fix(core-shared): derive Analyzed + RateLimited brands in binding slot

ProductionUseCase<I, O, M> only demanded Instrumented + Captured (+
Audited for mutating-with-audits). The boot assertion additionally
requires __analyzed for non-empty analyticsEvents and __rateLimited for
non-empty rateLimit, so the type-level gate under-promised what boot
enforces. The slot now derives both from the manifest entry; the
feature-scoped requiresConsent brand stays boot-only (documented).
Also make IAnalytics extend AnalyticsProtocol from
core-shared/di/bind-protocols so narrowing the ctx protocol fails
typecheck in core-analytics instead of drifting silently.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/core-analytics/src/analytics.interface.ts

@@ -1,10 +1,18 @@
+import type { AnalyticsProtocol } from "@repo/core-shared/di/bind-protocols";
+
 export type AnalyticsAttributeValue = string | number | boolean;
 
 export type AnalyticsUser = {
   id: string;
 };
 
-export interface IAnalytics {
+/**
+ * Product-analytics sink. Extends `AnalyticsProtocol` from
+ * `@repo/core-shared/di/bind-protocols` — the surface feature binders see via
+ * `ctx.analytics` — so narrowing the protocol fails typecheck here instead of
+ * silently drifting apart.
+ */
+export interface IAnalytics extends AnalyticsProtocol {
   track(
     event: string,
     attributes?: Record<string, AnalyticsAttributeValue>,

packages/core-shared/src/conformance/production-use-case.test.ts

@@ -11,12 +11,50 @@ describe("ProductionUseCase<I, O, M>", () => {
       consumes: readonly [];
     };
     type Slot = ProductionUseCase<{ x: number }, { y: string }, Manifest>;
-    type Wrapped = Instrumented<(input: { x: number }) => Promise<{ y: string }>> &
+    type Wrapped = Instrumented<
+      (input: { x: number }) => Promise<{ y: string }>
+    > &
       Captured<(input: { x: number }) => Promise<{ y: string }>>;
 
     expectTypeOf<Wrapped>().toMatchTypeOf<Slot>();
   });
 
+  it("requires Analyzed when the manifest declares analyticsEvents", () => {
+    type Manifest = {
+      mutates: false;
+      audits: readonly [];
+      publishes: readonly [];
+      consumes: readonly [];
+      analyticsEvents: readonly ["auth.signed_in"];
+    };
+    type Fn = (input: { x: number }) => Promise<{ y: string }>;
+    type Slot = ProductionUseCase<{ x: number }, { y: string }, Manifest>;
+    type WithoutAnalyzed = Instrumented<Fn> & Captured<Fn>;
+    type WithAnalyzed = WithoutAnalyzed & { readonly __analyzed: true };
+
+    expectTypeOf<WithAnalyzed>().toMatchTypeOf<Slot>();
+    expectTypeOf<WithoutAnalyzed>().not.toMatchTypeOf<Slot>();
+  });
+
+  it("requires RateLimited when the manifest declares rateLimit budgets", () => {
+    type Manifest = {
+      mutates: true;
+      audits: readonly [];
+      publishes: readonly [];
+      consumes: readonly [];
+      rateLimit: readonly [{ name: "ip"; window: "1m"; budget: 5 }];
+    };
+    type Fn = (input: { x: number }) => Promise<{ y: string }>;
+    type Slot = ProductionUseCase<{ x: number }, { y: string }, Manifest>;
+    type WithoutRateLimited = Instrumented<Fn> & Captured<Fn>;
+    type WithRateLimited = WithoutRateLimited & {
+      readonly __rateLimited: true;
+    };
+
+    expectTypeOf<WithRateLimited>().toMatchTypeOf<Slot>();
+    expectTypeOf<WithoutRateLimited>().not.toMatchTypeOf<Slot>();
+  });
+
   it("a plain factory is NOT assignable to the slot", () => {
     type Manifest = {
       mutates: false;

packages/core-shared/src/conformance/production-use-case.ts

@@ -1,10 +1,12 @@
 import type { UseCaseManifest } from "./define-feature";
-import type { Instrumented, Captured } from "./brands";
+import type { Instrumented, Captured, Analyzed, RateLimited } from "./brands";
 
 /**
  * Type-level binding slot for production use cases. Derived from the manifest
  * entry: every binding must be Instrumented + Captured; mutating use cases
- * that declare audits additionally must be Audited. The Audited brand lives
+ * that declare audits additionally must be Audited; use cases that declare
+ * non-empty `analyticsEvents` must be Analyzed; use cases that declare
+ * non-empty `rateLimit` must be RateLimited. The Audited brand lives
  * in `@repo/core-audit` because the wrap helper that attaches it depends on
  * `IAuditLog` — feature packages import the merged slot type implicitly
  * by typing their bindings as `ProductionUseCase<I, O, AuthManifest["useCases"]["signIn"]>`.
@@ -13,12 +15,24 @@ import type { Instrumented, Captured } from "./brands";
  * without depending on core-audit. When `mutates: true` AND `audits` is
  * non-empty, the slot demands a marker type with a `__audited` flag; the
  * concrete `Audited<F>` from core-audit satisfies it.
+ *
+ * `requiresConsent` is feature-scoped (a `FeatureManifest` field, not a
+ * per-use-case one), so the `__consentChecked` brand cannot be derived from
+ * the use-case entry here — it is enforced at boot by
+ * `assertFeatureConformance` instead.
  */
-export type ProductionUseCase<I, O, M extends UseCaseManifest> =
+export type ProductionUseCase<I, O, M extends UseCaseManifest> = Instrumented<
-  & Instrumented<(input: I) => Promise<O>>
+  (input: I) => Promise<O>
-  & Captured<(input: I) => Promise<O>>
+> &
-  & (M["mutates"] extends true
+  Captured<(input: I) => Promise<O>> &
+  (M["mutates"] extends true
     ? M["audits"]["length"] extends 0
       ? unknown
       : { readonly __audited: true }
+    : unknown) &
+  (M["analyticsEvents"] extends readonly [string, ...string[]]
+    ? Analyzed<(input: I) => Promise<O>>
+    : unknown) &
+  (M["rateLimit"] extends readonly [unknown, ...unknown[]]
+    ? RateLimited<(input: I) => Promise<O>>
     : unknown);