@wildo-ai/saas-models 1.1.6 → 1.1.7

package/dist/esm/external-data/external-data-provenance.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-data-provenance.shared.js","sourceRoot":"","sources":["../../../../src/external-data/external-data-provenance.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,wCAAwC,EACxC,6BAA6B,GAE9B,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yCAAyC,CAAC,WAA4C;IACpG,IAAI,WAAW,CAAC,SAAS,KAAK,6BAA6B,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,sBAAsB;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IACvF,IAAI,WAAW,CAAC,uBAAuB;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IACzF,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxC,mHAAmH;QACnH,+DAA+D;QAC/D,IAAI,WAAW,CAAC,SAAS,KAAK,6BAA6B,CAAC,aAAa,IAAI,6BAA6B,CAAC,KAAK,CAAC,KAAK,sBAAsB,CAAC,MAAM;YAAE,SAAS;QAC9J,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,0BAA0B,CAAC;AAEjF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,MAAM,EAAE,wBAAwB;IAChC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC","sourcesContent":["/**\n * Where a pipeline-written value came from, and how current it is (#1997) — the contract shared by the per-resource\n * provenance route and the field chrome that shows it.\n *\n * ## What a reader is told, and why at PIPELINE grain\n *\n * A field an external-data pipeline writes renders exactly like any other read-only field, so nothing told the person\n * reading it that the value belongs to a system of record rather than to this application, nor how old the local copy\n * is. The cue answers both: \"synced from ⟨instance⟩ · as of ⟨last completed pass⟩\".\n *\n * The \"as of\" is the START of the pipeline's most recent COMPLETED PASS, never a per-row instant, because no honest\n * per-row instant exists: the load reconciles by CONTENT, so an unchanged row is skipped and never written; the row's\n * seed metadata records only the FIRST stamp; and `updatedAt` also moves when a member edits an application-owned field.\n * After a completed pass, a row the pass loaded was current as of the moment the pass BEGAN reading — so the start of\n * the pass, not the start of the run that finished it: a full pass bounded by `maxRowsPerRun` spans several runs, and a\n * row read by the first of them is only as current as that first run. An incremental pass counts too: it re-read every\n * row that changed, so present rows are current as of it (deletion detection is what a FULL pass adds).\n *\n * What the cue does NOT promise, stated so nobody reads more into it: it describes the PASS, not the row. A row the pass\n * REJECTED keeps its previous version, and a row the source deleted stays in place under the REPORT orphan policy; both\n * are older than the cue says. The run history names both (#1740).\n */\nimport { z } from 'zod';\nimport { SystemOfRecordNameSchema } from '../systems-of-record/system-of-record-declaration.shared.schemas';\nimport {\n  ExternalDataFieldOwner,\n  ExternalDataPipelineDirection,\n  listExternalDataMappingEntryRemoteFields,\n  resolveExternalDataFieldOwner,\n  type ExternalDataPipelineDeclaration,\n} from './external-data-pipeline.shared.schemas';\n\n/**\n * Every LOCAL field whose value is a function of the remote row — the fields the provenance cue belongs on (#1997).\n *\n * - the remote key (`remoteKeyLocalField`);\n * - every mapping entry that READS at least one remote field, whatever its kind — REMOTE_FIELD, REMOTE_REFERENCE and\n *   the four declared expressions. Decided by {@link listExternalDataMappingEntryRemoteFields}, which is total over the\n *   entry kinds, so a kind added tomorrow is classified by what it reads rather than by a list kept here;\n * - both partition stamps: `partitionKeyLocalField` copies the remote partition verbatim, and\n *   `partitionUnitLocalField` is the unit the remote partition is assigned to, so both change when the remote row does.\n *\n * Deliberately EXCLUDED:\n * - a CONSTANT entry: the pipeline writes it, but its value is declared here, not synced from anywhere — saying\n *   \"synced from Odoo\" over it would be false;\n * - the tenant stamp (`organizationId`): engine-written from the owner organization, never from the remote row, and\n *   never named by a declaration at all;\n * - every field no mapping names (`internalNote` on Wonder Todos' `externalCustomers`): application-owned, the reason\n *   the resource is a pipeline rather than a read-through.\n *\n * Only TOP-LEVEL field names: a mapping entry targets a top-level local field, so a nested path is never pipeline-written.\n *\n * EMPTY for an OUTBOUND pipeline (#1690): its mapped fields are the application's own and are SENT to the system of\n * record, never synced from it, so \"synced from ⟨instance⟩\" would be false on every one of them — and the route is not\n * mounted for it either. The remote key it holds is the address of the copy the system of record keeps, not a value\n * read from it.\n */\nexport function listExternalDataPipelineSyncedLocalFields(declaration: ExternalDataPipelineDeclaration): readonly string[] {\n  if (declaration.direction === ExternalDataPipelineDirection.OUTBOUND) return [];\n  const fields = new Set<string>([declaration.remoteKeyLocalField]);\n  if (declaration.partitionKeyLocalField) fields.add(declaration.partitionKeyLocalField);\n  if (declaration.partitionUnitLocalField) fields.add(declaration.partitionUnitLocalField);\n  for (const entry of declaration.mapping) {\n    // A BIDIRECTIONAL pipeline's LOCAL and BOTH fields are written here too (#1723): only a REMOTE field is the system\n    // of record's copy, so only it carries the \"synced from\" note.\n    if (declaration.direction === ExternalDataPipelineDirection.BIDIRECTIONAL && resolveExternalDataFieldOwner(entry) !== ExternalDataFieldOwner.REMOTE) continue;\n    if (listExternalDataMappingEntryRemoteFields(entry).length > 0) fields.add(entry.localField);\n  }\n  return [...fields];\n}\n\n/**\n * The path segment of the provenance route, appended to the destination's LIST collection URL:\n * `GET /api/v1/…/<resource>/external-data-provenance`. One constant, so the backend that mounts the route and the\n * frontend that composes its URL describe one path rather than two that happen to agree.\n */\nexport const EXTERNAL_DATA_PROVENANCE_ROUTE_SEGMENT = 'external-data-provenance';\n\n/**\n * What the provenance route answers.\n *\n * `system` is the declared instance NAME, not words: a reader resolves the words through\n * `buildSystemOfRecordDisplayNameLabelKey(system)`. `currentAsOf` is when the most recent COMPLETED pass began reading\n * (ISO 8601) — the first run of that pass, not the run that finished it — or null when the pipeline has never completed\n * one, or when its history no longer reaches back to where that pass began; a surface then says nothing rather than\n * implying a currency the copy does not have.\n */\nexport const ExternalDataProvenanceResponseSchema = z.strictObject({\n  system: SystemOfRecordNameSchema,\n  currentAsOf: z.iso.datetime().nullable(),\n});\nexport type ExternalDataProvenanceResponse = z.infer<typeof ExternalDataProvenanceResponseSchema>;\n"]}
+{"version":3,"file":"external-data-provenance.shared.js","sourceRoot":"","sources":["../../../src/external-data/external-data-provenance.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,wCAAwC,EACxC,6BAA6B,GAE9B,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yCAAyC,CAAC,WAA4C;IACpG,IAAI,WAAW,CAAC,SAAS,KAAK,6BAA6B,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,sBAAsB;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IACvF,IAAI,WAAW,CAAC,uBAAuB;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IACzF,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxC,mHAAmH;QACnH,+DAA+D;QAC/D,IAAI,WAAW,CAAC,SAAS,KAAK,6BAA6B,CAAC,aAAa,IAAI,6BAA6B,CAAC,KAAK,CAAC,KAAK,sBAAsB,CAAC,MAAM;YAAE,SAAS;QAC9J,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,0BAA0B,CAAC;AAEjF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,MAAM,EAAE,wBAAwB;IAChC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC","sourcesContent":["/**\n * Where a pipeline-written value came from, and how current it is (#1997) — the contract shared by the per-resource\n * provenance route and the field chrome that shows it.\n *\n * ## What a reader is told, and why at PIPELINE grain\n *\n * A field an external-data pipeline writes renders exactly like any other read-only field, so nothing told the person\n * reading it that the value belongs to a system of record rather than to this application, nor how old the local copy\n * is. The cue answers both: \"synced from ⟨instance⟩ · as of ⟨last completed pass⟩\".\n *\n * The \"as of\" is the START of the pipeline's most recent COMPLETED PASS, never a per-row instant, because no honest\n * per-row instant exists: the load reconciles by CONTENT, so an unchanged row is skipped and never written; the row's\n * seed metadata records only the FIRST stamp; and `updatedAt` also moves when a member edits an application-owned field.\n * After a completed pass, a row the pass loaded was current as of the moment the pass BEGAN reading — so the start of\n * the pass, not the start of the run that finished it: a full pass bounded by `maxRowsPerRun` spans several runs, and a\n * row read by the first of them is only as current as that first run. An incremental pass counts too: it re-read every\n * row that changed, so present rows are current as of it (deletion detection is what a FULL pass adds).\n *\n * What the cue does NOT promise, stated so nobody reads more into it: it describes the PASS, not the row. A row the pass\n * REJECTED keeps its previous version, and a row the source deleted stays in place under the REPORT orphan policy; both\n * are older than the cue says. The run history names both (#1740).\n */\nimport { z } from 'zod';\nimport { SystemOfRecordNameSchema } from '../systems-of-record/system-of-record-declaration.shared.schemas';\nimport {\n  ExternalDataFieldOwner,\n  ExternalDataPipelineDirection,\n  listExternalDataMappingEntryRemoteFields,\n  resolveExternalDataFieldOwner,\n  type ExternalDataPipelineDeclaration,\n} from './external-data-pipeline.shared.schemas';\n\n/**\n * Every LOCAL field whose value is a function of the remote row — the fields the provenance cue belongs on (#1997).\n *\n * - the remote key (`remoteKeyLocalField`);\n * - every mapping entry that READS at least one remote field, whatever its kind — REMOTE_FIELD, REMOTE_REFERENCE and\n *   the four declared expressions. Decided by {@link listExternalDataMappingEntryRemoteFields}, which is total over the\n *   entry kinds, so a kind added tomorrow is classified by what it reads rather than by a list kept here;\n * - both partition stamps: `partitionKeyLocalField` copies the remote partition verbatim, and\n *   `partitionUnitLocalField` is the unit the remote partition is assigned to, so both change when the remote row does.\n *\n * Deliberately EXCLUDED:\n * - a CONSTANT entry: the pipeline writes it, but its value is declared here, not synced from anywhere — saying\n *   \"synced from Odoo\" over it would be false;\n * - the tenant stamp (`organizationId`): engine-written from the owner organization, never from the remote row, and\n *   never named by a declaration at all;\n * - every field no mapping names (`internalNote` on Wonder Todos' `externalCustomers`): application-owned, the reason\n *   the resource is a pipeline rather than a read-through.\n *\n * Only TOP-LEVEL field names: a mapping entry targets a top-level local field, so a nested path is never pipeline-written.\n *\n * EMPTY for an OUTBOUND pipeline (#1690): its mapped fields are the application's own and are SENT to the system of\n * record, never synced from it, so \"synced from ⟨instance⟩\" would be false on every one of them — and the route is not\n * mounted for it either. The remote key it holds is the address of the copy the system of record keeps, not a value\n * read from it.\n */\nexport function listExternalDataPipelineSyncedLocalFields(declaration: ExternalDataPipelineDeclaration): readonly string[] {\n  if (declaration.direction === ExternalDataPipelineDirection.OUTBOUND) return [];\n  const fields = new Set<string>([declaration.remoteKeyLocalField]);\n  if (declaration.partitionKeyLocalField) fields.add(declaration.partitionKeyLocalField);\n  if (declaration.partitionUnitLocalField) fields.add(declaration.partitionUnitLocalField);\n  for (const entry of declaration.mapping) {\n    // A BIDIRECTIONAL pipeline's LOCAL and BOTH fields are written here too (#1723): only a REMOTE field is the system\n    // of record's copy, so only it carries the \"synced from\" note.\n    if (declaration.direction === ExternalDataPipelineDirection.BIDIRECTIONAL && resolveExternalDataFieldOwner(entry) !== ExternalDataFieldOwner.REMOTE) continue;\n    if (listExternalDataMappingEntryRemoteFields(entry).length > 0) fields.add(entry.localField);\n  }\n  return [...fields];\n}\n\n/**\n * The path segment of the provenance route, appended to the destination's LIST collection URL:\n * `GET /api/v1/…/<resource>/external-data-provenance`. One constant, so the backend that mounts the route and the\n * frontend that composes its URL describe one path rather than two that happen to agree.\n */\nexport const EXTERNAL_DATA_PROVENANCE_ROUTE_SEGMENT = 'external-data-provenance';\n\n/**\n * What the provenance route answers.\n *\n * `system` is the declared instance NAME, not words: a reader resolves the words through\n * `buildSystemOfRecordDisplayNameLabelKey(system)`. `currentAsOf` is when the most recent COMPLETED pass began reading\n * (ISO 8601) — the first run of that pass, not the run that finished it — or null when the pipeline has never completed\n * one, or when its history no longer reaches back to where that pass began; a surface then says nothing rather than\n * implying a currency the copy does not have.\n */\nexport const ExternalDataProvenanceResponseSchema = z.strictObject({\n  system: SystemOfRecordNameSchema,\n  currentAsOf: z.iso.datetime().nullable(),\n});\nexport type ExternalDataProvenanceResponse = z.infer<typeof ExternalDataProvenanceResponseSchema>;\n"]}

package/dist/esm/external-data.exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-data.exports.d.ts","sourceRoot":"","sources":["../../../src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AAEnE,cAAc,kEAAkE,CAAC;AACjF,cAAc,2DAA2D,CAAC;AAE1E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AAEtE,cAAc,2DAA2D,CAAC;AAE1E,cAAc,iDAAiD,CAAC;AAGhE,cAAc,2DAA2D,CAAC"}
+{"version":3,"file":"external-data.exports.d.ts","sourceRoot":"","sources":["../../src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AAEnE,cAAc,kEAAkE,CAAC;AACjF,cAAc,2DAA2D,CAAC;AAE1E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AAEtE,cAAc,2DAA2D,CAAC;AAE1E,cAAc,iDAAiD,CAAC;AAGhE,cAAc,2DAA2D,CAAC"}

package/dist/esm/external-data.exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-data.exports.js","sourceRoot":"","sources":["../../../src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AACnE,4GAA4G;AAC5G,cAAc,kEAAkE,CAAC;AACjF,cAAc,2DAA2D,CAAC;AAC1E,qHAAqH;AACrH,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AACtE,+GAA+G;AAC/G,cAAc,2DAA2D,CAAC;AAC1E,+HAA+H;AAC/H,cAAc,iDAAiD,CAAC;AAChE,uGAAuG;AACvG,kFAAkF;AAClF,cAAc,2DAA2D,CAAC","sourcesContent":["/**\n * `@wildo-ai/saas-models/external-data` — the AUTHORING contract for data that lives in another\n * system: the read-through VIRTUAL binding (`httpApiBinding`) and the copy-in PIPELINE\n * (`externalDataPipeline`).\n *\n * ## Why this is a subpath rather than root, and why it is not in `saas-backend-lib`\n *\n * Both questions were measured on 2026-08-29 rather than argued.\n *\n * It is NOT backend-lib, even though only the backend has a runtime for it, because an application\n * author writes these declarations in `*.resources-config.ts` — which lives in the app's\n * `shared-lib`, a package that depends on `@wildo-ai/saas-models` and deliberately NOT on\n * `@wildo-ai/saas-backend-lib` (the frontend imports `shared-lib`, so a backend dependency there\n * would drag the backend graph browser-ward). Nothing in these modules is runtime: every symbol —\n * dialects, tenancy, erasure, key fields, population, orphan policy, coercions — is typed by a\n * human in a schema file. The runtime that consumes them (read client, extraction source,\n * transform, run service, batch) is already backend-only.\n *\n * It IS a subpath rather than the root barrel because only two audiences need it — the app author\n * declaring a resource, and the backend executing it — while the root is imported by every\n * consumer of the resource model, including packages that will never speak to a remote system.\n * Keeping it out of the root shrinks what they see without moving where it lives.\n *\n * ROW IDENTITY deliberately stays in the ROOT (`http-api-binding-id.shared.utils`): a synthesized\n * id appears in URLs and frontend routing, and `ResourcesConfigUtils.isHttpApiSynthesizedId` reads\n * it from shared code. Identity is not an integration concern.\n */\nexport * from './http-api-binding/http-api-binding.shared.schemas';\n// How a REST_JSON binding declares its row writes (#1728): method, path and where a create answers its key.\nexport * from './http-api-binding/http-api-rest-write-operations.shared.schemas';\nexport * from './systems-of-record/system-of-record-facet.shared.schemas';\n// Declared vendor ACTIONS of a system of record (#1678): the declaration a binding carries and its authoring checks.\nexport * from './systems-of-record/system-of-record-actions.shared.schemas';\nexport * from './external-data/external-data-pipeline.shared.schemas';\n// A pipeline declaration described for a reader — the resource specification's derived pipeline slice (#1685).\nexport * from './external-data/external-data-pipeline-description.shared';\n// Where a pipeline-written value came from and how current it is (#1997): the synced-field set, the route segment, the answer.\nexport * from './external-data/external-data-provenance.shared';\n// The write-declaration contract of a read-through resource (#1679): the verb ↔ core-operation map the\n// repository dispatches by, and the authoring rules the resource factory applies.\nexport * from './resources/utils/http-api-write-declaration.shared.utils';\n"]}
+{"version":3,"file":"external-data.exports.js","sourceRoot":"","sources":["../../src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AACnE,4GAA4G;AAC5G,cAAc,kEAAkE,CAAC;AACjF,cAAc,2DAA2D,CAAC;AAC1E,qHAAqH;AACrH,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AACtE,+GAA+G;AAC/G,cAAc,2DAA2D,CAAC;AAC1E,+HAA+H;AAC/H,cAAc,iDAAiD,CAAC;AAChE,uGAAuG;AACvG,kFAAkF;AAClF,cAAc,2DAA2D,CAAC","sourcesContent":["/**\n * `@wildo-ai/saas-models/external-data` — the AUTHORING contract for data that lives in another\n * system: the read-through VIRTUAL binding (`httpApiBinding`) and the copy-in PIPELINE\n * (`externalDataPipeline`).\n *\n * ## Why this is a subpath rather than root, and why it is not in `saas-backend-lib`\n *\n * Both questions were measured on 2026-08-29 rather than argued.\n *\n * It is NOT backend-lib, even though only the backend has a runtime for it, because an application\n * author writes these declarations in `*.resources-config.ts` — which lives in the app's\n * `shared-lib`, a package that depends on `@wildo-ai/saas-models` and deliberately NOT on\n * `@wildo-ai/saas-backend-lib` (the frontend imports `shared-lib`, so a backend dependency there\n * would drag the backend graph browser-ward). Nothing in these modules is runtime: every symbol —\n * dialects, tenancy, erasure, key fields, population, orphan policy, coercions — is typed by a\n * human in a schema file. The runtime that consumes them (read client, extraction source,\n * transform, run service, batch) is already backend-only.\n *\n * It IS a subpath rather than the root barrel because only two audiences need it — the app author\n * declaring a resource, and the backend executing it — while the root is imported by every\n * consumer of the resource model, including packages that will never speak to a remote system.\n * Keeping it out of the root shrinks what they see without moving where it lives.\n *\n * ROW IDENTITY deliberately stays in the ROOT (`http-api-binding-id.shared.utils`): a synthesized\n * id appears in URLs and frontend routing, and `ResourcesConfigUtils.isHttpApiSynthesizedId` reads\n * it from shared code. Identity is not an integration concern.\n */\nexport * from './http-api-binding/http-api-binding.shared.schemas';\n// How a REST_JSON binding declares its row writes (#1728): method, path and where a create answers its key.\nexport * from './http-api-binding/http-api-rest-write-operations.shared.schemas';\nexport * from './systems-of-record/system-of-record-facet.shared.schemas';\n// Declared vendor ACTIONS of a system of record (#1678): the declaration a binding carries and its authoring checks.\nexport * from './systems-of-record/system-of-record-actions.shared.schemas';\nexport * from './external-data/external-data-pipeline.shared.schemas';\n// A pipeline declaration described for a reader — the resource specification's derived pipeline slice (#1685).\nexport * from './external-data/external-data-pipeline-description.shared';\n// Where a pipeline-written value came from and how current it is (#1997): the synced-field set, the route segment, the answer.\nexport * from './external-data/external-data-provenance.shared';\n// The write-declaration contract of a read-through resource (#1679): the verb ↔ core-operation map the\n// repository dispatches by, and the authoring rules the resource factory applies.\nexport * from './resources/utils/http-api-write-declaration.shared.utils';\n"]}

package/dist/esm/external-providers/compose-provider-registry.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose-provider-registry.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/compose-provider-registry.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE/E,MAAM,WAAW,wBAAwB,CACvC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE;IAEpF,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB,CACvC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE;IAEpF,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,gBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IACjD,gCAAgC,CAC9B,kBAAkB,EAAE,kBAAkB,GACrC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1B,gCAAgC,CAC9B,kBAAkB,EAAE,kBAAkB,GACrC,OAAO,GAAG,SAAS,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B,CAAC,IAAI,SAAS,MAAM;IAC9D,GAAG,EAAE,IAAI,CAAC;IACV,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,qBAAa,gCAAgC,CAAC,IAAI,SAAS,MAAM,CAAE,SAAQ,KAAK;IAC9E,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,SAAS,EAAE,aAAa,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;gBAG1E,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,aAAa,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;CAc9D;AAED,wBAAgB,uBAAuB,CACrC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE,EAEpF,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,aAAa,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAChE,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAsDzC"}
+{"version":3,"file":"compose-provider-registry.shared.d.ts","sourceRoot":"","sources":["../../../src/external-providers/compose-provider-registry.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE/E,MAAM,WAAW,wBAAwB,CACvC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE;IAEpF,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB,CACvC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE;IAEpF,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,gBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IACjD,gCAAgC,CAC9B,kBAAkB,EAAE,kBAAkB,GACrC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1B,gCAAgC,CAC9B,kBAAkB,EAAE,kBAAkB,GACrC,OAAO,GAAG,SAAS,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B,CAAC,IAAI,SAAS,MAAM;IAC9D,GAAG,EAAE,IAAI,CAAC;IACV,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,qBAAa,gCAAgC,CAAC,IAAI,SAAS,MAAM,CAAE,SAAQ,KAAK;IAC9E,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,SAAS,EAAE,aAAa,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;gBAG1E,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,aAAa,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;CAc9D;AAED,wBAAgB,uBAAuB,CACrC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE,EAEpF,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,aAAa,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAChE,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAsDzC"}

package/dist/esm/external-providers/compose-provider-registry.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"compose-provider-registry.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/compose-provider-registry.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA8BH,MAAM,OAAO,gCAAsD,SAAQ,KAAK;IAC9D,KAAK,CAAS;IACd,SAAS,CAAmD;IAE5E,YACE,KAAa,EACb,SAA2D;QAE3D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CACzB,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAC3B,YAAY,GAAG,4BAA4B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3E,CAAC;QACF,KAAK,CACH,WAAW,KAAK,2DAA2D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7F,8FAA8F,CACjG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAIrC,KAAa,EACb,SAAiE;IAEjE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAwC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gCAAgC,CAAO,KAAK,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IACvC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAiC,CAAC;IACtE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACvB,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA4C;QACxD,OAAO,EAAE,KAAK;QACd,gBAAgB,CAAC,GAAG;YAClB,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,gCAAgC,CAAC,kBAAkB;YACjD,OAAO,oBAAoB,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC5D,CAAC;QACD,gCAAgC,CAAC,kBAAkB;YACjD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC5D,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC;KACF,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC","sourcesContent":["/**\n * `composeProviderRegistry` — facet-agnostic registry composition core.\n *\n * Each facet (backend, frontend-app, frontend-techdoc, frontend-website)\n * exposes its own `compose<Facet>Providers` wrapper that delegates here\n * so the conflict-detection diagnostic, the index-building algorithm,\n * and the freeze semantics stay identical across the codebase.\n *\n * The helper is generic over the facet-brand `TRef` (each facet uses a\n * branded string for its `ref` to keep cross-facet leakage compile-blocked)\n * and over the facet module shape `TModule` (constrained to anything with\n * a `providerCapabilities: ReadonlyArray<ProviderCapability>` field, which\n * is the one cross-facet invariant — every provider declares what it can\n * do regardless of facet).\n *\n * Conflict policy (locked in analysis §6 / §10 Q4): same `ref` declared in\n * two or more fragments → THROW with a precise diagnostic listing every\n * fragment index that contributed the conflicting ref. NO silent override.\n *\n * Returned shape: a frozen `ComposedProviderRegistry<TRef, TModule>` with:\n *   - `modules`                              — direct ref→module map\n *   - `getProviderByRef(ref)`                — direct lookup\n *   - `getProvidersByProviderCapability(c)`  — capability fan-out (ordered\n *                                              by fragment index, then by\n *                                              insertion order within each\n *                                              fragment's `modules` Map)\n *   - `findProviderByProviderCapability(c)`  — first match (single-fulfiller)\n *\n * The returned object surface is `Object.freeze`d; the underlying `Map`\n * and array references are NOT defensively cloned on every read — the\n * `Readonly` typing at consumer sites is the contract, and the builder is\n * the sole writer.\n *\n * See `.cursor/plans/provider-registration-refactor-implementation-plan.md`\n * §Phase 1.e for the canonical contract.\n */\n\nimport type { ProviderCapability } from './provider-capability.shared.schemas';\n\nexport interface ProviderRegistryFragment<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n> {\n  readonly modules: ReadonlyMap<TRef, TModule>;\n}\n\nexport interface ComposedProviderRegistry<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n> {\n  readonly modules: ReadonlyMap<TRef, TModule>;\n  getProviderByRef(ref: TRef): TModule | undefined;\n  getProvidersByProviderCapability(\n    providerCapability: ProviderCapability,\n  ): ReadonlyArray<TModule>;\n  findProviderByProviderCapability(\n    providerCapability: ProviderCapability,\n  ): TModule | undefined;\n}\n\nexport interface ProviderCompositionConflict<TRef extends string> {\n  ref: TRef;\n  fragmentIndexes: ReadonlyArray<number>;\n}\n\nexport class ProviderCompositionConflictError<TRef extends string> extends Error {\n  public readonly facet: string;\n  public readonly conflicts: ReadonlyArray<ProviderCompositionConflict<TRef>>;\n\n  constructor(\n    facet: string,\n    conflicts: ReadonlyArray<ProviderCompositionConflict<TRef>>,\n  ) {\n    const lines = conflicts.map(\n      ({ ref, fragmentIndexes }) =>\n        `  - ref \"${ref}\" declared by fragments [${fragmentIndexes.join(', ')}]`,\n    );\n    super(\n      `[compose${facet}Providers] conflicting provider refs across fragments:\\n${lines.join('\\n')}\\n` +\n        'Resolution: pick a different ref OR drop the conflicting fragment from the composition call.',\n    );\n    this.name = 'ProviderCompositionConflictError';\n    this.facet = facet;\n    this.conflicts = conflicts;\n  }\n}\n\nexport function composeProviderRegistry<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n>(\n  facet: string,\n  fragments: ReadonlyArray<ProviderRegistryFragment<TRef, TModule>>,\n): ComposedProviderRegistry<TRef, TModule> {\n  const refOwners = new Map<TRef, number[]>();\n  for (let index = 0; index < fragments.length; index += 1) {\n    for (const ref of fragments[index].modules.keys()) {\n      const existing = refOwners.get(ref);\n      if (existing) {\n        existing.push(index);\n      } else {\n        refOwners.set(ref, [index]);\n      }\n    }\n  }\n\n  const conflicts: ProviderCompositionConflict<TRef>[] = [];\n  for (const [ref, indexes] of refOwners) {\n    if (indexes.length > 1) {\n      conflicts.push({ ref, fragmentIndexes: indexes });\n    }\n  }\n  if (conflicts.length > 0) {\n    throw new ProviderCompositionConflictError<TRef>(facet, conflicts);\n  }\n\n  const byRef = new Map<TRef, TModule>();\n  const byProviderCapability = new Map<ProviderCapability, TModule[]>();\n  for (const fragment of fragments) {\n    for (const [ref, module] of fragment.modules) {\n      byRef.set(ref, module);\n      for (const capability of module.providerCapabilities) {\n        const bucket = byProviderCapability.get(capability);\n        if (bucket) {\n          bucket.push(module);\n        } else {\n          byProviderCapability.set(capability, [module]);\n        }\n      }\n    }\n  }\n\n  const registry: ComposedProviderRegistry<TRef, TModule> = {\n    modules: byRef,\n    getProviderByRef(ref) {\n      return byRef.get(ref);\n    },\n    getProvidersByProviderCapability(providerCapability) {\n      return byProviderCapability.get(providerCapability) ?? [];\n    },\n    findProviderByProviderCapability(providerCapability) {\n      const bucket = byProviderCapability.get(providerCapability);\n      return bucket && bucket.length > 0 ? bucket[0] : undefined;\n    },\n  };\n\n  return Object.freeze(registry);\n}\n"]}
+{"version":3,"file":"compose-provider-registry.shared.js","sourceRoot":"","sources":["../../../src/external-providers/compose-provider-registry.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AA8BH,MAAM,OAAO,gCAAsD,SAAQ,KAAK;IAC9D,KAAK,CAAS;IACd,SAAS,CAAmD;IAE5E,YACE,KAAa,EACb,SAA2D;QAE3D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CACzB,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,CAC3B,YAAY,GAAG,4BAA4B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3E,CAAC;QACF,KAAK,CACH,WAAW,KAAK,2DAA2D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7F,8FAA8F,CACjG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,uBAAuB,CAIrC,KAAa,EACb,SAAiE;IAEjE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAwC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gCAAgC,CAAO,KAAK,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IACvC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAiC,CAAC;IACtE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACvB,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACpD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,oBAAoB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA4C;QACxD,OAAO,EAAE,KAAK;QACd,gBAAgB,CAAC,GAAG;YAClB,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,gCAAgC,CAAC,kBAAkB;YACjD,OAAO,oBAAoB,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAC5D,CAAC;QACD,gCAAgC,CAAC,kBAAkB;YACjD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAC5D,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,CAAC;KACF,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC","sourcesContent":["/**\n * `composeProviderRegistry` — facet-agnostic registry composition core.\n *\n * Each facet (backend, frontend-app, frontend-techdoc, frontend-website)\n * exposes its own `compose<Facet>Providers` wrapper that delegates here\n * so the conflict-detection diagnostic, the index-building algorithm,\n * and the freeze semantics stay identical across the codebase.\n *\n * The helper is generic over the facet-brand `TRef` (each facet uses a\n * branded string for its `ref` to keep cross-facet leakage compile-blocked)\n * and over the facet module shape `TModule` (constrained to anything with\n * a `providerCapabilities: ReadonlyArray<ProviderCapability>` field, which\n * is the one cross-facet invariant — every provider declares what it can\n * do regardless of facet).\n *\n * Conflict policy (locked in analysis §6 / §10 Q4): same `ref` declared in\n * two or more fragments → THROW with a precise diagnostic listing every\n * fragment index that contributed the conflicting ref. NO silent override.\n *\n * Returned shape: a frozen `ComposedProviderRegistry<TRef, TModule>` with:\n *   - `modules`                              — direct ref→module map\n *   - `getProviderByRef(ref)`                — direct lookup\n *   - `getProvidersByProviderCapability(c)`  — capability fan-out (ordered\n *                                              by fragment index, then by\n *                                              insertion order within each\n *                                              fragment's `modules` Map)\n *   - `findProviderByProviderCapability(c)`  — first match (single-fulfiller)\n *\n * The returned object surface is `Object.freeze`d; the underlying `Map`\n * and array references are NOT defensively cloned on every read — the\n * `Readonly` typing at consumer sites is the contract, and the builder is\n * the sole writer.\n *\n * See `.cursor/plans/provider-registration-refactor-implementation-plan.md`\n * §Phase 1.e for the canonical contract.\n */\n\nimport type { ProviderCapability } from './provider-capability.shared.schemas';\n\nexport interface ProviderRegistryFragment<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n> {\n  readonly modules: ReadonlyMap<TRef, TModule>;\n}\n\nexport interface ComposedProviderRegistry<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n> {\n  readonly modules: ReadonlyMap<TRef, TModule>;\n  getProviderByRef(ref: TRef): TModule | undefined;\n  getProvidersByProviderCapability(\n    providerCapability: ProviderCapability,\n  ): ReadonlyArray<TModule>;\n  findProviderByProviderCapability(\n    providerCapability: ProviderCapability,\n  ): TModule | undefined;\n}\n\nexport interface ProviderCompositionConflict<TRef extends string> {\n  ref: TRef;\n  fragmentIndexes: ReadonlyArray<number>;\n}\n\nexport class ProviderCompositionConflictError<TRef extends string> extends Error {\n  public readonly facet: string;\n  public readonly conflicts: ReadonlyArray<ProviderCompositionConflict<TRef>>;\n\n  constructor(\n    facet: string,\n    conflicts: ReadonlyArray<ProviderCompositionConflict<TRef>>,\n  ) {\n    const lines = conflicts.map(\n      ({ ref, fragmentIndexes }) =>\n        `  - ref \"${ref}\" declared by fragments [${fragmentIndexes.join(', ')}]`,\n    );\n    super(\n      `[compose${facet}Providers] conflicting provider refs across fragments:\\n${lines.join('\\n')}\\n` +\n        'Resolution: pick a different ref OR drop the conflicting fragment from the composition call.',\n    );\n    this.name = 'ProviderCompositionConflictError';\n    this.facet = facet;\n    this.conflicts = conflicts;\n  }\n}\n\nexport function composeProviderRegistry<\n  TRef extends string,\n  TModule extends { readonly providerCapabilities: ReadonlyArray<ProviderCapability> },\n>(\n  facet: string,\n  fragments: ReadonlyArray<ProviderRegistryFragment<TRef, TModule>>,\n): ComposedProviderRegistry<TRef, TModule> {\n  const refOwners = new Map<TRef, number[]>();\n  for (let index = 0; index < fragments.length; index += 1) {\n    for (const ref of fragments[index].modules.keys()) {\n      const existing = refOwners.get(ref);\n      if (existing) {\n        existing.push(index);\n      } else {\n        refOwners.set(ref, [index]);\n      }\n    }\n  }\n\n  const conflicts: ProviderCompositionConflict<TRef>[] = [];\n  for (const [ref, indexes] of refOwners) {\n    if (indexes.length > 1) {\n      conflicts.push({ ref, fragmentIndexes: indexes });\n    }\n  }\n  if (conflicts.length > 0) {\n    throw new ProviderCompositionConflictError<TRef>(facet, conflicts);\n  }\n\n  const byRef = new Map<TRef, TModule>();\n  const byProviderCapability = new Map<ProviderCapability, TModule[]>();\n  for (const fragment of fragments) {\n    for (const [ref, module] of fragment.modules) {\n      byRef.set(ref, module);\n      for (const capability of module.providerCapabilities) {\n        const bucket = byProviderCapability.get(capability);\n        if (bucket) {\n          bucket.push(module);\n        } else {\n          byProviderCapability.set(capability, [module]);\n        }\n      }\n    }\n  }\n\n  const registry: ComposedProviderRegistry<TRef, TModule> = {\n    modules: byRef,\n    getProviderByRef(ref) {\n      return byRef.get(ref);\n    },\n    getProvidersByProviderCapability(providerCapability) {\n      return byProviderCapability.get(providerCapability) ?? [];\n    },\n    findProviderByProviderCapability(providerCapability) {\n      const bucket = byProviderCapability.get(providerCapability);\n      return bucket && bucket.length > 0 ? bucket[0] : undefined;\n    },\n  };\n\n  return Object.freeze(registry);\n}\n"]}

package/dist/esm/external-providers/engine-capabilities.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capabilities.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,sBAAsB,2BAA2B;IAEjD,mBAAmB,wBAAwB;IAC3C,eAAe,oBAAoB;IACnC;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAC/B,GAAG,QAAQ;IAEX,MAAM,WAAW;IACjB,mBAAmB,wBAAwB;IAC3C;;;;;;;;OAQG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;;;;;OAcG;IACH,eAAe,oBAAoB;IAyDnC,yBAAyB,8BAA8B;IACvD,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,iBAAiB,sBAAsB;IAEvC;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;CACpD;AAoGD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wCAAwC,EAAE,OAAO,CAC5D,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CACD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,+CAA+C,4EAYZ,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,eAAO,MAAM,qDAAqD,EAAE,WAAW,CAAC,gBAAgB,CAK9F,CAAC;AACH,qFAAqF"}
+{"version":3,"file":"engine-capabilities.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,sBAAsB,2BAA2B;IAEjD,mBAAmB,wBAAwB;IAC3C,eAAe,oBAAoB;IACnC;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAC/B,GAAG,QAAQ;IAEX,MAAM,WAAW;IACjB,mBAAmB,wBAAwB;IAC3C;;;;;;;;OAQG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;;;;;OAcG;IACH,eAAe,oBAAoB;IAyDnC,yBAAyB,8BAA8B;IACvD,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,iBAAiB,sBAAsB;IAEvC;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;CACpD;AAoGD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wCAAwC,EAAE,OAAO,CAC5D,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CACD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,+CAA+C,4EAYZ,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,eAAO,MAAM,qDAAqD,EAAE,WAAW,CAAC,gBAAgB,CAK9F,CAAC;AACH,qFAAqF"}

package/dist/esm/external-providers/engine-capabilities.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capabilities.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAkC,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,gBAoLX;AApLD,WAAY,gBAAgB;IAC1B,mDAA+B,CAAA;IAC/B,uCAAmB,CAAA;IACnB,qDAAiC,CAAA;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,qEAAiD,CAAA;IAEjD,+DAA2C,CAAA;IAC3C,uDAAmC,CAAA;IACnC;;;;;;;;;;OAUG;IACH,mDAA+B,CAAA;IAC/B,+BAAW,CAAA;IAEX,qCAAiB,CAAA;IACjB,+DAA2C,CAAA;IAC3C;;;;;;;;OAQG;IACH,mDAA+B,CAAA;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,qEAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uDAAmC,CAAA;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IAEH,2EAAuD,CAAA;IACvD,6EAAyD,CAAA;IAEzD;;;;;OAKG;IACH,2DAAuC,CAAA;IAEvC;;;;;;;;OAQG;IACH,uEAAmD,CAAA;AACrD,CAAC,EApLW,gBAAgB,KAAhB,gBAAgB,QAoL3B;AACD,6DAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,MAAM,gDAAgD,GAAG;IACvD,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACvF,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC/E,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC,aAAa;IAC3E,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,GAAG;IACvD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,OAAO;IAC/D,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,MAAM;IAC/D;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,aAAa;IAC5E;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;IAC/F,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC5E,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACpF,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,yBAAyB;IACnG,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,0BAA0B;IACrG,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,iBAAiB;IACnF,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,uBAAuB;IAC/F,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;CACd,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAEjD,gDAAgD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D;;;OAGG;IACH,gBAAgB,CAAC,aAAa;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,cAAc;CACe,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAkC,IAAI,GAAG,CAAC;IAC1G,gBAAgB,CAAC,mBAAmB;IACpC,gBAAgB,CAAC,OAAO;IACxB,gBAAgB,CAAC,GAAG;IACpB,gBAAgB,CAAC,aAAa;CAC/B,CAAC,CAAC;AACH,qFAAqF","sourcesContent":["import { BUILTIN_PROVIDER_CAPABILITY, type BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** @wildo_source:part:start saas.models.engine-capabilities facet:kind:api facet:audience:app-developer\n *\n * Closed application capability vocabulary used to declare what the\n * application needs from its configured providers.\n *\n * `EngineCapability` no longer means \"feature gate id\" and no longer\n * carries provider routing by itself. Provider-backed fulfillment is selected\n * by the application's provider configuration; entitlement/billing features\n * remain application feature decisions. Import this enum from\n * `@wildo-ai/saas-models` and declare only capabilities the application\n * actually intends to configure and operate.\n */\nexport enum EngineCapability {\n  ORGANIZATIONS = 'ORGANIZATIONS',\n  BILLING = 'BILLING',\n  MULTI_LANGUAGE = 'MULTI_LANGUAGE',\n  /**\n   * Durable, provider-backed audit trail: every audit event the application records is ALSO sent to\n   * each configured audit provider (an immutable ledger, a SIEM).\n   *\n   * Whether to enable it is a question of where the trail must live, not of what the application may\n   * claim. The assurance surface attests roughly half its control objectives through audit rows, and\n   * those rows are read from the application's OWN audit store, which exists whether or not this\n   * capability is on. So leaving it out removes no control objective an application can claim. Until\n   * 2026-09-14 the assurance basis wrongly treated this capability as the precondition for those\n   * claims, and this comment said leaving it out left about a third of them unclaimable.\n   *\n   * Two things this does NOT mean, because both are easy to assume:\n   *\n   * - It is not what makes security events happen. Authentication, authorization, privilege and\n   *   credential events are recorded in the application's own database regardless. What this\n   *   capability adds is the provider-backed fan-out — the durable, external, tamper-evident\n   *   destination an assurance reader can be pointed at.\n   * - It is not retroactive. Turning it on later starts a trail from that moment; it does not\n   *   furnish evidence for the period it was off, and a control's evidence cannot begin before its\n   *   evidence store does.\n   *\n   * So decide it with the compliance posture rather than as an infrastructure detail: enable it when\n   * the trail must also exist OUTSIDE the application — a store its own operators cannot rewrite, or a\n   * security team's SIEM. The application's own store stays the authoritative record either way.\n   */\n  COMPLIANCE_AUDIT_TRAIL = 'COMPLIANCE_AUDIT_TRAIL',\n\n  EMAIL_TRANSACTIONAL = 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING = 'EMAIL_MARKETING',\n  /**\n   * The application RECEIVES email: work arrives as messages to an address the application routes to\n   * an organization, and a channel handler decides what each message causes (#1630). The selected\n   * provider hosts the receiving domain, signs a notification per message and serves the message on\n   * request; the engine owns verification, deduplication, sender assurance, threads and replies.\n   *\n   * What it does NOT mean: a verified sender is identification, never authentication. A message's\n   * sender assurance gates what a handler accepts and grants no authority — the handler acts with\n   * the roles it declares, whoever wrote. Replies go out through `EMAIL_TRANSACTIONAL`, so the two\n   * slots may be served by different vendors.\n   */\n  EMAIL_INBOUND = 'EMAIL_INBOUND',\n  SMS = 'SMS',\n\n  AI_LLM = 'AI_LLM',\n  AI_IMAGE_GENERATION = 'AI_IMAGE_GENERATION',\n  /**\n   * Text → vector embeddings (the RAG derived-data tier: `.ragSource()` corpus embedding by the\n   * `rag:embedding-drain` worker, and query-time embedding in retrieval). A slot of its OWN,\n   * deliberately separate from `AI_LLM` (RAG plan DL2/H4): while `LLM_EMBEDDINGS` mapped into the\n   * `AI_LLM` slot, an application structurally could not pick Anthropic for chat and a different\n   * provider for embeddings — one `selection[AI_LLM].primary` decided both. Embeddings resolve\n   * through `EMBEDDINGS_PROVIDER` protocol bindings and are selected by applicability class\n   * (`Embeddings_Applicability`), never by a concrete model id at a call site.\n   */\n  AI_EMBEDDINGS = 'AI_EMBEDDINGS',\n  /**\n   * Document bytes → text: provider-backed extraction (OCR) for uploaded documents, serving\n   * `FileTextExtractionBackendService` and, through it, `.ragSource()` corpus ingestion.\n   *\n   * ## Why a slot of its own\n   *\n   * Three unrelated procurement decisions were otherwise fused. A deployment may well want one\n   * vendor for chat, another for embeddings, and a third for OCR — vendors are not equally good\n   * at all three, and their pricing models do not even share a unit (tokens vs. pages). Mapping\n   * extraction into `AI_LLM` would have made one `selection[AI_LLM].primary` decide all three,\n   * which is exactly the defect that split `AI_EMBEDDINGS` out of `AI_LLM`.\n   *\n   * ## Not to be confused with PDF GENERATION\n   *\n   * PDF generation — templates and data become bytes — is the `pdfTemplates` surface, done\n   * in-process and with no provider slot of its own. This is the opposite direction: bytes become\n   * text. The two are unrelated and nothing routes between them. (There WAS an\n   * `EngineCapability.DOCUMENT_GENERATION` that this paragraph used to name; it was withdrawn\n   * because no provider capability could ever fill it.)\n   *\n   * ## Absence is benign, and that is load-bearing\n   *\n   * With no provider selected, extraction falls back to the local `pdfjs-dist` text-layer read.\n   * That is a real answer for a born-digital PDF and returns nothing for a SCAN — so this\n   * capability is what makes scanned documents answerable, never what makes extraction work at\n   * all. An application that ingests only born-digital documents may leave it unset deliberately.\n   */\n  AI_DOCUMENT_EXTRACTION = 'AI_DOCUMENT_EXTRACTION',\n  /**\n   * An autonomous coding agent that mutates the application workspace.\n   *\n   * Its own slot rather than `AI_LLM`, for exactly the reason `AI_EMBEDDINGS`\n   * was split out of it: one `selection[AI_LLM].primary` decides every provider\n   * mapped into that slot. While the coding transport mapped to `AI_LLM`, an\n   * application structurally could NOT choose one vendor's coding agent and a\n   * different vendor for chat — picking a chat provider silently picked the\n   * agent that would be allowed to edit its source.\n   *\n   * The stakes differ too, which is why fusing them was wrong beyond the\n   * ergonomics: selecting a chat model is a quality and cost decision, while\n   * selecting the agent that writes your code is those things AND an\n   * authorisation decision. They deserve separate, deliberate answers.\n   */\n  AI_CODING_AGENT = 'AI_CODING_AGENT',\n\n  /*\n   * WITHDRAWN 2026-09-03: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` were members here and are\n   * not any more. Neither could ever be filled — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` had no\n   * entry pointing at either, so no provider capability token could claim the slot — while both were\n   * classified `SELECT_ONE`, which asserts that exactly one provider must be selected. Selecting one\n   * of zero candidates is not a resolution mode.\n   *\n   * Both capabilities are real and both are delivered elsewhere, which is why withdrawing the slots\n   * costs nothing: antivirus scanning is `InfraCapability.ANTIVIRUS_SCANNING`, fulfilled by ClamAV\n   * and consumed by `FileScanningBackendService`; PDF generation is the in-process `pdfTemplates`\n   * surface, rendered by `@react-pdf/renderer` inside the backend. Neither has an external\n   * provider, and neither is planned to.\n   *\n   * `InfraCapability.DOCUMENT_RENDERING` (Gotenberg) was provisioned beside the PDF surface and\n   * consumed by nothing; it was withdrawn on 2026-09-08 (#477) because in-process rendering had\n   * superseded it. Note the two are not interchangeable if it is ever reconsidered:\n   * `@react-pdf/renderer` composes a document from React primitives, while Gotenberg converts\n   * EXISTING HTML and Office documents — that is a different capability, not a second\n   * implementation of this one.\n   *\n   * Removing `ANTIVIRUS_SCANNING` also removes a collision: the identical spelling named an engine\n   * slot nothing could fill AND a live infra capability, in two packages, so a reader grepping the\n   * word landed in whichever they searched first.\n   *\n   * If a hosted AV or document-rendering vendor is ever adopted, the member comes back WITH its\n   * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` entry and its own JSDoc in the same change.\n   *\n   * WITHDRAWN 2026-09-09: `BILLING_PAYMENTS`, the third member of exactly that shape, and the one\n   * this paragraph's own closing rule should have caught. It was never withdrawn with the other two\n   * because it had been left behind DELIBERATELY — as a \"reserved slot\" — which reads as a decision\n   * and is why nobody re-examined it. Measured before removing, across the whole repository outside\n   * `node_modules` / `dist`: it appeared in live source at exactly THREE sites, and none of them was\n   * a use — the enum declaration itself, its row in the compile-forced\n   * `ENGINE_CAPABILITY_RESOLUTION_MODE` record, and a comment in a test naming it as a slot the\n   * billing provider must NOT be registered under. Zero applications enabled it, zero scaffolds\n   * wrote it, zero consumers queried it, and no provider capability token mapped to it.\n   *\n   * The capability it names is real and is already delivered: a billing provider (Stripe) declares\n   * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills `EngineCapability.BILLING`, which is the slot\n   * applications enable and `getProvidersForEngineCapability` gates on. Payment EXECUTION is served\n   * through that same provider's `BILLING_PROVIDER` protocol; splitting it into a second engine slot\n   * was a plan-era intention (`provider-registry-materialization-workflow.md`) that the shipped\n   * model settled the other way. So the withdrawal removes a name, not a capability.\n   *\n   * The reason a reserved slot is worse than no slot is `EngineCapabilityResolutionMode`: every\n   * member must be classified, `BILLING_PAYMENTS` was classified `SELECT_ONE`, and `SELECT_ONE`\n   * asserts that exactly one provider is selected from the candidates. There were zero candidates\n   * and there could never be one. A vocabulary member that no configuration can satisfy is not a\n   * reservation, it is a false statement the compiler is forced to carry.\n   *\n   * If a payments vendor is ever selected independently of the billing vendor, the member comes back\n   * with its provider-capability token and its map entry in the same change — the same rule as\n   * above, now with three instances behind it.\n   */\n\n  FRONTEND_ERROR_MONITORING = 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS = 'FRONTEND_PRODUCT_ANALYTICS',\n\n  /**\n   * Backend LLM-call observability (model/tokens/cost/latency per `invokeAgent`),\n   * platform-scoped. This enables model-call observability when the selected\n   * provider configuration supplies that capability; it does not itself\n   * configure a provider or make telemetry operational.\n   */\n  LLM_OBSERVABILITY = 'LLM_OBSERVABILITY',\n\n  /**\n   * Operational telemetry (traces/metrics/logs) shipped via the OpenTelemetry\n   * SDK over OTLP to a provider (for example, BetterStack). Unlike\n   * `LLM_OBSERVABILITY`, the connection is preloaded from\n   * `OTEL_*` env vars (the CLI translates the saas-config selection + per-env\n   * infra config into them) BEFORE app config — not resolved through the runtime\n   * registry. Author the corresponding infrastructure/provider settings in\n   * the application environment before relying on telemetry.\n   */\n  OBSERVABILITY_TELEMETRY = 'OBSERVABILITY_TELEMETRY',\n}\n/** @wildo_source:part:end saas.models.engine-capabilities */\n\n/**\n * Canonical, single-source-of-truth mapping from the open\n * `ProviderCapability` vocabulary (the built-in subset) to the closed\n * `EngineCapability` slots the engine actually fulfills.\n *\n * A provider declares which `providerCapabilities` it satisfies (e.g.\n * Stripe → `BILLING`, Resend → `EMAIL_TRANSACTIONAL`, Anthropic →\n * `LLM_CHAT`/`CODING_AGENT`). This map projects each built-in\n * capability onto the engine slot it fills, so a provider's\n * `engineCapabilities` set can be derived mechanically. Multiple\n * provider capabilities may share one engine slot (every `LLM_*`\n * capability maps to `AI_LLM`); de-duplicate after projecting.\n *\n * **Why this lives here (one map, three consumers).** The projection\n * used to be hand-copied in three places that silently drifted:\n *   1. The runtime registry projection in `saas-backend-lib`\n *      (`ExternalProvidersRegistryBackendService.buildRuntimeRegistryFromProviderModules`),\n *      which decides which provider answers `getProvidersForEngineCapability`.\n *   2. The backend companion-discovery export in\n *      `@wildo-ai/external-connectors-private` (feeds the generated\n *      `provider-catalog.types.ts` autocomplete via `wildo config sync`).\n *   3. The frontend companion-discovery export in\n *      `@wildo-ai/external-connectors-public` (same, for browser-bound\n *      provider modules).\n * A missing/wrong entry in any copy silently breaks a different surface\n * (a registry resolution, or the catalog autocomplete). It is co-located\n * with the `EngineCapability` enum it projects onto, and every consumer\n * imports it from the `@wildo-ai/saas-models` package root barrel.\n *\n * **Bundle boundary — why here and not beside `BUILTIN_PROVIDER_CAPABILITY`.**\n * This map references `EngineCapability`, which is deliberately kept off\n * the browser-safe `@wildo-ai/saas-models/public-runtime` seam. So it must\n * live in a full-only module. `engine-capabilities.shared.schemas.ts` is\n * exactly that (exported from the root barrel, never from\n * `public-runtime/index.ts`), whereas `provider-capability.shared.schemas.ts`\n * — the other natural home — IS on the public seam and would drag\n * `EngineCapability` into the browser bundle. The frontend discovery\n * consumer (#3) imports this map through its Node-only `./companion`\n * subpath, which already pulls the full root barrel; the browser-shipped\n * `./app`/`./techdoc`/`./website` subpaths never reach it.\n *\n * **BILLING → BILLING.** A billing provider (Stripe) declares\n * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills the\n * `EngineCapability.BILLING` slot — the SAME slot apps enable in\n * `defineSaaSProviders`/`engineCapabilities` activation config and that\n * `getProvidersForEngineCapability` gates resolution on. The runtime copy\n * of this projection historically mapped it onto a distinct\n * `EngineCapability.BILLING_PAYMENTS` slot instead, registering Stripe\n * under something no activation config enables and no consumer queries,\n * which made it unreachable through the registry. That second slot was\n * withdrawn from the enum on 2026-09-09 (see the WITHDRAWN block beside\n * the enum) — it had no producer and no consumer other than the bug.\n *\n * **Intentionally unmapped.** `SSO_OAUTH2`, `SSO_SAML`, `FRONTEND_SEARCH`,\n * `FRONTEND_FILE_PICKER`, `FRONTEND_CAPTCHA` and `FRONTEND_ADDRESS_LOOKUP`\n * (#1702 — an address field works without one, so no engine slot requires it)\n * have no closed engine slot today — they are fulfilled by provider protocols / app wiring, not\n * by an `EngineCapability`. Their absence here is by construction, not an\n * oversight: a `Partial<Record<…>>` lookup returns `undefined` and the\n * capability contributes nothing to a provider's `engineCapabilities`.\n *\n * There are no app-extended provider capabilities: the augmentation point was\n * removed as an extension point with no resolver (#502), so this map covers the\n * whole vocabulary rather than the built-in half of it.\n */\nconst PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: EngineCapability.EMAIL_TRANSACTIONAL,\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: EngineCapability.EMAIL_MARKETING,\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: EngineCapability.EMAIL_INBOUND,\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: EngineCapability.SMS,\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: EngineCapability.BILLING,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: EngineCapability.AI_LLM,\n  /**\n   * REPOINTED 2026-08-27 (RAG plan DL2/H4): `LLM_EMBEDDINGS` used to map into `AI_LLM`, which\n   * fused the chat and embeddings provider selections into one slot. The TOKEN keeps its name —\n   * it correctly says \"this provider can produce embeddings\", and it sits inside the anchored\n   * `saas.models.provider-capabilities` block compiled into shipped skills — only the slot it\n   * fills changed. Exactly one token claims the embeddings slot.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: EngineCapability.AI_EMBEDDINGS,\n  /**\n   * EXACTLY ONE token claims the document-extraction slot, and it is a new one. Checked rather\n   * than assumed before adding it: `IMAGE_GENERATION` maps to `AI_IMAGE_GENERATION` (output),\n   * `LLM_CHAT` to `AI_LLM`, `LLM_EMBEDDINGS` to `AI_EMBEDDINGS`, and no built-in token mapped\n   * anywhere near document INPUT. Repointing an existing token — the move that kept\n   * `LLM_EMBEDDINGS` alive — was not available here because none of them meant this.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: EngineCapability.AI_DOCUMENT_EXTRACTION,\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: EngineCapability.AI_CODING_AGENT,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: EngineCapability.AI_IMAGE_GENERATION,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: EngineCapability.FRONTEND_ERROR_MONITORING,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: EngineCapability.FRONTEND_PRODUCT_ANALYTICS,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: EngineCapability.LLM_OBSERVABILITY,\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: EngineCapability.OBSERVABILITY_TELEMETRY,\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n} as const satisfies Partial<Record<BuiltinProviderCapability, EngineCapability>>;\n\n/**\n * The projection every consumer uses, with the WIDE type it has always had.\n *\n * **Why the literal above and the widened alias here are two declarations.** Consumers index this\n * map with a `BuiltinProviderCapability` VARIABLE — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[cap]`\n * in the runtime registry, in both companion-discovery exports, in `defineSaaSProviders` and in the\n * tier rule — and that only type-checks against `Partial<Record<…>>`, which admits every token in\n * the vocabulary and answers `undefined` for the six that map nowhere. Annotating the literal that\n * way is what USED to be written here, and it is also what erased the information the totality\n * check below needs: an annotation discards the per-property literal types, so\n * `(typeof MAP)[keyof typeof MAP]` collapsed to `EngineCapability | undefined` and could not say\n * WHICH slots are filled.\n *\n * `as const satisfies` on the literal keeps both: the compiler still rejects a wrong key or a\n * non-`EngineCapability` value at the site where it is written, and the exact filled set survives\n * into the type system. The widening then happens once, here, so no consumer changes and nobody has\n * to know the literal exists.\n */\nexport const PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY: Partial<\n  Record<BuiltinProviderCapability, EngineCapability>\n> = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES;\n\n/**\n * Engine capabilities that DELIBERATELY have no provider capability pointing at them, each named\n * with the reason it is an empty slot rather than a hole.\n *\n * This exists so the two states can never be confused. Before it, an `EngineCapability` member with\n * no entry in the map above looked exactly like one whose entry someone forgot — the absence WAS the\n * record — and that indistinguishability is the whole mechanism behind three separate slots shipping\n * unfillable: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` (withdrawn 2026-09-03) and\n * `BILLING_PAYMENTS` (withdrawn 2026-09-09, and left standing for six days precisely because\n * \"reserved\" reads like a decision). A capability listed here has been looked at; one that is\n * neither listed here nor mapped above does not compile.\n *\n * **Both members are ACTIVATION capabilities, and that is the criterion.** Each is a real, live,\n * enabled-or-not decision an application makes in `wildo.saas.config.ts` (`ORGANIZATIONS` is\n * enabled by both dogfood applications, `MULTI_LANGUAGE` is written by the scaffold and by the\n * application-creation composition step), and each is implemented BY THE ENGINE — multi-tenancy is\n * the engine's own organization model and scoping, translation is the engine's own i18n pipeline.\n * There is no external party to select, so there is nothing for a provider capability to say. That\n * is categorically different from a withdrawn slot, which named work an external party WOULD do and\n * had no external party able to do it.\n *\n * **Adding a member here is a decision that must be argued, not a way to make a compile error go\n * away.** The test beside this file pins the set to exactly these two, so a third one cannot arrive\n * as a silent edit — see `__tests__/engine-capability-provider-coverage.shared.test.ts`.\n */\nexport const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY = [\n  /**\n   * Multi-tenancy: organizations, memberships, roles and organization scoping are engine resources\n   * and engine authorization. Nothing about them is procured.\n   */\n  EngineCapability.ORGANIZATIONS,\n  /**\n   * Application-wide i18n: the label tree, the locale negotiation and the translation pipeline are\n   * the engine's. Where translation is MODEL-backed it reaches a provider through `AI_LLM`, which is\n   * its own slot with its own selection — so even that path is not this capability's producer.\n   */\n  EngineCapability.MULTI_LANGUAGE,\n] as const satisfies readonly EngineCapability[];\n\n/**\n * COMPILE-TIME TOTALITY: every `EngineCapability` is either filled by a provider capability or\n * declared an empty slot above. Adding a member to the enum without doing one of the two is a\n * TypeScript error at this line, not a test failure and not a runtime surprise.\n *\n * A compile error is the right instrument here because both inputs are static literals in this one\n * file — there is no runtime state to consult, so nothing is gained by deferring the question to\n * execution, and a great deal is lost: a test only fails for someone who runs it, while this fails\n * for whoever adds the member, in the editor, before the commit.\n *\n * The error a violation produces is `TS2344` on `EngineCapabilityAccountedFor`, reading\n * `Type 'EngineCapability.X' does not satisfy the constraint 'never'` — X being the exact member\n * that is neither mapped nor declared. Measured rather than asserted: deleting the\n * `BUILTIN_PROVIDER_CAPABILITY.SMS` row from the literal above produced exactly that diagnostic,\n * naming `EngineCapability.SMS`, and the row was restored.\n *\n * The two declarations below are unused by design — the assertion IS the declaration, and it is\n * evaluated the moment the file is type-checked. `noUnusedLocals` is off in this package's\n * tsconfig, so nothing objects; do not \"clean them up\".\n */\ntype EngineCapabilityFilledByAProviderCapability =\n  (typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES)[keyof typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES];\n\ntype EngineCapabilityDeclaredEmpty = (typeof ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY)[number];\n\n/** Resolves to `never` when the two sets above cover the enum, and to the offending member(s) when they do not. */\ntype EngineCapabilityAccountedFor<Unaccounted extends never> = Unaccounted;\n\ntype _EveryEngineCapabilityIsMappedOrDeclaredEmpty = EngineCapabilityAccountedFor<\n  Exclude<EngineCapability, EngineCapabilityFilledByAProviderCapability | EngineCapabilityDeclaredEmpty>\n>;\n\n/**\n * The mirror assertion: a capability may not be BOTH mapped and declared empty.\n *\n * Without it the totality check is satisfiable by lying in the easier direction — list a mapped\n * capability as an empty slot and the union still covers the enum, so a genuinely missing mapping\n * elsewhere could be hidden by a bogus declaration here. `TS2344` again, naming the member that\n * appears on both sides.\n */\ntype _NoEngineCapabilityIsBothMappedAndDeclaredEmpty = EngineCapabilityAccountedFor<\n  Extract<EngineCapabilityDeclaredEmpty, EngineCapabilityFilledByAProviderCapability>\n>;\n\n/** @wildo_source:part:start saas.models.engine-capabilities.required-provider-floor facet:layer:shared facet:audience:app-developer */\n/**\n * Engine capabilities that REQUIRE a resolved provider the moment an\n * application ENABLES them — the engine-level MAIN floor (#328).\n *\n * The asymmetry is the thing to carry away: **enabling a capability with nothing serving it fails at\n * BOOT for these four and at the point of USE for every other slot.** So an author who tries one\n * unserved slot, sees the application come up, and concludes that an unserved capability degrades\n * gracefully has learned the wrong rule from the larger half of the vocabulary.\n *\n * `EngineCapabilityActivation.required` is the application's decision;\n * this set is the ENGINE's: for each member, an enabled capability with no\n * provider is not a degraded mode but a boot-time misconfiguration, because\n * an engine flow the application already relies on fails at first use:\n *\n * - `EMAIL_TRANSACTIONAL` — invitations, address verification and password\n *   reset are engine flows that send mail; with no provider they fail\n *   silently at the moment a user needs them.\n * - `BILLING` — `initializeBillingServices` already fails loud with no\n *   provider; the floor names it in the same place as the others.\n * - `SMS` — phone verification and MFA-by-SMS are engine flows.\n * - `EMAIL_INBOUND` — enabling it declares that work arrives by email; with no\n *   provider nothing hosts the receiving domain, so every message is lost\n *   before the engine sees it and nothing anywhere records that it was (#1630).\n *\n * DELIBERATELY ABSENT, with the reason each would need to overturn:\n * - the `AI_*` slots — consumed per feature (an agent, the logo generator)\n *   and legitimately served on a DIFFERENT host (the companion reaches image\n *   generation; the backend need not), so \"enabled with no backend provider\"\n *   is a normal topology, not a fault. A feature that needs one refuses at\n *   its own site.\n * - the sinks (`COMPLIANCE_AUDIT_TRAIL`, `LLM_OBSERVABILITY`,\n *   `OBSERVABILITY_TELEMETRY`) — fail-OPEN by design (the G4 reconcile\n *   warns), because Layer-1 persistence is unaffected.\n * - `EMAIL_MARKETING` — a campaign feature, not an engine flow.\n * - the `FRONTEND_*` slots — resolved by the frontend facet, invisible to\n *   the backend registry that evaluates this floor.\n * - `ORGANIZATIONS` and `MULTI_LANGUAGE` — no provider token maps to them,\n *   deliberately and by declaration; see\n *   `ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`. A floor requiring a\n *   resolved provider for a slot nothing can fill would refuse every boot that\n *   enabled them. (`BILLING_PAYMENTS` was named here too until it was withdrawn\n *   from the enum on 2026-09-09.)\n *\n * The floor runs only on a host expected to SERVE these slots (see\n * `ApplicationRuntimeProfileBootAssertions.assertsEngineCapabilityProviderFloor`);\n * a minion's scope-filtered registry legitimately resolves none of them.\n */\nexport const ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED: ReadonlySet<EngineCapability> = new Set([\n  EngineCapability.EMAIL_TRANSACTIONAL,\n  EngineCapability.BILLING,\n  EngineCapability.SMS,\n  EngineCapability.EMAIL_INBOUND,\n]);\n/** @wildo_source:part:end saas.models.engine-capabilities.required-provider-floor */\n"]}
+{"version":3,"file":"engine-capabilities.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAkC,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,gBAoLX;AApLD,WAAY,gBAAgB;IAC1B,mDAA+B,CAAA;IAC/B,uCAAmB,CAAA;IACnB,qDAAiC,CAAA;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,qEAAiD,CAAA;IAEjD,+DAA2C,CAAA;IAC3C,uDAAmC,CAAA;IACnC;;;;;;;;;;OAUG;IACH,mDAA+B,CAAA;IAC/B,+BAAW,CAAA;IAEX,qCAAiB,CAAA;IACjB,+DAA2C,CAAA;IAC3C;;;;;;;;OAQG;IACH,mDAA+B,CAAA;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,qEAAiD,CAAA;IACjD;;;;;;;;;;;;;;OAcG;IACH,uDAAmC,CAAA;IAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqDG;IAEH,2EAAuD,CAAA;IACvD,6EAAyD,CAAA;IAEzD;;;;;OAKG;IACH,2DAAuC,CAAA;IAEvC;;;;;;;;OAQG;IACH,uEAAmD,CAAA;AACrD,CAAC,EApLW,gBAAgB,KAAhB,gBAAgB,QAoL3B;AACD,6DAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,MAAM,gDAAgD,GAAG;IACvD,CAAC,2BAA2B,CAAC,mBAAmB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACvF,CAAC,2BAA2B,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC/E,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC,aAAa;IAC3E,CAAC,2BAA2B,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,GAAG;IACvD,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC,OAAO;IAC/D,CAAC,2BAA2B,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,MAAM;IAC/D;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,aAAa;IAC5E;;;;;;OAMG;IACH,CAAC,2BAA2B,CAAC,wBAAwB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;IAC/F,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,eAAe;IAC5E,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC,mBAAmB;IACpF,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,EAAE,gBAAgB,CAAC,yBAAyB;IACnG,CAAC,2BAA2B,CAAC,0BAA0B,CAAC,EAAE,gBAAgB,CAAC,0BAA0B;IACrG,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,iBAAiB;IACnF,CAAC,2BAA2B,CAAC,uBAAuB,CAAC,EAAE,gBAAgB,CAAC,uBAAuB;IAC/F,CAAC,2BAA2B,CAAC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC,sBAAsB;CACd,CAAC;AAElF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAEjD,gDAAgD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+CAA+C,GAAG;IAC7D;;;OAGG;IACH,gBAAgB,CAAC,aAAa;IAC9B;;;;OAIG;IACH,gBAAgB,CAAC,cAAc;CACe,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,MAAM,qDAAqD,GAAkC,IAAI,GAAG,CAAC;IAC1G,gBAAgB,CAAC,mBAAmB;IACpC,gBAAgB,CAAC,OAAO;IACxB,gBAAgB,CAAC,GAAG;IACpB,gBAAgB,CAAC,aAAa;CAC/B,CAAC,CAAC;AACH,qFAAqF","sourcesContent":["import { BUILTIN_PROVIDER_CAPABILITY, type BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** @wildo_source:part:start saas.models.engine-capabilities facet:kind:api facet:audience:app-developer\n *\n * Closed application capability vocabulary used to declare what the\n * application needs from its configured providers.\n *\n * `EngineCapability` no longer means \"feature gate id\" and no longer\n * carries provider routing by itself. Provider-backed fulfillment is selected\n * by the application's provider configuration; entitlement/billing features\n * remain application feature decisions. Import this enum from\n * `@wildo-ai/saas-models` and declare only capabilities the application\n * actually intends to configure and operate.\n */\nexport enum EngineCapability {\n  ORGANIZATIONS = 'ORGANIZATIONS',\n  BILLING = 'BILLING',\n  MULTI_LANGUAGE = 'MULTI_LANGUAGE',\n  /**\n   * Durable, provider-backed audit trail: every audit event the application records is ALSO sent to\n   * each configured audit provider (an immutable ledger, a SIEM).\n   *\n   * Whether to enable it is a question of where the trail must live, not of what the application may\n   * claim. The assurance surface attests roughly half its control objectives through audit rows, and\n   * those rows are read from the application's OWN audit store, which exists whether or not this\n   * capability is on. So leaving it out removes no control objective an application can claim. Until\n   * 2026-09-14 the assurance basis wrongly treated this capability as the precondition for those\n   * claims, and this comment said leaving it out left about a third of them unclaimable.\n   *\n   * Two things this does NOT mean, because both are easy to assume:\n   *\n   * - It is not what makes security events happen. Authentication, authorization, privilege and\n   *   credential events are recorded in the application's own database regardless. What this\n   *   capability adds is the provider-backed fan-out — the durable, external, tamper-evident\n   *   destination an assurance reader can be pointed at.\n   * - It is not retroactive. Turning it on later starts a trail from that moment; it does not\n   *   furnish evidence for the period it was off, and a control's evidence cannot begin before its\n   *   evidence store does.\n   *\n   * So decide it with the compliance posture rather than as an infrastructure detail: enable it when\n   * the trail must also exist OUTSIDE the application — a store its own operators cannot rewrite, or a\n   * security team's SIEM. The application's own store stays the authoritative record either way.\n   */\n  COMPLIANCE_AUDIT_TRAIL = 'COMPLIANCE_AUDIT_TRAIL',\n\n  EMAIL_TRANSACTIONAL = 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING = 'EMAIL_MARKETING',\n  /**\n   * The application RECEIVES email: work arrives as messages to an address the application routes to\n   * an organization, and a channel handler decides what each message causes (#1630). The selected\n   * provider hosts the receiving domain, signs a notification per message and serves the message on\n   * request; the engine owns verification, deduplication, sender assurance, threads and replies.\n   *\n   * What it does NOT mean: a verified sender is identification, never authentication. A message's\n   * sender assurance gates what a handler accepts and grants no authority — the handler acts with\n   * the roles it declares, whoever wrote. Replies go out through `EMAIL_TRANSACTIONAL`, so the two\n   * slots may be served by different vendors.\n   */\n  EMAIL_INBOUND = 'EMAIL_INBOUND',\n  SMS = 'SMS',\n\n  AI_LLM = 'AI_LLM',\n  AI_IMAGE_GENERATION = 'AI_IMAGE_GENERATION',\n  /**\n   * Text → vector embeddings (the RAG derived-data tier: `.ragSource()` corpus embedding by the\n   * `rag:embedding-drain` worker, and query-time embedding in retrieval). A slot of its OWN,\n   * deliberately separate from `AI_LLM` (RAG plan DL2/H4): while `LLM_EMBEDDINGS` mapped into the\n   * `AI_LLM` slot, an application structurally could not pick Anthropic for chat and a different\n   * provider for embeddings — one `selection[AI_LLM].primary` decided both. Embeddings resolve\n   * through `EMBEDDINGS_PROVIDER` protocol bindings and are selected by applicability class\n   * (`Embeddings_Applicability`), never by a concrete model id at a call site.\n   */\n  AI_EMBEDDINGS = 'AI_EMBEDDINGS',\n  /**\n   * Document bytes → text: provider-backed extraction (OCR) for uploaded documents, serving\n   * `FileTextExtractionBackendService` and, through it, `.ragSource()` corpus ingestion.\n   *\n   * ## Why a slot of its own\n   *\n   * Three unrelated procurement decisions were otherwise fused. A deployment may well want one\n   * vendor for chat, another for embeddings, and a third for OCR — vendors are not equally good\n   * at all three, and their pricing models do not even share a unit (tokens vs. pages). Mapping\n   * extraction into `AI_LLM` would have made one `selection[AI_LLM].primary` decide all three,\n   * which is exactly the defect that split `AI_EMBEDDINGS` out of `AI_LLM`.\n   *\n   * ## Not to be confused with PDF GENERATION\n   *\n   * PDF generation — templates and data become bytes — is the `pdfTemplates` surface, done\n   * in-process and with no provider slot of its own. This is the opposite direction: bytes become\n   * text. The two are unrelated and nothing routes between them. (There WAS an\n   * `EngineCapability.DOCUMENT_GENERATION` that this paragraph used to name; it was withdrawn\n   * because no provider capability could ever fill it.)\n   *\n   * ## Absence is benign, and that is load-bearing\n   *\n   * With no provider selected, extraction falls back to the local `pdfjs-dist` text-layer read.\n   * That is a real answer for a born-digital PDF and returns nothing for a SCAN — so this\n   * capability is what makes scanned documents answerable, never what makes extraction work at\n   * all. An application that ingests only born-digital documents may leave it unset deliberately.\n   */\n  AI_DOCUMENT_EXTRACTION = 'AI_DOCUMENT_EXTRACTION',\n  /**\n   * An autonomous coding agent that mutates the application workspace.\n   *\n   * Its own slot rather than `AI_LLM`, for exactly the reason `AI_EMBEDDINGS`\n   * was split out of it: one `selection[AI_LLM].primary` decides every provider\n   * mapped into that slot. While the coding transport mapped to `AI_LLM`, an\n   * application structurally could NOT choose one vendor's coding agent and a\n   * different vendor for chat — picking a chat provider silently picked the\n   * agent that would be allowed to edit its source.\n   *\n   * The stakes differ too, which is why fusing them was wrong beyond the\n   * ergonomics: selecting a chat model is a quality and cost decision, while\n   * selecting the agent that writes your code is those things AND an\n   * authorisation decision. They deserve separate, deliberate answers.\n   */\n  AI_CODING_AGENT = 'AI_CODING_AGENT',\n\n  /*\n   * WITHDRAWN 2026-09-03: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` were members here and are\n   * not any more. Neither could ever be filled — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` had no\n   * entry pointing at either, so no provider capability token could claim the slot — while both were\n   * classified `SELECT_ONE`, which asserts that exactly one provider must be selected. Selecting one\n   * of zero candidates is not a resolution mode.\n   *\n   * Both capabilities are real and both are delivered elsewhere, which is why withdrawing the slots\n   * costs nothing: antivirus scanning is `InfraCapability.ANTIVIRUS_SCANNING`, fulfilled by ClamAV\n   * and consumed by `FileScanningBackendService`; PDF generation is the in-process `pdfTemplates`\n   * surface, rendered by `@react-pdf/renderer` inside the backend. Neither has an external\n   * provider, and neither is planned to.\n   *\n   * `InfraCapability.DOCUMENT_RENDERING` (Gotenberg) was provisioned beside the PDF surface and\n   * consumed by nothing; it was withdrawn on 2026-09-08 (#477) because in-process rendering had\n   * superseded it. Note the two are not interchangeable if it is ever reconsidered:\n   * `@react-pdf/renderer` composes a document from React primitives, while Gotenberg converts\n   * EXISTING HTML and Office documents — that is a different capability, not a second\n   * implementation of this one.\n   *\n   * Removing `ANTIVIRUS_SCANNING` also removes a collision: the identical spelling named an engine\n   * slot nothing could fill AND a live infra capability, in two packages, so a reader grepping the\n   * word landed in whichever they searched first.\n   *\n   * If a hosted AV or document-rendering vendor is ever adopted, the member comes back WITH its\n   * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` entry and its own JSDoc in the same change.\n   *\n   * WITHDRAWN 2026-09-09: `BILLING_PAYMENTS`, the third member of exactly that shape, and the one\n   * this paragraph's own closing rule should have caught. It was never withdrawn with the other two\n   * because it had been left behind DELIBERATELY — as a \"reserved slot\" — which reads as a decision\n   * and is why nobody re-examined it. Measured before removing, across the whole repository outside\n   * `node_modules` / `dist`: it appeared in live source at exactly THREE sites, and none of them was\n   * a use — the enum declaration itself, its row in the compile-forced\n   * `ENGINE_CAPABILITY_RESOLUTION_MODE` record, and a comment in a test naming it as a slot the\n   * billing provider must NOT be registered under. Zero applications enabled it, zero scaffolds\n   * wrote it, zero consumers queried it, and no provider capability token mapped to it.\n   *\n   * The capability it names is real and is already delivered: a billing provider (Stripe) declares\n   * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills `EngineCapability.BILLING`, which is the slot\n   * applications enable and `getProvidersForEngineCapability` gates on. Payment EXECUTION is served\n   * through that same provider's `BILLING_PROVIDER` protocol; splitting it into a second engine slot\n   * was a plan-era intention (`provider-registry-materialization-workflow.md`) that the shipped\n   * model settled the other way. So the withdrawal removes a name, not a capability.\n   *\n   * The reason a reserved slot is worse than no slot is `EngineCapabilityResolutionMode`: every\n   * member must be classified, `BILLING_PAYMENTS` was classified `SELECT_ONE`, and `SELECT_ONE`\n   * asserts that exactly one provider is selected from the candidates. There were zero candidates\n   * and there could never be one. A vocabulary member that no configuration can satisfy is not a\n   * reservation, it is a false statement the compiler is forced to carry.\n   *\n   * If a payments vendor is ever selected independently of the billing vendor, the member comes back\n   * with its provider-capability token and its map entry in the same change — the same rule as\n   * above, now with three instances behind it.\n   */\n\n  FRONTEND_ERROR_MONITORING = 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS = 'FRONTEND_PRODUCT_ANALYTICS',\n\n  /**\n   * Backend LLM-call observability (model/tokens/cost/latency per `invokeAgent`),\n   * platform-scoped. This enables model-call observability when the selected\n   * provider configuration supplies that capability; it does not itself\n   * configure a provider or make telemetry operational.\n   */\n  LLM_OBSERVABILITY = 'LLM_OBSERVABILITY',\n\n  /**\n   * Operational telemetry (traces/metrics/logs) shipped via the OpenTelemetry\n   * SDK over OTLP to a provider (for example, BetterStack). Unlike\n   * `LLM_OBSERVABILITY`, the connection is preloaded from\n   * `OTEL_*` env vars (the CLI translates the saas-config selection + per-env\n   * infra config into them) BEFORE app config — not resolved through the runtime\n   * registry. Author the corresponding infrastructure/provider settings in\n   * the application environment before relying on telemetry.\n   */\n  OBSERVABILITY_TELEMETRY = 'OBSERVABILITY_TELEMETRY',\n}\n/** @wildo_source:part:end saas.models.engine-capabilities */\n\n/**\n * Canonical, single-source-of-truth mapping from the open\n * `ProviderCapability` vocabulary (the built-in subset) to the closed\n * `EngineCapability` slots the engine actually fulfills.\n *\n * A provider declares which `providerCapabilities` it satisfies (e.g.\n * Stripe → `BILLING`, Resend → `EMAIL_TRANSACTIONAL`, Anthropic →\n * `LLM_CHAT`/`CODING_AGENT`). This map projects each built-in\n * capability onto the engine slot it fills, so a provider's\n * `engineCapabilities` set can be derived mechanically. Multiple\n * provider capabilities may share one engine slot (every `LLM_*`\n * capability maps to `AI_LLM`); de-duplicate after projecting.\n *\n * **Why this lives here (one map, three consumers).** The projection\n * used to be hand-copied in three places that silently drifted:\n *   1. The runtime registry projection in `saas-backend-lib`\n *      (`ExternalProvidersRegistryBackendService.buildRuntimeRegistryFromProviderModules`),\n *      which decides which provider answers `getProvidersForEngineCapability`.\n *   2. The backend companion-discovery export in\n *      `@wildo-ai/external-connectors-private` (feeds the generated\n *      `provider-catalog.types.ts` autocomplete via `wildo config sync`).\n *   3. The frontend companion-discovery export in\n *      `@wildo-ai/external-connectors-public` (same, for browser-bound\n *      provider modules).\n * A missing/wrong entry in any copy silently breaks a different surface\n * (a registry resolution, or the catalog autocomplete). It is co-located\n * with the `EngineCapability` enum it projects onto, and every consumer\n * imports it from the `@wildo-ai/saas-models` package root barrel.\n *\n * **Bundle boundary — why here and not beside `BUILTIN_PROVIDER_CAPABILITY`.**\n * This map references `EngineCapability`, which is deliberately kept off\n * the browser-safe `@wildo-ai/saas-models/public-runtime` seam. So it must\n * live in a full-only module. `engine-capabilities.shared.schemas.ts` is\n * exactly that (exported from the root barrel, never from\n * `public-runtime/index.ts`), whereas `provider-capability.shared.schemas.ts`\n * — the other natural home — IS on the public seam and would drag\n * `EngineCapability` into the browser bundle. The frontend discovery\n * consumer (#3) imports this map through its Node-only `./companion`\n * subpath, which already pulls the full root barrel; the browser-shipped\n * `./app`/`./techdoc`/`./website` subpaths never reach it.\n *\n * **BILLING → BILLING.** A billing provider (Stripe) declares\n * `BUILTIN_PROVIDER_CAPABILITY.BILLING` and fills the\n * `EngineCapability.BILLING` slot — the SAME slot apps enable in\n * `defineSaaSProviders`/`engineCapabilities` activation config and that\n * `getProvidersForEngineCapability` gates resolution on. The runtime copy\n * of this projection historically mapped it onto a distinct\n * `EngineCapability.BILLING_PAYMENTS` slot instead, registering Stripe\n * under something no activation config enables and no consumer queries,\n * which made it unreachable through the registry. That second slot was\n * withdrawn from the enum on 2026-09-09 (see the WITHDRAWN block beside\n * the enum) — it had no producer and no consumer other than the bug.\n *\n * **Intentionally unmapped.** `SSO_OAUTH2`, `SSO_SAML`, `FRONTEND_SEARCH`,\n * `FRONTEND_FILE_PICKER`, `FRONTEND_CAPTCHA` and `FRONTEND_ADDRESS_LOOKUP`\n * (#1702 — an address field works without one, so no engine slot requires it)\n * have no closed engine slot today — they are fulfilled by provider protocols / app wiring, not\n * by an `EngineCapability`. Their absence here is by construction, not an\n * oversight: a `Partial<Record<…>>` lookup returns `undefined` and the\n * capability contributes nothing to a provider's `engineCapabilities`.\n *\n * There are no app-extended provider capabilities: the augmentation point was\n * removed as an extension point with no resolver (#502), so this map covers the\n * whole vocabulary rather than the built-in half of it.\n */\nconst PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES = {\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_TRANSACTIONAL]: EngineCapability.EMAIL_TRANSACTIONAL,\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_MARKETING]: EngineCapability.EMAIL_MARKETING,\n  [BUILTIN_PROVIDER_CAPABILITY.EMAIL_INBOUND]: EngineCapability.EMAIL_INBOUND,\n  [BUILTIN_PROVIDER_CAPABILITY.SMS]: EngineCapability.SMS,\n  [BUILTIN_PROVIDER_CAPABILITY.BILLING]: EngineCapability.BILLING,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_CHAT]: EngineCapability.AI_LLM,\n  /**\n   * REPOINTED 2026-08-27 (RAG plan DL2/H4): `LLM_EMBEDDINGS` used to map into `AI_LLM`, which\n   * fused the chat and embeddings provider selections into one slot. The TOKEN keeps its name —\n   * it correctly says \"this provider can produce embeddings\", and it sits inside the anchored\n   * `saas.models.provider-capabilities` block compiled into shipped skills — only the slot it\n   * fills changed. Exactly one token claims the embeddings slot.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_EMBEDDINGS]: EngineCapability.AI_EMBEDDINGS,\n  /**\n   * EXACTLY ONE token claims the document-extraction slot, and it is a new one. Checked rather\n   * than assumed before adding it: `IMAGE_GENERATION` maps to `AI_IMAGE_GENERATION` (output),\n   * `LLM_CHAT` to `AI_LLM`, `LLM_EMBEDDINGS` to `AI_EMBEDDINGS`, and no built-in token mapped\n   * anywhere near document INPUT. Repointing an existing token — the move that kept\n   * `LLM_EMBEDDINGS` alive — was not available here because none of them meant this.\n   */\n  [BUILTIN_PROVIDER_CAPABILITY.DOCUMENT_TEXT_EXTRACTION]: EngineCapability.AI_DOCUMENT_EXTRACTION,\n  [BUILTIN_PROVIDER_CAPABILITY.CODING_AGENT]: EngineCapability.AI_CODING_AGENT,\n  [BUILTIN_PROVIDER_CAPABILITY.IMAGE_GENERATION]: EngineCapability.AI_IMAGE_GENERATION,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING]: EngineCapability.FRONTEND_ERROR_MONITORING,\n  [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS]: EngineCapability.FRONTEND_PRODUCT_ANALYTICS,\n  [BUILTIN_PROVIDER_CAPABILITY.LLM_OBSERVABILITY]: EngineCapability.LLM_OBSERVABILITY,\n  [BUILTIN_PROVIDER_CAPABILITY.OBSERVABILITY_TELEMETRY]: EngineCapability.OBSERVABILITY_TELEMETRY,\n  [BUILTIN_PROVIDER_CAPABILITY.COMPLIANCE_AUDIT_TRAIL]: EngineCapability.COMPLIANCE_AUDIT_TRAIL,\n} as const satisfies Partial<Record<BuiltinProviderCapability, EngineCapability>>;\n\n/**\n * The projection every consumer uses, with the WIDE type it has always had.\n *\n * **Why the literal above and the widened alias here are two declarations.** Consumers index this\n * map with a `BuiltinProviderCapability` VARIABLE — `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[cap]`\n * in the runtime registry, in both companion-discovery exports, in `defineSaaSProviders` and in the\n * tier rule — and that only type-checks against `Partial<Record<…>>`, which admits every token in\n * the vocabulary and answers `undefined` for the six that map nowhere. Annotating the literal that\n * way is what USED to be written here, and it is also what erased the information the totality\n * check below needs: an annotation discards the per-property literal types, so\n * `(typeof MAP)[keyof typeof MAP]` collapsed to `EngineCapability | undefined` and could not say\n * WHICH slots are filled.\n *\n * `as const satisfies` on the literal keeps both: the compiler still rejects a wrong key or a\n * non-`EngineCapability` value at the site where it is written, and the exact filled set survives\n * into the type system. The widening then happens once, here, so no consumer changes and nobody has\n * to know the literal exists.\n */\nexport const PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY: Partial<\n  Record<BuiltinProviderCapability, EngineCapability>\n> = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES;\n\n/**\n * Engine capabilities that DELIBERATELY have no provider capability pointing at them, each named\n * with the reason it is an empty slot rather than a hole.\n *\n * This exists so the two states can never be confused. Before it, an `EngineCapability` member with\n * no entry in the map above looked exactly like one whose entry someone forgot — the absence WAS the\n * record — and that indistinguishability is the whole mechanism behind three separate slots shipping\n * unfillable: `DOCUMENT_GENERATION` and `ANTIVIRUS_SCANNING` (withdrawn 2026-09-03) and\n * `BILLING_PAYMENTS` (withdrawn 2026-09-09, and left standing for six days precisely because\n * \"reserved\" reads like a decision). A capability listed here has been looked at; one that is\n * neither listed here nor mapped above does not compile.\n *\n * **Both members are ACTIVATION capabilities, and that is the criterion.** Each is a real, live,\n * enabled-or-not decision an application makes in `wildo.saas.config.ts` (`ORGANIZATIONS` is\n * enabled by both dogfood applications, `MULTI_LANGUAGE` is written by the scaffold and by the\n * application-creation composition step), and each is implemented BY THE ENGINE — multi-tenancy is\n * the engine's own organization model and scoping, translation is the engine's own i18n pipeline.\n * There is no external party to select, so there is nothing for a provider capability to say. That\n * is categorically different from a withdrawn slot, which named work an external party WOULD do and\n * had no external party able to do it.\n *\n * **Adding a member here is a decision that must be argued, not a way to make a compile error go\n * away.** The test beside this file pins the set to exactly these two, so a third one cannot arrive\n * as a silent edit — see `__tests__/engine-capability-provider-coverage.shared.test.ts`.\n */\nexport const ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY = [\n  /**\n   * Multi-tenancy: organizations, memberships, roles and organization scoping are engine resources\n   * and engine authorization. Nothing about them is procured.\n   */\n  EngineCapability.ORGANIZATIONS,\n  /**\n   * Application-wide i18n: the label tree, the locale negotiation and the translation pipeline are\n   * the engine's. Where translation is MODEL-backed it reaches a provider through `AI_LLM`, which is\n   * its own slot with its own selection — so even that path is not this capability's producer.\n   */\n  EngineCapability.MULTI_LANGUAGE,\n] as const satisfies readonly EngineCapability[];\n\n/**\n * COMPILE-TIME TOTALITY: every `EngineCapability` is either filled by a provider capability or\n * declared an empty slot above. Adding a member to the enum without doing one of the two is a\n * TypeScript error at this line, not a test failure and not a runtime surprise.\n *\n * A compile error is the right instrument here because both inputs are static literals in this one\n * file — there is no runtime state to consult, so nothing is gained by deferring the question to\n * execution, and a great deal is lost: a test only fails for someone who runs it, while this fails\n * for whoever adds the member, in the editor, before the commit.\n *\n * The error a violation produces is `TS2344` on `EngineCapabilityAccountedFor`, reading\n * `Type 'EngineCapability.X' does not satisfy the constraint 'never'` — X being the exact member\n * that is neither mapped nor declared. Measured rather than asserted: deleting the\n * `BUILTIN_PROVIDER_CAPABILITY.SMS` row from the literal above produced exactly that diagnostic,\n * naming `EngineCapability.SMS`, and the row was restored.\n *\n * The two declarations below are unused by design — the assertion IS the declaration, and it is\n * evaluated the moment the file is type-checked. `noUnusedLocals` is off in this package's\n * tsconfig, so nothing objects; do not \"clean them up\".\n */\ntype EngineCapabilityFilledByAProviderCapability =\n  (typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES)[keyof typeof PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY_ENTRIES];\n\ntype EngineCapabilityDeclaredEmpty = (typeof ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY)[number];\n\n/** Resolves to `never` when the two sets above cover the enum, and to the offending member(s) when they do not. */\ntype EngineCapabilityAccountedFor<Unaccounted extends never> = Unaccounted;\n\ntype _EveryEngineCapabilityIsMappedOrDeclaredEmpty = EngineCapabilityAccountedFor<\n  Exclude<EngineCapability, EngineCapabilityFilledByAProviderCapability | EngineCapabilityDeclaredEmpty>\n>;\n\n/**\n * The mirror assertion: a capability may not be BOTH mapped and declared empty.\n *\n * Without it the totality check is satisfiable by lying in the easier direction — list a mapped\n * capability as an empty slot and the union still covers the enum, so a genuinely missing mapping\n * elsewhere could be hidden by a bogus declaration here. `TS2344` again, naming the member that\n * appears on both sides.\n */\ntype _NoEngineCapabilityIsBothMappedAndDeclaredEmpty = EngineCapabilityAccountedFor<\n  Extract<EngineCapabilityDeclaredEmpty, EngineCapabilityFilledByAProviderCapability>\n>;\n\n/** @wildo_source:part:start saas.models.engine-capabilities.required-provider-floor facet:layer:shared facet:audience:app-developer */\n/**\n * Engine capabilities that REQUIRE a resolved provider the moment an\n * application ENABLES them — the engine-level MAIN floor (#328).\n *\n * The asymmetry is the thing to carry away: **enabling a capability with nothing serving it fails at\n * BOOT for these four and at the point of USE for every other slot.** So an author who tries one\n * unserved slot, sees the application come up, and concludes that an unserved capability degrades\n * gracefully has learned the wrong rule from the larger half of the vocabulary.\n *\n * `EngineCapabilityActivation.required` is the application's decision;\n * this set is the ENGINE's: for each member, an enabled capability with no\n * provider is not a degraded mode but a boot-time misconfiguration, because\n * an engine flow the application already relies on fails at first use:\n *\n * - `EMAIL_TRANSACTIONAL` — invitations, address verification and password\n *   reset are engine flows that send mail; with no provider they fail\n *   silently at the moment a user needs them.\n * - `BILLING` — `initializeBillingServices` already fails loud with no\n *   provider; the floor names it in the same place as the others.\n * - `SMS` — phone verification and MFA-by-SMS are engine flows.\n * - `EMAIL_INBOUND` — enabling it declares that work arrives by email; with no\n *   provider nothing hosts the receiving domain, so every message is lost\n *   before the engine sees it and nothing anywhere records that it was (#1630).\n *\n * DELIBERATELY ABSENT, with the reason each would need to overturn:\n * - the `AI_*` slots — consumed per feature (an agent, the logo generator)\n *   and legitimately served on a DIFFERENT host (the companion reaches image\n *   generation; the backend need not), so \"enabled with no backend provider\"\n *   is a normal topology, not a fault. A feature that needs one refuses at\n *   its own site.\n * - the sinks (`COMPLIANCE_AUDIT_TRAIL`, `LLM_OBSERVABILITY`,\n *   `OBSERVABILITY_TELEMETRY`) — fail-OPEN by design (the G4 reconcile\n *   warns), because Layer-1 persistence is unaffected.\n * - `EMAIL_MARKETING` — a campaign feature, not an engine flow.\n * - the `FRONTEND_*` slots — resolved by the frontend facet, invisible to\n *   the backend registry that evaluates this floor.\n * - `ORGANIZATIONS` and `MULTI_LANGUAGE` — no provider token maps to them,\n *   deliberately and by declaration; see\n *   `ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`. A floor requiring a\n *   resolved provider for a slot nothing can fill would refuse every boot that\n *   enabled them. (`BILLING_PAYMENTS` was named here too until it was withdrawn\n *   from the enum on 2026-09-09.)\n *\n * The floor runs only on a host expected to SERVE these slots (see\n * `ApplicationRuntimeProfileBootAssertions.assertsEngineCapabilityProviderFloor`);\n * a minion's scope-filtered registry legitimately resolves none of them.\n */\nexport const ENGINE_CAPABILITIES_REQUIRING_A_PROVIDER_WHEN_ENABLED: ReadonlySet<EngineCapability> = new Set([\n  EngineCapability.EMAIL_TRANSACTIONAL,\n  EngineCapability.BILLING,\n  EngineCapability.SMS,\n  EngineCapability.EMAIL_INBOUND,\n]);\n/** @wildo_source:part:end saas.models.engine-capabilities.required-provider-floor */\n"]}

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-resolution-mode.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,eAAe;IACzB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AA+DD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,gBAAgB,GAC3B,8BAA8B,CAEhC"}
+{"version":3,"file":"engine-capability-resolution-mode.shared.d.ts","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,oBAAY,8BAA8B;IACxC;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,eAAe;IACzB;;;;;OAKG;IACH,OAAO,YAAY;CACpB;AA+DD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,gBAAgB,GAC3B,8BAA8B,CAEhC"}

package/dist/esm/external-providers/engine-capability-resolution-mode.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-resolution-mode.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BA0BX;AA1BD,WAAY,8BAA8B;IACxC;;;;;;;;;;;;;;;;OAgBG;IACH,2DAAyB,CAAA;IACzB;;;;;OAKG;IACH,qDAAmB,CAAA;AACrB,CAAC,EA1BW,8BAA8B,KAA9B,8BAA8B,QA0BzC;AACD,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,iCAAiC,GAA6D;IAClG,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,OAAO;IAEjF;;;;;;;;;;;;;;OAcG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACrE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC5E,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,+FAA+F;IAC/F,8EAA8E;IAC9E,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,8FAA8F;IAC9F,8FAA8F;IAC9F,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,oBAAoB;IACpB,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACvF,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACxF,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC/E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,UAAU;CACtF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA4B;IAE5B,OAAO,iCAAiC,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-resolution-mode facet:layer:shared facet:audience:app-developer\n *\n * How the engine resolves the provider(s) fulfilling an `EngineCapability`\n * when more than one is declared for the same scope.\n *\n * This is a FIRST-CLASS, declared property of a capability — NOT an implicit\n * per-consumer convention. A reader can tell whether a capability picks one\n * provider or writes to all of them; a new capability author declares it\n * here; and both the runtime registry resolver and the `defineSaaSProviders`\n * config validators branch on it (so a `FAN_OUT` capability is validated by\n * DECLARATION and never keyed off `selection`).\n */\nexport enum EngineCapabilityResolutionMode {\n  /**\n   * At most one active provider: the first eligible ref after selection ordering. The default for every capability\n   * (billing, email, observability, …), and a request is served by that one provider.\n   *\n   * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on\n   * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a\n   * primary that is not eligible in the active runtime scope. Eligible policy refs come first;\n   * remaining eligible providers follow, so an invalid primary does not empty that set.\n   * Eligibility requires a registered module declaring the capability and an active scope\n   * declaration for it; resolution does not validate credentials or vendor health. Nothing\n   * retries a second provider when a call to the first one FAILS: the send raises the primary's\n   * error and stops.\n   *\n   * So do not read a declared `whenUnavailable` entry as redundancy, and do not size an\n   * availability argument on it. An application that wants call-time failover builds it at its own\n   * call site, per capability — a deliberate framework boundary, not an omission.\n   */\n  SELECT_ONE = 'SELECT_ONE',\n  /**\n   * ALL declared providers are active simultaneously — every one receives\n   * every emission (no primary, no failover). For sinks whose nature is\n   * additive rather than substitutable: `COMPLIANCE_AUDIT_TRAIL` writes each\n   * audit event to every configured destination.\n   */\n  FAN_OUT = 'FAN_OUT',\n}\n/** @wildo_source:part:end saas.models.providers.capability-resolution-mode */\n\n/**\n * The DECLARED resolution mode for EVERY engine capability. Exhaustive by\n * construction: because this is a `Record<EngineCapability, …>`, adding a new\n * member to the `EngineCapability` enum WITHOUT classifying it here is a COMPILE\n * error. That is deliberate — a bare \"default to SELECT_ONE\" would let a future\n * additive/fan-out capability silently collapse to single-provider resolution\n * (dropping emissions to every non-primary destination) just because its author\n * forgot a one-line edit. The compiler now forces the decision.\n *\n * Only `COMPLIANCE_AUDIT_TRAIL` is `FAN_OUT` today (audit events are additive —\n * every declared destination receives every event). Everything else is\n * `SELECT_ONE`: one active provider, and no failover to a second one.\n */\nconst ENGINE_CAPABILITY_RESOLUTION_MODE: Record<EngineCapability, EngineCapabilityResolutionMode> = {\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: EngineCapabilityResolutionMode.FAN_OUT,\n\n  /**\n   * NOMINAL for the two ACTIVATION capabilities below, and worth stating because the next reader\n   * will otherwise ask the right question. `BILLING_PAYMENTS` was withdrawn from the enum on\n   * 2026-09-09 for being classified `SELECT_ONE` with no provider capability able to fill it —\n   * \"select one of zero candidates\" is not a resolution mode. `ORGANIZATIONS` and `MULTI_LANGUAGE`\n   * have no provider capability either, so why do they stand?\n   *\n   * Because nothing ever RESOLVES them. They are engine-implemented activations (multi-tenancy, the\n   * i18n pipeline): an application enables them, the engine serves them, and no code path asks this\n   * record which provider fulfills them — where the withdrawn slot's whole purpose was to be\n   * resolved and it could not be. Their absence from `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` is a\n   * DECLARATION (`ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`), not a gap, and the row here\n   * exists only because this record is total over the enum by construction — which is the property\n   * that makes a genuinely resolvable new capability impossible to leave unclassified.\n   */\n  [EngineCapability.ORGANIZATIONS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.BILLING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One provider hosts a receiving domain's MX: two receivers of the same address cannot both be\n  // the destination, so inbound email is substitutable, never additive (#1630).\n  [EngineCapability.EMAIL_INBOUND]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.SMS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_LLM]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_IMAGE_GENERATION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Embeddings are substitutable, not additive: one provider serves a vector space, and writing\n  // the same chunk through two providers would produce two incompatible spaces, not redundancy.\n  [EngineCapability.AI_EMBEDDINGS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Extraction is substitutable, not additive: one provider reads a document, and running the\n  // same bytes through two OCR services would produce two divergent transcriptions of one page\n  // with no principled way to merge them — plus a second egress of the same private content.\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One agent per task, and emphatically not fan-out: two coding agents given the same task\n  // against the same worktree do not produce redundancy, they produce a merge conflict nobody\n  // asked for — and the change attribution that follows a run could no longer say which agent\n  // wrote which file.\n  [EngineCapability.AI_CODING_AGENT]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.LLM_OBSERVABILITY]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: EngineCapabilityResolutionMode.SELECT_ONE,\n};\n\n/**\n * The declared resolution mode for an engine capability. A TOTAL lookup — every\n * capability is explicitly classified in `ENGINE_CAPABILITY_RESOLUTION_MODE`\n * (no silent default).\n *\n * Consumers: the runtime registry (`ExternalProvidersRegistryBackendService`\n * — `FAN_OUT` uses the full provider list, `SELECT_ONE` uses the primary) and\n * the `defineSaaSProviders` validators (a `FAN_OUT` capability is validated by\n * declaration and rejects a `selection` entry).\n */\nexport function getEngineCapabilityResolutionMode(\n  capability: EngineCapability,\n): EngineCapabilityResolutionMode {\n  return ENGINE_CAPABILITY_RESOLUTION_MODE[capability];\n}\n"]}
+{"version":3,"file":"engine-capability-resolution-mode.shared.js","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-resolution-mode.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,8BA0BX;AA1BD,WAAY,8BAA8B;IACxC;;;;;;;;;;;;;;;;OAgBG;IACH,2DAAyB,CAAA;IACzB;;;;;OAKG;IACH,qDAAmB,CAAA;AACrB,CAAC,EA1BW,8BAA8B,KAA9B,8BAA8B,QA0BzC;AACD,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,iCAAiC,GAA6D;IAClG,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,OAAO;IAEjF;;;;;;;;;;;;;;OAcG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACrE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC5E,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,+FAA+F;IAC/F,8EAA8E;IAC9E,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACjF,8FAA8F;IAC9F,8FAA8F;IAC9F,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC3E,4FAA4F;IAC5F,6FAA6F;IAC7F,2FAA2F;IAC3F,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACpF,0FAA0F;IAC1F,4FAA4F;IAC5F,4FAA4F;IAC5F,oBAAoB;IACpB,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC7E,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACvF,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,8BAA8B,CAAC,UAAU;IACxF,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,8BAA8B,CAAC,UAAU;IAC/E,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,8BAA8B,CAAC,UAAU;CACtF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAA4B;IAE5B,OAAO,iCAAiC,CAAC,UAAU,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-resolution-mode facet:layer:shared facet:audience:app-developer\n *\n * How the engine resolves the provider(s) fulfilling an `EngineCapability`\n * when more than one is declared for the same scope.\n *\n * This is a FIRST-CLASS, declared property of a capability — NOT an implicit\n * per-consumer convention. A reader can tell whether a capability picks one\n * provider or writes to all of them; a new capability author declares it\n * here; and both the runtime registry resolver and the `defineSaaSProviders`\n * config validators branch on it (so a `FAN_OUT` capability is validated by\n * DECLARATION and never keyed off `selection`).\n */\nexport enum EngineCapabilityResolutionMode {\n  /**\n   * At most one active provider: the first eligible ref after selection ordering. The default for every capability\n   * (billing, email, observability, …), and a request is served by that one provider.\n   *\n   * ⚠️ `whenUnavailable` is NOT a failover list, and the field was renamed from `fallbacks` on\n   * 2026-09-08 precisely because that name promised one. It names ORDERED SUBSTITUTES for a\n   * primary that is not eligible in the active runtime scope. Eligible policy refs come first;\n   * remaining eligible providers follow, so an invalid primary does not empty that set.\n   * Eligibility requires a registered module declaring the capability and an active scope\n   * declaration for it; resolution does not validate credentials or vendor health. Nothing\n   * retries a second provider when a call to the first one FAILS: the send raises the primary's\n   * error and stops.\n   *\n   * So do not read a declared `whenUnavailable` entry as redundancy, and do not size an\n   * availability argument on it. An application that wants call-time failover builds it at its own\n   * call site, per capability — a deliberate framework boundary, not an omission.\n   */\n  SELECT_ONE = 'SELECT_ONE',\n  /**\n   * ALL declared providers are active simultaneously — every one receives\n   * every emission (no primary, no failover). For sinks whose nature is\n   * additive rather than substitutable: `COMPLIANCE_AUDIT_TRAIL` writes each\n   * audit event to every configured destination.\n   */\n  FAN_OUT = 'FAN_OUT',\n}\n/** @wildo_source:part:end saas.models.providers.capability-resolution-mode */\n\n/**\n * The DECLARED resolution mode for EVERY engine capability. Exhaustive by\n * construction: because this is a `Record<EngineCapability, …>`, adding a new\n * member to the `EngineCapability` enum WITHOUT classifying it here is a COMPILE\n * error. That is deliberate — a bare \"default to SELECT_ONE\" would let a future\n * additive/fan-out capability silently collapse to single-provider resolution\n * (dropping emissions to every non-primary destination) just because its author\n * forgot a one-line edit. The compiler now forces the decision.\n *\n * Only `COMPLIANCE_AUDIT_TRAIL` is `FAN_OUT` today (audit events are additive —\n * every declared destination receives every event). Everything else is\n * `SELECT_ONE`: one active provider, and no failover to a second one.\n */\nconst ENGINE_CAPABILITY_RESOLUTION_MODE: Record<EngineCapability, EngineCapabilityResolutionMode> = {\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: EngineCapabilityResolutionMode.FAN_OUT,\n\n  /**\n   * NOMINAL for the two ACTIVATION capabilities below, and worth stating because the next reader\n   * will otherwise ask the right question. `BILLING_PAYMENTS` was withdrawn from the enum on\n   * 2026-09-09 for being classified `SELECT_ONE` with no provider capability able to fill it —\n   * \"select one of zero candidates\" is not a resolution mode. `ORGANIZATIONS` and `MULTI_LANGUAGE`\n   * have no provider capability either, so why do they stand?\n   *\n   * Because nothing ever RESOLVES them. They are engine-implemented activations (multi-tenancy, the\n   * i18n pipeline): an application enables them, the engine serves them, and no code path asks this\n   * record which provider fulfills them — where the withdrawn slot's whole purpose was to be\n   * resolved and it could not be. Their absence from `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` is a\n   * DECLARATION (`ENGINE_CAPABILITIES_WITH_NO_PROVIDER_CAPABILITY`), not a gap, and the row here\n   * exists only because this record is total over the enum by construction — which is the property\n   * that makes a genuinely resolvable new capability impossible to leave unclassified.\n   */\n  [EngineCapability.ORGANIZATIONS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.BILLING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.MULTI_LANGUAGE]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.EMAIL_MARKETING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One provider hosts a receiving domain's MX: two receivers of the same address cannot both be\n  // the destination, so inbound email is substitutable, never additive (#1630).\n  [EngineCapability.EMAIL_INBOUND]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.SMS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_LLM]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.AI_IMAGE_GENERATION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Embeddings are substitutable, not additive: one provider serves a vector space, and writing\n  // the same chunk through two providers would produce two incompatible spaces, not redundancy.\n  [EngineCapability.AI_EMBEDDINGS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // Extraction is substitutable, not additive: one provider reads a document, and running the\n  // same bytes through two OCR services would produce two divergent transcriptions of one page\n  // with no principled way to merge them — plus a second egress of the same private content.\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: EngineCapabilityResolutionMode.SELECT_ONE,\n  // One agent per task, and emphatically not fan-out: two coding agents given the same task\n  // against the same worktree do not produce redundancy, they produce a merge conflict nobody\n  // asked for — and the change attribution that follows a run could no longer say which agent\n  // wrote which file.\n  [EngineCapability.AI_CODING_AGENT]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.LLM_OBSERVABILITY]: EngineCapabilityResolutionMode.SELECT_ONE,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: EngineCapabilityResolutionMode.SELECT_ONE,\n};\n\n/**\n * The declared resolution mode for an engine capability. A TOTAL lookup — every\n * capability is explicitly classified in `ENGINE_CAPABILITY_RESOLUTION_MODE`\n * (no silent default).\n *\n * Consumers: the runtime registry (`ExternalProvidersRegistryBackendService`\n * — `FAN_OUT` uses the full provider list, `SELECT_ONE` uses the primary) and\n * the `defineSaaSProviders` validators (a `FAN_OUT` capability is validated by\n * declaration and rejects a `selection` entry).\n */\nexport function getEngineCapabilityResolutionMode(\n  capability: EngineCapability,\n): EngineCapabilityResolutionMode {\n  return ENGINE_CAPABILITY_RESOLUTION_MODE[capability];\n}\n"]}

package/dist/esm/external-providers/engine-capability-surface.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-surface.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-surface.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;;OAQG;IACH,eAAe,oBAAoB;IACnC;;;;;;;;;;;OAWG;IACH,mBAAmB,wBAAwB;CAC5C;AAiGD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,uBAAuB,EAAE,CAE5G;AAED;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAE3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAGrF"}
+{"version":3,"file":"engine-capability-surface.shared.d.ts","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-surface.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;;OAQG;IACH,eAAe,oBAAoB;IACnC;;;;;;;;;;;OAWG;IACH,mBAAmB,wBAAwB;CAC5C;AAiGD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,gBAAgB,GAAG,SAAS,uBAAuB,EAAE,CAE5G;AAED;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAE3F;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAGrF"}

package/dist/esm/external-providers/engine-capability-surface.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-capability-surface.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/engine-capability-surface.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC;;;;;;;;OAQG;IACH,8DAAmC,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,sEAA2C,CAAA;AAC7C,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AACD,sEAAsE;AAEtE,uFAAuF;AACvF,MAAM,aAAa,GAAuC;IACxD,uBAAuB,CAAC,eAAe;IACvC,uBAAuB,CAAC,mBAAmB;CAC5C,CAAC;AACF,mFAAmF;AACnF,MAAM,YAAY,GAAuC,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,0BAA0B,GAAiE;IAC/F;;OAEG;IAEH;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,aAAa;IACxC;;;;;;;OAOG;IACH,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,aAAa;IACrD;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,CAAC,uBAAuB,CAAC,mBAAmB,CAAC;IACjF;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,gFAAgF;IAChF,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IAEvD;;;;;;OAMG;IACH,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,aAAa;IACnD,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,aAAa;IAEzD;;;;OAIG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,YAAY;IACxC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,YAAY;IAC/C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IACvD,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,YAAY;IACpD,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,YAAY;IAChD,2GAA2G;IAC3G,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY;IACpC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,YAAY;IAC1D,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,YAAY;CAC5D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAA4B;IACtE,OAAO,0BAA0B,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qCAAqC,CAAC,UAA4B;IAChF,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,UAA4B;IAC1E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACvI,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-surface facet:layer:shared facet:audience:app-developer\n *\n * WHICH SURFACE of the system reaches an `EngineCapability` — the deployed\n * application serving its users, the development companion building that\n * application, or both.\n *\n * This exists because compliance is not one question. A privacy notice, a\n * record of processing and a processor agreement all describe what the\n * CONTRACTED SERVICE does with a data subject's personal data; a\n * secure-development or supply-chain control describes how the software was\n * BUILT. An application that answers the first honestly — \"my product performs\n * no AI processing of customer content\" — may still have been authored with an\n * AI coding agent, and until this axis existed it had no way to say so: one\n * `engineCapabilities` field answered both questions at once, so declaring the\n * build-time tool silently made the product claim a runtime feature.\n *\n * **A capability may serve BOTH, and that is the common case for the `AI_*`\n * slots.** The axis is therefore a SET, not a choice. What narrows a particular\n * declaration to one surface is the provider SCOPE it is declared in\n * (`companion` versus the runtime scopes) — this map says what the capability\n * CAN serve, the scope says what a given declaration DOES serve.\n */\nexport enum EngineCapabilitySurface {\n  /**\n   * Reached by the DEPLOYED application while it serves its users.\n   *\n   * This is the surface every customer-facing compliance statement is about:\n   * GDPR Art. 13/14 notices, Art. 30 records, Art. 28 processor terms, EU AI\n   * Act Art. 50 transparency, and service terms. If a capability is not on this\n   * surface, it processes no data subject's personal data through the\n   * contracted service, and a document about that service must not describe it.\n   */\n  RUNTIME_SERVICE = 'RUNTIME_SERVICE',\n  /**\n   * Reached by the DEVELOPMENT COMPANION while the application is being built.\n   *\n   * Operates on the application's own source, specifications and generated\n   * artifacts — never on a customer's data. Not exempt from compliance, and\n   * saying so is the point of the axis rather than a caveat to it: this is the\n   * surface NIST SP 800-53 SA-3/SA-8/SA-11/SA-15 and the SR supply-chain family\n   * are about, as are the secure-development and change-management controls of\n   * the commercial certification frameworks. It is simply a\n   * DIFFERENT set of obligations from the runtime ones, asked of a different\n   * artifact.\n   */\n  AUTHORING_COMPANION = 'AUTHORING_COMPANION',\n}\n/** @wildo_source:part:end saas.models.providers.capability-surface */\n\n/** Both surfaces, named once so the common `AI_*` answer is not retyped per member. */\nconst BOTH_SURFACES: readonly EngineCapabilitySurface[] = [\n  EngineCapabilitySurface.RUNTIME_SERVICE,\n  EngineCapabilitySurface.AUTHORING_COMPANION,\n];\n/** Runtime only — the answer for every capability the companion does not reach. */\nconst RUNTIME_ONLY: readonly EngineCapabilitySurface[] = [EngineCapabilitySurface.RUNTIME_SERVICE];\n\n/**\n * The DECLARED surfaces of EVERY engine capability. Exhaustive by construction:\n * because this is a `Record<EngineCapability, …>`, adding a member to the\n * `EngineCapability` enum WITHOUT classifying it here is a COMPILE error.\n *\n * That is the whole reason it is a Record rather than a lookup with a default,\n * and it is the same argument `ENGINE_CAPABILITY_RESOLUTION_MODE` makes beside\n * it: a bare \"default to RUNTIME_SERVICE\" would let a future build-time\n * capability silently enter a privacy notice as a product feature, which is\n * exactly the defect this map was created to close.\n *\n * **Every classification below is MEASURED against what reaches the capability\n * today, not against what plausibly might.** A capability whose companion\n * consumer is added later becomes a compile-visible decision at that moment,\n * which is better than a speculative `AUTHORING_COMPANION` nothing serves. A\n * per-host grep of the enum members was tried as the basis for this map and\n * REJECTED — it reports `AI_CODING_AGENT` as unreferenced on every host while\n * that capability is plainly companion-reached, because naming the enum and\n * reaching the capability are different things.\n */\nconst ENGINE_CAPABILITY_SURFACES: Record<EngineCapability, readonly EngineCapabilitySurface[]> = {\n  /*\n   * The four AI slots split two-and-two, and the split is the reason this map exists.\n   */\n\n  /**\n   * BOTH. An application may expose LLM features to its users, and the companion\n   * reaches an LLM for its own work: the meta-workflows structured-generation\n   * agent and the playbook judge (`META_WORKFLOWS_PROVIDER_REF`), and the\n   * brief-adequacy agent. Neither of those touches customer data.\n   */\n  [EngineCapability.AI_LLM]: BOTH_SURFACES,\n  /**\n   * BOTH. The companion's brand step generates and judges a logo through an\n   * IMAGE-modality agent; an application may equally offer image generation to\n   * its users. `engine-capabilities.shared.schemas.ts` already recorded this\n   * topology in prose — \"legitimately served on a DIFFERENT host (the companion\n   * reaches image generation; the backend need not)\" — one file before anything\n   * could read it.\n   */\n  [EngineCapability.AI_IMAGE_GENERATION]: BOTH_SURFACES,\n  /**\n   * AUTHORING ONLY, and this is the member the axis was written for. The coding\n   * agent writes the application's SOURCE. It is never reached while the\n   * application serves a user, so it belongs in a secure-development statement\n   * and must never appear in a statement about the contracted service.\n   */\n  [EngineCapability.AI_CODING_AGENT]: [EngineCapabilitySurface.AUTHORING_COMPANION],\n  /**\n   * RUNTIME ONLY. Embeddings are produced for `.ragSource()` fields as the\n   * application writes rows — a runtime feature over customer content. The\n   * companion has no embeddings consumer today; the only companion-side mention\n   * is a test asserting how an ABSENT capability is reported.\n   */\n  [EngineCapability.AI_EMBEDDINGS]: RUNTIME_ONLY,\n  /** RUNTIME ONLY. Extraction runs over content an application's users supply. */\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: RUNTIME_ONLY,\n\n  /*\n   * The two observability sinks are BOTH, because what they observe happens on\n   * both surfaces. The companion binds them itself: its container comments that\n   * the instrumentation \"must be installed in any runtime that binds\n   * LLM_OBSERVABILITY (this companion …)\", and its startup initializes for the\n   * LLM_OBSERVABILITY / OBSERVABILITY_TELEMETRY selection.\n   */\n  [EngineCapability.LLM_OBSERVABILITY]: BOTH_SURFACES,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: BOTH_SURFACES,\n\n  /*\n   * Everything below is RUNTIME ONLY: each is an engine flow of the deployed\n   * application, reached while it serves a user, and none has a companion\n   * consumer.\n   */\n  [EngineCapability.ORGANIZATIONS]: RUNTIME_ONLY,\n  [EngineCapability.BILLING]: RUNTIME_ONLY,\n  [EngineCapability.MULTI_LANGUAGE]: RUNTIME_ONLY,\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_MARKETING]: RUNTIME_ONLY,\n  /** RUNTIME ONLY. Mail to the deployed application's organizations; the companion receives none (#1630). */\n  [EngineCapability.EMAIL_INBOUND]: RUNTIME_ONLY,\n  [EngineCapability.SMS]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: RUNTIME_ONLY,\n};\n\n/**\n * The surfaces a capability may be reached on.\n *\n * Returns the declared set; never empty, because a capability nothing reaches\n * on either surface would have no reason to exist in the vocabulary.\n */\nexport function getEngineCapabilitySurfaces(capability: EngineCapability): readonly EngineCapabilitySurface[] {\n  return ENGINE_CAPABILITY_SURFACES[capability];\n}\n\n/**\n * Does this capability reach the DEPLOYED application serving its users?\n *\n * The predicate a customer-facing compliance statement asks. A capability for\n * which this is `false` processes no data subject's personal data through the\n * contracted service, so a privacy notice, a record of processing or a set of\n * service terms must not describe it as a feature of that service.\n */\nexport function engineCapabilityReachesRuntimeService(capability: EngineCapability): boolean {\n  return getEngineCapabilitySurfaces(capability).includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n\n/**\n * Is this capability reached ONLY while the application is being built?\n *\n * Deliberately not the negation of the predicate above: a capability that is\n * BOTH is reached at authoring time too, and a statement about how the software\n * is developed should include it. This names the narrower population — the\n * capabilities that are invisible to the running product — which is the set a\n * runtime-scoped document must exclude and a secure-development document must\n * not.\n */\nexport function engineCapabilityIsAuthoringOnly(capability: EngineCapability): boolean {\n  const surfaces = getEngineCapabilitySurfaces(capability);\n  return surfaces.includes(EngineCapabilitySurface.AUTHORING_COMPANION) && !surfaces.includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n"]}
+{"version":3,"file":"engine-capability-surface.shared.js","sourceRoot":"","sources":["../../../src/external-providers/engine-capability-surface.shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAN,IAAY,uBAwBX;AAxBD,WAAY,uBAAuB;IACjC;;;;;;;;OAQG;IACH,8DAAmC,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,sEAA2C,CAAA;AAC7C,CAAC,EAxBW,uBAAuB,KAAvB,uBAAuB,QAwBlC;AACD,sEAAsE;AAEtE,uFAAuF;AACvF,MAAM,aAAa,GAAuC;IACxD,uBAAuB,CAAC,eAAe;IACvC,uBAAuB,CAAC,mBAAmB;CAC5C,CAAC;AACF,mFAAmF;AACnF,MAAM,YAAY,GAAuC,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,0BAA0B,GAAiE;IAC/F;;OAEG;IAEH;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,aAAa;IACxC;;;;;;;OAOG;IACH,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,aAAa;IACrD;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,CAAC,uBAAuB,CAAC,mBAAmB,CAAC;IACjF;;;;;OAKG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,gFAAgF;IAChF,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IAEvD;;;;;;OAMG;IACH,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,aAAa;IACnD,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,aAAa;IAEzD;;;;OAIG;IACH,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,YAAY;IACxC,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,YAAY;IAC/C,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,EAAE,YAAY;IACvD,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,YAAY;IACpD,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,YAAY;IAChD,2GAA2G;IAC3G,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,YAAY;IAC9C,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY;IACpC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,EAAE,YAAY;IAC1D,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,YAAY;CAC5D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAA4B;IACtE,OAAO,0BAA0B,CAAC,UAAU,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qCAAqC,CAAC,UAA4B;IAChF,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,UAA4B;IAC1E,MAAM,QAAQ,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACzD,OAAO,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC;AACvI,CAAC","sourcesContent":["import { EngineCapability } from './engine-capabilities.shared.schemas';\n\n/**\n * @wildo_source:part:start saas.models.providers.capability-surface facet:layer:shared facet:audience:app-developer\n *\n * WHICH SURFACE of the system reaches an `EngineCapability` — the deployed\n * application serving its users, the development companion building that\n * application, or both.\n *\n * This exists because compliance is not one question. A privacy notice, a\n * record of processing and a processor agreement all describe what the\n * CONTRACTED SERVICE does with a data subject's personal data; a\n * secure-development or supply-chain control describes how the software was\n * BUILT. An application that answers the first honestly — \"my product performs\n * no AI processing of customer content\" — may still have been authored with an\n * AI coding agent, and until this axis existed it had no way to say so: one\n * `engineCapabilities` field answered both questions at once, so declaring the\n * build-time tool silently made the product claim a runtime feature.\n *\n * **A capability may serve BOTH, and that is the common case for the `AI_*`\n * slots.** The axis is therefore a SET, not a choice. What narrows a particular\n * declaration to one surface is the provider SCOPE it is declared in\n * (`companion` versus the runtime scopes) — this map says what the capability\n * CAN serve, the scope says what a given declaration DOES serve.\n */\nexport enum EngineCapabilitySurface {\n  /**\n   * Reached by the DEPLOYED application while it serves its users.\n   *\n   * This is the surface every customer-facing compliance statement is about:\n   * GDPR Art. 13/14 notices, Art. 30 records, Art. 28 processor terms, EU AI\n   * Act Art. 50 transparency, and service terms. If a capability is not on this\n   * surface, it processes no data subject's personal data through the\n   * contracted service, and a document about that service must not describe it.\n   */\n  RUNTIME_SERVICE = 'RUNTIME_SERVICE',\n  /**\n   * Reached by the DEVELOPMENT COMPANION while the application is being built.\n   *\n   * Operates on the application's own source, specifications and generated\n   * artifacts — never on a customer's data. Not exempt from compliance, and\n   * saying so is the point of the axis rather than a caveat to it: this is the\n   * surface NIST SP 800-53 SA-3/SA-8/SA-11/SA-15 and the SR supply-chain family\n   * are about, as are the secure-development and change-management controls of\n   * the commercial certification frameworks. It is simply a\n   * DIFFERENT set of obligations from the runtime ones, asked of a different\n   * artifact.\n   */\n  AUTHORING_COMPANION = 'AUTHORING_COMPANION',\n}\n/** @wildo_source:part:end saas.models.providers.capability-surface */\n\n/** Both surfaces, named once so the common `AI_*` answer is not retyped per member. */\nconst BOTH_SURFACES: readonly EngineCapabilitySurface[] = [\n  EngineCapabilitySurface.RUNTIME_SERVICE,\n  EngineCapabilitySurface.AUTHORING_COMPANION,\n];\n/** Runtime only — the answer for every capability the companion does not reach. */\nconst RUNTIME_ONLY: readonly EngineCapabilitySurface[] = [EngineCapabilitySurface.RUNTIME_SERVICE];\n\n/**\n * The DECLARED surfaces of EVERY engine capability. Exhaustive by construction:\n * because this is a `Record<EngineCapability, …>`, adding a member to the\n * `EngineCapability` enum WITHOUT classifying it here is a COMPILE error.\n *\n * That is the whole reason it is a Record rather than a lookup with a default,\n * and it is the same argument `ENGINE_CAPABILITY_RESOLUTION_MODE` makes beside\n * it: a bare \"default to RUNTIME_SERVICE\" would let a future build-time\n * capability silently enter a privacy notice as a product feature, which is\n * exactly the defect this map was created to close.\n *\n * **Every classification below is MEASURED against what reaches the capability\n * today, not against what plausibly might.** A capability whose companion\n * consumer is added later becomes a compile-visible decision at that moment,\n * which is better than a speculative `AUTHORING_COMPANION` nothing serves. A\n * per-host grep of the enum members was tried as the basis for this map and\n * REJECTED — it reports `AI_CODING_AGENT` as unreferenced on every host while\n * that capability is plainly companion-reached, because naming the enum and\n * reaching the capability are different things.\n */\nconst ENGINE_CAPABILITY_SURFACES: Record<EngineCapability, readonly EngineCapabilitySurface[]> = {\n  /*\n   * The four AI slots split two-and-two, and the split is the reason this map exists.\n   */\n\n  /**\n   * BOTH. An application may expose LLM features to its users, and the companion\n   * reaches an LLM for its own work: the meta-workflows structured-generation\n   * agent and the playbook judge (`META_WORKFLOWS_PROVIDER_REF`), and the\n   * brief-adequacy agent. Neither of those touches customer data.\n   */\n  [EngineCapability.AI_LLM]: BOTH_SURFACES,\n  /**\n   * BOTH. The companion's brand step generates and judges a logo through an\n   * IMAGE-modality agent; an application may equally offer image generation to\n   * its users. `engine-capabilities.shared.schemas.ts` already recorded this\n   * topology in prose — \"legitimately served on a DIFFERENT host (the companion\n   * reaches image generation; the backend need not)\" — one file before anything\n   * could read it.\n   */\n  [EngineCapability.AI_IMAGE_GENERATION]: BOTH_SURFACES,\n  /**\n   * AUTHORING ONLY, and this is the member the axis was written for. The coding\n   * agent writes the application's SOURCE. It is never reached while the\n   * application serves a user, so it belongs in a secure-development statement\n   * and must never appear in a statement about the contracted service.\n   */\n  [EngineCapability.AI_CODING_AGENT]: [EngineCapabilitySurface.AUTHORING_COMPANION],\n  /**\n   * RUNTIME ONLY. Embeddings are produced for `.ragSource()` fields as the\n   * application writes rows — a runtime feature over customer content. The\n   * companion has no embeddings consumer today; the only companion-side mention\n   * is a test asserting how an ABSENT capability is reported.\n   */\n  [EngineCapability.AI_EMBEDDINGS]: RUNTIME_ONLY,\n  /** RUNTIME ONLY. Extraction runs over content an application's users supply. */\n  [EngineCapability.AI_DOCUMENT_EXTRACTION]: RUNTIME_ONLY,\n\n  /*\n   * The two observability sinks are BOTH, because what they observe happens on\n   * both surfaces. The companion binds them itself: its container comments that\n   * the instrumentation \"must be installed in any runtime that binds\n   * LLM_OBSERVABILITY (this companion …)\", and its startup initializes for the\n   * LLM_OBSERVABILITY / OBSERVABILITY_TELEMETRY selection.\n   */\n  [EngineCapability.LLM_OBSERVABILITY]: BOTH_SURFACES,\n  [EngineCapability.OBSERVABILITY_TELEMETRY]: BOTH_SURFACES,\n\n  /*\n   * Everything below is RUNTIME ONLY: each is an engine flow of the deployed\n   * application, reached while it serves a user, and none has a companion\n   * consumer.\n   */\n  [EngineCapability.ORGANIZATIONS]: RUNTIME_ONLY,\n  [EngineCapability.BILLING]: RUNTIME_ONLY,\n  [EngineCapability.MULTI_LANGUAGE]: RUNTIME_ONLY,\n  [EngineCapability.COMPLIANCE_AUDIT_TRAIL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_TRANSACTIONAL]: RUNTIME_ONLY,\n  [EngineCapability.EMAIL_MARKETING]: RUNTIME_ONLY,\n  /** RUNTIME ONLY. Mail to the deployed application's organizations; the companion receives none (#1630). */\n  [EngineCapability.EMAIL_INBOUND]: RUNTIME_ONLY,\n  [EngineCapability.SMS]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_ERROR_MONITORING]: RUNTIME_ONLY,\n  [EngineCapability.FRONTEND_PRODUCT_ANALYTICS]: RUNTIME_ONLY,\n};\n\n/**\n * The surfaces a capability may be reached on.\n *\n * Returns the declared set; never empty, because a capability nothing reaches\n * on either surface would have no reason to exist in the vocabulary.\n */\nexport function getEngineCapabilitySurfaces(capability: EngineCapability): readonly EngineCapabilitySurface[] {\n  return ENGINE_CAPABILITY_SURFACES[capability];\n}\n\n/**\n * Does this capability reach the DEPLOYED application serving its users?\n *\n * The predicate a customer-facing compliance statement asks. A capability for\n * which this is `false` processes no data subject's personal data through the\n * contracted service, so a privacy notice, a record of processing or a set of\n * service terms must not describe it as a feature of that service.\n */\nexport function engineCapabilityReachesRuntimeService(capability: EngineCapability): boolean {\n  return getEngineCapabilitySurfaces(capability).includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n\n/**\n * Is this capability reached ONLY while the application is being built?\n *\n * Deliberately not the negation of the predicate above: a capability that is\n * BOTH is reached at authoring time too, and a statement about how the software\n * is developed should include it. This names the narrower population — the\n * capabilities that are invisible to the running product — which is the set a\n * runtime-scoped document must exclude and a secure-development document must\n * not.\n */\nexport function engineCapabilityIsAuthoringOnly(capability: EngineCapability): boolean {\n  const surfaces = getEngineCapabilitySurfaces(capability);\n  return surfaces.includes(EngineCapabilitySurface.AUTHORING_COMPANION) && !surfaces.includes(EngineCapabilitySurface.RUNTIME_SERVICE);\n}\n"]}

package/dist/esm/external-providers/external-providers.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-providers.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EAEf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE;;;;;;;;GAQG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAehD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9C,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM7F;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;iBA2C5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;kBAGvC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}
+{"version":3,"file":"external-providers.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EAEf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAMxE;;;;;;;;GAQG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAehD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9C,CAAC;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAM7F;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;iBA2C5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;kBAGvC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/esm/external-providers/external-providers.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-providers.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EACd,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,uCAAuC;IACvC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAElE,oDAAoD;IACpD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjE,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,4EAA4E;IAC5E,kBAAkB,EAAE,+BAA+B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,MAAM,EAAE,EACV,qCAAqC,CACtC,CAAC;AAGF,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAEpB,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,8CAA8C;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;IAE9D,8CAA8C;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,mCAAmC;IACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,MAAM,EAAE,EACV,iCAAiC,CAClC,CAAC","sourcesContent":["/**\n * External Providers Shared Schemas\n *\n * Provides application-level registry schemas for external providers.\n * OAuth2 configurations are defined per-provider in @wildo-ai/external-connectors-models.\n */\n\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  OAuth2_Purpose,\n  OAuth2_ProviderDefinitionSchema,\n} from \"@wildo-ai/external-connectors-models\";\nimport { z } from \"zod\";\nimport { EngineCapability } from \"./engine-capabilities.shared.schemas\";\n\n// =============================================================================\n// EXTERNAL PROVIDERS REGISTRY\n// =============================================================================\n\n/**\n * External Providers Registry Item\n * Defines what protocols and capabilities a provider supports\n *\n * Note: This is a COMPUTED structure populated from:\n * - BackendProviderModule.providerCapabilities (what provider actually supports)\n * - Materialized provider scope selection (what capabilities are assigned to this provider)\n * - Capability requirements validation\n */\nexport const External_Providers_RegistryItemSchema = z.object({\n  /** Reference to the provider (string identifier) */\n  providerRef: z.string(),\n\n  /** Protocols this provider supports */\n  protocols: z.array(z.enum(ExternalProvider_ExchangeProtocol_Kind)),\n\n  /** Engine capabilities enabled for this provider */\n  engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n\n  /** Does this provider support OAuth2? */\n  supportsOAuth2: z.boolean().optional(),\n\n  /** Custom OAuth2 configuration (if needed to override provider defaults) */\n  customOAuth2Config: OAuth2_ProviderDefinitionSchema.partial().optional(),\n});\nexport type External_Providers_RegistryItem = z.infer<typeof External_Providers_RegistryItemSchema>;\n\n/**\n * External Providers Registry\n * Maps provider references to their configurations\n */\nexport const External_Providers_Registry_Schema = z.record(\n  z.string(),\n  External_Providers_RegistryItemSchema\n);\nexport type External_Providers_Registry = z.infer<typeof External_Providers_Registry_Schema>;\n\n// =============================================================================\n// OAUTH2 ENABLED PROVIDERS CONFIGURATION\n// =============================================================================\n\n/**\n * OAuth2 Enabled Provider Configuration\n * For configuring OAuth2 providers at the application level\n *\n * Note: OAuth2 protocol definitions are in each provider folder in external-connectors.\n * This schema is for application-level enabling/customization of OAuth2 providers.\n */\nexport const OAuth2EnabledProviderConfigSchema = z.object({\n  /** Provider reference (string identifier) */\n  provider: z.string(),\n\n  /** Is this provider enabled? */\n  enabled: z.boolean().default(true),\n\n  /** Allowed email domains for this provider */\n  allowedDomains: z.array(z.string()).optional(),\n\n  /** Purpose: SSO only, API only, or both */\n  purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.HYBRID),\n\n  /** Custom display name (overrides default) */\n  displayName: z.string().optional(),\n\n  /** Custom icon URL (overrides default) */\n  iconUrl: z.url().optional(),\n\n  /** Additional scopes to request */\n  additionalScopes: z.array(z.string()).optional(),\n\n  /**\n   * May an account re-prove who it is through this identity provider (#1441)?\n   *\n   * When on, an account whose link to this provider is an OIDC link can answer a re-authentication\n   * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in\n   * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`\n   * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the\n   * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is\n   * refused, never trusted.\n   *\n   * OFF by default, and it should be switched on only for a provider that honours those parameters.\n   * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`\n   * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value\n   * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security\n   * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.\n   * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from\n   * https://openid.net/specs/openid-connect-core-1_0.html\n   * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched\n   * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect\n   */\n  reAuthenticationEnabled: z.boolean().default(false),\n});\nexport type OAuth2EnabledProviderConfig = z.infer<typeof OAuth2EnabledProviderConfigSchema>;\n\n/**\n * OAuth2 Providers Configuration Map\n * Application-level configuration for all enabled OAuth2 providers\n */\nexport const OAuth2ProvidersConfigSchema = z.record(\n  z.string(),\n  OAuth2EnabledProviderConfigSchema\n);\nexport type OAuth2ProvidersConfig = z.infer<typeof OAuth2ProvidersConfigSchema>;\n"]}
+{"version":3,"file":"external-providers.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EACd,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,uCAAuC;IACvC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAElE,oDAAoD;IACpD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjE,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,4EAA4E;IAC5E,kBAAkB,EAAE,+BAA+B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,MAAM,EAAE,EACV,qCAAqC,CACtC,CAAC;AAGF,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAEpB,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,8CAA8C;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;IAE9D,8CAA8C;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,mCAAmC;IACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,MAAM,EAAE,EACV,iCAAiC,CAClC,CAAC","sourcesContent":["/**\n * External Providers Shared Schemas\n *\n * Provides application-level registry schemas for external providers.\n * OAuth2 configurations are defined per-provider in @wildo-ai/external-connectors-models.\n */\n\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  OAuth2_Purpose,\n  OAuth2_ProviderDefinitionSchema,\n} from \"@wildo-ai/external-connectors-models\";\nimport { z } from \"zod\";\nimport { EngineCapability } from \"./engine-capabilities.shared.schemas\";\n\n// =============================================================================\n// EXTERNAL PROVIDERS REGISTRY\n// =============================================================================\n\n/**\n * External Providers Registry Item\n * Defines what protocols and capabilities a provider supports\n *\n * Note: This is a COMPUTED structure populated from:\n * - BackendProviderModule.providerCapabilities (what provider actually supports)\n * - Materialized provider scope selection (what capabilities are assigned to this provider)\n * - Capability requirements validation\n */\nexport const External_Providers_RegistryItemSchema = z.object({\n  /** Reference to the provider (string identifier) */\n  providerRef: z.string(),\n\n  /** Protocols this provider supports */\n  protocols: z.array(z.enum(ExternalProvider_ExchangeProtocol_Kind)),\n\n  /** Engine capabilities enabled for this provider */\n  engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n\n  /** Does this provider support OAuth2? */\n  supportsOAuth2: z.boolean().optional(),\n\n  /** Custom OAuth2 configuration (if needed to override provider defaults) */\n  customOAuth2Config: OAuth2_ProviderDefinitionSchema.partial().optional(),\n});\nexport type External_Providers_RegistryItem = z.infer<typeof External_Providers_RegistryItemSchema>;\n\n/**\n * External Providers Registry\n * Maps provider references to their configurations\n */\nexport const External_Providers_Registry_Schema = z.record(\n  z.string(),\n  External_Providers_RegistryItemSchema\n);\nexport type External_Providers_Registry = z.infer<typeof External_Providers_Registry_Schema>;\n\n// =============================================================================\n// OAUTH2 ENABLED PROVIDERS CONFIGURATION\n// =============================================================================\n\n/**\n * OAuth2 Enabled Provider Configuration\n * For configuring OAuth2 providers at the application level\n *\n * Note: OAuth2 protocol definitions are in each provider folder in external-connectors.\n * This schema is for application-level enabling/customization of OAuth2 providers.\n */\nexport const OAuth2EnabledProviderConfigSchema = z.object({\n  /** Provider reference (string identifier) */\n  provider: z.string(),\n\n  /** Is this provider enabled? */\n  enabled: z.boolean().default(true),\n\n  /** Allowed email domains for this provider */\n  allowedDomains: z.array(z.string()).optional(),\n\n  /** Purpose: SSO only, API only, or both */\n  purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.HYBRID),\n\n  /** Custom display name (overrides default) */\n  displayName: z.string().optional(),\n\n  /** Custom icon URL (overrides default) */\n  iconUrl: z.url().optional(),\n\n  /** Additional scopes to request */\n  additionalScopes: z.array(z.string()).optional(),\n\n  /**\n   * May an account re-prove who it is through this identity provider (#1441)?\n   *\n   * When on, an account whose link to this provider is an OIDC link can answer a re-authentication\n   * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in\n   * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`\n   * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the\n   * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is\n   * refused, never trusted.\n   *\n   * OFF by default, and it should be switched on only for a provider that honours those parameters.\n   * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`\n   * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value\n   * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security\n   * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.\n   * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from\n   * https://openid.net/specs/openid-connect-core-1_0.html\n   * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched\n   * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect\n   */\n  reAuthenticationEnabled: z.boolean().default(false),\n});\nexport type OAuth2EnabledProviderConfig = z.infer<typeof OAuth2EnabledProviderConfigSchema>;\n\n/**\n * OAuth2 Providers Configuration Map\n * Application-level configuration for all enabled OAuth2 providers\n */\nexport const OAuth2ProvidersConfigSchema = z.record(\n  z.string(),\n  OAuth2EnabledProviderConfigSchema\n);\nexport type OAuth2ProvidersConfig = z.infer<typeof OAuth2ProvidersConfigSchema>;\n"]}

package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-bootstrap.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1D,CAAC;AACL,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC9D,OAAO,iDAAiD,CACzD,CAAC"}
+{"version":3,"file":"frontend-bootstrap.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1D,CAAC;AACL,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC9D,OAAO,iDAAiD,CACzD,CAAC"}

package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-bootstrap.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAC;AACnG,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAG7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AAExF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,iBAAiB,EAAE,4BAA4B;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAC5D,8BAA8B,CAAC,MAAM,CAAC;IACpC,iBAAiB,EAAE,4BAA4B;CAChD,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { AppConfiguration_Shared_Schema } from '../config/app-configuration-shared.shared.schemas';\nexport {\n  FrontendProviderEntrySchema,\n  FrontendProvidersBlockSchema,\n  type FrontendProviderEntry,\n  type FrontendProvidersBlock,\n} from './frontend-provider-entry.shared.schemas';\nimport { FrontendProvidersBlockSchema } from './frontend-provider-entry.shared.schemas';\n\nexport const FrontendAppBootstrapPayloadSchema = z.object({\n  frontendProviders: FrontendProvidersBlockSchema,\n});\nexport type FrontendAppBootstrapPayload = z.infer<typeof FrontendAppBootstrapPayloadSchema>;\n\n/**\n * Existing `/application-config` response extended with frontend provider\n * bootstrap data. Parsing through `AppConfiguration_Shared_Schema` later still\n * strips `frontendProviders`, so frontend startup can keep the shared config\n * contract intact while hydrating the registry alongside it.\n */\nexport const AppConfiguration_FrontendBootstrapResponse_Schema =\n  AppConfiguration_Shared_Schema.extend({\n    frontendProviders: FrontendProvidersBlockSchema,\n  });\nexport type AppConfiguration_FrontendBootstrapResponse = z.infer<\n  typeof AppConfiguration_FrontendBootstrapResponse_Schema\n>;\n"]}
+{"version":3,"file":"frontend-bootstrap.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,8BAA8B,EAAE,MAAM,mDAAmD,CAAC;AACnG,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAG7B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AAExF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,iBAAiB,EAAE,4BAA4B;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAC5D,8BAA8B,CAAC,MAAM,CAAC;IACpC,iBAAiB,EAAE,4BAA4B;CAChD,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { AppConfiguration_Shared_Schema } from '../config/app-configuration-shared.shared.schemas';\nexport {\n  FrontendProviderEntrySchema,\n  FrontendProvidersBlockSchema,\n  type FrontendProviderEntry,\n  type FrontendProvidersBlock,\n} from './frontend-provider-entry.shared.schemas';\nimport { FrontendProvidersBlockSchema } from './frontend-provider-entry.shared.schemas';\n\nexport const FrontendAppBootstrapPayloadSchema = z.object({\n  frontendProviders: FrontendProvidersBlockSchema,\n});\nexport type FrontendAppBootstrapPayload = z.infer<typeof FrontendAppBootstrapPayloadSchema>;\n\n/**\n * Existing `/application-config` response extended with frontend provider\n * bootstrap data. Parsing through `AppConfiguration_Shared_Schema` later still\n * strips `frontendProviders`, so frontend startup can keep the shared config\n * contract intact while hydrating the registry alongside it.\n */\nexport const AppConfiguration_FrontendBootstrapResponse_Schema =\n  AppConfiguration_Shared_Schema.extend({\n    frontendProviders: FrontendProvidersBlockSchema,\n  });\nexport type AppConfiguration_FrontendBootstrapResponse = z.infer<\n  typeof AppConfiguration_FrontendBootstrapResponse_Schema\n>;\n"]}

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-public-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC;IAC/C;;;;;;;;;OASG;;IAKH;;;;;;OAMG;;IAEH,mFAAmF;;iBAEnF,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAE1F,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAClD,SAAS,MAAM,EAAE,CASnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CAAC,KAAK,EAAE;IAC7D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1D,GAAG;IACF,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAA;KAAE,CAAC,CAAC;CACrG,CA0BA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9D,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAGhC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kCAAkC,CAChD,YAAY,SAAS;IACnB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,EACD,KAAK,EAAE;IACP,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACtE,GAAG,YAAY,CAcf"}
+{"version":3,"file":"frontend-capability-public-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC;IAC/C;;;;;;;;;OASG;;IAKH;;;;;;OAMG;;IAEH,mFAAmF;;iBAEnF,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAE1F,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAClD,SAAS,MAAM,EAAE,CASnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CAAC,KAAK,EAAE;IAC7D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1D,GAAG;IACF,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAA;KAAE,CAAC,CAAC;CACrG,CA0BA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9D,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAGhC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kCAAkC,CAChD,YAAY,SAAS;IACnB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,EACD,KAAK,EAAE;IACP,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACtE,GAAG,YAAY,CAcf"}

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-public-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,WAAW,CAAC;IAChE;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0C,MAAM,CAAC,MAAM,CAAC;IAC5G,oBAAoB,EAAE,oCAAoC;CAC3D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,kCAAkC,CAChD,oBAAmD;IAEnD,IAAI,oBAAoB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uCAAuC,CAAC,KAGvD;IAKC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACtF,MAAM,gBAAgB,GAA4B,EAAE,CAAC;IACrD,MAAM,cAAc,GAA4B,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAA6D,EAAE,CAAC;IAC5E,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,8EAA8E;QAC9E,8EAA8E;QAC9E,iCAAiC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CACxE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,OAAO;YAAE,SAAS;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,GAAG,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kCAAkC,CAMhD,KAID;IACC,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACxF,wEAAwE;IACxE,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC;IAEzC,OAAO;QACL,GAAG,KAAK,CAAC,IAAI;QACb,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,iBAAiB;QAC3E,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;QAC9F,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;KACrG,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The public-config shape a BUILT-IN frontend capability expects, as a named\n * schema rather than a convention.\n *\n * ## Why the capability owns this and not each provider\n *\n * `publicConfig` is `Record<string, unknown>`, so every consuming site was\n * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter\n * for strings, a Mb-to-bytes multiplication — and a renamed key produced\n * `undefined` and a silently wrong picker rather than an error. The keys were a\n * convention nobody had written down, which is the whole defect: three ad-hoc\n * readers agreeing by luck.\n *\n * What a FILE PICKER's constraints mean is framework knowledge — the framework\n * is what applies them to its own file fields — so the shape belongs to the\n * CAPABILITY. A provider is free to carry its own keys beside these (a client\n * id, an app key); it is not free to invent a different spelling of the ones\n * the framework reads, and now it cannot.\n *\n * A provider declaring `publicConfigSchema` should EXTEND the schema for the\n * capability it claims, so hydration validates the framework's fields and its\n * own in one pass.\n */\n\nimport { z } from 'zod';\n\n/**\n * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.\n *\n * Every field is optional: a provider that constrains nothing is legitimate,\n * and the field's own Zod file metadata always wins anyway — a provider only\n * fills the gaps the schema left open.\n *\n * LOOSE, because a provider's own keys live in the same object and must survive\n * a parse that is only looking for these.\n */\nexport const FrontendFilePickerPublicConfigSchema = z.looseObject({\n  /**\n   * MIME types the picker can return.\n   *\n   * An EMPTY list is normalized to absent, and that is behaviour rather than\n   * decoration: the framework turns this into an `accept=` attribute, and an\n   * empty `accept=\"\"` does not mean \"anything\" — it means the file dialog\n   * offers nothing. A provider that declares no types is unconstrained, so the\n   * normalization happens here, once, instead of at each reader that would have\n   * to remember it.\n   */\n  acceptedMimeTypes: z\n    .array(z.string().min(1))\n    .optional()\n    .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),\n  /**\n   * Largest file the picker will hand back, in MEGABYTES.\n   *\n   * The unit is in the name because the framework's own constraint is in BYTES\n   * and the conversion is the kind of thing that is wrong by a factor of 1024²\n   * exactly once, silently, in production.\n   */\n  maxFileSizeMb: z.number().positive().optional(),\n  /** How many files one selection may return. Applies only to a `multiple` field. */\n  maxSelectionCount: z.number().int().positive().optional(),\n});\nexport type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;\n\n/**\n * Every built-in capability that owns public-config keys, and the schema that\n * owns them.\n *\n * A MAP rather than a list of keys, so the keys are derived from the schema that\n * validates them and the two cannot disagree. Adding a capability's shape here\n * is the ONE edit that makes its keys admissible everywhere — the admission,\n * the refusal message and the validation all read this map.\n *\n * A capability absent from this map owns no public-config keys, which is the\n * common case and needs no entry.\n */\nexport const FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS: Readonly<Record<string, z.ZodObject>> = Object.freeze({\n  FRONTEND_FILE_PICKER: FrontendFilePickerPublicConfigSchema,\n});\n\n/**\n * The public-config keys a provider admits BY VIRTUE OF the capabilities it\n * claims, beside whatever its own `publicConfigSchema` declares.\n *\n * ## Why this exists — measured 2026-09-18 (#380)\n *\n * `FrontendFilePickerPublicConfigSchema` declares the constraint vocabulary the\n * FRAMEWORK reads off a picker (`acceptedMimeTypes`, `maxFileSizeMb`,\n * `maxSelectionCount`), and `resolveFormFieldFileProviderConstraints` reads it.\n * Three separate gates refused it, because each asked only what the PROVIDER\n * declares:\n *\n * - the config overlay THREW `UNDECLARED_KEY` — *\"a key the provider never reads\n *   would be served to every browser and used by nothing\"*, which is false here:\n *   the framework reads it, for that provider, because it claims the capability;\n * - hydration answered `unknown key` and set the provider's code to `undefined`,\n *   so declaring a size limit DELETED the picker;\n * - and the resolver then found nothing, because nothing had been allowed through.\n *\n * All three engine pickers declare a `publicConfigSchema` (`appId`, `clientId`,\n * `appKey`), so the capability's whole vocabulary was unusable on every one of\n * them. It worked only on an application-authored picker that declares NO\n * schema, where the first gate is skipped — which is why the dogfood never saw it.\n *\n * The capability schema's own docstring asked a provider to *\"EXTEND the schema\n * for the capability it claims\"*, and no affordance to do that existed. This is\n * the affordance, DERIVED instead: a provider claiming `FRONTEND_FILE_PICKER`\n * admits the file-picker keys with no edit to the provider, so a capability\n * shape added tomorrow reaches every provider claiming it and none that does not.\n */\nexport function frontendCapabilityPublicConfigKeys(\n  providerCapabilities: readonly string[] | undefined,\n): readonly string[] {\n  if (providerCapabilities === undefined) return [];\n  const keys = new Set<string>();\n  for (const capability of providerCapabilities) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    for (const key of Object.keys(schema.shape)) keys.add(key);\n  }\n  return [...keys];\n}\n\n/**\n * Splits a public-config bag into the half the CAPABILITIES own and the half the\n * provider's own schema must answer for, validating the first here.\n *\n * Returning the two halves rather than one merged bag is what lets a caller run\n * the provider's schema over exactly the keys it declared — a strict provider\n * schema would otherwise refuse the capability's keys, which is the defect this\n * whole mechanism exists to remove.\n */\nexport function partitionFrontendCapabilityPublicConfig(input: {\n  readonly providerCapabilities: readonly string[] | undefined;\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n}): {\n  readonly capabilityConfig: Readonly<Record<string, unknown>>;\n  readonly providerConfig: Readonly<Record<string, unknown>>;\n  readonly issues: ReadonlyArray<{ readonly message: string; readonly path: readonly PropertyKey[] }>;\n} {\n  const owned = new Set(frontendCapabilityPublicConfigKeys(input.providerCapabilities));\n  const capabilityConfig: Record<string, unknown> = {};\n  const providerConfig: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input.publicConfig)) {\n    (owned.has(key) ? capabilityConfig : providerConfig)[key] = value;\n  }\n\n  const issues: Array<{ message: string; path: readonly PropertyKey[] }> = [];\n  for (const capability of input.providerCapabilities ?? []) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    // Only the keys this capability owns: a loose schema would otherwise re-admit\n    // the provider's own keys and report nothing about them, which is correct but\n    // makes the partition pointless.\n    const subject = Object.fromEntries(\n      Object.entries(capabilityConfig).filter(([key]) => key in schema.shape),\n    );\n    const parsed = schema.safeParse(subject);\n    if (parsed.success) continue;\n    for (const issue of parsed.error.issues) {\n      issues.push({ message: issue.message, path: issue.path });\n    }\n  }\n\n  return { capabilityConfig, providerConfig, issues };\n}\n\n/**\n * The full set of public-config keys a provider admits: what its own schema\n * declares, UNION what the capabilities it claims own.\n *\n * `undefined` in, `undefined` out — and that is load-bearing. A provider with no\n * introspectable schema has no key list, which every gate refuses\n * (`SCHEMA_NOT_INTROSPECTABLE`, #1705); widening `undefined` to the capability\n * keys would instead turn that refusal into \"declares exactly these\" and hide\n * the missing schema behind a plausible list.\n *\n * It lives beside the capability map rather than beside\n * `readDeclaredPublicConfigKeys`, because that module is deliberately\n * dependency-free so a provider module can declare a schema without pulling a\n * validation library in.\n */\nexport function admissibleFrontendPublicConfigKeys(input: {\n  readonly declaredKeys: readonly string[] | undefined;\n  readonly providerCapabilities: readonly string[] | undefined;\n}): readonly string[] | undefined {\n  if (input.declaredKeys === undefined) return undefined;\n  return [...new Set([...input.declaredKeys, ...frontendCapabilityPublicConfigKeys(input.providerCapabilities)])];\n}\n\n/**\n * Lays ONE provider's declared picker limits under the field's own, for that\n * provider's picker and no other.\n *\n * ## Why this is per-provider and not resolved once (#380)\n *\n * The field used to resolve its picker constraints from the FIRST provider the\n * registry returned for `FRONTEND_FILE_PICKER`, and pass that single object to\n * whichever picker the person then chose — so a Drive limit governed a Dropbox\n * pick, and which provider won depended on registry order. `ProviderFilePickerHost`\n * was built so \"a framework that picked one would be making a product decision in\n * a lookup table\"; the constraints were still making exactly that decision, one\n * layer up, and it became reachable the moment a third picker shipped.\n *\n * It also reached the field's OWN native upload, which is wrong at any number of\n * providers: a vendor's picker limit says nothing about a local file going to the\n * field's own storage.\n *\n * Precedence is unchanged and is the part that must not move: the field's Zod\n * metadata ALWAYS wins, and a provider only fills the gaps the schema left open.\n * `maxSelectionCount` applies only to a `multiple` field — a single-file field\n * never inherits a selection count.\n */\nexport function layerProviderFilePickerConstraints<\n  TConstraints extends {\n    readonly allowedMimeTypes?: readonly string[];\n    readonly maxSize?: number;\n    readonly maxFiles?: number;\n  },\n>(input: {\n  readonly base: TConstraints;\n  readonly multiple: boolean;\n  readonly publicConfig: Readonly<Record<string, unknown>> | undefined;\n}): TConstraints {\n  const parsed = FrontendFilePickerPublicConfigSchema.safeParse(input.publicConfig ?? {});\n  // A provider whose own values are wrong contributes NOTHING rather than\n  // nonsense — the same choice the three hand readers this replaced could not\n  // make, because a bad value was indistinguishable from an absent one.\n  const declared = parsed.success ? parsed.data : {};\n  const maxSizeMb = declared.maxFileSizeMb;\n\n  return {\n    ...input.base,\n    allowedMimeTypes: input.base.allowedMimeTypes ?? declared.acceptedMimeTypes,\n    maxSize: input.base.maxSize ?? (maxSizeMb === undefined ? undefined : maxSizeMb * 1024 * 1024),\n    maxFiles: input.multiple ? (input.base.maxFiles ?? declared.maxSelectionCount) : input.base.maxFiles,\n  };\n}\n"]}
+{"version":3,"file":"frontend-capability-public-config.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,WAAW,CAAC;IAChE;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0C,MAAM,CAAC,MAAM,CAAC;IAC5G,oBAAoB,EAAE,oCAAoC;CAC3D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,kCAAkC,CAChD,oBAAmD;IAEnD,IAAI,oBAAoB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uCAAuC,CAAC,KAGvD;IAKC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACtF,MAAM,gBAAgB,GAA4B,EAAE,CAAC;IACrD,MAAM,cAAc,GAA4B,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAA6D,EAAE,CAAC;IAC5E,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,8EAA8E;QAC9E,8EAA8E;QAC9E,iCAAiC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CACxE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,OAAO;YAAE,SAAS;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,GAAG,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kCAAkC,CAMhD,KAID;IACC,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACxF,wEAAwE;IACxE,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC;IAEzC,OAAO;QACL,GAAG,KAAK,CAAC,IAAI;QACb,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,iBAAiB;QAC3E,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;QAC9F,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;KACrG,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The public-config shape a BUILT-IN frontend capability expects, as a named\n * schema rather than a convention.\n *\n * ## Why the capability owns this and not each provider\n *\n * `publicConfig` is `Record<string, unknown>`, so every consuming site was\n * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter\n * for strings, a Mb-to-bytes multiplication — and a renamed key produced\n * `undefined` and a silently wrong picker rather than an error. The keys were a\n * convention nobody had written down, which is the whole defect: three ad-hoc\n * readers agreeing by luck.\n *\n * What a FILE PICKER's constraints mean is framework knowledge — the framework\n * is what applies them to its own file fields — so the shape belongs to the\n * CAPABILITY. A provider is free to carry its own keys beside these (a client\n * id, an app key); it is not free to invent a different spelling of the ones\n * the framework reads, and now it cannot.\n *\n * A provider declaring `publicConfigSchema` should EXTEND the schema for the\n * capability it claims, so hydration validates the framework's fields and its\n * own in one pass.\n */\n\nimport { z } from 'zod';\n\n/**\n * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.\n *\n * Every field is optional: a provider that constrains nothing is legitimate,\n * and the field's own Zod file metadata always wins anyway — a provider only\n * fills the gaps the schema left open.\n *\n * LOOSE, because a provider's own keys live in the same object and must survive\n * a parse that is only looking for these.\n */\nexport const FrontendFilePickerPublicConfigSchema = z.looseObject({\n  /**\n   * MIME types the picker can return.\n   *\n   * An EMPTY list is normalized to absent, and that is behaviour rather than\n   * decoration: the framework turns this into an `accept=` attribute, and an\n   * empty `accept=\"\"` does not mean \"anything\" — it means the file dialog\n   * offers nothing. A provider that declares no types is unconstrained, so the\n   * normalization happens here, once, instead of at each reader that would have\n   * to remember it.\n   */\n  acceptedMimeTypes: z\n    .array(z.string().min(1))\n    .optional()\n    .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),\n  /**\n   * Largest file the picker will hand back, in MEGABYTES.\n   *\n   * The unit is in the name because the framework's own constraint is in BYTES\n   * and the conversion is the kind of thing that is wrong by a factor of 1024²\n   * exactly once, silently, in production.\n   */\n  maxFileSizeMb: z.number().positive().optional(),\n  /** How many files one selection may return. Applies only to a `multiple` field. */\n  maxSelectionCount: z.number().int().positive().optional(),\n});\nexport type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;\n\n/**\n * Every built-in capability that owns public-config keys, and the schema that\n * owns them.\n *\n * A MAP rather than a list of keys, so the keys are derived from the schema that\n * validates them and the two cannot disagree. Adding a capability's shape here\n * is the ONE edit that makes its keys admissible everywhere — the admission,\n * the refusal message and the validation all read this map.\n *\n * A capability absent from this map owns no public-config keys, which is the\n * common case and needs no entry.\n */\nexport const FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS: Readonly<Record<string, z.ZodObject>> = Object.freeze({\n  FRONTEND_FILE_PICKER: FrontendFilePickerPublicConfigSchema,\n});\n\n/**\n * The public-config keys a provider admits BY VIRTUE OF the capabilities it\n * claims, beside whatever its own `publicConfigSchema` declares.\n *\n * ## Why this exists — measured 2026-09-18 (#380)\n *\n * `FrontendFilePickerPublicConfigSchema` declares the constraint vocabulary the\n * FRAMEWORK reads off a picker (`acceptedMimeTypes`, `maxFileSizeMb`,\n * `maxSelectionCount`), and `resolveFormFieldFileProviderConstraints` reads it.\n * Three separate gates refused it, because each asked only what the PROVIDER\n * declares:\n *\n * - the config overlay THREW `UNDECLARED_KEY` — *\"a key the provider never reads\n *   would be served to every browser and used by nothing\"*, which is false here:\n *   the framework reads it, for that provider, because it claims the capability;\n * - hydration answered `unknown key` and set the provider's code to `undefined`,\n *   so declaring a size limit DELETED the picker;\n * - and the resolver then found nothing, because nothing had been allowed through.\n *\n * All three engine pickers declare a `publicConfigSchema` (`appId`, `clientId`,\n * `appKey`), so the capability's whole vocabulary was unusable on every one of\n * them. It worked only on an application-authored picker that declares NO\n * schema, where the first gate is skipped — which is why the dogfood never saw it.\n *\n * The capability schema's own docstring asked a provider to *\"EXTEND the schema\n * for the capability it claims\"*, and no affordance to do that existed. This is\n * the affordance, DERIVED instead: a provider claiming `FRONTEND_FILE_PICKER`\n * admits the file-picker keys with no edit to the provider, so a capability\n * shape added tomorrow reaches every provider claiming it and none that does not.\n */\nexport function frontendCapabilityPublicConfigKeys(\n  providerCapabilities: readonly string[] | undefined,\n): readonly string[] {\n  if (providerCapabilities === undefined) return [];\n  const keys = new Set<string>();\n  for (const capability of providerCapabilities) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    for (const key of Object.keys(schema.shape)) keys.add(key);\n  }\n  return [...keys];\n}\n\n/**\n * Splits a public-config bag into the half the CAPABILITIES own and the half the\n * provider's own schema must answer for, validating the first here.\n *\n * Returning the two halves rather than one merged bag is what lets a caller run\n * the provider's schema over exactly the keys it declared — a strict provider\n * schema would otherwise refuse the capability's keys, which is the defect this\n * whole mechanism exists to remove.\n */\nexport function partitionFrontendCapabilityPublicConfig(input: {\n  readonly providerCapabilities: readonly string[] | undefined;\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n}): {\n  readonly capabilityConfig: Readonly<Record<string, unknown>>;\n  readonly providerConfig: Readonly<Record<string, unknown>>;\n  readonly issues: ReadonlyArray<{ readonly message: string; readonly path: readonly PropertyKey[] }>;\n} {\n  const owned = new Set(frontendCapabilityPublicConfigKeys(input.providerCapabilities));\n  const capabilityConfig: Record<string, unknown> = {};\n  const providerConfig: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input.publicConfig)) {\n    (owned.has(key) ? capabilityConfig : providerConfig)[key] = value;\n  }\n\n  const issues: Array<{ message: string; path: readonly PropertyKey[] }> = [];\n  for (const capability of input.providerCapabilities ?? []) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    // Only the keys this capability owns: a loose schema would otherwise re-admit\n    // the provider's own keys and report nothing about them, which is correct but\n    // makes the partition pointless.\n    const subject = Object.fromEntries(\n      Object.entries(capabilityConfig).filter(([key]) => key in schema.shape),\n    );\n    const parsed = schema.safeParse(subject);\n    if (parsed.success) continue;\n    for (const issue of parsed.error.issues) {\n      issues.push({ message: issue.message, path: issue.path });\n    }\n  }\n\n  return { capabilityConfig, providerConfig, issues };\n}\n\n/**\n * The full set of public-config keys a provider admits: what its own schema\n * declares, UNION what the capabilities it claims own.\n *\n * `undefined` in, `undefined` out — and that is load-bearing. A provider with no\n * introspectable schema has no key list, which every gate refuses\n * (`SCHEMA_NOT_INTROSPECTABLE`, #1705); widening `undefined` to the capability\n * keys would instead turn that refusal into \"declares exactly these\" and hide\n * the missing schema behind a plausible list.\n *\n * It lives beside the capability map rather than beside\n * `readDeclaredPublicConfigKeys`, because that module is deliberately\n * dependency-free so a provider module can declare a schema without pulling a\n * validation library in.\n */\nexport function admissibleFrontendPublicConfigKeys(input: {\n  readonly declaredKeys: readonly string[] | undefined;\n  readonly providerCapabilities: readonly string[] | undefined;\n}): readonly string[] | undefined {\n  if (input.declaredKeys === undefined) return undefined;\n  return [...new Set([...input.declaredKeys, ...frontendCapabilityPublicConfigKeys(input.providerCapabilities)])];\n}\n\n/**\n * Lays ONE provider's declared picker limits under the field's own, for that\n * provider's picker and no other.\n *\n * ## Why this is per-provider and not resolved once (#380)\n *\n * The field used to resolve its picker constraints from the FIRST provider the\n * registry returned for `FRONTEND_FILE_PICKER`, and pass that single object to\n * whichever picker the person then chose — so a Drive limit governed a Dropbox\n * pick, and which provider won depended on registry order. `ProviderFilePickerHost`\n * was built so \"a framework that picked one would be making a product decision in\n * a lookup table\"; the constraints were still making exactly that decision, one\n * layer up, and it became reachable the moment a third picker shipped.\n *\n * It also reached the field's OWN native upload, which is wrong at any number of\n * providers: a vendor's picker limit says nothing about a local file going to the\n * field's own storage.\n *\n * Precedence is unchanged and is the part that must not move: the field's Zod\n * metadata ALWAYS wins, and a provider only fills the gaps the schema left open.\n * `maxSelectionCount` applies only to a `multiple` field — a single-file field\n * never inherits a selection count.\n */\nexport function layerProviderFilePickerConstraints<\n  TConstraints extends {\n    readonly allowedMimeTypes?: readonly string[];\n    readonly maxSize?: number;\n    readonly maxFiles?: number;\n  },\n>(input: {\n  readonly base: TConstraints;\n  readonly multiple: boolean;\n  readonly publicConfig: Readonly<Record<string, unknown>> | undefined;\n}): TConstraints {\n  const parsed = FrontendFilePickerPublicConfigSchema.safeParse(input.publicConfig ?? {});\n  // A provider whose own values are wrong contributes NOTHING rather than\n  // nonsense — the same choice the three hand readers this replaced could not\n  // make, because a bad value was indistinguishable from an absent one.\n  const declared = parsed.success ? parsed.data : {};\n  const maxSizeMb = declared.maxFileSizeMb;\n\n  return {\n    ...input.base,\n    allowedMimeTypes: input.base.allowedMimeTypes ?? declared.acceptedMimeTypes,\n    maxSize: input.base.maxSize ?? (maxSizeMb === undefined ? undefined : maxSizeMb * 1024 * 1024),\n    maxFiles: input.multiple ? (input.base.maxFiles ?? declared.maxSelectionCount) : input.base.maxFiles,\n  };\n}\n"]}

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-runtime.shared.types.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAMpG;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,KAAK,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAClD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACzE,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxF,6EAA6E;IAC7E,KAAK,IAAI,IAAI,CAAC;CACf;AAED,uHAAuH;AACvH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,4BAA4B,CAOtG;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACtD;AAED,2GAA2G;AAC3G,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,mBAAmB,CAEpF"}
+{"version":3,"file":"frontend-capability-runtime.shared.types.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAMpG;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,KAAK,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAClD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACzE,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxF,6EAA6E;IAC7E,KAAK,IAAI,IAAI,CAAC;CACf;AAED,uHAAuH;AACvH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,4BAA4B,CAOtG;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACtD;AAED,2GAA2G;AAC3G,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,mBAAmB,CAEpF"}