities the application\n * actually intends to configure and operate.\n */\nexport enum EngineCapability {\n  ORGANIZATIONS = 'ORGANIZATIONS',\n  BILLING = 'BILLING',\n  MULTI_LANGUAGE = 'MULTI_LANGUAGE',\n  /**\n   * Durable, provider-backed audit trail: every audit event the application records is ALSO sent to\n   * each configured audit provider (an immutable ledger, a SIEM).\n   *\n   * Whether to enable it is a question of where the trail must live, not of what the application may\n   * claim. The assurance surface attests roughly half its control objectives through audit rows, and\n   * those rows are read from the application's OWN audit store, which exists whether or not this\n   * capability is on. So leaving it out removes no control objective an application can claim. Until\n   * 2026-09-14 the assurance basis wrongly treated this capability as the precondition for those\n   * claims, and this comment said leaving it out left about a third of them unclaimable.\n   *\n   * Two things this does NOT mean, because both are easy to assume:\n   *\n   * - It is not what makes security events happen. Authentication, authorization, privilege and\n   *   credential events are recorded in the application's own database regardless. What this\n   *   capability adds is the provider-backed fan-out — the durable, external, tamper-evident\n   *   destination an assurance reader can be pointed at.\n   * - It is not retroactive. Turning it on later starts a trail from that moment; it does not\n   *   furnish evidence for the period it was off, and a control's evidence cannot begin before its\n   *   evidence store does.\n   *\n   * So decide it with the compliance posture rather than as an infrastructure detail: enable it when\n   * the trail must also exist OUTSIDE the application — a store its own operators cannot rewrite, or a\n   * security team's SIEM. The application's own store stays the authoritative record either way.\n   */\n  COMPLIANCE_AUDIT_TRAIL = 'COMPLIANCE_AUDIT_TRAIL',\n\n  EMAIL_TRANSACTIONAL = 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING = 'EMAIL_MARKETING',\n  SMS = 'SMS',\n\n  AI_LLM = 'AI_LLM',\n  AI_IMAGE_GENERATION = 'AI_IMAGE_GENERATION',\n  /**\n   * Text → vector embeddings (the RAG derived-data tier: `.ragSource()` corpus embedding by the\n   * `rag:embedding-drain` worker, and query-time embedding in retrieval). A slot of its OWN,\n   * deliberately separate from `AI_LLM` (RAG plan DL2/H4): while `LLM_EMBEDDINGS` mapped into the\n   * `AI_LLM` slot, an application structurally could not pick Anthropic for chat and a different\n   * provider for embeddings — one `selection[AI_LLM].primary` decided both. Embeddings resolve\n   * through `EMBEDDINGS_PROVIDER` protocol bindings and are selected by applicability class\n   * (`Embeddings_Applicability`), never by a concrete model id at a call site.\n   */\n  AI_EMBEDDINGS = 'AI_EMBEDDINGS',\n  /**\n   * Document bytes → text: provider-backed extraction (OCR) for uploaded documents, serving\n   * `FileTextExtractionBackendService` and, through it, `.ragSource()` corpus ingestion.\n   *\n   * ## Why a slot of its own\n   *\n   * Three unrelated procurement decisions were otherwise fused. A deployment may well want one\n   * vendor for chat, another for embeddings, and a third for OCR — vendors are not equally good\n   * at all three, and their pricing models do not even share a unit (tokens vs. pages). Mapping\n   * extraction into `AI_LLM` would have made one `selection[AI_LLM].primary` decide all three,\n   * which is exactly the defect that split `AI_EMBEDDINGS` out of `AI_LLM`.\n   *\n   * ## Not to be confused with PDF GENERATION\n   *\n   * PDF generation — templates and data become bytes — is the `pdfTemplates` surface, done\n   * in-process and with no provider slot of its own. This is the opposite direction: bytes become\n   * text. The two are unrelated and nothing routes between them. (There WAS an\n   * `EngineCapability.DOCUMENT_GENERATION` that this paragraph used to name; it was withdrawn\n   * because no provider capability could ever fill it.)\n   *\n   * ## Absence is benign, and that is load-bearing\n   *\n   * With no provider selected, extraction falls back to the local `pdfjs-dist` text-layer read.\n   * That is a real answer for a born-digital PDF and returns nothing for a SCAN — so this\n   * capability is what makes scanned documents answerable, never what makes extraction work at\n   * all. An application that ingests only born-digital documents may leave it unset deliberately.\n   */\n  AI_DOCUMENT_EXTRACTION = 'AI_DOCUMENT_EXTRACTION',\n  /**\n   * An autonomous coding agent that mutates the application workspace.\n   *\n   * Its own slot rather than `AI_LLM`, for exactly the reason `AI_EMBEDDINGS`\n   * was split out of it: one `selection[AI_LLM].primary` decides every provider\n   * mapped into that slot. While the coding transport mapped to `AI_LLM`, an\n   * application structurally could NOT choose one vendor's coding agent and a\n   * different vendor for chat — picking a chat provider silently picked the\n   * agent that would be allowed to edit its source.\n   *\n   * The stakes differ too, which is why fusing them was wrong beyond the\n   * ergonomics: selecting a chat model is a quality and cost decision, while\n   * selecting the agent that writes your code is those things AND an\n   * authorisation decision. They deserve separate, deliberate answers.\n   */\n  AI_CODING_AGENT = 'AI_CODING_AGENT',\n\n  /*\n   * WITHDRAWN 2026-09-03: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` were members here and are\n   * not any more. Neither could ever be filled — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` had no\n   * entry pointing at either, so no provider capability token could claim the slot — while both were\n   * classified `SELECT_ONE`, which asserts that exactly one provider must be selected. Selecting one\n   * of zero candidates is not a resolution mode.\n   *\n   * Both capabilities are real and both are delivered elsewhere, which is why withdrawing the slots\n   * costs nothing: antivirus scanning is `InfraCapability.ANTIVIRUS_SCANNING`, fulfilled by ClamAV\n   * and consumed by `FileScanningBackendService`; PDF generation is the in-process `pdfTemplates`\n   * surface, rendered by `@react-pdf/renderer` inside the backend. Neither has an external\n   * provider, and neither is planned to.\n   *\n   * `InfraCapability.DOCUMENT_RENDERING` (Gotenberg) was provisioned beside the PDF surface and\n   * consumed by nothing; it was withdrawn on 2026-09-08 (#477) because in-process rendering had\n   * superseded it. Note the two are not interchangeable if it is ever reconsidered:\n   * `@react-pdf/renderer` composes a document from React primitives, while Gotenberg converts\n   * EXISTING HTML and Office documents — that is a different capability, not a second\n   * implementation of this one.\n   *\n   * Removing `ANTIVIRUS_SCANNING` also removes a collision: the identical spelling named an engine\n   * slot nothing could fill AND a live infra capability, in two packages, so a reader grepping the\n   * word landed in whichever they searched first.\n   *\n   * If a hosted AV or document-rendering vendor is ever adopted, the member comes back WITH its\n   * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` entry and its own JSDoc in the same change.\n   *\n   * WITHDRAWN 2026-09-09: `BILLING_PAYMENTS`, the third member of exactly that shape, and the one\n   * this paragraph's own closing rule should have caught. It was never withdrawn with the other two\n   * because it had been left behind DELIBERATELY — as a \"reserved slot\" — which reads as a decision\n   * and is why nobody re-examined it. Measured before removing, across the whole repository outside\n   * `node_modules` / `dist`: it appeared in live source at exactly THREE sites, and none of them was\n   * a use — the enum declaration itself, its row in the compile-forced\n   * `ENGINE_CAPABILITY_RESOLUTION_MODE` record, and a comment in a test naming it as a slot the\n   * billing provider must NOT be registered under. Zero applications enabled it, zero scaffolds\n   * wrote it, zero consumers queried it, and no provider capability token mapped to it.\n   *\n   * The capability it names is real and is already delivered: a billing provider (Stripe) declares\n   * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills `EngineCapability.BILLING`, which is the slot\n   * applications enable and `getProvidersForEngineCapability` gates on. Payment EXECUTION is served\n   * through that same provider's `BILLING_PROVIDER` protocol; splitting it into a second engine slot\n   * was a plan-era intention (`provider-registry-materialization-workflow.md`) that the shipped\n   * model settled the other way. So the withdrawal removes a name, not a capability.\n   *\n   * The reason a reserved slot is worse than no slot is `EngineCapabilityResolutionMode`: every\n   * member must be classified, `BILLING_PAYMENTS` was classified `SELECT_ONE`, and `SELECT_ONE`\n   * asserts that exactly one provider is selected from the candidates. There were zero candidates\n   * and there could never be one. A vocabulary member that no configuration can satisfy is not a\n   * reservation, it is a false statement the compiler is forced to carry.\n   *\n   * If a payments vendor is ever selected independently of the billing vendor, the member comes back\n   * with its provider-capability token and its map entry in the same change — the same rule as\n   * above, now with three instances behind it.\n   */\n\n  FRONTEND_ERROR_MONITORING = 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS = 'FRONTEND_PRODUCT_ANALYTICS',\n\n  /**\n   * Backend LLM-call observability (model/tokens/cost/latency per `invokeAgent`),\n   * platform-scoped. This enables model-call observability when the selected\n   * provider configuration supplies that capability; it does not itself\n   * configure a provider or make telemetry operational.\n   */\n  LLM_OBSERVABILITY = 'LLM_OBSERVABILITY',\n\n  /**\n   * Operational telemetry (traces/metrics/logs) shipped via the OpenTelemetry\n   * SDK over OTLP to a provider (for example, BetterStack). Unlike\n   * `LLM_OBSERVABILITY`, the connection is preloaded from\n   * `OTEL_*` env vars (the CLI translates the saas-config selection + per-env\n   * infra config into them) BEFORE app config — not resolved through the runtime\n   * registry. Author the corresponding infrastructure/provider settings in\n   * the application environment before relying on telemetry.\n   */\n  OBSERVABILITY_TELEMETRY = 'OBSERVABILITY_TELEMETRY',\n}\n/** @wildo_source:part:end saas.models.engine-capabilities */\n\n/**\n * Canonical, single-source-of-truth mapping from the open\n * `ProviderCapability` vocabulary (the built-in subset) to the closed\n * `EngineCapability` slots the engine actually fulfills.\n *\n * A provider declares which `providerCapabilities` it satisfies (e.g.\n * Stripe → `BILLING`, Resend → `EMAIL_TRANSACTIONAL`, Anthropic →\n * `LLM_CHAT`/`CODING_AGENT`). This map projects each built-in\n * capability onto the engine slot it fills, so a provider's\n * `engineCapabilities` set can be derived mechanically. Multiple\n * provider capabilities may share one engine slot (every `LLM_*`\n * capability maps to `AI_LLM`); de-duplicate after projecting.\n *\n * **Why this lives here (one map, three consumers).** The projection\n * used to be hand-copied in three places that silently drifted:\n *   1. The runtime registry projection in `saas-backend-lib`\n *      (`ExternalProvidersRegistryBackendService.buildRuntimeRegistryFromProviderModules`),\n *      which decides which provider answers `getProvidersForEngineCapability`.\n *   2. The backend companion-discovery export in\n *      `@wildo-ai/external-connectors-private` (feeds the generated\n *      `provider-catalog.types.ts` autocomplete via `wildo config sync`).\n *   3. The frontend companion-discovery export in\n *      `@wildo-ai/external-connectors-public` (same, for browser-bound\n *      provider modules).\n * A missing/wrong entry in any copy silently breaks a different surface\n * (a registry resolution, or the catalog autocomplete). It is co-located\n * with the `EngineCapability` enum it projects onto, and every consumer\n * imports it from the `@wildo-ai/saas-models` package root barrel.\n *\n * **Bundle boundary — why here and not beside `BUILTIN_PROVIDER_CAPABILITY`.**\n * This map references `EngineCapability`, which is deliberately kept off\n * the browser-safe `@wildo-ai/saas-models/public-runtime` seam. So it must\n * live in a full-only module. `engine-capabilities.shared.schemas.ts` is\n * exactly that (exported from the root barrel, never from\n * `public-runtime/index.ts`), whereas `provider-capability.shared.schemas.ts`\n * — the other natural home — IS on the public seam and would drag\n * `EngineCapability` into the browser bundle. The frontend discovery\n * consumer (#3) imports this map through its Node-only `./companion`\n * subpath, which already pulls the full root barrel; the browser-shipped\n * `./app`/`./techdoc`/`./website` subpaths never reach it.\n *\n * **BILLING → BILLING.** A billing provider (Stripe) declares\n * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills the\n * `EngineCapability.BILLING` slot — the SAME slot apps enable in\n * `defineSaaSProviders`/`engineCapabilities` activation config and that\n * `getProvidersForEngineCapability` gates resolution on. The runtime copy\n * of this projection historically mapped it onto a distinct\n * `EngineCapability.BILLING_PAYMENTS` slot instead, registering Stripe\n * under something no activation config enables and no consumer queries,\n * which made it unreachable through the registry. That second slot was\n * withdrawn from the enum on 2026-09-09 (see the WITHDRAWN block beside\n * the enum) — it had no producer and no consumer other than the bug.\n *\n * **Intentionally unmapped.** `SSO_OAUTH2`, `SSO_SAML`, `FRONTEND_SEARCH`,\n * `FRONTEND_FILE_PICKER`, and `FRONTEND_CAPTCHA` have no closed engine\n * slot today — they are fulfilled by provider protocols / app wiring, not\n * by an `EngineCapability`. Their absence here is by construction, not an\n * oversight: a `Partial<Record<…>>` lookup returns `undefined` and the\n * capability contributes nothing to a provider's `engineCapabilities`.\n *\n * There are no app-extended provider capabilities: the augmentation point was\n * removed as an extension point with no resolver (#502), so this map covers the\n * whole vocabulary rather than the built-in half of it.\n */\nconst PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: EngineCapability.EMAIL_TRANSACTIONAL,\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: EngineCapability.EMAIL_MARKETING,\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: EngineCapability.SMS,\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: EngineCapability.BILLING,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: EngineCapability.AI_LLM,\n  /**\n   * REPOINTED 2026-08-27 (RAG plan DL2/H4): `LLM_EMBEDDINGS` used to map into `AI_LLM`, which\n   * fused the chat and embeddings provider selections into one slot. The TOKEN keeps its name —\n   * it correctly says \"this provider can produce embeddings\", and it sits inside the anchored\n   * `saas.models.provider-capabilities` block compiled into shipped skills — only the slot it\n   * fills changed. Exactly one token claims the embeddings slot.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: EngineCapability.AI_EMBEDDINGS,\n  /**\n   * EXACTLY ONE token claims the document-extraction slot, and it is a new one. Checked rather\n   * than assumed before adding it: `IMAGE_GENERATION` maps to `AI_IMAGE_GENERATION` (output),\n   * `LLM_CHAT` to `AI_LLM`, `LLM_EMBEDDINGS` to `AI_EMBEDDINGS`, and no built-in token mapped\n   * anywhere near document INPUT. Repointing an existing token — the move that kept\n   * `LLM_EMBEDDINGS` alive — was not available here because none of them meant this.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: EngineCapability.AI_DOCUMENT_EXTRACTION,\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: EngineCapability.AI_CODING_AGENT,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: EngineCapability.AI_IMAGE_GENERATION,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: EngineCapability.FRONTEND_ERROR_MONITORING,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: EngineCapability.FRONTEND_PRODUCT_ANALYTICS,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: EngineCapability.LLM_OBSERVABILITY,\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: EngineCapability.OBSERVABILITY_TELEMETRY,\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n} as const satisfies Partial<Record<BuiltinProviderCapability, EngineCapability>>;\n\n/**\n * The projection every consumer uses, with the WIDE type it has always had.\n *\n * **Why the literal above and the widened alias here are two declarations.** Consumers index this\n * map with a `BuiltinProviderCapability` VARIABLE — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[cap]`\n * in the runtime registry, in both companion-discovery exports, in `defineSaaSProviders` and in the\n * tier rule — and that only type-checks against `Partial<Record<…>>`, which admits every token in\n * the vocabulary and answers `undefined` for the five that map nowhere. Annotating the literal that\n * way is what USED to be written here, and it is also what erased the information the totality\n * check below needs: an annotation discards the per-property literal types, so\n * `(typeof MAP)[keyof typeof MAP]` collapsed to `EngineCapability | undefined` and could not say\n * WHICH slots are filled.\n *\n * `as const satisfies` on the literal keeps both: the compiler still rejects a wrong key or a\n * non-`EngineCapability` value at the site where it is written, and the exact filled set survives\n * into the type system. The widening then happens once, here, so no consumer changes and nobody has\n * to know the literal exists.\n */\nexport const PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY: Partial<\n  Record<BuiltinProviderCapability, EngineCapability>\n> = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES;\n\n/**\n * Engine capabilities that DELIBERATELY have no provider capability pointing at them, each named\n * with the reason it is an empty slot rather than a hole.\n *\n * This exists so the two states can never be confused. Before it, an `EngineCapability` member with\n * no entry in the map above looked exactly like one whose entry someone forgot — the absence WAS the\n * record — and that indistinguishability is the whole mechanism behind three separate slots shipping\n * unfillable: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` (withdrawn 2026-09-03) and\n * `BILLING_PAYMENTS` (withdrawn 2026-09-09, and left standing for six days precisely because\n * \"reserved\" reads like a decision). A capability listed here has been looked at; one that is\n * neither listed here nor mapped above does not compile.\n *\n * **Both members are ACTIVATION capabilities, and that is the criterion.** Each is a real, live,\n * enabled-or-not decision an application makes in `wildo.saas.config.ts` (`ORGANIZATIONS` is\n * enabled by both dogfood applications, `MULTI_LANGUAGE` is written by the scaffold and by the\n * application-creation composition step), and each is implemented BY THE ENGINE — multi-tenancy is\n * the engine's own organization model and scoping, translation is the engine's own i18n pipeline.\n * There is no external party to select, so there is nothing for a provider capability to say. That\n * is categorically different from a withdrawn slot, which named work an external party WOULD do and\n * had no external party able to do it.\n *\n * **Adding a member here is a decision that must be argued, not a way to make a compile error go\n * away.** The test beside this file pins the set to exactly these two, so a third one cannot arrive\n * as a silent edit — see `__tests__/engine-capability-provider-coverage.shared.test.ts`.\n */\nexport const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY = [\n  /**\n   * Multi-tenancy: organizations, memberships, roles and organization scoping are engine resources\n   * and engine authorization. Nothing about them is procured.\n   */\n  EngineCapability.ORGANIZATIONS,\n  /**\n   * Application-wide i18n: the label tree, the locale negotiation and the translation pipeline are\n   * the engine's. Where translation is MODEL-backed it reaches a provider through `AI_LLM`, which is\n   * its own slot with its own selection — so even that path is not this capability's producer.\n   */\n  EngineCapability.MULTI_LANGUAGE,\n] as const satisfies readonly EngineCapability[];\n\n/**\n * COMPILE-TIME TOTALITY: every `EngineCapability` is either filled by a provider capability or\n * declared an empty slot above. Adding a member to the enum without doing one of the two is a\n * TypeScript error at this line, not a test failure and not a runtime surprise.\n *\n * A compile error is the right instrument here because both inputs are static literals in this one\n * file — there is no runtime state to consult, so nothing is gained by deferring the question to\n * execution, and a great deal is lost: a test only fails for someone who runs it, while this fails\n * for whoever adds the member, in the editor, before the commit.\n *\n * The error a violation produces is `TS2344` on `EngineCapabilityAccountedFor`, reading\n * `Type 'EngineCapability.X' does not satisfy the constraint 'never'` — X being the exact member\n * that is neither mapped nor declared. Measured rather than asserted: deleting the\n * `BUILTIN_PROVIDER_CAPABILITY.SMS` row from the literal above produced exactly that diagnostic,\n * naming `EngineCapability.SMS`, and the row was restored.\n *\n * The two declarations below are unused by design — the assertion IS the declaration, and it is\n * evaluated the moment the file is type-checked. `noUnusedLocals` is off in this package's\n * tsconfig, so nothing objects; do not \"clean them up\".\n */\ntype EngineCapabilityFilledByAProviderCapability =\n  (typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES)[keyof typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES];\n\ntype EngineCapabilityDeclaredEmpty = (typeof ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY)[number];\n\n/** Resolves to `never` when the two sets above cover the enum, and to the offending member(s) when they do not. */\ntype EngineCapabilityAccountedFor<Unaccounted extends never> = Unaccounted;\n\ntype _EveryEngineCapabilityIsMappedOrDeclaredEmpty = EngineCapabilityAccountedFor<\n  Exclude<EngineCapability, EngineCapabilityFilledByAProviderCapability | EngineCapabilityDeclaredEmpty>\n>;\n\n/**\n * The mirror assertion: a capability may not be BOTH mapped and declared empty.\n *\n * Without it the totality check is satisfiable by lying in the easier direction — list a mapped\n * capability as an empty slot and the union still covers the enum, so a genuinely missing mapping\n * elsewhere could be hidden by a bogus declaration here. `TS2344` again, naming the member that\n * appears on both sides.\n */\ntype _NoEngineCapabilityIsBothMappedAndDeclaredEmpty = EngineCapabilityAccountedFor<\n  Extract<EngineCapabilityDeclaredEmpty, EngineCapabilityFilledByAProviderCapability>\n>;\n\n/** @wildo_source:part:start saas.models.engine-capabilities.required-provider-floor facet:layer:shared facet:audience:app-developer */\n/**\n * Engine capabilities that REQUIRE a resolved provider the moment an\n * application ENABLES them — the engine-level MAIN floor (#328).\n *\n * The asymmetry is the thing to carry away: **enabling a capability with nothing serving it fails at\n * BOOT for these three and at the point of USE for every other slot.** So an author who tries one\n * unserved slot, sees the application come up, and concludes that an unserved capability degrades\n * gracefully has learned the wrong rule from the larger half of the vocabulary.\n *\n * `EngineCapabilityActivation.required` is the application's decision;\n * this set is the ENGINE's: for each member, an enabled capability with no\n * provider is not a degraded mode but a boot-time misconfiguration, because\n * an engine flow the application already relies on fails at first use:\n *\n * - `EMAIL_TRANSACTIONAL` — invitations, address verification and password\n *   reset are engine flows that send mail; with no provider they fail\n *   silently at the moment a user needs them.\n * - `BILLING` — `initializeBillingServices` already fails loud with no\n *   provider; the floor names it in the same place as the others.\n * - `SMS` — phone verification and MFA-by-SMS are engine flows.\n *\n * DELIBERATELY ABSENT, with the reason each would need to overturn:\n * - the `AI_*` slots — consumed per feature (an agent, the logo generator)\n *   and legitimately served on a DIFFERENT host (the companion reaches image\n *   generation; the backend need not), so \"enabled with no backend provider\"\n *   is a normal topology, not a fault. A feature that needs one refuses at\n *   its own site.\n * - the sinks (`COMPLIANCE_AUDIT_TRAIL`, `LLM_OBSERVABILITY`,\n *   `OBSERVABILITY_TELEMETRY`) — fail-OPEN by design (the G4 reconcile\n *   warns), because Layer-1 persistence is unaffected.\n * - `EMAIL_MARKETING` — a campaign feature, not an engine flow.\n * - the `FRONTEND_*` slots — resolved by the frontend facet, invisible to\n *   the backend registry that evaluates this floor.\n * - `ORGANIZATIONS` and `MULTI_LANGUAGE` — no provider token maps to them,\n *   deliberately and by declaration; see\n *   `ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`. A floor requiring a\n *   resolved provider for a slot nothing can fill would refuse every boot that\n *   enabled them. (`BILLING_PAYMENTS` was named here too until it was withdrawn\n *   from the enum on 2026-09-09.)\n *\n * The floor runs only on a host expected to SERVE these slots (see\n * `ApplicationRuntimeProfileBootAssertions.assertsEngineCapabilityProviderFloor`);\n * a minion's scope-filtered registry legitimately resolves none of them.\n */\nexport const ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED: ReadonlySet<EngineCapability> = new Set([\n  EngineCapability.EMAIL_TRANSACTIONAL,\n  EngineCapability.BILLING,\n  EngineCapability.SMS,\n]);\n/** @wildo_source:part:end saas.models.engine-capabilities.required-provider-floor */\n"]}
+{"version":3,"file":"engine-capabilities.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAkC,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,gBAoLX;AApLD,WAAY,gBAAgB;IAC1B,mDAA+B,CAAA;IAC/B,uCAAmB,CAAA;IACnB,qDAAiC,CAAA;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,qEAAiD,CAAA;IAEjD,+DAA2C,CAAA;IAC3C,uDAAmC,CAAA;IACnC;;;;;;;;;;OAUG;IACH,mDAA+B,CAAA;IAC/B,+BAAW,CAAA;IAEX,qCAAiB,CAAA;IACjB,+DAA2C,CAAA;IAC3C;;;;;;;;OAQG;IACH,mDAA+B,CAAA;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,qEAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uDAAmC,CAAA;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IAEH,2EAAuD,CAAA;IACvD,6EAAyD,CAAA;IAEzD;;;;;OAKG;IACH,2DAAuC,CAAA;IAEvC;;;;;;;;OAQG;IACH,uEAAmD,CAAA;AACrD,CAAC,EApLW,gBAAgB,KAAhB,gBAAgB,QAoL3B;AACD,6DAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,MAAM,gDAAgD,GAAG;IACvD,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACvF,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC/E,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC,aAAa;IAC3E,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,GAAG;IACvD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,OAAO;IAC/D,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,MAAM;IAC/D;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,aAAa;IAC5E;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;IAC/F,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC5E,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACpF,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,yBAAyB;IACnG,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,0BAA0B;IACrG,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,iBAAiB;IACnF,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,uBAAuB;IAC/F,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;CACd,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAEjD,gDAAgD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D;;;OAGG;IACH,gBAAgB,CAAC,aAAa;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,cAAc;CACe,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAkC,IAAI,GAAG,CAAC;IAC1G,gBAAgB,CAAC,mBAAmB;IACpC,gBAAgB,CAAC,OAAO;IACxB,gBAAgB,CAAC,GAAG;IACpB,gBAAgB,CAAC,aAAa;CAC/B,CAAC,CAAC;AACH,qFAAqF","sourcesContent":["import { BUILTIN_PROVIDER_CAPABILITY, type BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** @wildo_source:part:start saas.models.engine-capabilities facet:kind:api facet:audience:app-developer\n *\n * Closed application capability vocabulary used to declare what the\n * application needs from its configured providers.\n *\n * `EngineCapability` no longer means \"feature gate id\" and no longer\n * carries provider routing by itself. Provider-backed fulfillment is selected\n * by the application's provider configuration; entitlement/billing features\n * remain application feature decisions. Import this enum from\n * `@wildo-ai/saas-models` and declare only capabilities the application\n * actually intends to configure and operate.\n */\nexport enum EngineCapability {\n  ORGANIZATIONS = 'ORGANIZATIONS',\n  BILLING = 'BILLING',\n  MULTI_LANGUAGE = 'MULTI_LANGUAGE',\n  /**\n   * Durable, provider-backed audit trail: every audit event the application records is ALSO sent to\n   * each configured audit provider (an immutable ledger, a SIEM).\n   *\n   * Whether to enable it is a question of where the trail must live, not of what the application may\n   * claim. The assurance surface attests roughly half its control objectives through audit rows, and\n   * those rows are read from the application's OWN audit store, which exists whether or not this\n   * capability is on. So leaving it out removes no control objective an application can claim. Until\n   * 2026-09-14 the assurance basis wrongly treated this capability as the precondition for those\n   * claims, and this comment said leaving it out left about a third of them unclaimable.\n   *\n   * Two things this does NOT mean, because both are easy to assume:\n   *\n   * - It is not what makes security events happen. Authentication, authorization, privilege and\n   *   credential events are recorded in the application's own database regardless. What this\n   *   capability adds is the provider-backed fan-out — the durable, external, tamper-evident\n   *   destination an assurance reader can be pointed at.\n   * - It is not retroactive. Turning it on later starts a trail from that moment; it does not\n   *   furnish evidence for the period it was off, and a control's evidence cannot begin before its\n   *   evidence store does.\n   *\n   * So decide it with the compliance posture rather than as an infrastructure detail: enable it when\n   * the trail must also exist OUTSIDE the application — a store its own operators cannot rewrite, or a\n   * security team's SIEM. The application's own store stays the authoritative record either way.\n   */\n  COMPLIANCE_AUDIT_TRAIL = 'COMPLIANCE_AUDIT_TRAIL',\n\n  EMAIL_TRANSACTIONAL = 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING = 'EMAIL_MARKETING',\n  /**\n   * The application RECEIVES email: work arrives as messages to an address the application routes to\n   * an organization, and a channel handler decides what each message causes (#1630). The selected\n   * provider hosts the receiving domain, signs a notification per message and serves the message on\n   * request; the engine owns verification, deduplication, sender assurance, threads and replies.\n   *\n   * What it does NOT mean: a verified sender is identification, never authentication. A message's\n   * sender assurance gates what a handler accepts and grants no authority — the handler acts with\n   * the roles it declares, whoever wrote. Replies go out through `EMAIL_TRANSACTIONAL`, so the two\n   * slots may be served by different vendors.\n   */\n  EMAIL_INBOUND = 'EMAIL_INBOUND',\n  SMS = 'SMS',\n\n  AI_LLM = 'AI_LLM',\n  AI_IMAGE_GENERATION = 'AI_IMAGE_GENERATION',\n  /**\n   * Text → vector embeddings (the RAG derived-data tier: `.ragSource()` corpus embedding by the\n   * `rag:embedding-drain` worker, and query-time embedding in retrieval). A slot of its OWN,\n   * deliberately separate from `AI_LLM` (RAG plan DL2/H4): while `LLM_EMBEDDINGS` mapped into the\n   * `AI_LLM` slot, an application structurally could not pick Anthropic for chat and a different\n   * provider for embeddings — one `selection[AI_LLM].primary` decided both. Embeddings resolve\n   * through `EMBEDDINGS_PROVIDER` protocol bindings and are selected by applicability class\n   * (`Embeddings_Applicability`), never by a concrete model id at a call site.\n   */\n  AI_EMBEDDINGS = 'AI_EMBEDDINGS',\n  /**\n   * Document bytes → text: provider-backed extraction (OCR) for uploaded documents, serving\n   * `FileTextExtractionBackendService` and, through it, `.ragSource()` corpus ingestion.\n   *\n   * ## Why a slot of its own\n   *\n   * Three unrelated procurement decisions were otherwise fused. A deployment may well want one\n   * vendor for chat, another for embeddings, and a third for OCR — vendors are not equally good\n   * at all three, and their pricing models do not even share a unit (tokens vs. pages). Mapping\n   * extraction into `AI_LLM` would have made one `selection[AI_LLM].primary` decide all three,\n   * which is exactly the defect that split `AI_EMBEDDINGS` out of `AI_LLM`.\n   *\n   * ## Not to be confused with PDF GENERATION\n   *\n   * PDF generation — templates and data become bytes — is the `pdfTemplates` surface, done\n   * in-process and with no provider slot of its own. This is the opposite direction: bytes become\n   * text. The two are unrelated and nothing routes between them. (There WAS an\n   * `EngineCapability.DOCUMENT_GENERATION` that this paragraph used to name; it was withdrawn\n   * because no provider capability could ever fill it.)\n   *\n   * ## Absence is benign, and that is load-bearing\n   *\n   * With no provider selected, extraction falls back to the local `pdfjs-dist` text-layer read.\n   * That is a real answer for a born-digital PDF and returns nothing for a SCAN — so this\n   * capability is what makes scanned documents answerable, never what makes extraction work at\n   * all. An application that ingests only born-digital documents may leave it unset deliberately.\n   */\n  AI_DOCUMENT_EXTRACTION = 'AI_DOCUMENT_EXTRACTION',\n  /**\n   * An autonomous coding agent that mutates the application workspace.\n   *\n   * Its own slot rather than `AI_LLM`, for exactly the reason `AI_EMBEDDINGS`\n   * was split out of it: one `selection[AI_LLM].primary` decides every provider\n   * mapped into that slot. While the coding transport mapped to `AI_LLM`, an\n   * application structurally could NOT choose one vendor's coding agent and a\n   * different vendor for chat — picking a chat provider silently picked the\n   * agent that would be allowed to edit its source.\n   *\n   * The stakes differ too, which is why fusing them was wrong beyond the\n   * ergonomics: selecting a chat model is a quality and cost decision, while\n   * selecting the agent that writes your code is those things AND an\n   * authorisation decision. They deserve separate, deliberate answers.\n   */\n  AI_CODING_AGENT = 'AI_CODING_AGENT',\n\n  /*\n   * WITHDRAWN 2026-09-03: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` were members here and are\n   * not any more. Neither could ever be filled — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` had no\n   * entry pointing at either, so no provider capability token could claim the slot — while both were\n   * classified `SELECT_ONE`, which asserts that exactly one provider must be selected. Selecting one\n   * of zero candidates is not a resolution mode.\n   *\n   * Both capabilities are real and both are delivered elsewhere, which is why withdrawing the slots\n   * costs nothing: antivirus scanning is `InfraCapability.ANTIVIRUS_SCANNING`, fulfilled by ClamAV\n   * and consumed by `FileScanningBackendService`; PDF generation is the in-process `pdfTemplates`\n   * surface, rendered by `@react-pdf/renderer` inside the backend. Neither has an external\n   * provider, and neither is planned to.\n   *\n   * `InfraCapability.DOCUMENT_RENDERING` (Gotenberg) was provisioned beside the PDF surface and\n   * consumed by nothing; it was withdrawn on 2026-09-08 (#477) because in-process rendering had\n   * superseded it. Note the two are not interchangeable if it is ever reconsidered:\n   * `@react-pdf/renderer` composes a document from React primitives, while Gotenberg converts\n   * EXISTING HTML and Office documents — that is a different capability, not a second\n   * implementation of this one.\n   *\n   * Removing `ANTIVIRUS_SCANNING` also removes a collision: the identical spelling named an engine\n   * slot nothing could fill AND a live infra capability, in two packages, so a reader grepping the\n   * word landed in whichever they searched first.\n   *\n   * If a hosted AV or document-rendering vendor is ever adopted, the member comes back WITH its\n   * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` entry and its own JSDoc in the same change.\n   *\n   * WITHDRAWN 2026-09-09: `BILLING_PAYMENTS`, the third member of exactly that shape, and the one\n   * this paragraph's own closing rule should have caught. It was never withdrawn with the other two\n   * because it had been left behind DELIBERATELY — as a \"reserved slot\" — which reads as a decision\n   * and is why nobody re-examined it. Measured before removing, across the whole repository outside\n   * `node_modules` / `dist`: it appeared in live source at exactly THREE sites, and none of them was\n   * a use — the enum declaration itself, its row in the compile-forced\n   * `ENGINE_CAPABILITY_RESOLUTION_MODE` record, and a comment in a test naming it as a slot the\n   * billing provider must NOT be registered under. Zero applications enabled it, zero scaffolds\n   * wrote it, zero consumers queried it, and no provider capability token mapped to it.\n   *\n   * The capability it names is real and is already delivered: a billing provider (Stripe) declares\n   * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills `EngineCapability.BILLING`, which is the slot\n   * applications enable and `getProvidersForEngineCapability` gates on. Payment EXECUTION is served\n   * through that same provider's `BILLING_PROVIDER` protocol; splitting it into a second engine slot\n   * was a plan-era intention (`provider-registry-materialization-workflow.md`) that the shipped\n   * model settled the other way. So the withdrawal removes a name, not a capability.\n   *\n   * The reason a reserved slot is worse than no slot is `EngineCapabilityResolutionMode`: every\n   * member must be classified, `BILLING_PAYMENTS` was classified `SELECT_ONE`, and `SELECT_ONE`\n   * asserts that exactly one provider is selected from the candidates. There were zero candidates\n   * and there could never be one. A vocabulary member that no configuration can satisfy is not a\n   * reservation, it is a false statement the compiler is forced to carry.\n   *\n   * If a payments vendor is ever selected independently of the billing vendor, the member comes back\n   * with its provider-capability token and its map entry in the same change — the same rule as\n   * above, now with three instances behind it.\n   */\n\n  FRONTEND_ERROR_MONITORING = 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS = 'FRONTEND_PRODUCT_ANALYTICS',\n\n  /**\n   * Backend LLM-call observability (model/tokens/cost/latency per `invokeAgent`),\n   * platform-scoped. This enables model-call observability when the selected\n   * provider configuration supplies that capability; it does not itself\n   * configure a provider or make telemetry operational.\n   */\n  LLM_OBSERVABILITY = 'LLM_OBSERVABILITY',\n\n  /**\n   * Operational telemetry (traces/metrics/logs) shipped via the OpenTelemetry\n   * SDK over OTLP to a provider (for example, BetterStack). Unlike\n   * `LLM_OBSERVABILITY`, the connection is preloaded from\n   * `OTEL_*` env vars (the CLI translates the saas-config selection + per-env\n   * infra config into them) BEFORE app config — not resolved through the runtime\n   * registry. Author the corresponding infrastructure/provider settings in\n   * the application environment before relying on telemetry.\n   */\n  OBSERVABILITY_TELEMETRY = 'OBSERVABILITY_TELEMETRY',\n}\n/** @wildo_source:part:end saas.models.engine-capabilities */\n\n/**\n * Canonical, single-source-of-truth mapping from the open\n * `ProviderCapability` vocabulary (the built-in subset) to the closed\n * `EngineCapability` slots the engine actually fulfills.\n *\n * A provider declares which `providerCapabilities` it satisfies (e.g.\n * Stripe → `BILLING`, Resend → `EMAIL_TRANSACTIONAL`, Anthropic →\n * `LLM_CHAT`/`CODING_AGENT`). This map projects each built-in\n * capability onto the engine slot it fills, so a provider's\n * `engineCapabilities` set can be derived mechanically. Multiple\n * provider capabilities may share one engine slot (every `LLM_*`\n * capability maps to `AI_LLM`); de-duplicate after projecting.\n *\n * **Why this lives here (one map, three consumers).** The projection\n * used to be hand-copied in three places that silently drifted:\n *   1. The runtime registry projection in `saas-backend-lib`\n *      (`ExternalProvidersRegistryBackendService.buildRuntimeRegistryFromProviderModules`),\n *      which decides which provider answers `getProvidersForEngineCapability`.\n *   2. The backend companion-discovery export in\n *      `@wildo-ai/external-connectors-private` (feeds the generated\n *      `provider-catalog.types.ts` autocomplete via `wildo config sync`).\n *   3. The frontend companion-discovery export in\n *      `@wildo-ai/external-connectors-public` (same, for browser-bound\n *      provider modules).\n * A missing/wrong entry in any copy silently breaks a different surface\n * (a registry resolution, or the catalog autocomplete). It is co-located\n * with the `EngineCapability` enum it projects onto, and every consumer\n * imports it from the `@wildo-ai/saas-models` package root barrel.\n *\n * **Bundle boundary — why here and not beside `BUILTIN_PROVIDER_CAPABILITY`.**\n * This map references `EngineCapability`, which is deliberately kept off\n * the browser-safe `@wildo-ai/saas-models/public-runtime` seam. So it must\n * live in a full-only module. `engine-capabilities.shared.schemas.ts` is\n * exactly that (exported from the root barrel, never from\n * `public-runtime/index.ts`), whereas `provider-capability.shared.schemas.ts`\n * — the other natural home — IS on the public seam and would drag\n * `EngineCapability` into the browser bundle. The frontend discovery\n * consumer (#3) imports this map through its Node-only `./companion`\n * subpath, which already pulls the full root barrel; the browser-shipped\n * `./app`/`./techdoc`/`./website` subpaths never reach it.\n *\n * **BILLING → BILLING.** A billing provider (Stripe) declares\n * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills the\n * `EngineCapability.BILLING` slot — the SAME slot apps enable in\n * `defineSaaSProviders`/`engineCapabilities` activation config and that\n * `getProvidersForEngineCapability` gates resolution on. The runtime copy\n * of this projection historically mapped it onto a distinct\n * `EngineCapability.BILLING_PAYMENTS` slot instead, registering Stripe\n * under something no activation config enables and no consumer queries,\n * which made it unreachable through the registry. That second slot was\n * withdrawn from the enum on 2026-09-09 (see the WITHDRAWN block beside\n * the enum) — it had no producer and no consumer other than the bug.\n *\n * **Intentionally unmapped.** `SSO_OAUTH2`, `SSO_SAML`, `FRONTEND_SEARCH`,\n * `FRONTEND_FILE_PICKER`, `FRONTEND_CAPTCHA` and `FRONTEND_ADDRESS_LOOKUP`\n * (#1702 — an address field works without one, so no engine slot requires it)\n * have no closed engine slot today — they are fulfilled by provider protocols / app wiring, not\n * by an `EngineCapability`. Their absence here is by construction, not an\n * oversight: a `Partial<Record<…>>` lookup returns `undefined` and the\n * capability contributes nothing to a provider's `engineCapabilities`.\n *\n * There are no app-extended provider capabilities: the augmentation point was\n * removed as an extension point with no resolver (#502), so this map covers the\n * whole vocabulary rather than the built-in half of it.\n */\nconst PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: EngineCapability.EMAIL_TRANSACTIONAL,\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: EngineCapability.EMAIL_MARKETING,\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: EngineCapability.EMAIL_INBOUND,\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: EngineCapability.SMS,\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: EngineCapability.BILLING,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: EngineCapability.AI_LLM,\n  /**\n   * REPOINTED 2026-08-27 (RAG plan DL2/H4): `LLM_EMBEDDINGS` used to map into `AI_LLM`, which\n   * fused the chat and embeddings provider selections into one slot. The TOKEN keeps its name —\n   * it correctly says \"this provider can produce embeddings\", and it sits inside the anchored\n   * `saas.models.provider-capabilities` block compiled into shipped skills — only the slot it\n   * fills changed. Exactly one token claims the embeddings slot.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: EngineCapability.AI_EMBEDDINGS,\n  /**\n   * EXACTLY ONE token claims the document-extraction slot, and it is a new one. Checked rather\n   * than assumed before adding it: `IMAGE_GENERATION` maps to `AI_IMAGE_GENERATION` (output),\n   * `LLM_CHAT` to `AI_LLM`, `LLM_EMBEDDINGS` to `AI_EMBEDDINGS`, and no built-in token mapped\n   * anywhere near document INPUT. Repointing an existing token — the move that kept\n   * `LLM_EMBEDDINGS` alive — was not available here because none of them meant this.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: EngineCapability.AI_DOCUMENT_EXTRACTION,\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: EngineCapability.AI_CODING_AGENT,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: EngineCapability.AI_IMAGE_GENERATION,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: EngineCapability.FRONTEND_ERROR_MONITORING,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: EngineCapability.FRONTEND_PRODUCT_ANALYTICS,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: EngineCapability.LLM_OBSERVABILITY,\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: EngineCapability.OBSERVABILITY_TELEMETRY,\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n} as const satisfies Partial<Record<BuiltinProviderCapability, EngineCapability>>;\n\n/**\n * The projection every consumer uses, with the WIDE type it has always had.\n *\n * **Why the literal above and the widened alias here are two declarations.** Consumers index this\n * map with a `BuiltinProviderCapability` VARIABLE — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[cap]`\n * in the runtime registry, in both companion-discovery exports, in `defineSaaSProviders` and in the\n * tier rule — and that only type-checks against `Partial<Record<…>>`, which admits every token in\n * the vocabulary and answers `undefined` for the six that map nowhere. Annotating the literal that\n * way is what USED to be written here, and it is also what erased the information the totality\n * check below needs: an annotation discards the per-property literal types, so\n * `(typeof MAP)[keyof typeof MAP]` collapsed to `EngineCapability | undefined` and could not say\n * WHICH slots are filled.\n *\n * `as const satisfies` on the literal keeps both: the compiler still rejects a wrong key or a\n * non-`EngineCapability` value at the site where it is written, and the exact filled set survives\n * into the type system. The widening then happens once, here, so no consumer changes and nobody has\n * to know the literal exists.\n */\nexport const PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY: Partial<\n  Record<BuiltinProviderCapability, EngineCapability>\n> = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES;\n\n/**\n * Engine capabilities that DELIBERATELY have no provider capability pointing at them, each named\n * with the reason it is an empty slot rather than a hole.\n *\n * This exists so the two states can never be confused. Before it, an `EngineCapability` member with\n * no entry in the map above looked exactly like one whose entry someone forgot — the absence WAS the\n * record — and that indistinguishability is the whole mechanism behind three separate slots shipping\n * unfillable: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` (withdrawn 2026-09-03) and\n * `BILLING_PAYMENTS` (withdrawn 2026-09-09, and left standing for six days precisely because\n * \"reserved\" reads like a decision). A capability listed here has been looked at; one that is\n * neither listed here nor mapped above does not compile.\n *\n * **Both members are ACTIVATION capabilities, and that is the criterion.** Each is a real, live,\n * enabled-or-not decision an application makes in `wildo.saas.config.ts` (`ORGANIZATIONS` is\n * enabled by both dogfood applications, `MULTI_LANGUAGE` is written by the scaffold and by the\n * application-creation composition step), and each is implemented BY THE ENGINE — multi-tenancy is\n * the engine's own organization model and scoping, translation is the engine's own i18n pipeline.\n * There is no external party to select, so there is nothing for a provider capability to say. That\n * is categorically different from a withdrawn slot, which named work an external party WOULD do and\n * had no external party able to do it.\n *\n * **Adding a member here is a decision that must be argued, not a way to make a compile error go\n * away.** The test beside this file pins the set to exactly these two, so a third one cannot arrive\n * as a silent edit — see `__tests__/engine-capability-provider-coverage.shared.test.ts`.\n */\nexport const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY = [\n  /**\n   * Multi-tenancy: organizations, memberships, roles and organization scoping are engine resources\n   * and engine authorization. Nothing about them is procured.\n   */\n  EngineCapability.ORGANIZATIONS,\n  /**\n   * Application-wide i18n: the label tree, the locale negotiation and the translation pipeline are\n   * the engine's. Where translation is MODEL-backed it reaches a provider through `AI_LLM`, which is\n   * its own slot with its own selection — so even that path is not this capability's producer.\n   */\n  EngineCapability.MULTI_LANGUAGE,\n] as const satisfies readonly EngineCapability[];\n\n/**\n * COMPILE-TIME TOTALITY: every `EngineCapability` is either filled by a provider capability or\n * declared an empty slot above. Adding a member to the enum without doing one of the two is a\n * TypeScript error at this line, not a test failure and not a runtime surprise.\n *\n * A compile error is the right instrument here because both inputs are static literals in this one\n * file — there is no runtime state to consult, so nothing is gained by deferring the question to\n * execution, and a great deal is lost: a test only fails for someone who runs it, while this fails\n * for whoever adds the member, in the editor, before the commit.\n *\n * The error a violation produces is `TS2344` on `EngineCapabilityAccountedFor`, reading\n * `Type 'EngineCapability.X' does not satisfy the constraint 'never'` — X being the exact member\n * that is neither mapped nor declared. Measured rather than asserted: deleting the\n * `BUILTIN_PROVIDER_CAPABILITY.SMS` row from the literal above produced exactly that diagnostic,\n * naming `EngineCapability.SMS`, and the row was restored.\n *\n * The two declarations below are unused by design — the assertion IS the declaration, and it is\n * evaluated the moment the file is type-checked. `noUnusedLocals` is off in this package's\n * tsconfig, so nothing objects; do not \"clean them up\".\n */\ntype EngineCapabilityFilledByAProviderCapability =\n  (typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES)[keyof typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES];\n\ntype EngineCapabilityDeclaredEmpty = (typeof ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY)[number];\n\n/** Resolves to `never` when the two sets above cover the enum, and to the offending member(s) when they do not. */\ntype EngineCapabilityAccountedFor<Unaccounted extends never> = Unaccounted;\n\ntype _EveryEngineCapabilityIsMappedOrDeclaredEmpty = EngineCapabilityAccountedFor<\n  Exclude<EngineCapability, EngineCapabilityFilledByAProviderCapability | EngineCapabilityDeclaredEmpty>\n>;\n\n/**\n * The mirror assertion: a capability may not be BOTH mapped and declared empty.\n *\n * Without it the totality check is satisfiable by lying in the easier direction — list a mapped\n * capability as an empty slot and the union still covers the enum, so a genuinely missing mapping\n * elsewhere could be hidden by a bogus declaration here. `TS2344` again, naming the member that\n * appears on both sides.\n */\ntype _NoEngineCapabilityIsBothMappedAndDeclaredEmpty = EngineCapabilityAccountedFor<\n  Extract<EngineCapabilityDeclaredEmpty, EngineCapabilityFilledByAProviderCapability>\n>;\n\n/** @wildo_source:part:start saas.models.engine-capabilities.required-provider-floor facet:layer:shared facet:audience:app-developer */\n/**\n * Engine capabilities that REQUIRE a resolved provider the moment an\n * application ENABLES them — the engine-level MAIN floor (#328).\n *\n * The asymmetry is the thing to carry away: **enabling a capability with nothing serving it fails at\n * BOOT for these four and at the point of USE for every other slot.** So an author who tries one\n * unserved slot, sees the application come up, and concludes that an unserved capability degrades\n * gracefully has learned the wrong rule from the larger half of the vocabulary.\n *\n * `EngineCapabilityActivation.required` is the application's decision;\n * this set is the ENGINE's: for each member, an enabled capability with no\n * provider is not a degraded mode but a boot-time misconfiguration, because\n * an engine flow the application already relies on fails at first use:\n *\n * - `EMAIL_TRANSACTIONAL` — invitations, address verification and password\n *   reset are engine flows that send mail; with no provider they fail\n *   silently at the moment a user needs them.\n * - `BILLING` — `initializeBillingServices` already fails loud with no\n *   provider; the floor names it in the same place as the others.\n * - `SMS` — phone verification and MFA-by-SMS are engine flows.\n * - `EMAIL_INBOUND` — enabling it declares that work arrives by email; with no\n *   provider nothing hosts the receiving domain, so every message is lost\n *   before the engine sees it and nothing anywhere records that it was (#1630).\n *\n * DELIBERATELY ABSENT, with the reason each would need to overturn:\n * - the `AI_*` slots — consumed per feature (an agent, the logo generator)\n *   and legitimately served on a DIFFERENT host (the companion reaches image\n *   generation; the backend need not), so \"enabled with no backend provider\"\n *   is a normal topology, not a fault. A feature that needs one refuses at\n *   its own site.\n * - the sinks (`COMPLIANCE_AUDIT_TRAIL`, `LLM_OBSERVABILITY`,\n *   `OBSERVABILITY_TELEMETRY`) — fail-OPEN by design (the G4 reconcile\n *   warns), because Layer-1 persistence is unaffected.\n * - `EMAIL_MARKETING` — a campaign feature, not an engine flow.\n * - the `FRONTEND_*` slots — resolved by the frontend facet, invisible to\n *   the backend registry that evaluates this floor.\n * - `ORGANIZATIONS` and `MULTI_LANGUAGE` — no provider token maps to them,\n *   deliberately and by declaration; see\n *   `ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`. A floor requiring a\n *   resolved provider for a slot nothing can fill would refuse every boot that\n *   enabled them. (`BILLING_PAYMENTS` was named here too until it was withdrawn\n *   from the enum on 2026-09-09.)\n *\n * The floor runs only on a host expected to SERVE these slots (see\n * `ApplicationRuntimeProfileBootAssertions.assertsEngineCapabilityProviderFloor`);\n * a minion's scope-filtered registry legitimately resolves none of them.\n */\nexport const ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED: ReadonlySet<EngineCapability> = new Set([\n  EngineCapability.EMAIL_TRANSACTIONAL,\n  EngineCapability.BILLING,\n  EngineCapability.SMS,\n  EngineCapability.EMAIL_INBOUND,\n]);\n/** @wildo_source:part:end saas.models.engine-capabilities.required-provider-floor */\n"]}

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-resolution-mode.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,eAAe;IACzB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AA4DD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,gBAAgB,GAC3B,8BAA8B,CAEhC"}
+{"version":3,"file":"engine-capability-resolution-mode.shared.d.ts","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,eAAe;IACzB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AA+DD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,gBAAgB,GAC3B,8BAA8B,CAEhC"}

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.js

@@ -76,6 +76,9 @@ const ENGINE_CAPABILITY_RESOLUTION_MODE = {
     [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,
     [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,
     [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,
+    // One provider hosts a receiving domain's MX: two receivers of the same address cannot both be
+    // the destination, so inbound email is substitutable, never additive (#1630).
+    [EngineCapability.EMAIL_INBOUND]: EngineCapabilityResolutionMode.SELECT_ONE,
     [EngineCapability.SMS]: EngineCapabilityResolutionMode.SELECT_ONE,
     [EngineCapability.AI_LLM]: EngineCapabilityResolutionMode.SELECT_ONE,
     [EngineCapability.AI_IMAGE_GENERATION]: EngineCapabilityResolutionMode.SELECT_ONE,

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-resolution-mode.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BA0BX;AA1BD,WAAY,8BAA8B;IACxC;;;;;;;;;;;;;;;;OAgBG;IACH,2DAAyB,CAAA;IACzB;;;;;OAKG;IACH,qDAAmB,CAAA;AACrB,CAAC,EA1BW,8BAA8B,KAA9B,8BAA8B,QA0BzC;AACD,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,iCAAiC,GAA6D;IAClG,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,OAAO;IAEjF;;;;;;;;;;;;;;OAcG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACrE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC5E,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,8FAA8F;IAC9F,8FAA8F;IAC9F,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,oBAAoB;IACpB,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACvF,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACxF,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC/E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,UAAU;CACtF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA4B;IAE5B,OAAO,iCAAiC,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-resolution-mode facet:layer:shared facet:audience:app-developer\n *\n * How the engine resolves the provider(s) fulfilling an `EngineCapability`\n * when more than one is declared for the same scope.\n *\n * This is a FIRST-CLASS, declared property of a capability — NOT an implicit\n * per-consumer convention. A reader can tell whether a capability picks one\n * provider or writes to all of them; a new capability author declares it\n * here; and both the runtime registry resolver and the `defineSaaSProviders`\n * config validators branch on it (so a `FAN_OUT` capability is validated by\n * DECLARATION and never keyed off `selection`).\n */\nexport enum EngineCapabilityResolutionMode {\n  /**\n   * At most one active provider: the first eligible ref after selection ordering. The default for every capability\n   * (billing, email, observability, …), and a request is served by that one provider.\n   *\n   * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on\n   * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a\n   * primary that is not eligible in the active runtime scope. Eligible policy refs come first;\n   * remaining eligible providers follow, so an invalid primary does not empty that set.\n   * Eligibility requires a registered module declaring the capability and an active scope\n   * declaration for it; resolution does not validate credentials or vendor health. Nothing\n   * retries a second provider when a call to the first one FAILS: the send raises the primary's\n   * error and stops.\n   *\n   * So do not read a declared `whenUnavailable` entry as redundancy, and do not size an\n   * availability argument on it. An application that wants call-time failover builds it at its own\n   * call site, per capability — a deliberate framework boundary, not an omission.\n   */\n  SELECT_ONE = 'SELECT_ONE',\n  /**\n   * ALL declared providers are active simultaneously — every one receives\n   * every emission (no primary, no failover). For sinks whose nature is\n   * additive rather than substitutable: `COMPLIANCE_AUDIT_TRAIL` writes each\n   * audit event to every configured destination.\n   */\n  FAN_OUT = 'FAN_OUT',\n}\n/** @wildo_source:part:end saas.models.providers.capability-resolution-mode */\n\n/**\n * The DECLARED resolution mode for EVERY engine capability. Exhaustive by\n * construction: because this is a `Record<EngineCapability, …>`, adding a new\n * member to the `EngineCapability` enum WITHOUT classifying it here is a COMPILE\n * error. That is deliberate — a bare \"default to SELECT_ONE\" would let a future\n * additive/fan-out capability silently collapse to single-provider resolution\n * (dropping emissions to every non-primary destination) just because its author\n * forgot a one-line edit. The compiler now forces the decision.\n *\n * Only `COMPLIANCE_AUDIT_TRAIL` is `FAN_OUT` today (audit events are additive —\n * every declared destination receives every event). Everything else is\n * `SELECT_ONE`: one active provider, and no failover to a second one.\n */\nconst ENGINE_CAPABILITY_RESOLUTION_MODE: Record<EngineCapability, EngineCapabilityResolutionMode> = {\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: EngineCapabilityResolutionMode.FAN_OUT,\n\n  /**\n   * NOMINAL for the two ACTIVATION capabilities below, and worth stating because the next reader\n   * will otherwise ask the right question. `BILLING_PAYMENTS` was withdrawn from the enum on\n   * 2026-09-09 for being classified `SELECT_ONE` with no provider capability able to fill it —\n   * \"select one of zero candidates\" is not a resolution mode. `ORGANIZATIONS` and `MULTI_LANGUAGE`\n   * have no provider capability either, so why do they stand?\n   *\n   * Because nothing ever RESOLVES them. They are engine-implemented activations (multi-tenancy, the\n   * i18n pipeline): an application enables them, the engine serves them, and no code path asks this\n   * record which provider fulfills them — where the withdrawn slot's whole purpose was to be\n   * resolved and it could not be. Their absence from `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` is a\n   * DECLARATION (`ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`), not a gap, and the row here\n   * exists only because this record is total over the enum by construction — which is the property\n   * that makes a genuinely resolvable new capability impossible to leave unclassified.\n   */\n  [EngineCapability.ORGANIZATIONS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.BILLING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.SMS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_LLM]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_IMAGE_GENERATION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Embeddings are substitutable, not additive: one provider serves a vector space, and writing\n  // the same chunk through two providers would produce two incompatible spaces, not redundancy.\n  [EngineCapability.AI_EMBEDDINGS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Extraction is substitutable, not additive: one provider reads a document, and running the\n  // same bytes through two OCR services would produce two divergent transcriptions of one page\n  // with no principled way to merge them — plus a second egress of the same private content.\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One agent per task, and emphatically not fan-out: two coding agents given the same task\n  // against the same worktree do not produce redundancy, they produce a merge conflict nobody\n  // asked for — and the change attribution that follows a run could no longer say which agent\n  // wrote which file.\n  [EngineCapability.AI_CODING_AGENT]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.LLM_OBSERVABILITY]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: EngineCapabilityResolutionMode.SELECT_ONE,\n};\n\n/**\n * The declared resolution mode for an engine capability. A TOTAL lookup — every\n * capability is explicitly classified in `ENGINE_CAPABILITY_RESOLUTION_MODE`\n * (no silent default).\n *\n * Consumers: the runtime registry (`ExternalProvidersRegistryBackendService`\n * — `FAN_OUT` uses the full provider list, `SELECT_ONE` uses the primary) and\n * the `defineSaaSProviders` validators (a `FAN_OUT` capability is validated by\n * declaration and rejects a `selection` entry).\n */\nexport function getEngineCapabilityResolutionMode(\n  capability: EngineCapability,\n): EngineCapabilityResolutionMode {\n  return ENGINE_CAPABILITY_RESOLUTION_MODE[capability];\n}\n"]}
+{"version":3,"file":"engine-capability-resolution-mode.shared.js","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BA0BX;AA1BD,WAAY,8BAA8B;IACxC;;;;;;;;;;;;;;;;OAgBG;IACH,2DAAyB,CAAA;IACzB;;;;;OAKG;IACH,qDAAmB,CAAA;AACrB,CAAC,EA1BW,8BAA8B,KAA9B,8BAA8B,QA0BzC;AACD,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,iCAAiC,GAA6D;IAClG,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,OAAO;IAEjF;;;;;;;;;;;;;;OAcG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACrE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC5E,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,+FAA+F;IAC/F,8EAA8E;IAC9E,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,8FAA8F;IAC9F,8FAA8F;IAC9F,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,oBAAoB;IACpB,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACvF,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACxF,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC/E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,UAAU;CACtF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA4B;IAE5B,OAAO,iCAAiC,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-resolution-mode facet:layer:shared facet:audience:app-developer\n *\n * How the engine resolves the provider(s) fulfilling an `EngineCapability`\n * when more than one is declared for the same scope.\n *\n * This is a FIRST-CLASS, declared property of a capability — NOT an implicit\n * per-consumer convention. A reader can tell whether a capability picks one\n * provider or writes to all of them; a new capability author declares it\n * here; and both the runtime registry resolver and the `defineSaaSProviders`\n * config validators branch on it (so a `FAN_OUT` capability is validated by\n * DECLARATION and never keyed off `selection`).\n */\nexport enum EngineCapabilityResolutionMode {\n  /**\n   * At most one active provider: the first eligible ref after selection ordering. The default for every capability\n   * (billing, email, observability, …), and a request is served by that one provider.\n   *\n   * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on\n   * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a\n   * primary that is not eligible in the active runtime scope. Eligible policy refs come first;\n   * remaining eligible providers follow, so an invalid primary does not empty that set.\n   * Eligibility requires a registered module declaring the capability and an active scope\n   * declaration for it; resolution does not validate credentials or vendor health. Nothing\n   * retries a second provider when a call to the first one FAILS: the send raises the primary's\n   * error and stops.\n   *\n   * So do not read a declared `whenUnavailable` entry as redundancy, and do not size an\n   * availability argument on it. An application that wants call-time failover builds it at its own\n   * call site, per capability — a deliberate framework boundary, not an omission.\n   */\n  SELECT_ONE = 'SELECT_ONE',\n  /**\n   * ALL declared providers are active simultaneously — every one receives\n   * every emission (no primary, no failover). For sinks whose nature is\n   * additive rather than substitutable: `COMPLIANCE_AUDIT_TRAIL` writes each\n   * audit event to every configured destination.\n   */\n  FAN_OUT = 'FAN_OUT',\n}\n/** @wildo_source:part:end saas.models.providers.capability-resolution-mode */\n\n/**\n * The DECLARED resolution mode for EVERY engine capability. Exhaustive by\n * construction: because this is a `Record<EngineCapability, …>`, adding a new\n * member to the `EngineCapability` enum WITHOUT classifying it here is a COMPILE\n * error. That is deliberate — a bare \"default to SELECT_ONE\" would let a future\n * additive/fan-out capability silently collapse to single-provider resolution\n * (dropping emissions to every non-primary destination) just because its author\n * forgot a one-line edit. The compiler now forces the decision.\n *\n * Only `COMPLIANCE_AUDIT_TRAIL` is `FAN_OUT` today (audit events are additive —\n * every declared destination receives every event). Everything else is\n * `SELECT_ONE`: one active provider, and no failover to a second one.\n */\nconst ENGINE_CAPABILITY_RESOLUTION_MODE: Record<EngineCapability, EngineCapabilityResolutionMode> = {\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: EngineCapabilityResolutionMode.FAN_OUT,\n\n  /**\n   * NOMINAL for the two ACTIVATION capabilities below, and worth stating because the next reader\n   * will otherwise ask the right question. `BILLING_PAYMENTS` was withdrawn from the enum on\n   * 2026-09-09 for being classified `SELECT_ONE` with no provider capability able to fill it —\n   * \"select one of zero candidates\" is not a resolution mode. `ORGANIZATIONS` and `MULTI_LANGUAGE`\n   * have no provider capability either, so why do they stand?\n   *\n   * Because nothing ever RESOLVES them. They are engine-implemented activations (multi-tenancy, the\n   * i18n pipeline): an application enables them, the engine serves them, and no code path asks this\n   * record which provider fulfills them — where the withdrawn slot's whole purpose was to be\n   * resolved and it could not be. Their absence from `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` is a\n   * DECLARATION (`ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`), not a gap, and the row here\n   * exists only because this record is total over the enum by construction — which is the property\n   * that makes a genuinely resolvable new capability impossible to leave unclassified.\n   */\n  [EngineCapability.ORGANIZATIONS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.BILLING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One provider hosts a receiving domain's MX: two receivers of the same address cannot both be\n  // the destination, so inbound email is substitutable, never additive (#1630).\n  [EngineCapability.EMAIL_INBOUND]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.SMS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_LLM]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_IMAGE_GENERATION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Embeddings are substitutable, not additive: one provider serves a vector space, and writing\n  // the same chunk through two providers would produce two incompatible spaces, not redundancy.\n  [EngineCapability.AI_EMBEDDINGS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Extraction is substitutable, not additive: one provider reads a document, and running the\n  // same bytes through two OCR services would produce two divergent transcriptions of one page\n  // with no principled way to merge them — plus a second egress of the same private content.\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One agent per task, and emphatically not fan-out: two coding agents given the same task\n  // against the same worktree do not produce redundancy, they produce a merge conflict nobody\n  // asked for — and the change attribution that follows a run could no longer say which agent\n  // wrote which file.\n  [EngineCapability.AI_CODING_AGENT]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.LLM_OBSERVABILITY]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: EngineCapabilityResolutionMode.SELECT_ONE,\n};\n\n/**\n * The declared resolution mode for an engine capability. A TOTAL lookup — every\n * capability is explicitly classified in `ENGINE_CAPABILITY_RESOLUTION_MODE`\n * (no silent default).\n *\n * Consumers: the runtime registry (`ExternalProvidersRegistryBackendService`\n * — `FAN_OUT` uses the full provider list, `SELECT_ONE` uses the primary) and\n * the `defineSaaSProviders` validators (a `FAN_OUT` capability is validated by\n * declaration and rejects a `selection` entry).\n */\nexport function getEngineCapabilityResolutionMode(\n  capability: EngineCapability,\n): EngineCapabilityResolutionMode {\n  return ENGINE_CAPABILITY_RESOLUTION_MODE[capability];\n}\n"]}

package/dist/esm/external-providers/engine-capability-surface.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-surface.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-surface.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;;OAQG;IACH,eAAe,oBAAoB;IACnC;;;;;;;;;;;OAWG;IACH,mBAAmB,wBAAwB;CAC5C;AA+FD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,uBAAuB,EAAE,CAE5G;AAED;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAE3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAGrF"}
+{"version":3,"file":"engine-capability-surface.shared.d.ts","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-surface.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;;OAQG;IACH,eAAe,oBAAoB;IACnC;;;;;;;;;;;OAWG;IACH,mBAAmB,wBAAwB;CAC5C;AAiGD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,uBAAuB,EAAE,CAE5G;AAED;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAE3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAGrF"}

package/dist/esm/external-providers/engine-capability-surface.shared.js

@@ -132,6 +132,8 @@ const ENGINE_CAPABILITY_SURFACES = {
     [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: RUNTIME_ONLY,
     [EngineCapability.EMAIL_TRANSACTIONAL]: RUNTIME_ONLY,
     [EngineCapability.EMAIL_MARKETING]: RUNTIME_ONLY,
+    /** RUNTIME ONLY. Mail to the deployed application's organizations; the companion receives none (#1630). */
+    [EngineCapability.EMAIL_INBOUND]: RUNTIME_ONLY,
     [EngineCapability.SMS]: RUNTIME_ONLY,
     [EngineCapability.FRONTEND_ERROR_MONITORING]: RUNTIME_ONLY,
     [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: RUNTIME_ONLY,

package/dist/esm/external-providers/engine-capability-surface.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-surface.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-surface.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC;;;;;;;;OAQG;IACH,8DAAmC,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,sEAA2C,CAAA;AAC7C,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AACD,sEAAsE;AAEtE,uFAAuF;AACvF,MAAM,aAAa,GAAuC;IACxD,uBAAuB,CAAC,eAAe;IACvC,uBAAuB,CAAC,mBAAmB;CAC5C,CAAC;AACF,mFAAmF;AACnF,MAAM,YAAY,GAAuC,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,0BAA0B,GAAiE;IAC/F;;OAEG;IAEH;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,aAAa;IACxC;;;;;;;OAOG;IACH,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,aAAa;IACrD;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,CAAC,uBAAuB,CAAC,mBAAmB,CAAC;IACjF;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,gFAAgF;IAChF,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IAEvD;;;;;;OAMG;IACH,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,aAAa;IACnD,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,aAAa;IAEzD;;;;OAIG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,YAAY;IACxC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,YAAY;IAC/C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IACvD,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,YAAY;IACpD,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,YAAY;IAChD,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY;IACpC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,YAAY;IAC1D,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,YAAY;CAC5D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAA4B;IACtE,OAAO,0BAA0B,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qCAAqC,CAAC,UAA4B;IAChF,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,UAA4B;IAC1E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACvI,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-surface facet:layer:shared facet:audience:app-developer\n *\n * WHICH SURFACE of the system reaches an `EngineCapability` — the deployed\n * application serving its users, the development companion building that\n * application, or both.\n *\n * This exists because compliance is not one question. A privacy notice, a\n * record of processing and a processor agreement all describe what the\n * CONTRACTED SERVICE does with a data subject's personal data; a\n * secure-development or supply-chain control describes how the software was\n * BUILT. An application that answers the first honestly — \"my product performs\n * no AI processing of customer content\" — may still have been authored with an\n * AI coding agent, and until this axis existed it had no way to say so: one\n * `engineCapabilities` field answered both questions at once, so declaring the\n * build-time tool silently made the product claim a runtime feature.\n *\n * **A capability may serve BOTH, and that is the common case for the `AI_*`\n * slots.** The axis is therefore a SET, not a choice. What narrows a particular\n * declaration to one surface is the provider SCOPE it is declared in\n * (`companion` versus the runtime scopes) — this map says what the capability\n * CAN serve, the scope says what a given declaration DOES serve.\n */\nexport enum EngineCapabilitySurface {\n  /**\n   * Reached by the DEPLOYED application while it serves its users.\n   *\n   * This is the surface every customer-facing compliance statement is about:\n   * GDPR Art. 13/14 notices, Art. 30 records, Art. 28 processor terms, EU AI\n   * Act Art. 50 transparency, and service terms. If a capability is not on this\n   * surface, it processes no data subject's personal data through the\n   * contracted service, and a document about that service must not describe it.\n   */\n  RUNTIME_SERVICE = 'RUNTIME_SERVICE',\n  /**\n   * Reached by the DEVELOPMENT COMPANION while the application is being built.\n   *\n   * Operates on the application's own source, specifications and generated\n   * artifacts — never on a customer's data. Not exempt from compliance, and\n   * saying so is the point of the axis rather than a caveat to it: this is the\n   * surface NIST SP 800-53 SA-3/SA-8/SA-11/SA-15 and the SR supply-chain family\n   * are about, as are the secure-development and change-management controls of\n   * the commercial certification frameworks. It is simply a\n   * DIFFERENT set of obligations from the runtime ones, asked of a different\n   * artifact.\n   */\n  AUTHORING_COMPANION = 'AUTHORING_COMPANION',\n}\n/** @wildo_source:part:end saas.models.providers.capability-surface */\n\n/** Both surfaces, named once so the common `AI_*` answer is not retyped per member. */\nconst BOTH_SURFACES: readonly EngineCapabilitySurface[] = [\n  EngineCapabilitySurface.RUNTIME_SERVICE,\n  EngineCapabilitySurface.AUTHORING_COMPANION,\n];\n/** Runtime only — the answer for every capability the companion does not reach. */\nconst RUNTIME_ONLY: readonly EngineCapabilitySurface[] = [EngineCapabilitySurface.RUNTIME_SERVICE];\n\n/**\n * The DECLARED surfaces of EVERY engine capability. Exhaustive by construction:\n * because this is a `Record<EngineCapability, …>`, adding a member to the\n * `EngineCapability` enum WITHOUT classifying it here is a COMPILE error.\n *\n * That is the whole reason it is a Record rather than a lookup with a default,\n * and it is the same argument `ENGINE_CAPABILITY_RESOLUTION_MODE` makes beside\n * it: a bare \"default to RUNTIME_SERVICE\" would let a future build-time\n * capability silently enter a privacy notice as a product feature, which is\n * exactly the defect this map was created to close.\n *\n * **Every classification below is MEASURED against what reaches the capability\n * today, not against what plausibly might.** A capability whose companion\n * consumer is added later becomes a compile-visible decision at that moment,\n * which is better than a speculative `AUTHORING_COMPANION` nothing serves. A\n * per-host grep of the enum members was tried as the basis for this map and\n * REJECTED — it reports `AI_CODING_AGENT` as unreferenced on every host while\n * that capability is plainly companion-reached, because naming the enum and\n * reaching the capability are different things.\n */\nconst ENGINE_CAPABILITY_SURFACES: Record<EngineCapability, readonly EngineCapabilitySurface[]> = {\n  /*\n   * The four AI slots split two-and-two, and the split is the reason this map exists.\n   */\n\n  /**\n   * BOTH. An application may expose LLM features to its users, and the companion\n   * reaches an LLM for its own work: the meta-workflows structured-generation\n   * agent and the playbook judge (`META_WORKFLOWS_PROVIDER_REF`), and the\n   * brief-adequacy agent. Neither of those touches customer data.\n   */\n  [EngineCapability.AI_LLM]: BOTH_SURFACES,\n  /**\n   * BOTH. The companion's brand step generates and judges a logo through an\n   * IMAGE-modality agent; an application may equally offer image generation to\n   * its users. `engine-capabilities.shared.schemas.ts` already recorded this\n   * topology in prose — \"legitimately served on a DIFFERENT host (the companion\n   * reaches image generation; the backend need not)\" — one file before anything\n   * could read it.\n   */\n  [EngineCapability.AI_IMAGE_GENERATION]: BOTH_SURFACES,\n  /**\n   * AUTHORING ONLY, and this is the member the axis was written for. The coding\n   * agent writes the application's SOURCE. It is never reached while the\n   * application serves a user, so it belongs in a secure-development statement\n   * and must never appear in a statement about the contracted service.\n   */\n  [EngineCapability.AI_CODING_AGENT]: [EngineCapabilitySurface.AUTHORING_COMPANION],\n  /**\n   * RUNTIME ONLY. Embeddings are produced for `.ragSource()` fields as the\n   * application writes rows — a runtime feature over customer content. The\n   * companion has no embeddings consumer today; the only companion-side mention\n   * is a test asserting how an ABSENT capability is reported.\n   */\n  [EngineCapability.AI_EMBEDDINGS]: RUNTIME_ONLY,\n  /** RUNTIME ONLY. Extraction runs over content an application's users supply. */\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: RUNTIME_ONLY,\n\n  /*\n   * The two observability sinks are BOTH, because what they observe happens on\n   * both surfaces. The companion binds them itself: its container comments that\n   * the instrumentation \"must be installed in any runtime that binds\n   * LLM_OBSERVABILITY (this companion …)\", and its startup initializes for the\n   * LLM_OBSERVABILITY / OBSERVABILITY_TELEMETRY selection.\n   */\n  [EngineCapability.LLM_OBSERVABILITY]: BOTH_SURFACES,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: BOTH_SURFACES,\n\n  /*\n   * Everything below is RUNTIME ONLY: each is an engine flow of the deployed\n   * application, reached while it serves a user, and none has a companion\n   * consumer.\n   */\n  [EngineCapability.ORGANIZATIONS]: RUNTIME_ONLY,\n  [EngineCapability.BILLING]: RUNTIME_ONLY,\n  [EngineCapability.MULTI_LANGUAGE]: RUNTIME_ONLY,\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_MARKETING]: RUNTIME_ONLY,\n  [EngineCapability.SMS]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: RUNTIME_ONLY,\n};\n\n/**\n * The surfaces a capability may be reached on.\n *\n * Returns the declared set; never empty, because a capability nothing reaches\n * on either surface would have no reason to exist in the vocabulary.\n */\nexport function getEngineCapabilitySurfaces(capability: EngineCapability): readonly EngineCapabilitySurface[] {\n  return ENGINE_CAPABILITY_SURFACES[capability];\n}\n\n/**\n * Does this capability reach the DEPLOYED application serving its users?\n *\n * The predicate a customer-facing compliance statement asks. A capability for\n * which this is `false` processes no data subject's personal data through the\n * contracted service, so a privacy notice, a record of processing or a set of\n * service terms must not describe it as a feature of that service.\n */\nexport function engineCapabilityReachesRuntimeService(capability: EngineCapability): boolean {\n  return getEngineCapabilitySurfaces(capability).includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n\n/**\n * Is this capability reached ONLY while the application is being built?\n *\n * Deliberately not the negation of the predicate above: a capability that is\n * BOTH is reached at authoring time too, and a statement about how the software\n * is developed should include it. This names the narrower population — the\n * capabilities that are invisible to the running product — which is the set a\n * runtime-scoped document must exclude and a secure-development document must\n * not.\n */\nexport function engineCapabilityIsAuthoringOnly(capability: EngineCapability): boolean {\n  const surfaces = getEngineCapabilitySurfaces(capability);\n  return surfaces.includes(EngineCapabilitySurface.AUTHORING_COMPANION) && !surfaces.includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n"]}
+{"version":3,"file":"engine-capability-surface.shared.js","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-surface.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC;;;;;;;;OAQG;IACH,8DAAmC,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,sEAA2C,CAAA;AAC7C,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AACD,sEAAsE;AAEtE,uFAAuF;AACvF,MAAM,aAAa,GAAuC;IACxD,uBAAuB,CAAC,eAAe;IACvC,uBAAuB,CAAC,mBAAmB;CAC5C,CAAC;AACF,mFAAmF;AACnF,MAAM,YAAY,GAAuC,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,0BAA0B,GAAiE;IAC/F;;OAEG;IAEH;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,aAAa;IACxC;;;;;;;OAOG;IACH,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,aAAa;IACrD;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,CAAC,uBAAuB,CAAC,mBAAmB,CAAC;IACjF;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,gFAAgF;IAChF,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IAEvD;;;;;;OAMG;IACH,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,aAAa;IACnD,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,aAAa;IAEzD;;;;OAIG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,YAAY;IACxC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,YAAY;IAC/C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IACvD,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,YAAY;IACpD,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,YAAY;IAChD,2GAA2G;IAC3G,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY;IACpC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,YAAY;IAC1D,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,YAAY;CAC5D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAA4B;IACtE,OAAO,0BAA0B,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qCAAqC,CAAC,UAA4B;IAChF,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,UAA4B;IAC1E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACvI,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-surface facet:layer:shared facet:audience:app-developer\n *\n * WHICH SURFACE of the system reaches an `EngineCapability` — the deployed\n * application serving its users, the development companion building that\n * application, or both.\n *\n * This exists because compliance is not one question. A privacy notice, a\n * record of processing and a processor agreement all describe what the\n * CONTRACTED SERVICE does with a data subject's personal data; a\n * secure-development or supply-chain control describes how the software was\n * BUILT. An application that answers the first honestly — \"my product performs\n * no AI processing of customer content\" — may still have been authored with an\n * AI coding agent, and until this axis existed it had no way to say so: one\n * `engineCapabilities` field answered both questions at once, so declaring the\n * build-time tool silently made the product claim a runtime feature.\n *\n * **A capability may serve BOTH, and that is the common case for the `AI_*`\n * slots.** The axis is therefore a SET, not a choice. What narrows a particular\n * declaration to one surface is the provider SCOPE it is declared in\n * (`companion` versus the runtime scopes) — this map says what the capability\n * CAN serve, the scope says what a given declaration DOES serve.\n */\nexport enum EngineCapabilitySurface {\n  /**\n   * Reached by the DEPLOYED application while it serves its users.\n   *\n   * This is the surface every customer-facing compliance statement is about:\n   * GDPR Art. 13/14 notices, Art. 30 records, Art. 28 processor terms, EU AI\n   * Act Art. 50 transparency, and service terms. If a capability is not on this\n   * surface, it processes no data subject's personal data through the\n   * contracted service, and a document about that service must not describe it.\n   */\n  RUNTIME_SERVICE = 'RUNTIME_SERVICE',\n  /**\n   * Reached by the DEVELOPMENT COMPANION while the application is being built.\n   *\n   * Operates on the application's own source, specifications and generated\n   * artifacts — never on a customer's data. Not exempt from compliance, and\n   * saying so is the point of the axis rather than a caveat to it: this is the\n   * surface NIST SP 800-53 SA-3/SA-8/SA-11/SA-15 and the SR supply-chain family\n   * are about, as are the secure-development and change-management controls of\n   * the commercial certification frameworks. It is simply a\n   * DIFFERENT set of obligations from the runtime ones, asked of a different\n   * artifact.\n   */\n  AUTHORING_COMPANION = 'AUTHORING_COMPANION',\n}\n/** @wildo_source:part:end saas.models.providers.capability-surface */\n\n/** Both surfaces, named once so the common `AI_*` answer is not retyped per member. */\nconst BOTH_SURFACES: readonly EngineCapabilitySurface[] = [\n  EngineCapabilitySurface.RUNTIME_SERVICE,\n  EngineCapabilitySurface.AUTHORING_COMPANION,\n];\n/** Runtime only — the answer for every capability the companion does not reach. */\nconst RUNTIME_ONLY: readonly EngineCapabilitySurface[] = [EngineCapabilitySurface.RUNTIME_SERVICE];\n\n/**\n * The DECLARED surfaces of EVERY engine capability. Exhaustive by construction:\n * because this is a `Record<EngineCapability, …>`, adding a member to the\n * `EngineCapability` enum WITHOUT classifying it here is a COMPILE error.\n *\n * That is the whole reason it is a Record rather than a lookup with a default,\n * and it is the same argument `ENGINE_CAPABILITY_RESOLUTION_MODE` makes beside\n * it: a bare \"default to RUNTIME_SERVICE\" would let a future build-time\n * capability silently enter a privacy notice as a product feature, which is\n * exactly the defect this map was created to close.\n *\n * **Every classification below is MEASURED against what reaches the capability\n * today, not against what plausibly might.** A capability whose companion\n * consumer is added later becomes a compile-visible decision at that moment,\n * which is better than a speculative `AUTHORING_COMPANION` nothing serves. A\n * per-host grep of the enum members was tried as the basis for this map and\n * REJECTED — it reports `AI_CODING_AGENT` as unreferenced on every host while\n * that capability is plainly companion-reached, because naming the enum and\n * reaching the capability are different things.\n */\nconst ENGINE_CAPABILITY_SURFACES: Record<EngineCapability, readonly EngineCapabilitySurface[]> = {\n  /*\n   * The four AI slots split two-and-two, and the split is the reason this map exists.\n   */\n\n  /**\n   * BOTH. An application may expose LLM features to its users, and the companion\n   * reaches an LLM for its own work: the meta-workflows structured-generation\n   * agent and the playbook judge (`META_WORKFLOWS_PROVIDER_REF`), and the\n   * brief-adequacy agent. Neither of those touches customer data.\n   */\n  [EngineCapability.AI_LLM]: BOTH_SURFACES,\n  /**\n   * BOTH. The companion's brand step generates and judges a logo through an\n   * IMAGE-modality agent; an application may equally offer image generation to\n   * its users. `engine-capabilities.shared.schemas.ts` already recorded this\n   * topology in prose — \"legitimately served on a DIFFERENT host (the companion\n   * reaches image generation; the backend need not)\" — one file before anything\n   * could read it.\n   */\n  [EngineCapability.AI_IMAGE_GENERATION]: BOTH_SURFACES,\n  /**\n   * AUTHORING ONLY, and this is the member the axis was written for. The coding\n   * agent writes the application's SOURCE. It is never reached while the\n   * application serves a user, so it belongs in a secure-development statement\n   * and must never appear in a statement about the contracted service.\n   */\n  [EngineCapability.AI_CODING_AGENT]: [EngineCapabilitySurface.AUTHORING_COMPANION],\n  /**\n   * RUNTIME ONLY. Embeddings are produced for `.ragSource()` fields as the\n   * application writes rows — a runtime feature over customer content. The\n   * companion has no embeddings consumer today; the only companion-side mention\n   * is a test asserting how an ABSENT capability is reported.\n   */\n  [EngineCapability.AI_EMBEDDINGS]: RUNTIME_ONLY,\n  /** RUNTIME ONLY. Extraction runs over content an application's users supply. */\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: RUNTIME_ONLY,\n\n  /*\n   * The two observability sinks are BOTH, because what they observe happens on\n   * both surfaces. The companion binds them itself: its container comments that\n   * the instrumentation \"must be installed in any runtime that binds\n   * LLM_OBSERVABILITY (this companion …)\", and its startup initializes for the\n   * LLM_OBSERVABILITY / OBSERVABILITY_TELEMETRY selection.\n   */\n  [EngineCapability.LLM_OBSERVABILITY]: BOTH_SURFACES,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: BOTH_SURFACES,\n\n  /*\n   * Everything below is RUNTIME ONLY: each is an engine flow of the deployed\n   * application, reached while it serves a user, and none has a companion\n   * consumer.\n   */\n  [EngineCapability.ORGANIZATIONS]: RUNTIME_ONLY,\n  [EngineCapability.BILLING]: RUNTIME_ONLY,\n  [EngineCapability.MULTI_LANGUAGE]: RUNTIME_ONLY,\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_MARKETING]: RUNTIME_ONLY,\n  /** RUNTIME ONLY. Mail to the deployed application's organizations; the companion receives none (#1630). */\n  [EngineCapability.EMAIL_INBOUND]: RUNTIME_ONLY,\n  [EngineCapability.SMS]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: RUNTIME_ONLY,\n};\n\n/**\n * The surfaces a capability may be reached on.\n *\n * Returns the declared set; never empty, because a capability nothing reaches\n * on either surface would have no reason to exist in the vocabulary.\n */\nexport function getEngineCapabilitySurfaces(capability: EngineCapability): readonly EngineCapabilitySurface[] {\n  return ENGINE_CAPABILITY_SURFACES[capability];\n}\n\n/**\n * Does this capability reach the DEPLOYED application serving its users?\n *\n * The predicate a customer-facing compliance statement asks. A capability for\n * which this is `false` processes no data subject's personal data through the\n * contracted service, so a privacy notice, a record of processing or a set of\n * service terms must not describe it as a feature of that service.\n */\nexport function engineCapabilityReachesRuntimeService(capability: EngineCapability): boolean {\n  return getEngineCapabilitySurfaces(capability).includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n\n/**\n * Is this capability reached ONLY while the application is being built?\n *\n * Deliberately not the negation of the predicate above: a capability that is\n * BOTH is reached at authoring time too, and a statement about how the software\n * is developed should include it. This names the narrower population — the\n * capabilities that are invisible to the running product — which is the set a\n * runtime-scoped document must exclude and a secure-development document must\n * not.\n */\nexport function engineCapabilityIsAuthoringOnly(capability: EngineCapability): boolean {\n  const surfaces = getEngineCapabilitySurfaces(capability);\n  return surfaces.includes(EngineCapabilitySurface.AUTHORING_COMPANION) && !surfaces.includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n"]}

package/dist/esm/external-providers/external-providers.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-providers.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EAEf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE;;;;;;;;GAQG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAehD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9C,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM7F;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;iBA2C5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;kBAGvC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}
+{"version":3,"file":"external-providers.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EAEf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE;;;;;;;;GAQG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAehD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9C,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM7F;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;iBA2C5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;kBAGvC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/esm/external-providers/external-providers.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-providers.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EACd,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,uCAAuC;IACvC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAElE,oDAAoD;IACpD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjE,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,4EAA4E;IAC5E,kBAAkB,EAAE,+BAA+B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,MAAM,EAAE,EACV,qCAAqC,CACtC,CAAC;AAGF,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAEpB,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,8CAA8C;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;IAE9D,8CAA8C;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,mCAAmC;IACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,MAAM,EAAE,EACV,iCAAiC,CAClC,CAAC","sourcesContent":["/**\n * External Providers Shared Schemas\n *\n * Provides application-level registry schemas for external providers.\n * OAuth2 configurations are defined per-provider in @wildo-ai/external-connectors-models.\n */\n\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  OAuth2_Purpose,\n  OAuth2_ProviderDefinitionSchema,\n} from \"@wildo-ai/external-connectors-models\";\nimport { z } from \"zod\";\nimport { EngineCapability } from \"./engine-capabilities.shared.schemas\";\n\n// =============================================================================\n// EXTERNAL PROVIDERS REGISTRY\n// =============================================================================\n\n/**\n * External Providers Registry Item\n * Defines what protocols and capabilities a provider supports\n *\n * Note: This is a COMPUTED structure populated from:\n * - BackendProviderModule.providerCapabilities (what provider actually supports)\n * - Materialized provider scope selection (what capabilities are assigned to this provider)\n * - Capability requirements validation\n */\nexport const External_Providers_RegistryItemSchema = z.object({\n  /** Reference to the provider (string identifier) */\n  providerRef: z.string(),\n\n  /** Protocols this provider supports */\n  protocols: z.array(z.enum(ExternalProvider_ExchangeProtocol_Kind)),\n\n  /** Engine capabilities enabled for this provider */\n  engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n\n  /** Does this provider support OAuth2? */\n  supportsOAuth2: z.boolean().optional(),\n\n  /** Custom OAuth2 configuration (if needed to override provider defaults) */\n  customOAuth2Config: OAuth2_ProviderDefinitionSchema.partial().optional(),\n});\nexport type External_Providers_RegistryItem = z.infer<typeof External_Providers_RegistryItemSchema>;\n\n/**\n * External Providers Registry\n * Maps provider references to their configurations\n */\nexport const External_Providers_Registry_Schema = z.record(\n  z.string(),\n  External_Providers_RegistryItemSchema\n);\nexport type External_Providers_Registry = z.infer<typeof External_Providers_Registry_Schema>;\n\n// =============================================================================\n// OAUTH2 ENABLED PROVIDERS CONFIGURATION\n// =============================================================================\n\n/**\n * OAuth2 Enabled Provider Configuration\n * For configuring OAuth2 providers at the application level\n *\n * Note: OAuth2 protocol definitions are in each provider folder in external-connectors.\n * This schema is for application-level enabling/customization of OAuth2 providers.\n */\nexport const OAuth2EnabledProviderConfigSchema = z.object({\n  /** Provider reference (string identifier) */\n  provider: z.string(),\n\n  /** Is this provider enabled? */\n  enabled: z.boolean().default(true),\n\n  /** Allowed email domains for this provider */\n  allowedDomains: z.array(z.string()).optional(),\n\n  /** Purpose: SSO only, API only, or both */\n  purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.HYBRID),\n\n  /** Custom display name (overrides default) */\n  displayName: z.string().optional(),\n\n  /** Custom icon URL (overrides default) */\n  iconUrl: z.url().optional(),\n\n  /** Additional scopes to request */\n  additionalScopes: z.array(z.string()).optional(),\n\n  /**\n   * May an account re-prove who it is through this identity provider (#1441)?\n   *\n   * When on, an account whose link to this provider is an OIDC link can answer a re-authentication\n   * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in\n   * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`\n   * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the\n   * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is\n   * refused, never trusted.\n   *\n   * OFF by default, and it should be switched on only for a provider that honours those parameters.\n   * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`\n   * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value\n   * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security\n   * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.\n   * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from\n   * https://openid.net/specs/openid-connect-core-1_0.html\n   * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched\n   * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect\n   */\n  reAuthenticationEnabled: z.boolean().default(false),\n});\nexport type OAuth2EnabledProviderConfig = z.infer<typeof OAuth2EnabledProviderConfigSchema>;\n\n/**\n * OAuth2 Providers Configuration Map\n * Application-level configuration for all enabled OAuth2 providers\n */\nexport const OAuth2ProvidersConfigSchema = z.record(\n  z.string(),\n  OAuth2EnabledProviderConfigSchema\n);\nexport type OAuth2ProvidersConfig = z.infer<typeof OAuth2ProvidersConfigSchema>;\n"]}
+{"version":3,"file":"external-providers.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EACd,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,uCAAuC;IACvC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAElE,oDAAoD;IACpD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjE,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,4EAA4E;IAC5E,kBAAkB,EAAE,+BAA+B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,MAAM,EAAE,EACV,qCAAqC,CACtC,CAAC;AAGF,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAEpB,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,8CAA8C;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;IAE9D,8CAA8C;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,mCAAmC;IACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,MAAM,EAAE,EACV,iCAAiC,CAClC,CAAC","sourcesContent":["/**\n * External Providers Shared Schemas\n *\n * Provides application-level registry schemas for external providers.\n * OAuth2 configurations are defined per-provider in @wildo-ai/external-connectors-models.\n */\n\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  OAuth2_Purpose,\n  OAuth2_ProviderDefinitionSchema,\n} from \"@wildo-ai/external-connectors-models\";\nimport { z } from \"zod\";\nimport { EngineCapability } from \"./engine-capabilities.shared.schemas\";\n\n// =============================================================================\n// EXTERNAL PROVIDERS REGISTRY\n// =============================================================================\n\n/**\n * External Providers Registry Item\n * Defines what protocols and capabilities a provider supports\n *\n * Note: This is a COMPUTED structure populated from:\n * - BackendProviderModule.providerCapabilities (what provider actually supports)\n * - Materialized provider scope selection (what capabilities are assigned to this provider)\n * - Capability requirements validation\n */\nexport const External_Providers_RegistryItemSchema = z.object({\n  /** Reference to the provider (string identifier) */\n  providerRef: z.string(),\n\n  /** Protocols this provider supports */\n  protocols: z.array(z.enum(ExternalProvider_ExchangeProtocol_Kind)),\n\n  /** Engine capabilities enabled for this provider */\n  engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n\n  /** Does this provider support OAuth2? */\n  supportsOAuth2: z.boolean().optional(),\n\n  /** Custom OAuth2 configuration (if needed to override provider defaults) */\n  customOAuth2Config: OAuth2_ProviderDefinitionSchema.partial().optional(),\n});\nexport type External_Providers_RegistryItem = z.infer<typeof External_Providers_RegistryItemSchema>;\n\n/**\n * External Providers Registry\n * Maps provider references to their configurations\n */\nexport const External_Providers_Registry_Schema = z.record(\n  z.string(),\n  External_Providers_RegistryItemSchema\n);\nexport type External_Providers_Registry = z.infer<typeof External_Providers_Registry_Schema>;\n\n// =============================================================================\n// OAUTH2 ENABLED PROVIDERS CONFIGURATION\n// =============================================================================\n\n/**\n * OAuth2 Enabled Provider Configuration\n * For configuring OAuth2 providers at the application level\n *\n * Note: OAuth2 protocol definitions are in each provider folder in external-connectors.\n * This schema is for application-level enabling/customization of OAuth2 providers.\n */\nexport const OAuth2EnabledProviderConfigSchema = z.object({\n  /** Provider reference (string identifier) */\n  provider: z.string(),\n\n  /** Is this provider enabled? */\n  enabled: z.boolean().default(true),\n\n  /** Allowed email domains for this provider */\n  allowedDomains: z.array(z.string()).optional(),\n\n  /** Purpose: SSO only, API only, or both */\n  purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.HYBRID),\n\n  /** Custom display name (overrides default) */\n  displayName: z.string().optional(),\n\n  /** Custom icon URL (overrides default) */\n  iconUrl: z.url().optional(),\n\n  /** Additional scopes to request */\n  additionalScopes: z.array(z.string()).optional(),\n\n  /**\n   * May an account re-prove who it is through this identity provider (#1441)?\n   *\n   * When on, an account whose link to this provider is an OIDC link can answer a re-authentication\n   * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in\n   * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`\n   * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the\n   * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is\n   * refused, never trusted.\n   *\n   * OFF by default, and it should be switched on only for a provider that honours those parameters.\n   * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`\n   * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value\n   * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security\n   * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.\n   * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from\n   * https://openid.net/specs/openid-connect-core-1_0.html\n   * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched\n   * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect\n   */\n  reAuthenticationEnabled: z.boolean().default(false),\n});\nexport type OAuth2EnabledProviderConfig = z.infer<typeof OAuth2EnabledProviderConfigSchema>;\n\n/**\n * OAuth2 Providers Configuration Map\n * Application-level configuration for all enabled OAuth2 providers\n */\nexport const OAuth2ProvidersConfigSchema = z.record(\n  z.string(),\n  OAuth2EnabledProviderConfigSchema\n);\nexport type OAuth2ProvidersConfig = z.infer<typeof OAuth2ProvidersConfigSchema>;\n"]}