@wildo-ai/saas-models 1.1.3 → 1.1.4

package/dist/esm/external-providers/provider-compliance-profile.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-compliance-profile.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,uBAYX;AAZD,WAAY,uBAAuB;IACjC;;;OAGG;IACH,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;AAC7B,CAAC,EAZW,uBAAuB,KAAvB,uBAAuB,QAYlC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAClC;;;;;;;OAOG;IACH,IAAI,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvH,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,mIAAmI;SAC7I,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,4GAA4G;AAC5G,MAAM,UAAU,0BAA0B,CAAC,OAAkC;IAC3E,OAAO,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yCAAyC,CAAC,OAAkC;IAC1F,OAAO,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAChD;;;;;;;;;;;;OAYG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC;;;;;;;OAOG;IACH,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC9G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,qIAAqI;SAC/I,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC5G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,wIAAwI;SAClJ,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,qEAAqE;AACrE,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACxB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAG5C;IACC,MAAM,QAAQ,GAAmD,EAAE,CAAC;IAEpE,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAAE,SAAS;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC1D,+FAA+F;QAC/F,gFAAgF;QAChF,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA6C;IACpF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,CAAC;SACxF,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;SACnC,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHO RUNS the software a provider module drives.\n *\n * This is the axis that decides whether a provider is a third-party RECIPIENT of personal data at\n * all, and until 2026-08-30 it did not exist anywhere in the provider model. immudb is described in\n * `BUILTIN_PROVIDER_CAPABILITY` as an audit-trail provider with nothing separating the container an\n * operator runs themselves from a hosted service — so the first privacy notice to ENUMERATE\n * recipients would have named a self-hosted audit ledger as a third party. That is false, and false\n * in the direction that alarms a reader rather than the direction they can check.\n *\n * ⚠️ NOT a hosting-topology field and not an infrastructure concern. It answers one compliance\n * question — does personal data leave the operator's control by reaching this provider — and a\n * consumer must not read it as \"where is it deployed\".\n */\nexport enum ProviderDeploymentModel {\n  /**\n   * The vendor runs it. Data reaching this provider reaches a third party, so it is a processor\n   * under Art. 28 and belongs in the subprocessor register.\n   */\n  VENDOR_HOSTED = 'VENDOR_HOSTED',\n  /**\n   * The operator runs it — their own container, their own infrastructure. No third party receives\n   * anything, so it is NOT a recipient. A notice states it as processing under the operator's own\n   * control, which is a different sentence and a stronger one.\n   */\n  SELF_HOSTED = 'SELF_HOSTED',\n}\n\n/**\n * The compliance-relevant facts a PROVIDER MODULE knows about itself.\n *\n * ## Why these live on the provider and not on the application\n *\n * The processor register shipped by issue #88 was fully application-authored, and that made every\n * application restate facts the framework already holds. What a provider IS — who runs it, which\n * regions its vendor offers, what legal entity stands behind it — does not vary per application, and\n * an application asked to restate it will eventually get it wrong. What DOES vary is the operator's\n * CHOICE among those possibilities, and that is configuration.\n *\n * So the split is: possibilities here, choice in `wildo.saas.config.ts`, and the register entry\n * derived from both (issue #130).\n *\n * ## What is deliberately NOT here\n *\n * **A transfer mechanism.** Adequacy decisions move by court ruling rather than by release cycle, so\n * a list baked into the engine goes stale silently and emits a false compliance statement — the worst\n * failure mode in this lane. The mechanism is a legal determination with a shelf life, recorded per\n * subprocessor entry by a human, never derived here (issue #126).\n *\n * **What the provider RECEIVES.** That is already implied by the capability it serves —\n * `BUILTIN_PROVIDER_CAPABILITY` describes the data flow per member. Restating it here would be a\n * second authority for one fact.\n */\nexport const ProviderComplianceProfileSchema = z.strictObject({\n  /**\n   * The deployment models this provider SUPPORTS — one, or both where the provider genuinely offers\n   * a choice (immudb: a hosted service and a container you run).\n   *\n   * A single entry means the answer is not the operator's to make and no configuration should offer\n   * it. Two means the application must choose, and a register entry cannot be derived until it has.\n   */\n  deploymentModels: z.array(z.enum(ProviderDeploymentModel)).min(1),\n  /**\n   * The regions this vendor can process in — POSSIBILITIES the operator chooses from, never a\n   * choice already made.\n   *\n   * Open strings, deliberately, because these are the VENDOR's own labels (`eu-west-1`,\n   * `us-east-1`, `EU`) and a closed enum here would be this repository inventing a vocabulary it\n   * does not own. The compliance question a transfer statement asks is about JURISDICTION rather\n   * than datacentre, and mapping one to the other is part of the legal determination that is\n   * deliberately not modelled (see above).\n   *\n   * EMPTY is meaningful and is the honest answer for a provider that is only ever self-hosted: the\n   * region is wherever the operator runs it, which the framework cannot know. A configuration\n   * choosing `SELF_HOSTED` therefore needs no region from this list.\n   */\n  processingRegions: z.array(z.string().trim().min(1)),\n  /**\n   * The vendor's legal entity, where the provider module's author can state it.\n   *\n   * OPTIONAL, and the reason is that this is the field most likely to go stale: vendors reorganise,\n   * and a stale legal entity published as a current one is worse than an absent one. Absent means\n   * the application must declare it on the register entry, which is where an operator's own contract\n   * makes it checkable.\n   */\n  vendorLegalEntityName: z.string().trim().min(1).optional(),\n}).superRefine((profile, context) => {\n  /*\n   * A VENDOR_HOSTED provider that offers no region cannot support a transfer statement, and the\n   * whole point of carrying regions is that a transfer statement becomes derivable. Refused at the\n   * schema so the gap surfaces where the provider module is authored, rather than as an\n   * unexplainable hole in a produced notice months later.\n   *\n   * The SELF_HOSTED-only case is exempt above: its region is wherever the operator runs it.\n   */\n  if (profile.deploymentModels.includes(ProviderDeploymentModel.VENDOR_HOSTED) && profile.processingRegions.length === 0) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegions'],\n      message: 'a VENDOR_HOSTED provider must declare at least one processing region — without one, no transfer statement about it can be derived',\n    });\n  }\n});\nexport type ProviderComplianceProfile = z.infer<typeof ProviderComplianceProfileSchema>;\n\n/** True when this provider can only ever be run by the operator, so it is never a third-party recipient. */\nexport function providerIsAlwaysSelfHosted(profile: ProviderComplianceProfile): boolean {\n  return profile.deploymentModels.every((model) => model === ProviderDeploymentModel.SELF_HOSTED);\n}\n\n/**\n * True when the operator must CHOOSE, because the provider supports both.\n *\n * A register entry for such a provider cannot be derived from the provider module alone — the\n * application's configuration decides whether it is a recipient at all.\n */\nexport function providerDeploymentModelIsAnOperatorChoice(profile: ProviderComplianceProfile): boolean {\n  return profile.deploymentModels.length > 1;\n}\n\n/**\n * The application's CHOICE among what a provider offers — one entry per configured provider.\n *\n * The provider declares possibilities ({@link ProviderComplianceProfileSchema}); this is where an\n * operator says which of them applies to their deployment. Keeping the two apart is the whole point\n * of the layering: a vendor's regions change when it opens a data centre, an operator's choice\n * changes when they migrate, and collapsing them would make one edit look like the other.\n *\n * Not carried inside `providerConfigurations`, which is an opaque `Record<string, unknown>` bag for a\n * provider's own runtime profile. A compliance answer must not live somewhere nothing can read it\n * without knowing the provider.\n */\nexport const ApplicationProviderComplianceChoiceSchema = z.strictObject({\n  /**\n   * Who runs this provider in THIS deployment.\n   *\n   * Required even when the provider supports only one model. The redundancy is deliberate: whether\n   * personal data leaves the operator's control is the single most consequential fact a notice states\n   * about a provider, and reading it out of a framework default rather than an operator's declaration\n   * is how a wrong one goes unnoticed.\n   */\n  deploymentModel: z.enum(ProviderDeploymentModel),\n  /**\n   * Which region this provider processes in, chosen from what the provider declares possible.\n   *\n   * NOT validated here, and NOT validated at boot either. This schema cannot see the provider\n   * registry, and refusing an unlisted region would make a vendor's new data centre an application\n   * build failure, so the intended posture is warn-do-not-block: a region outside the provider's\n   * declared list is APP-ASSERTED and reported, never refused.\n   *\n   * ⚠️ Nothing reports it today. `appAssertedProcessingRegions` below computes exactly that set and\n   * has no runtime caller, so an application that names a region its provider does not declare is\n   * accepted in silence and the cross-check is a manual one. Whatever wires the report should call\n   * that helper rather than re-deriving the comparison.\n   */\n  processingRegion: z.string().trim().min(1).optional(),\n}).superRefine((choice, context) => {\n  /*\n   * The pairing, in both directions.\n   *\n   * A VENDOR_HOSTED choice with no region leaves the notice unable to state where the data goes,\n   * which is the question this whole layer exists to answer. A SELF_HOSTED choice WITH one is the\n   * fiction the provider layer already refuses: the operator runs it, so its region is wherever they\n   * run it, and a value here would be a guess presented as a configuration.\n   */\n  if (choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED && choice.processingRegion === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a VENDOR_HOSTED provider must be configured with the region it processes in — without one, no notice can state where this data goes',\n    });\n  }\n  if (choice.deploymentModel === ProviderDeploymentModel.SELF_HOSTED && choice.processingRegion !== undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a SELF_HOSTED provider runs wherever the operator runs it, so a processing region here is a guess presented as configuration — drop it',\n    });\n  }\n});\nexport type ApplicationProviderComplianceChoice = z.infer<typeof ApplicationProviderComplianceChoiceSchema>;\n\n/** Per configured provider ref, the operator's compliance choice. */\nexport const ApplicationProviderComplianceChoicesSchema = z.record(\n  z.string().trim().min(1),\n  ApplicationProviderComplianceChoiceSchema,\n);\nexport type ApplicationProviderComplianceChoices = z.infer<typeof ApplicationProviderComplianceChoicesSchema>;\n\n/**\n * Regions an application asserts that the provider does not declare.\n *\n * Reported, never refused — a vendor opening a data centre must not become a build failure, and an\n * operator who genuinely knows better than a stale framework list should be able to say so. What the\n * framework owes is that the divergence is VISIBLE, which is the same trade the personal-data\n * declaration report makes.\n */\nexport function appAssertedProcessingRegions(params: {\n  readonly choices: ApplicationProviderComplianceChoices;\n  readonly profilesByProviderRef: Readonly<Record<string, ProviderComplianceProfile>>;\n}): ReadonlyArray<{ readonly providerRef: string; readonly region: string }> {\n  const asserted: Array<{ providerRef: string; region: string }> = [];\n\n  for (const [providerRef, choice] of Object.entries(params.choices)) {\n    if (choice.processingRegion === undefined) continue;\n    const profile = params.profilesByProviderRef[providerRef];\n    // No profile is not an assertion about a region — it is a provider that declares no compliance\n    // profile at all, which is a different gap and belongs to whoever reports THAT.\n    if (profile === undefined) continue;\n    if (profile.processingRegions.includes(choice.processingRegion)) continue;\n    asserted.push({ providerRef, region: choice.processingRegion });\n  }\n\n  return asserted;\n}\n\n/**\n * The configured providers that are THIRD-PARTY RECIPIENTS — vendor-hosted, and therefore processors.\n *\n * A self-hosted provider is excluded by construction rather than by a filter a caller must remember:\n * no data leaves the operator, so it is not a recipient and must never be enumerated as one.\n */\nexport function vendorHostedProviderRefs(choices: ApplicationProviderComplianceChoices): readonly string[] {\n  return Object.entries(choices)\n    .filter(([, choice]) => choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED)\n    .map(([providerRef]) => providerRef)\n    .sort();\n}\n"]}
+{"version":3,"file":"provider-compliance-profile.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,uBAYX;AAZD,WAAY,uBAAuB;IACjC;;;OAGG;IACH,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;AAC7B,CAAC,EAZW,uBAAuB,KAAvB,uBAAuB,QAYlC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAClC;;;;;;;OAOG;IACH,IAAI,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvH,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,mIAAmI;SAC7I,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,4GAA4G;AAC5G,MAAM,UAAU,0BAA0B,CAAC,OAAkC;IAC3E,OAAO,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yCAAyC,CAAC,OAAkC;IAC1F,OAAO,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,uHAAuH;AACvH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAChD;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC;;;;;;;OAOG;IACH,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC9G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,qIAAqI;SAC/I,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC5G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,wIAAwI;SAClJ,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,qEAAqE;AACrE,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACxB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAG5C;IACC,MAAM,QAAQ,GAAmD,EAAE,CAAC;IAEpE,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAAE,SAAS;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC1D,+FAA+F;QAC/F,gFAAgF;QAChF,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,qEAAqE;AAErE;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA6C;IACpF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,CAAC;SACxF,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;SACnC,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHO RUNS the software a provider module drives.\n *\n * This is the axis that decides whether a provider is a third-party RECIPIENT of personal data at\n * all, and until 2026-08-30 it did not exist anywhere in the provider model. immudb is described in\n * `BUILTIN_PROVIDER_CAPABILITY` as an audit-trail provider with nothing separating the container an\n * operator runs themselves from a hosted service — so the first privacy notice to ENUMERATE\n * recipients would have named a self-hosted audit ledger as a third party. That is false, and false\n * in the direction that alarms a reader rather than the direction they can check.\n *\n * ⚠️ NOT a hosting-topology field and not an infrastructure concern. It answers one compliance\n * question — does personal data leave the operator's control by reaching this provider — and a\n * consumer must not read it as \"where is it deployed\".\n */\nexport enum ProviderDeploymentModel {\n  /**\n   * The vendor runs it. Data reaching this provider reaches a third party, so it is a processor\n   * under Art. 28 and belongs in the subprocessor register.\n   */\n  VENDOR_HOSTED = 'VENDOR_HOSTED',\n  /**\n   * The operator runs it — their own container, their own infrastructure. No third party receives\n   * anything, so it is NOT a recipient. A notice states it as processing under the operator's own\n   * control, which is a different sentence and a stronger one.\n   */\n  SELF_HOSTED = 'SELF_HOSTED',\n}\n\n/**\n * The compliance-relevant facts a PROVIDER MODULE knows about itself.\n *\n * ## Why these live on the provider and not on the application\n *\n * The processor register shipped by issue #88 was fully application-authored, and that made every\n * application restate facts the framework already holds. What a provider IS — who runs it, which\n * regions its vendor offers, what legal entity stands behind it — does not vary per application, and\n * an application asked to restate it will eventually get it wrong. What DOES vary is the operator's\n * CHOICE among those possibilities, and that is configuration.\n *\n * So the split is: possibilities here, choice in `wildo.saas.config.ts`, and the register entry\n * derived from both (issue #130).\n *\n * ## What is deliberately NOT here\n *\n * **A transfer mechanism.** Adequacy decisions move by court ruling rather than by release cycle, so\n * a list baked into the engine goes stale silently and emits a false compliance statement — the worst\n * failure mode in this lane. The mechanism is a legal determination with a shelf life, recorded per\n * subprocessor entry by a human, never derived here (issue #126).\n *\n * **What the provider RECEIVES.** That is already implied by the capability it serves —\n * `BUILTIN_PROVIDER_CAPABILITY` describes the data flow per member. Restating it here would be a\n * second authority for one fact.\n */\nexport const ProviderComplianceProfileSchema = z.strictObject({\n  /**\n   * The deployment models this provider SUPPORTS — one, or both where the provider genuinely offers\n   * a choice (immudb: a hosted service and a container you run).\n   *\n   * A single entry means the answer is not the operator's to make and no configuration should offer\n   * it. Two means the application must choose, and a register entry cannot be derived until it has.\n   */\n  deploymentModels: z.array(z.enum(ProviderDeploymentModel)).min(1),\n  /**\n   * The regions this vendor can process in — POSSIBILITIES the operator chooses from, never a\n   * choice already made.\n   *\n   * Open strings, deliberately, because these are the VENDOR's own labels (`eu-west-1`,\n   * `us-east-1`, `EU`) and a closed enum here would be this repository inventing a vocabulary it\n   * does not own. The compliance question a transfer statement asks is about JURISDICTION rather\n   * than datacentre, and mapping one to the other is part of the legal determination that is\n   * deliberately not modelled (see above).\n   *\n   * EMPTY is meaningful and is the honest answer for a provider that is only ever self-hosted: the\n   * region is wherever the operator runs it, which the framework cannot know. A configuration\n   * choosing `SELF_HOSTED` therefore needs no region from this list.\n   */\n  processingRegions: z.array(z.string().trim().min(1)),\n  /**\n   * The vendor's legal entity, where the provider module's author can state it.\n   *\n   * OPTIONAL, and the reason is that this is the field most likely to go stale: vendors reorganise,\n   * and a stale legal entity published as a current one is worse than an absent one. Absent means\n   * the application must declare it on the register entry, which is where an operator's own contract\n   * makes it checkable.\n   */\n  vendorLegalEntityName: z.string().trim().min(1).optional(),\n}).superRefine((profile, context) => {\n  /*\n   * A VENDOR_HOSTED provider that offers no region cannot support a transfer statement, and the\n   * whole point of carrying regions is that a transfer statement becomes derivable. Refused at the\n   * schema so the gap surfaces where the provider module is authored, rather than as an\n   * unexplainable hole in a produced notice months later.\n   *\n   * The SELF_HOSTED-only case is exempt above: its region is wherever the operator runs it.\n   */\n  if (profile.deploymentModels.includes(ProviderDeploymentModel.VENDOR_HOSTED) && profile.processingRegions.length === 0) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegions'],\n      message: 'a VENDOR_HOSTED provider must declare at least one processing region — without one, no transfer statement about it can be derived',\n    });\n  }\n});\nexport type ProviderComplianceProfile = z.infer<typeof ProviderComplianceProfileSchema>;\n\n/** True when this provider can only ever be run by the operator, so it is never a third-party recipient. */\nexport function providerIsAlwaysSelfHosted(profile: ProviderComplianceProfile): boolean {\n  return profile.deploymentModels.every((model) => model === ProviderDeploymentModel.SELF_HOSTED);\n}\n\n/**\n * True when the operator must CHOOSE, because the provider supports both.\n *\n * A register entry for such a provider cannot be derived from the provider module alone — the\n * application's configuration decides whether it is a recipient at all.\n */\nexport function providerDeploymentModelIsAnOperatorChoice(profile: ProviderComplianceProfile): boolean {\n  return profile.deploymentModels.length > 1;\n}\n\n/** @wildo_source:part:start saas.models.providers.compliance-choice facet:layer:shared facet:audience:app-developer */\n/**\n * The application's CHOICE among what a provider offers — one entry per configured provider.\n *\n * The provider declares possibilities ({@link ProviderComplianceProfileSchema}); this is where an\n * operator says which of them applies to their deployment. Keeping the two apart is the whole point\n * of the layering: a vendor's regions change when it opens a data centre, an operator's choice\n * changes when they migrate, and collapsing them would make one edit look like the other.\n *\n * Not carried inside `providerConfigurations`, which is an opaque `Record<string, unknown>` bag for a\n * provider's own runtime profile. A compliance answer must not live somewhere nothing can read it\n * without knowing the provider.\n */\nexport const ApplicationProviderComplianceChoiceSchema = z.strictObject({\n  /**\n   * Who runs this provider in THIS deployment.\n   *\n   * Required even when the provider supports only one model. The redundancy is deliberate: whether\n   * personal data leaves the operator's control is the single most consequential fact a notice states\n   * about a provider, and reading it out of a framework default rather than an operator's declaration\n   * is how a wrong one goes unnoticed.\n   */\n  deploymentModel: z.enum(ProviderDeploymentModel),\n  /**\n   * Which region this provider processes in, chosen from what the provider declares possible.\n   *\n   * NOT validated here, and NOT validated at boot either. This schema cannot see the provider\n   * registry, and refusing an unlisted region would make a vendor's new data centre an application\n   * build failure, so the intended posture is warn-do-not-block: a region outside the provider's\n   * declared list is APP-ASSERTED and reported, never refused.\n   *\n   * WIRED since 2026-09-10 (issue #308). `appAssertedProcessingRegions` below computes exactly that\n   * set, and the companion's compliance-primary-facts section reports it per provider, naming both the\n   * configured value and what the provider declares — because a divergence is either a typo or a stale\n   * provider module, and those are opposite work. It took this long only because of a DATA PATH: the\n   * vendor's region list lives on the backend provider module and the renderer reads provider\n   * SPECIFICATIONS, so the helper could not be called until `complianceProfile` was mirrored onto the\n   * specification contract. Any future report must call this helper rather than re-derive the\n   * comparison.\n   */\n  processingRegion: z.string().trim().min(1).optional(),\n}).superRefine((choice, context) => {\n  /*\n   * The pairing, in both directions.\n   *\n   * A VENDOR_HOSTED choice with no region leaves the notice unable to state where the data goes,\n   * which is the question this whole layer exists to answer. A SELF_HOSTED choice WITH one is the\n   * fiction the provider layer already refuses: the operator runs it, so its region is wherever they\n   * run it, and a value here would be a guess presented as a configuration.\n   */\n  if (choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED && choice.processingRegion === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a VENDOR_HOSTED provider must be configured with the region it processes in — without one, no notice can state where this data goes',\n    });\n  }\n  if (choice.deploymentModel === ProviderDeploymentModel.SELF_HOSTED && choice.processingRegion !== undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a SELF_HOSTED provider runs wherever the operator runs it, so a processing region here is a guess presented as configuration — drop it',\n    });\n  }\n});\nexport type ApplicationProviderComplianceChoice = z.infer<typeof ApplicationProviderComplianceChoiceSchema>;\n\n/** Per configured provider ref, the operator's compliance choice. */\nexport const ApplicationProviderComplianceChoicesSchema = z.record(\n  z.string().trim().min(1),\n  ApplicationProviderComplianceChoiceSchema,\n);\nexport type ApplicationProviderComplianceChoices = z.infer<typeof ApplicationProviderComplianceChoicesSchema>;\n\n/**\n * Regions an application asserts that the provider does not declare.\n *\n * Reported, never refused — a vendor opening a data centre must not become a build failure, and an\n * operator who genuinely knows better than a stale framework list should be able to say so. What the\n * framework owes is that the divergence is VISIBLE, which is the same trade the personal-data\n * declaration report makes.\n */\nexport function appAssertedProcessingRegions(params: {\n  readonly choices: ApplicationProviderComplianceChoices;\n  readonly profilesByProviderRef: Readonly<Record<string, ProviderComplianceProfile>>;\n}): ReadonlyArray<{ readonly providerRef: string; readonly region: string }> {\n  const asserted: Array<{ providerRef: string; region: string }> = [];\n\n  for (const [providerRef, choice] of Object.entries(params.choices)) {\n    if (choice.processingRegion === undefined) continue;\n    const profile = params.profilesByProviderRef[providerRef];\n    // No profile is not an assertion about a region — it is a provider that declares no compliance\n    // profile at all, which is a different gap and belongs to whoever reports THAT.\n    if (profile === undefined) continue;\n    if (profile.processingRegions.includes(choice.processingRegion)) continue;\n    asserted.push({ providerRef, region: choice.processingRegion });\n  }\n\n  return asserted;\n}\n/** @wildo_source:part:end saas.models.providers.compliance-choice */\n\n/**\n * The configured providers that are THIRD-PARTY RECIPIENTS — vendor-hosted, and therefore processors.\n *\n * A self-hosted provider is excluded by construction rather than by a filter a caller must remember:\n * no data leaves the operator, so it is not a recipient and must never be enumerated as one.\n */\nexport function vendorHostedProviderRefs(choices: ApplicationProviderComplianceChoices): readonly string[] {\n  return Object.entries(choices)\n    .filter(([, choice]) => choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED)\n    .map(([providerRef]) => providerRef)\n    .sort();\n}\n"]}

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.d.ts

@@ -0,0 +1,165 @@
+/**
+ * The contract between a provider's frontend COMPONENT and the framework surface
+ * that mounts it.
+ *
+ * ## Why it lives here and not beside the module types it serves
+ *
+ * These types were written in `@wildo-ai/external-connectors-public`, next to the
+ * facet module types that declare a component — which reads as the right place
+ * until you follow what depends on what:
+ *
+ *   - a component lives in its own package (`@wildo-ai/providers-frontend-<vendor>`,
+ *     issue #394) because it carries React, which the connectors package must not;
+ *   - that package needs this contract to type its component;
+ *   - the connectors package needs to RESOLVE that package, because it reaches the
+ *     component by a bare dynamic import.
+ *
+ * With the contract in the connectors package that is a cycle *through emitted
+ * declarations*: the component package's `.d.ts` references the connectors
+ * package's `.d.ts`, which makes the connectors package's own `dist` an INPUT of
+ * its own build. Measured, not predicted — `tsc` refuses with `TS5055 Cannot
+ * write file … because it would overwrite input file`, once per emitted
+ * declaration.
+ *
+ * So the contract belongs BELOW both, and `saas-models` is where "below both"
+ * already is.
+ *
+ * ## Why function-valued types are allowed in this package
+ *
+ * The sibling `provider-frontend-surface.shared.schemas.ts` states that
+ * everything in it is the DATA half, and that nothing function-valued may join
+ * it. That rule is about VALUES crossing a JSON channel — a projected `activate`
+ * would be dropped by `JSON.stringify` with no error anywhere. A TYPE crosses
+ * nothing. `onSelect` here is a compile-time obligation on two parties, and it
+ * never appears in a wire record.
+ *
+ * `File` is a DOM type, which this package already uses
+ * (`files.shared.utils.ts`), so nothing new is required of its lib.
+ */
+import type { ProviderFrontendSelectionDelivery } from './provider-frontend-surface.shared.schemas';
+/**
+ * What a provider's file picker hands back for ONE chosen file.
+ *
+ * The three arms are the three answers to issue #383, and the union exists
+ * because the decision was **per vendor**: a picker for a credentialed vendor and
+ * a picker for a vendor with a browser-safe public token genuinely cannot return
+ * the same thing, and both must ship.
+ *
+ * `kind` is not a runtime choice. Each arm corresponds to exactly one
+ * `ProviderFrontendSelectionDelivery`, the provider DECLARES which one it emits,
+ * and the framework refuses a selection whose `kind` contradicts that
+ * declaration. Without the refusal the union would be the hedge the decision
+ * rejected — a contract that says "one of these three, we will find out at
+ * runtime" is not one an application's file field can be written against.
+ */
+export type ProviderFileSelection = {
+    /** @see ProviderFrontendSelectionDelivery.REMOTE_REFERENCE */
+    readonly kind: ProviderFrontendSelectionDelivery.REMOTE_REFERENCE;
+    /** Opaque to everything in the browser. Only the application backend can resolve it. */
+    readonly externalId: string;
+    /** What to show the user before the backend has resolved anything. */
+    readonly displayName?: string;
+    readonly mimeType?: string;
+    readonly sizeBytes?: number;
+} | {
+    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE */
+    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE;
+    readonly file: File;
+} | {
+    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL */
+    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL;
+    /** Fetchable by the browser. Its origin must be admitted by the surface's composed CSP. */
+    readonly url: string;
+    readonly displayName?: string;
+    readonly mimeType?: string;
+    readonly sizeBytes?: number;
+};
+/**
+ * The constraints a framework file field imposes on a picker.
+ *
+ * Resolved by the framework — schema metadata first, then the provider's own
+ * `publicConfig` through the capability's named schema — so a picker never
+ * re-reads either. `maxSize` is BYTES; a provider stating megabytes in its public
+ * config (`maxFileSizeMb`) is converted before it reaches here.
+ *
+ * ## Why the field names are these and not clearer ones
+ *
+ * They are the framework file field's OWN names:
+ * `resolveFormFieldFileProviderConstraints` in `@wildo-ai/saas-frontend-lib`
+ * produces exactly this shape and its `ResolvedFormFieldFileProviderConstraints`
+ * is an alias of this type, so there is one source rather than two spellings of
+ * one contract.
+ *
+ * That is not tidiness. The first draft called the size cap `maxSizeBytes` while
+ * the resolver called it `maxSize` — both BYTES, both optional — and TypeScript
+ * accepts the assignment: the weak-type check is satisfied by the two names that
+ * DO match, so wiring the resolver into a picker would have compiled and silently
+ * dropped the size cap. A picker would then accept files the field rejects, and
+ * the user finds out after choosing one.
+ */
+export interface ProviderFilePickerConstraints {
+    /**
+     * A MUTABLE array, deliberately: `@wildo-ai/zod-decorators`' MIME helpers
+     * (`isMimeTypeAllowed`, `buildAcceptAttribute`) take `string[]`, and this
+     * type's whole reason for existing is to BE the framework file field's own
+     * shape rather than a second one. A `readonly string[]` here would be a better
+     * type in isolation and would force a cast at every one of those call sites,
+     * which is how the drift this type prevents starts again.
+     */
+    allowedMimeTypes?: string[];
+    /** BYTES, not megabytes. */
+    maxSize?: number;
+    maxFiles?: number;
+}
+/**
+ * The props every `FRONTEND_FILE_PICKER` component receives.
+ *
+ * `onSelect` takes an ARRAY even for a single-file field. A picker that supports
+ * multi-select otherwise needs a second callback or a hidden convention, and a
+ * field that allows one file can reject a second selection with a message instead
+ * of silently keeping whichever arrived first — which is what a single-value
+ * callback forces it to do.
+ */
+export interface ProviderFilePickerProps {
+    /** The provider's own `ref`, so a picker can label what it renders without being told twice. */
+    readonly providerRef: string;
+    /**
+     * The provider's public configuration, already validated against the module's
+     * `publicConfigSchema` when it declares one. A picker never re-coerces it.
+     */
+    readonly publicConfig: Readonly<Record<string, unknown>>;
+    readonly constraints: ProviderFilePickerConstraints;
+    /**
+     * An access token for THIS provider, on behalf of the current user, when the
+     * application has one.
+     *
+     * Optional, and its absence is a real state rather than a defect: a picker that
+     * authenticates through its own vendor popup (OneDrive's does) needs nothing
+     * here, and an application that has not connected a user's account to this
+     * provider has nothing to give. A picker that does need one must call this and
+     * report through `onError` when it is absent — never fall back to a token from
+     * `publicConfig`, which is served to every browser.
+     *
+     * Supplying it is the account-connection surface's job (issue #333), which does
+     * not exist yet; until it does, the framework passes nothing and a picker that
+     * requires a token says so. The prop is declared now so that the dependency is
+     * VISIBLE in the contract rather than discovered by whoever writes the second
+     * picker.
+     */
+    getAccessToken?(): Promise<string | undefined>;
+    /**
+     * Called with everything the user chose. May be called once with several files;
+     * must not be called after `onCancel`.
+     */
+    onSelect(selections: readonly ProviderFileSelection[]): void;
+    /** The user dismissed the picker without choosing. */
+    onCancel(): void;
+    /**
+     * The picker could not run — the vendor SDK failed to load, a grant was
+     * refused, the vendor returned an error. Reported rather than thrown: a throw
+     * inside a picker's own event handler does not reach a React error boundary, so
+     * it would be a surface that silently stops responding.
+     */
+    onError(error: Error): void;
+}
+//# sourceMappingURL=provider-frontend-component-contract.shared.types.d.ts.map

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-frontend-component-contract.shared.types.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IACA,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,gBAAgB,CAAC;IAClE,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GACC;IACA,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,qBAAqB,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACC;IACA,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,oBAAoB,CAAC;IACtE,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,qBAAqB,EAAE,GAAG,IAAI,CAAC;IAC7D,sDAAsD;IACtD,QAAQ,IAAI,IAAI,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC7B"}

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.js

@@ -0,0 +1,39 @@
+/**
+ * The contract between a provider's frontend COMPONENT and the framework surface
+ * that mounts it.
+ *
+ * ## Why it lives here and not beside the module types it serves
+ *
+ * These types were written in `@wildo-ai/external-connectors-public`, next to the
+ * facet module types that declare a component — which reads as the right place
+ * until you follow what depends on what:
+ *
+ *   - a component lives in its own package (`@wildo-ai/providers-frontend-<vendor>`,
+ *     issue #394) because it carries React, which the connectors package must not;
+ *   - that package needs this contract to type its component;
+ *   - the connectors package needs to RESOLVE that package, because it reaches the
+ *     component by a bare dynamic import.
+ *
+ * With the contract in the connectors package that is a cycle *through emitted
+ * declarations*: the component package's `.d.ts` references the connectors
+ * package's `.d.ts`, which makes the connectors package's own `dist` an INPUT of
+ * its own build. Measured, not predicted — `tsc` refuses with `TS5055 Cannot
+ * write file … because it would overwrite input file`, once per emitted
+ * declaration.
+ *
+ * So the contract belongs BELOW both, and `saas-models` is where "below both"
+ * already is.
+ *
+ * ## Why function-valued types are allowed in this package
+ *
+ * The sibling `provider-frontend-surface.shared.schemas.ts` states that
+ * everything in it is the DATA half, and that nothing function-valued may join
+ * it. That rule is about VALUES crossing a JSON channel — a projected `activate`
+ * would be dropped by `JSON.stringify` with no error anywhere. A TYPE crosses
+ * nothing. `onSelect` here is a compile-time obligation on two parties, and it
+ * never appears in a wire record.
+ *
+ * `File` is a DOM type, which this package already uses
+ * (`files.shared.utils.ts`), so nothing new is required of its lib.
+ */
+//# sourceMappingURL=provider-frontend-component-contract.shared.types.js.map

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-frontend-component-contract.shared.types.js","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG","sourcesContent":["/**\n * The contract between a provider's frontend COMPONENT and the framework surface\n * that mounts it.\n *\n * ## Why it lives here and not beside the module types it serves\n *\n * These types were written in `@wildo-ai/external-connectors-public`, next to the\n * facet module types that declare a component — which reads as the right place\n * until you follow what depends on what:\n *\n *   - a component lives in its own package (`@wildo-ai/providers-frontend-<vendor>`,\n *     issue #394) because it carries React, which the connectors package must not;\n *   - that package needs this contract to type its component;\n *   - the connectors package needs to RESOLVE that package, because it reaches the\n *     component by a bare dynamic import.\n *\n * With the contract in the connectors package that is a cycle *through emitted\n * declarations*: the component package's `.d.ts` references the connectors\n * package's `.d.ts`, which makes the connectors package's own `dist` an INPUT of\n * its own build. Measured, not predicted — `tsc` refuses with `TS5055 Cannot\n * write file … because it would overwrite input file`, once per emitted\n * declaration.\n *\n * So the contract belongs BELOW both, and `saas-models` is where \"below both\"\n * already is.\n *\n * ## Why function-valued types are allowed in this package\n *\n * The sibling `provider-frontend-surface.shared.schemas.ts` states that\n * everything in it is the DATA half, and that nothing function-valued may join\n * it. That rule is about VALUES crossing a JSON channel — a projected `activate`\n * would be dropped by `JSON.stringify` with no error anywhere. A TYPE crosses\n * nothing. `onSelect` here is a compile-time obligation on two parties, and it\n * never appears in a wire record.\n *\n * `File` is a DOM type, which this package already uses\n * (`files.shared.utils.ts`), so nothing new is required of its lib.\n */\n\nimport type { ProviderFrontendSelectionDelivery } from './provider-frontend-surface.shared.schemas';\n\n/**\n * What a provider's file picker hands back for ONE chosen file.\n *\n * The three arms are the three answers to issue #383, and the union exists\n * because the decision was **per vendor**: a picker for a credentialed vendor and\n * a picker for a vendor with a browser-safe public token genuinely cannot return\n * the same thing, and both must ship.\n *\n * `kind` is not a runtime choice. Each arm corresponds to exactly one\n * `ProviderFrontendSelectionDelivery`, the provider DECLARES which one it emits,\n * and the framework refuses a selection whose `kind` contradicts that\n * declaration. Without the refusal the union would be the hedge the decision\n * rejected — a contract that says \"one of these three, we will find out at\n * runtime\" is not one an application's file field can be written against.\n */\nexport type ProviderFileSelection =\n  | {\n    /** @see ProviderFrontendSelectionDelivery.REMOTE_REFERENCE */\n    readonly kind: ProviderFrontendSelectionDelivery.REMOTE_REFERENCE;\n    /** Opaque to everything in the browser. Only the application backend can resolve it. */\n    readonly externalId: string;\n    /** What to show the user before the backend has resolved anything. */\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE;\n    readonly file: File;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL;\n    /** Fetchable by the browser. Its origin must be admitted by the surface's composed CSP. */\n    readonly url: string;\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  };\n\n/**\n * The constraints a framework file field imposes on a picker.\n *\n * Resolved by the framework — schema metadata first, then the provider's own\n * `publicConfig` through the capability's named schema — so a picker never\n * re-reads either. `maxSize` is BYTES; a provider stating megabytes in its public\n * config (`maxFileSizeMb`) is converted before it reaches here.\n *\n * ## Why the field names are these and not clearer ones\n *\n * They are the framework file field's OWN names:\n * `resolveFormFieldFileProviderConstraints` in `@wildo-ai/saas-frontend-lib`\n * produces exactly this shape and its `ResolvedFormFieldFileProviderConstraints`\n * is an alias of this type, so there is one source rather than two spellings of\n * one contract.\n *\n * That is not tidiness. The first draft called the size cap `maxSizeBytes` while\n * the resolver called it `maxSize` — both BYTES, both optional — and TypeScript\n * accepts the assignment: the weak-type check is satisfied by the two names that\n * DO match, so wiring the resolver into a picker would have compiled and silently\n * dropped the size cap. A picker would then accept files the field rejects, and\n * the user finds out after choosing one.\n */\nexport interface ProviderFilePickerConstraints {\n  /**\n   * A MUTABLE array, deliberately: `@wildo-ai/zod-decorators`' MIME helpers\n   * (`isMimeTypeAllowed`, `buildAcceptAttribute`) take `string[]`, and this\n   * type's whole reason for existing is to BE the framework file field's own\n   * shape rather than a second one. A `readonly string[]` here would be a better\n   * type in isolation and would force a cast at every one of those call sites,\n   * which is how the drift this type prevents starts again.\n   */\n  allowedMimeTypes?: string[];\n  /** BYTES, not megabytes. */\n  maxSize?: number;\n  maxFiles?: number;\n}\n\n/**\n * The props every `FRONTEND_FILE_PICKER` component receives.\n *\n * `onSelect` takes an ARRAY even for a single-file field. A picker that supports\n * multi-select otherwise needs a second callback or a hidden convention, and a\n * field that allows one file can reject a second selection with a message instead\n * of silently keeping whichever arrived first — which is what a single-value\n * callback forces it to do.\n */\nexport interface ProviderFilePickerProps {\n  /** The provider's own `ref`, so a picker can label what it renders without being told twice. */\n  readonly providerRef: string;\n  /**\n   * The provider's public configuration, already validated against the module's\n   * `publicConfigSchema` when it declares one. A picker never re-coerces it.\n   */\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n  readonly constraints: ProviderFilePickerConstraints;\n  /**\n   * An access token for THIS provider, on behalf of the current user, when the\n   * application has one.\n   *\n   * Optional, and its absence is a real state rather than a defect: a picker that\n   * authenticates through its own vendor popup (OneDrive's does) needs nothing\n   * here, and an application that has not connected a user's account to this\n   * provider has nothing to give. A picker that does need one must call this and\n   * report through `onError` when it is absent — never fall back to a token from\n   * `publicConfig`, which is served to every browser.\n   *\n   * Supplying it is the account-connection surface's job (issue #333), which does\n   * not exist yet; until it does, the framework passes nothing and a picker that\n   * requires a token says so. The prop is declared now so that the dependency is\n   * VISIBLE in the contract rather than discovered by whoever writes the second\n   * picker.\n   */\n  getAccessToken?(): Promise<string | undefined>;\n  /**\n   * Called with everything the user chose. May be called once with several files;\n   * must not be called after `onCancel`.\n   */\n  onSelect(selections: readonly ProviderFileSelection[]): void;\n  /** The user dismissed the picker without choosing. */\n  onCancel(): void;\n  /**\n   * The picker could not run — the vendor SDK failed to load, a grant was\n   * refused, the vendor returned an error. Reported rather than thrown: a throw\n   * inside a picker's own event handler does not reach a React error boundary, so\n   * it would be a surface that silently stops responding.\n   */\n  onError(error: Error): void;\n}\n"]}

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-surface.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,MAAM,kBAAkB;IACxB,OAAO,mBAAmB;IAC1B,KAAK,iBAAiB;IACtB,GAAG,eAAe;IAClB,KAAK,iBAAiB;IACtB,IAAI,gBAAgB;CACrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC;IACjD,kEAAkE;;;kBAGlE,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,kCAAkC;IAC7C,uEAAuE;;IAEvE,gGAAgG;;IAEhG,gGAAgG;;IAEhG,oEAAoE;;IAEpE,iEAAiE;;IAEjE,8DAA8D;;IAE9D;;;;OAIG;;QAvBH,kEAAkE;;;;kBAyBlE,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAEzG;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,uCAAuC,GACnD,4BAA4B,CAE9B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mCAAmC;IAC9C,kEAAkE;;IAElE;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,oBAAY,iCAAiC;IAC3C,gIAAgI;IAChI,SAAS,cAAc;IACvB,kHAAkH;IAClH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uCAAuC;IAEhD,sFAAsF;;IAEtF,mDAAmD;;;;;kBAgBnD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,gBAAgB,qBAAqB;IACrC;;;;;;OAMG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G;;;;;;;;GAQG;AACH,eAAO,MAAM,0CAA0C;IAlBrD;;;;OAIG;;mBAiBJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}
+{"version":3,"file":"provider-frontend-surface.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,MAAM,kBAAkB;IACxB,OAAO,mBAAmB;IAC1B,KAAK,iBAAiB;IACtB,GAAG,eAAe;IAClB,KAAK,iBAAiB;IACtB,IAAI,gBAAgB;CACrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC;IACjD,kEAAkE;;;kBAGlE,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,kCAAkC;IAC7C,uEAAuE;;IAEvE,gGAAgG;;IAEhG,gGAAgG;;IAEhG,oEAAoE;;IAEpE,iEAAiE;;IAEjE,8DAA8D;;IAE9D;;;;OAIG;;QAvBH,kEAAkE;;;;kBAyBlE,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAEzG;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,uCAAuC,GACnD,4BAA4B,CAE9B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mCAAmC;IAC9C,kEAAkE;;IAElE;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,oBAAY,iCAAiC;IAC3C,gIAAgI;IAChI,SAAS,cAAc;IACvB,kHAAkH;IAClH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uCAAuC;IAEhD,sFAAsF;;IAEtF,mDAAmD;;;;;kBAgBnD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,gBAAgB,qBAAqB;IACrC;;;;;;OAMG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G;;;;;;;;GAQG;AACH,eAAO,MAAM,0CAA0C;IAlBrD;;;;OAIG;;mBAiBJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-surface.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,2DAAwB,CAAA;IACxB,6DAA0B,CAAA;IAC1B,yDAAsB,CAAA;IACtB,qDAAkB,CAAA;IAClB,yDAAsB,CAAA;IACtB,uDAAoB,CAAA;AACtB,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,8DAA8D;IAC9D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAyBH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAoD;IAEpD,OAAO,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,kEAAkE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,gIAAgI;IAChI,4DAAuB,CAAA;IACvB,kHAAkH;IAClH,wEAAmC,CAAA;AACrC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,mDAAmD;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACjE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mGAAmG;kBACjG,+EAA+E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,iCAuBX;AAvBD,WAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,0EAAqC,CAAA;IACrC;;;;;;OAMG;IACH,oFAA+C,CAAA;IAC/C;;;;;OAKG;IACH,kFAA6C,CAAA;AAC/C,CAAC,EAvBW,iCAAiC,KAAjC,iCAAiC,QAuB5C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,gCAAgC,GAGlC;IACF,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,gBAAgB;IAC3D,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,GAAG,CAAC,EAAE,YAAY;IACnD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,aAAa;CACtD,CAAC;AACF,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * Frontend-surface atoms a provider declares: what it needs the page to be\n * ALLOWED to reach (its CSP footprint), which vendor SDK package it loads, and\n * which third-party `<script>` tags it asks the surface to add.\n *\n * ## Why these are DATA and live here\n *\n * A frontend provider reaches its surface through TWO channels, and only one of\n * them can carry code:\n *\n *   - the **DATA** channel — `FrontendProviderEntry`, projected by the backend\n *     into `/application-config` and materialized into the generated\n *     frontend-services artifact. It is JSON end to end, so nothing\n *     function-valued survives it (it used to be cast to a module type anyway,\n *     which is the defect this split closes);\n *   - the **CODE** channel — the provider package's own facet barrel, imported\n *     by the bundle through the generated `frontend-providers.generated.ts`.\n *\n * Everything in this file is the DATA half. It is what the CLI, the CSP\n * composer and the bundle-isolation policy need to SEE without executing any\n * frontend module — and the CLI genuinely cannot execute one: it is a Node\n * process and these modules are browser-bound. The executable half (`sdk.activate`,\n * `publicConfigSchema`) lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this boundary.\n *\n * Added by slice S4a of epic #337 (issue #332).\n */\n\nimport { z } from 'zod';\n\n/**\n * The origins a provider needs the composed Content-Security-Policy to admit,\n * grouped by WHAT THE PROVIDER IS REACHING rather than by CSP directive name.\n *\n * ## Why semantic buckets and not directive names\n *\n * `CSP_DIRECTIVE_NAMES` is a closed vocabulary that already has one named\n * runtime source, in `@wildo-ai/platform-config-lib`. That package DEPENDS on\n * this one, so this file cannot reference it, and re-declaring the list here\n * would create a second source for one vocabulary — precisely what the\n * one-named-source rule exists to prevent, and the way the two copies would\n * drift the first time a directive is added.\n *\n * Keying on intent instead is also the better contract. A provider author knows\n * \"my SDK is fetched from `https://js.stripe.com` and it calls back to\n * `https://api.stripe.com`\"; which directive grades which fetch is framework\n * knowledge, and it lives in exactly one place — the bucket-to-directive\n * mapping in `platform-config-lib`'s `csp-emit.ts`.\n *\n * ## Why it is STRICT while the entry that carries it is loose\n *\n * The entry is a WIRE record read by a possibly-older consumer, so it tolerates\n * unknown keys (see `frontend-provider-entry.shared.schemas.ts`). This footprint\n * is AUTHORED, by a provider package, and validated where it is authored — so a\n * misspelled bucket must fail loudly rather than contribute nothing. That\n * distinction matters more here than anywhere else in the frontend surface:\n * CSP is enforced in production and report-only in development, so a bucket that\n * silently contributes nothing is invisible until the provider breaks in\n * production only.\n *\n * Adding a bucket is not a one-sided producer change either — a new bucket is\n * useless until `csp-emit.ts` maps it to a directive — so strictness costs no\n * version-skew tolerance that was ever available.\n *\n * Every field defaults to `[]`: a provider that declares a footprint at all is\n * making a complete statement about the buckets it did not name.\n */\n/**\n * Which bucket an origin lands in, as a value a provider can name.\n *\n * The bucket names are already the footprint's field names; this enum is what\n * lets a provider REFER to one — a derived origin has to say where it goes, and\n * a bare string there would be a second, unexplained spelling of a closed\n * vocabulary. A compile-time check below pins the two together.\n */\nexport enum ProviderFrontendCspOriginBucket {\n  SCRIPT = 'scriptOrigins',\n  CONNECT = 'connectOrigins',\n  FRAME = 'frameOrigins',\n  IMG = 'imgOrigins',\n  STYLE = 'styleOrigins',\n  FONT = 'fontOrigins',\n}\n\n/**\n * An origin the framework must READ OUT OF the provider's own public config,\n * because the provider cannot know it.\n *\n * The case that forced this: an error-monitoring provider sends to the host\n * inside its DSN, and a product-analytics provider to whatever `apiHost` the\n * application configured — including a self-hosted one. Both are per\n * APPLICATION, and often per ENVIRONMENT, so no static list on the provider\n * module can contain them. Without this the application would have to author\n * the same host twice — once as the provider's config and once in its CSP — and\n * the copy that drifts fails in production only, because development is\n * report-only.\n *\n * Resolution is data, not code: the CLI takes `publicConfig[publicConfigKey]`,\n * reads its URL origin, and adds it to `bucket`. An absent key contributes\n * nothing (the provider simply is not configured for that service); a key that\n * is present and is NOT a URL fails the sync loudly, because silently dropping\n * it is the exact failure this exists to prevent.\n */\nexport const ProviderFrontendCspDerivedOriginSchema = z.strictObject({\n  /** Key in this provider's `publicConfig` whose value is a URL. */\n  publicConfigKey: z.string().min(1),\n  bucket: z.enum(ProviderFrontendCspOriginBucket),\n});\nexport type ProviderFrontendCspDerivedOrigin = z.infer<typeof ProviderFrontendCspDerivedOriginSchema>;\n\nexport const ProviderFrontendCspFootprintSchema = z.strictObject({\n  /** Origins the surface loads executable script from (`script-src`). */\n  scriptOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider's code opens fetch / XHR / WebSocket connections to (`connect-src`). */\n  connectOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider embeds in an iframe — a picker, a checkout, a meeting (`frame-src`). */\n  frameOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads images or pixels from (`img-src`). */\n  imgOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads stylesheets from (`style-src`). */\n  styleOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads web fonts from (`font-src`). */\n  fontOrigins: z.array(z.string().min(1)).default([]),\n  /**\n   * Origins the framework reads out of this provider's own `publicConfig`,\n   * for the endpoints a provider cannot know in advance. See\n   * {@link ProviderFrontendCspDerivedOriginSchema}.\n   */\n  derivedOrigins: z.array(ProviderFrontendCspDerivedOriginSchema).default([]),\n});\nexport type ProviderFrontendCspFootprint = z.infer<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * The footprint as a provider AUTHORS it: name only the buckets you reach.\n *\n * Authoring and the wire are deliberately different shapes, and the asymmetry\n * is the point.\n *\n *   - **Authoring is partial.** A provider that only loads a script should write\n *     `{ scriptOrigins: ['https://js.acme.com'] }`, not that plus four empty\n *     arrays. Four empty arrays are noise at exactly the place the declaration\n *     should be readable, and noise is what stops a reviewer noticing the one\n *     line that grants an origin.\n *   - **The wire is total.** Every bucket is present by the time the footprint\n *     reaches an entry, so the CSP composer never branches on absence and the\n *     staleness comparison between a served footprint and its module's has two\n *     comparable shapes rather than a partial and a total that differ in every\n *     bucket nobody named.\n *\n * Derived as `z.input` rather than written as a `Partial<…>`, so it cannot drift\n * from the schema: adding a bucket makes it optional here automatically.\n */\nexport type ProviderFrontendCspFootprintDeclaration = z.input<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * Fills in the buckets a declaration did not name.\n *\n * The ONE place that normalization happens, used by the projection that builds\n * an entry and by the hydration join that compares one against a module. Two\n * copies would eventually disagree about whether an unnamed bucket is `[]` or\n * absent, and the join reads that difference as a stale artifact — a false\n * alarm on the diagnostic whose whole job is to be believed.\n */\nexport function normalizeProviderFrontendCspFootprint(\n  declaration: ProviderFrontendCspFootprintDeclaration,\n): ProviderFrontendCspFootprint {\n  return ProviderFrontendCspFootprintSchema.parse(declaration);\n}\n\n/**\n * The DATA half of a provider's `sdk` declaration: WHICH npm package carries the\n * vendor SDK, and at which range.\n *\n * The CODE half — the dynamic import and the vendor's initialization call — is\n * `ProviderFrontendSdk.activate` on the facet module type, and is deliberately\n * absent here: a function cannot cross a JSON channel, and a channel that\n * silently drops one is worse than a channel that never carried it.\n *\n * The descriptor is not decoration. It is what the bundle-isolation policy reads\n * to decide whether a bare specifier a provider package imports was DECLARED,\n * what an application's dependency alignment needs in order to install the SDK\n * as an optional peer, and what a human reads when asking why a bundle grew.\n *\n * Who authors it, since the epic's bulk-integration model was reversed on\n * 2026-09-06: a FIRST-CLASS provider package or an application's own provider\n * module. The scraper-mapper that fills the catalogue emits identity, auth, a\n * secrets contract and an operation catalogue on the `rest` arm — a\n * backend-only package — so a scraped provider has no frontend facet to carry\n * this. That is a narrowing of the population, not of the contract: the pickers\n * and embeds this surface exists for were always the hand-authored kind.\n */\nexport const ProviderFrontendSdkDescriptorSchema = z.strictObject({\n  /** npm package name of the vendor SDK, e.g. `@sentry/browser`. */\n  packageName: z.string().min(1),\n  /**\n   * Semver range the provider was built against. Optional because a provider\n   * that pins its SDK as a direct dependency has already said so in its own\n   * manifest; stating it here as well would be a second copy of that pin.\n   */\n  versionRange: z.string().min(1).optional(),\n});\nexport type ProviderFrontendSdkDescriptor = z.infer<typeof ProviderFrontendSdkDescriptorSchema>;\n\n/**\n * `crossorigin` attribute values for a provider-declared `<script>`.\n *\n * A closed vocabulary with a named runtime source rather than a bare literal\n * union, so each member can carry why it exists — and there are exactly two\n * reasons to pick one over the other.\n */\nexport enum ProviderFrontendScriptCrossOrigin {\n  /** No credentials are sent; the response must carry `Access-Control-Allow-Origin`. The right choice for a public CDN script. */\n  ANONYMOUS = 'anonymous',\n  /** Cookies and TLS client certificates are sent. Only for a vendor that authenticates the script fetch itself. */\n  USE_CREDENTIALS = 'use-credentials',\n}\n\n/**\n * A third-party `<script>` a provider asks its surface to add — the case a\n * dynamic `import()` cannot serve, because the vendor ships a global-installing\n * tag rather than an npm module (reCAPTCHA, most tag managers, several chat\n * widgets).\n *\n * `integrity` is Subresource Integrity. It is optional because a vendor that\n * versionless-serves a mutable URL (again, reCAPTCHA) cannot publish a stable\n * hash — but when it IS given the surface must also send `crossorigin`, or the\n * browser refuses the integrity check outright. That coupling is enforced below\n * rather than left to each surface to remember.\n */\nexport const ProviderFrontendScriptDeclarationSchema = z\n  .strictObject({\n    /** Absolute URL of the script. Its origin must also appear in `csp.scriptOrigins`. */\n    src: z.string().min(1),\n    /** Subresource-integrity hash, e.g. `sha384-…`. */\n    integrity: z.string().min(1).optional(),\n    crossOrigin: z.enum(ProviderFrontendScriptCrossOrigin).optional(),\n    async: z.boolean().optional(),\n    defer: z.boolean().optional(),\n  })\n  .superRefine((declaration, context) => {\n    if (declaration.integrity !== undefined && declaration.crossOrigin === undefined) {\n      context.addIssue({\n        code: 'custom',\n        path: ['crossOrigin'],\n        message:\n          'A script declaring `integrity` must also declare `crossOrigin`; without it the browser skips the '\n          + 'integrity check for a cross-origin script, so the hash would protect nothing.',\n      });\n    }\n  });\nexport type ProviderFrontendScriptDeclaration = z.infer<typeof ProviderFrontendScriptDeclarationSchema>;\n\n/**\n * WHAT a provider's component hands back, when what it hands back is a thing\n * rather than a value.\n *\n * ## The question this answers, and why it is a DECLARATION\n *\n * An application's objective is that it calls third-party APIs directly from\n * custom frontend components. On the backend that is unambiguous. In a browser\n * it is not, because a tenant credential must never get there — so a picker for\n * a credentialed vendor and a picker for a vendor with a browser-safe public\n * token cannot hand back the same thing, and the framework surface that\n * receives a selection has to know which before it mounts anything.\n *\n * Settled 2026-09-07 (issue #383, recorded as Q5 of the provider-architecture\n * plan): **per vendor, DECLARED.** Both shapes are real and both ship; which one\n * a provider emits is a static fact about that provider, stated here and\n * visible on the DATA channel without executing a line of its code.\n *\n * The word doing the work is *declared*. A discriminated union alone would let a\n * provider decide at runtime, which is the shape the decision explicitly\n * rejected — so the framework REFUSES a selection whose discriminant contradicts\n * this field. Without that refusal the declaration is decoration, and a reviewer\n * reading a provider's manifest would be reading a wish.\n *\n * ## Why a single value and not a set\n *\n * A provider that genuinely could emit either — Google's Picker hands back both\n * a file id and a URL, and which is usable depends on the granted OAuth scope —\n * was the argument for `selectionDelivery: [...]`. Rejected: an array puts the\n * choice back at runtime, which is the half of the decision that carries all the\n * weight. A vendor whose two modes are both wanted contributes two components,\n * and the chooser then shows them as what they are — two different things a user\n * can pick between — rather than one component whose behaviour a reader cannot\n * predict.\n *\n * ## What it means for CSP\n *\n * `REMOTE_REFERENCE` does NOT imply a provider needs no `connectOrigins`: a\n * picker still talks to its vendor to RENDER, even when the bytes it selects are\n * fetched later by the backend. So this field does not gate the CSP buckets, and\n * a guard inferring otherwise would break every real picker. What it does gate\n * is where the SELECTED OBJECT travels.\n */\nexport enum ProviderFrontendSelectionDelivery {\n  /**\n   * An opaque handle only the application backend can resolve — a Drive file id,\n   * a DAM asset key. The browser never holds the bytes and never authenticates\n   * to the vendor for them; the framework routes the reference to the\n   * application's executor door, which holds the tenant credential.\n   */\n  REMOTE_REFERENCE = 'REMOTE_REFERENCE',\n  /**\n   * Bytes the browser already holds, as a `File`. Available only to a vendor\n   * whose picker runs on a browser-safe grant — a publishable key, a\n   * user-consented OAuth token, a picker's own scoped grant — so nothing\n   * tenant-secret is involved. The framework uploads it exactly as it uploads a\n   * file chosen from disk.\n   */\n  BROWSER_READABLE_FILE = 'BROWSER_READABLE_FILE',\n  /**\n   * A URL the browser may fetch, under the same browser-safe-grant condition as\n   * `BROWSER_READABLE_FILE`. Distinct from it because the framework must fetch\n   * before it can upload, and that fetch is a network call the composed CSP has\n   * to admit — a difference the surface cannot discover from a `File`.\n   */\n  BROWSER_READABLE_URL = 'BROWSER_READABLE_URL',\n}\n\n/**\n * The DATA half of one component a provider contributes — everything about it\n * that a reviewer, the CLI or a build step can read without running a browser.\n *\n * The loader is the CODE half and stays on the facet module in\n * `@wildo-ai/external-connectors-public`, exactly as `sdk.activate` does. What\n * crosses the wire is the fact that a component EXISTS for this capability, plus\n * the contract it commits to.\n *\n * Strict, and for the same reason the CSP footprint is: this is AUTHORED by a\n * provider package rather than received from an older producer, so a misspelled\n * key must fail where it is written instead of contributing nothing.\n */\nexport const ProviderFrontendComponentDescriptorSchema = z.strictObject({\n  /**\n   * What a selection from this component contains. Absent for a capability whose\n   * component returns a plain value rather than a thing — a captcha widget hands\n   * back a token, and there is no delivery question to answer about a string.\n   */\n  selectionDelivery: z.enum(ProviderFrontendSelectionDelivery).optional(),\n});\nexport type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFrontendComponentDescriptorSchema>;\n\n/**\n * A provider's component descriptors, keyed by the CAPABILITY each fills.\n *\n * The key is a capability token rather than a member of a closed enum because\n * `ProviderCapability` is OPEN — an application extends it by module\n * augmentation — so a `z.enum` here would refuse an application's own\n * capability. The registry that consumes this makes the same choice for the same\n * reason.\n */\nexport const ProviderFrontendComponentDescriptorsSchema = z.record(\n  z.string().min(1),\n  ProviderFrontendComponentDescriptorSchema,\n);\nexport type ProviderFrontendComponentDescriptors = z.infer<typeof ProviderFrontendComponentDescriptorsSchema>;\n\n/**\n * Pins every bucket member to a real field of the footprint.\n *\n * A member whose value is not a footprint key would be authorable, would parse,\n * and would contribute nothing — in production only, because CSP is report-only\n * in development. This makes it a compile error instead.\n */\nconst _everyBucketNamesAFootprintField: Record<\n  ProviderFrontendCspOriginBucket,\n  keyof Omit<ProviderFrontendCspFootprint, 'derivedOrigins'>\n> = {\n  [ProviderFrontendCspOriginBucket.SCRIPT]: 'scriptOrigins',\n  [ProviderFrontendCspOriginBucket.CONNECT]: 'connectOrigins',\n  [ProviderFrontendCspOriginBucket.FRAME]: 'frameOrigins',\n  [ProviderFrontendCspOriginBucket.IMG]: 'imgOrigins',\n  [ProviderFrontendCspOriginBucket.STYLE]: 'styleOrigins',\n  [ProviderFrontendCspOriginBucket.FONT]: 'fontOrigins',\n};\nvoid _everyBucketNamesAFootprintField;\n"]}
+{"version":3,"file":"provider-frontend-surface.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,2DAAwB,CAAA;IACxB,6DAA0B,CAAA;IAC1B,yDAAsB,CAAA;IACtB,qDAAkB,CAAA;IAClB,yDAAsB,CAAA;IACtB,uDAAoB,CAAA;AACtB,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,8DAA8D;IAC9D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAyBH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAoD;IAEpD,OAAO,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,kEAAkE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,gIAAgI;IAChI,4DAAuB,CAAA;IACvB,kHAAkH;IAClH,wEAAmC,CAAA;AACrC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,mDAAmD;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACjE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mGAAmG;kBACjG,+EAA+E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,iCAuBX;AAvBD,WAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,0EAAqC,CAAA;IACrC;;;;;;OAMG;IACH,oFAA+C,CAAA;IAC/C;;;;;OAKG;IACH,kFAA6C,CAAA;AAC/C,CAAC,EAvBW,iCAAiC,KAAjC,iCAAiC,QAuB5C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,gCAAgC,GAGlC;IACF,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,gBAAgB;IAC3D,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,GAAG,CAAC,EAAE,YAAY;IACnD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,aAAa;CACtD,CAAC;AACF,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * Frontend-surface atoms a provider declares: what it needs the page to be\n * ALLOWED to reach (its CSP footprint), which vendor SDK package it loads, and\n * which third-party `<script>` tags it asks the surface to add.\n *\n * ## Why these are DATA and live here\n *\n * A frontend provider reaches its surface through TWO channels, and only one of\n * them can carry code:\n *\n *   - the **DATA** channel — `FrontendProviderEntry`, projected by the backend\n *     into `/application-config` and materialized into the generated\n *     frontend-services artifact. It is JSON end to end, so nothing\n *     function-valued survives it (it used to be cast to a module type anyway,\n *     which is the defect this split closes);\n *   - the **CODE** channel — the provider package's own facet barrel, imported\n *     by the bundle through the generated `frontend-providers.generated.ts`.\n *\n * Everything in this file is the DATA half. It is what the CLI, the CSP\n * composer and the bundle-isolation policy need to SEE without executing any\n * frontend module — and the CLI genuinely cannot execute one: it is a Node\n * process and these modules are browser-bound. The executable half (`sdk.activate`,\n * `publicConfigSchema`) lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this boundary.\n *\n * Added by slice S4a of epic #337 (issue #332).\n */\n\nimport { z } from 'zod';\n\n/**\n * The origins a provider needs the composed Content-Security-Policy to admit,\n * grouped by WHAT THE PROVIDER IS REACHING rather than by CSP directive name.\n *\n * ## Why semantic buckets and not directive names\n *\n * `CSP_DIRECTIVE_NAMES` is a closed vocabulary that already has one named\n * runtime source, in `@wildo-ai/platform-config-lib`. That package DEPENDS on\n * this one, so this file cannot reference it, and re-declaring the list here\n * would create a second source for one vocabulary — precisely what the\n * one-named-source rule exists to prevent, and the way the two copies would\n * drift the first time a directive is added.\n *\n * Keying on intent instead is also the better contract. A provider author knows\n * \"my SDK is fetched from `https://js.stripe.com` and it calls back to\n * `https://api.stripe.com`\"; which directive grades which fetch is framework\n * knowledge, and it lives in exactly one place — the bucket-to-directive\n * mapping in `platform-config-lib`'s `csp-emit.ts`.\n *\n * ## Why it is STRICT while the entry that carries it is loose\n *\n * The entry is a WIRE record read by a possibly-older consumer, so it tolerates\n * unknown keys (see `frontend-provider-entry.shared.schemas.ts`). This footprint\n * is AUTHORED, by a provider package, and validated where it is authored — so a\n * misspelled bucket must fail loudly rather than contribute nothing. That\n * distinction matters more here than anywhere else in the frontend surface:\n * CSP is enforced in production and report-only in development, so a bucket that\n * silently contributes nothing is invisible until the provider breaks in\n * production only.\n *\n * Adding a bucket is not a one-sided producer change either — a new bucket is\n * useless until `csp-emit.ts` maps it to a directive — so strictness costs no\n * version-skew tolerance that was ever available.\n *\n * Every field defaults to `[]`: a provider that declares a footprint at all is\n * making a complete statement about the buckets it did not name.\n */\n/**\n * Which bucket an origin lands in, as a value a provider can name.\n *\n * The bucket names are already the footprint's field names; this enum is what\n * lets a provider REFER to one — a derived origin has to say where it goes, and\n * a bare string there would be a second, unexplained spelling of a closed\n * vocabulary. A compile-time check below pins the two together.\n */\nexport enum ProviderFrontendCspOriginBucket {\n  SCRIPT = 'scriptOrigins',\n  CONNECT = 'connectOrigins',\n  FRAME = 'frameOrigins',\n  IMG = 'imgOrigins',\n  STYLE = 'styleOrigins',\n  FONT = 'fontOrigins',\n}\n\n/**\n * An origin the framework must READ OUT OF the provider's own public config,\n * because the provider cannot know it.\n *\n * The case that forced this: an error-monitoring provider sends to the host\n * inside its DSN, and a product-analytics provider to whatever `apiHost` the\n * application configured — including a self-hosted one. Both are per\n * APPLICATION, and often per ENVIRONMENT, so no static list on the provider\n * module can contain them. Without this the application would have to author\n * the same host twice — once as the provider's config and once in its CSP — and\n * the copy that drifts fails in production only, because development is\n * report-only.\n *\n * Resolution is data, not code: the CLI takes `publicConfig[publicConfigKey]`,\n * reads its URL origin, and adds it to `bucket`. An absent key contributes\n * nothing (the provider simply is not configured for that service); a key that\n * is present and is NOT a URL fails the sync loudly, because silently dropping\n * it is the exact failure this exists to prevent.\n */\nexport const ProviderFrontendCspDerivedOriginSchema = z.strictObject({\n  /** Key in this provider's `publicConfig` whose value is a URL. */\n  publicConfigKey: z.string().min(1),\n  bucket: z.enum(ProviderFrontendCspOriginBucket),\n});\nexport type ProviderFrontendCspDerivedOrigin = z.infer<typeof ProviderFrontendCspDerivedOriginSchema>;\n\nexport const ProviderFrontendCspFootprintSchema = z.strictObject({\n  /** Origins the surface loads executable script from (`script-src`). */\n  scriptOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider's code opens fetch / XHR / WebSocket connections to (`connect-src`). */\n  connectOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider embeds in an iframe — a picker, a checkout, a meeting (`frame-src`). */\n  frameOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads images or pixels from (`img-src`). */\n  imgOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads stylesheets from (`style-src`). */\n  styleOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads web fonts from (`font-src`). */\n  fontOrigins: z.array(z.string().min(1)).default([]),\n  /**\n   * Origins the framework reads out of this provider's own `publicConfig`,\n   * for the endpoints a provider cannot know in advance. See\n   * {@link ProviderFrontendCspDerivedOriginSchema}.\n   */\n  derivedOrigins: z.array(ProviderFrontendCspDerivedOriginSchema).default([]),\n});\nexport type ProviderFrontendCspFootprint = z.infer<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * The footprint as a provider AUTHORS it: name only the buckets you reach.\n *\n * Authoring and the wire are deliberately different shapes, and the asymmetry\n * is the point.\n *\n *   - **Authoring is partial.** A provider that only loads a script should write\n *     `{ scriptOrigins: ['https://js.acme.com'] }`, not that plus four empty\n *     arrays. Four empty arrays are noise at exactly the place the declaration\n *     should be readable, and noise is what stops a reviewer noticing the one\n *     line that grants an origin.\n *   - **The wire is total.** Every bucket is present by the time the footprint\n *     reaches an entry, so the CSP composer never branches on absence and the\n *     staleness comparison between a served footprint and its module's has two\n *     comparable shapes rather than a partial and a total that differ in every\n *     bucket nobody named.\n *\n * Derived as `z.input` rather than written as a `Partial<…>`, so it cannot drift\n * from the schema: adding a bucket makes it optional here automatically.\n */\nexport type ProviderFrontendCspFootprintDeclaration = z.input<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * Fills in the buckets a declaration did not name.\n *\n * The ONE place that normalization happens, used by the projection that builds\n * an entry and by the hydration join that compares one against a module. Two\n * copies would eventually disagree about whether an unnamed bucket is `[]` or\n * absent, and the join reads that difference as a stale artifact — a false\n * alarm on the diagnostic whose whole job is to be believed.\n */\nexport function normalizeProviderFrontendCspFootprint(\n  declaration: ProviderFrontendCspFootprintDeclaration,\n): ProviderFrontendCspFootprint {\n  return ProviderFrontendCspFootprintSchema.parse(declaration);\n}\n\n/**\n * The DATA half of a provider's `sdk` declaration: WHICH npm package carries the\n * vendor SDK, and at which range.\n *\n * The CODE half — the dynamic import and the vendor's initialization call — is\n * `ProviderFrontendSdk.activate` on the facet module type, and is deliberately\n * absent here: a function cannot cross a JSON channel, and a channel that\n * silently drops one is worse than a channel that never carried it.\n *\n * The descriptor is not decoration. It is what the bundle-isolation policy reads\n * to decide whether a bare specifier a provider package imports was DECLARED,\n * what an application's dependency alignment needs in order to install the SDK\n * as an optional peer, and what a human reads when asking why a bundle grew.\n *\n * Who authors it, since the epic's bulk-integration model was reversed on\n * 2026-09-06: a FIRST-CLASS provider package or an application's own provider\n * module. The scraper-mapper that fills the catalogue emits identity, auth, a\n * secrets contract and an operation catalogue on the `rest` arm — a\n * backend-only package — so a scraped provider has no frontend facet to carry\n * this. That is a narrowing of the population, not of the contract: the pickers\n * and embeds this surface exists for were always the hand-authored kind.\n */\nexport const ProviderFrontendSdkDescriptorSchema = z.strictObject({\n  /** npm package name of the vendor SDK, e.g. `@sentry/browser`. */\n  packageName: z.string().min(1),\n  /**\n   * Semver range the provider was built against. Optional because a provider\n   * that pins its SDK as a direct dependency has already said so in its own\n   * manifest; stating it here as well would be a second copy of that pin.\n   */\n  versionRange: z.string().min(1).optional(),\n});\nexport type ProviderFrontendSdkDescriptor = z.infer<typeof ProviderFrontendSdkDescriptorSchema>;\n\n/**\n * `crossorigin` attribute values for a provider-declared `<script>`.\n *\n * A closed vocabulary with a named runtime source rather than a bare literal\n * union, so each member can carry why it exists — and there are exactly two\n * reasons to pick one over the other.\n */\nexport enum ProviderFrontendScriptCrossOrigin {\n  /** No credentials are sent; the response must carry `Access-Control-Allow-Origin`. The right choice for a public CDN script. */\n  ANONYMOUS = 'anonymous',\n  /** Cookies and TLS client certificates are sent. Only for a vendor that authenticates the script fetch itself. */\n  USE_CREDENTIALS = 'use-credentials',\n}\n\n/**\n * A third-party `<script>` a provider asks its surface to add — the case a\n * dynamic `import()` cannot serve, because the vendor ships a global-installing\n * tag rather than an npm module (reCAPTCHA, most tag managers, several chat\n * widgets).\n *\n * `integrity` is Subresource Integrity. It is optional because a vendor that\n * versionless-serves a mutable URL (again, reCAPTCHA) cannot publish a stable\n * hash — but when it IS given the surface must also send `crossorigin`, or the\n * browser refuses the integrity check outright. That coupling is enforced below\n * rather than left to each surface to remember.\n */\nexport const ProviderFrontendScriptDeclarationSchema = z\n  .strictObject({\n    /** Absolute URL of the script. Its origin must also appear in `csp.scriptOrigins`. */\n    src: z.string().min(1),\n    /** Subresource-integrity hash, e.g. `sha384-…`. */\n    integrity: z.string().min(1).optional(),\n    crossOrigin: z.enum(ProviderFrontendScriptCrossOrigin).optional(),\n    async: z.boolean().optional(),\n    defer: z.boolean().optional(),\n  })\n  .superRefine((declaration, context) => {\n    if (declaration.integrity !== undefined && declaration.crossOrigin === undefined) {\n      context.addIssue({\n        code: 'custom',\n        path: ['crossOrigin'],\n        message:\n          'A script declaring `integrity` must also declare `crossOrigin`; without it the browser skips the '\n          + 'integrity check for a cross-origin script, so the hash would protect nothing.',\n      });\n    }\n  });\nexport type ProviderFrontendScriptDeclaration = z.infer<typeof ProviderFrontendScriptDeclarationSchema>;\n\n/**\n * WHAT a provider's component hands back, when what it hands back is a thing\n * rather than a value.\n *\n * ## The question this answers, and why it is a DECLARATION\n *\n * An application's objective is that it calls third-party APIs directly from\n * custom frontend components. On the backend that is unambiguous. In a browser\n * it is not, because a tenant credential must never get there — so a picker for\n * a credentialed vendor and a picker for a vendor with a browser-safe public\n * token cannot hand back the same thing, and the framework surface that\n * receives a selection has to know which before it mounts anything.\n *\n * Settled 2026-09-07 (issue #383, recorded as Q5 of the provider-architecture\n * plan): **per vendor, DECLARED.** Both shapes are real and both ship; which one\n * a provider emits is a static fact about that provider, stated here and\n * visible on the DATA channel without executing a line of its code.\n *\n * The word doing the work is *declared*. A discriminated union alone would let a\n * provider decide at runtime, which is the shape the decision explicitly\n * rejected — so the framework REFUSES a selection whose discriminant contradicts\n * this field. Without that refusal the declaration is decoration, and a reviewer\n * reading a provider's manifest would be reading a wish.\n *\n * ## Why a single value and not a set\n *\n * A provider that genuinely could emit either — Google's Picker hands back both\n * a file id and a URL, and which is usable depends on the granted OAuth scope —\n * was the argument for `selectionDelivery: [...]`. Rejected: an array puts the\n * choice back at runtime, which is the half of the decision that carries all the\n * weight. A vendor whose two modes are both wanted contributes two components,\n * and the chooser then shows them as what they are — two different things a user\n * can pick between — rather than one component whose behaviour a reader cannot\n * predict.\n *\n * ## What it means for CSP\n *\n * `REMOTE_REFERENCE` does NOT imply a provider needs no `connectOrigins`: a\n * picker still talks to its vendor to RENDER, even when the bytes it selects are\n * fetched later by the backend. So this field does not gate the CSP buckets, and\n * a guard inferring otherwise would break every real picker. What it does gate\n * is where the SELECTED OBJECT travels.\n */\nexport enum ProviderFrontendSelectionDelivery {\n  /**\n   * An opaque handle only the application backend can resolve — a Drive file id,\n   * a DAM asset key. The browser never holds the bytes and never authenticates\n   * to the vendor for them; the framework routes the reference to the\n   * application's executor door, which holds the tenant credential.\n   */\n  REMOTE_REFERENCE = 'REMOTE_REFERENCE',\n  /**\n   * Bytes the browser already holds, as a `File`. Available only to a vendor\n   * whose picker runs on a browser-safe grant — a publishable key, a\n   * user-consented OAuth token, a picker's own scoped grant — so nothing\n   * tenant-secret is involved. The framework uploads it exactly as it uploads a\n   * file chosen from disk.\n   */\n  BROWSER_READABLE_FILE = 'BROWSER_READABLE_FILE',\n  /**\n   * A URL the browser may fetch, under the same browser-safe-grant condition as\n   * `BROWSER_READABLE_FILE`. Distinct from it because the framework must fetch\n   * before it can upload, and that fetch is a network call the composed CSP has\n   * to admit — a difference the surface cannot discover from a `File`.\n   */\n  BROWSER_READABLE_URL = 'BROWSER_READABLE_URL',\n}\n\n/**\n * The DATA half of one component a provider contributes — everything about it\n * that a reviewer, the CLI or a build step can read without running a browser.\n *\n * The loader is the CODE half and stays on the facet module in\n * `@wildo-ai/external-connectors-public`, exactly as `sdk.activate` does. What\n * crosses the wire is the fact that a component EXISTS for this capability, plus\n * the contract it commits to.\n *\n * Strict, and for the same reason the CSP footprint is: this is AUTHORED by a\n * provider package rather than received from an older producer, so a misspelled\n * key must fail where it is written instead of contributing nothing.\n */\nexport const ProviderFrontendComponentDescriptorSchema = z.strictObject({\n  /**\n   * What a selection from this component contains. Absent for a capability whose\n   * component returns a plain value rather than a thing — a captcha widget hands\n   * back a token, and there is no delivery question to answer about a string.\n   */\n  selectionDelivery: z.enum(ProviderFrontendSelectionDelivery).optional(),\n});\nexport type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFrontendComponentDescriptorSchema>;\n\n/**\n * A provider's component descriptors, keyed by the CAPABILITY each fills.\n *\n * The key is a capability token rather than a member of a closed enum because\n * `ProviderCapability` is OPEN — an application extends it by module\n * augmentation — so a `z.enum` here would refuse an application's own\n * capability. The registry that consumes this makes the same choice for the same\n * reason.\n */\nexport const ProviderFrontendComponentDescriptorsSchema = z.record(\n  z.string().min(1),\n  ProviderFrontendComponentDescriptorSchema,\n);\nexport type ProviderFrontendComponentDescriptors = z.infer<typeof ProviderFrontendComponentDescriptorsSchema>;\n\n/**\n * Pins every bucket member to a real field of the footprint.\n *\n * A member whose value is not a footprint key would be authorable, would parse,\n * and would contribute nothing — in production only, because CSP is report-only\n * in development. This makes it a compile error instead.\n */\nconst _everyBucketNamesAFootprintField: Record<\n  ProviderFrontendCspOriginBucket,\n  keyof Omit<ProviderFrontendCspFootprint, 'derivedOrigins'>\n> = {\n  [ProviderFrontendCspOriginBucket.SCRIPT]: 'scriptOrigins',\n  [ProviderFrontendCspOriginBucket.CONNECT]: 'connectOrigins',\n  [ProviderFrontendCspOriginBucket.FRAME]: 'frameOrigins',\n  [ProviderFrontendCspOriginBucket.IMG]: 'imgOrigins',\n  [ProviderFrontendCspOriginBucket.STYLE]: 'styleOrigins',\n  [ProviderFrontendCspOriginBucket.FONT]: 'fontOrigins',\n};\nvoid _everyBucketNamesAFootprintField;\n"]}

package/dist/esm/external-providers/provider-metadata.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED,iDAAiD;AACjD,oBAAY,kBAAkB;IAC5B,yDAAyD;IACzD,MAAM,WAAW;IACjB,yEAAyE;IACzE,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,uBAAuB;IACjC,YAAY,iBAAiB;IAC7B,GAAG,QAAQ;IACX,gBAAgB,qBAAqB;CACtC;AAED,eAAO,MAAM,iCAAiC;;;;iBAa5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAa7B,CAAC;AACL,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEnF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,EAAE,cAAmE,CAAC;AAEzG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBA2CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAW3F"}
+{"version":3,"file":"provider-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED,iDAAiD;AACjD,oBAAY,kBAAkB;IAC5B,yDAAyD;IACzD,MAAM,WAAW;IACjB,yEAAyE;IACzE,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,uBAAuB;IACjC,YAAY,iBAAiB;IAC7B,GAAG,QAAQ;IACX,gBAAgB,qBAAqB;CACtC;AAED,eAAO,MAAM,iCAAiC;;;;iBAa5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAa7B,CAAC;AACL,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEnF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,EAAE,cAAmE,CAAC;AAEzG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBA2CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAW3F"}

package/dist/esm/external-providers/provider-metadata.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,OAAO,aAAa,WAAW,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,YAuBX;AAvBD,WAAY,YAAY;IACtB;;;;;;OAMG;IACH,6BAAa,CAAA;IACb;;;;;OAKG;IACH,uCAAuB,CAAA;IACvB;;;;;OAKG;IACH,uCAAuB,CAAA;AACzB,CAAC,EAvBW,YAAY,KAAZ,YAAY,QAuBvB;AAED,iDAAiD;AACjD,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,yDAAyD;IACzD,uCAAiB,CAAA;IACjB,yEAAyE;IACzE,iDAA2B,CAAA;IAC3B;;;;OAIG;IACH,6CAAuB,CAAA;AACzB,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,wDAA6B,CAAA;IAC7B,sCAAW,CAAA;IACX,gEAAqC,CAAA;AACvC,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,wCAAwC;IACxC,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,iEAAiE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC,CAAC,CAAC;AAML,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;OAIG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,qEAAqE;IACrE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC1B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,wCAAwC;IACxC,MAAM,EAAE,oBAAoB;IAC5B;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC;IAChE,WAAW,EAAE,IAAI;IACjB,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAcH;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACnE,CAAqB,CAAC;AACzB,CAAC","sourcesContent":["/**\n * `ProviderMetadata` — shared, frontend-safe header carried by every\n * provider module across every facet (backend, frontend-app, techdoc,\n * website).\n *\n * Intentionally **frontend-safe**: holds no secrets, no protocol\n * contracts, no backend behavior. The fields are exactly what a UI needs\n * to render a provider entry (translation-ready display-name key, optional\n * legacy fallback label, optional icon ref) plus the stable `ref` used as\n * the join key between facet modules — and, since #328, the provider's\n * IDENTITY: which package ships it, which tier it belongs to, which vendor\n * groups it, and where it came from.\n *\n * ## Why identity lives here and not on the ref\n *\n * A bare `ref` string cannot say whether a provider is one the engine\n * REQUIRES (a MAIN provider binding an `EngineCapability` slot), one that\n * merely MAY bind a slot as a substitute (EXTENSION), or one of the bulk\n * loaded on demand that must never claim a slot (CATALOGUE). Nor can it say\n * that `microsoft-graph-mail` and `microsoft-teams` are two packages of one\n * vendor sharing an OAuth client. Encoding any of that in the ref's\n * spelling is invisible to the compiler and to every consumer; encoding it\n * as fields is what lets composition ENFORCE the tier rule\n * (`assertProviderTierCoherence`) and lets tooling display and group.\n *\n * The identity fields are REQUIRED. A provider without a tier is a provider\n * nobody has decided about, and \"undecided\" must not parse as \"fine\".\n */\n\nimport { z } from 'zod';\n\n\n/**\n * Translation key builder for provider display names.\n *\n * Provider modules stay locale-neutral by exporting this stable label key;\n * consuming frontend surfaces resolve it via the app i18n service at render\n * time instead of freezing human copy into generated/runtime artifacts.\n */\nexport function buildProviderDisplayNameLabelKey(providerRef: string): string {\n  return `providers.${providerRef}.displayName`;\n}\n\n/**\n * The three provider tiers (decided 2026-09-05, epic #337).\n *\n * The tier is a DECISION recorded on the module, never inferred from its\n * capabilities at runtime — inference is silent and wrong for a provider\n * such as Odoo, whose empty capability list says nothing about whether the\n * engine depends on it.\n */\nexport enum ProviderTier {\n  /**\n   * Mandatory, engine-shipped. Binds an `EngineCapability` slot the engine\n   * itself consumes (email, billing, SMS, the AI slots) or is an SSO login\n   * provider the auth subsystem consumes. MAIN is the engine's own set:\n   * its origin is always `ENGINE`, and it is what stays in the static\n   * engine registry when everything else loads on demand.\n   */\n  MAIN = 'MAIN',\n  /**\n   * May ALSO bind an engine slot, as a substitute for a MAIN provider\n   * (a second email sink, a telemetry sink, an audit sink). Kept distinct\n   * from MAIN so the engine's floor is not confused with what happens to\n   * be installed.\n   */\n  EXTENSION = 'EXTENSION',\n  /**\n   * The bulk: integrations with no engine slot, loaded on demand when an\n   * application declares them. A CATALOGUE provider may claim only OPEN\n   * `ProviderCapability` tokens — never one that maps to an engine slot —\n   * which composition enforces.\n   */\n  CATALOGUE = 'CATALOGUE',\n}\n\n/** Where a provider module's code comes from. */\nexport enum ProviderOriginKind {\n  /** Shipped by the framework's own connector packages. */\n  ENGINE = 'ENGINE',\n  /** Authored inside an application (its own `provider-contributions`). */\n  APPLICATION = 'APPLICATION',\n  /**\n   * Emitted by the framework packager from an external catalogue source;\n   * carries the catalogue provenance so the wrapped upstream artifact can\n   * be named, attributed and re-generated.\n   */\n  GENERATED = 'GENERATED',\n}\n\n/**\n * External catalogues a build-time MAPPER reads to emit a native Wildo provider package.\n *\n * Every member is a SOURCE that is read, never a runtime the application depends on: the mapper\n * extracts each operation's method, URL template, parameters and auth shape as DATA, and Wildo's\n * own HTTP client executes them. Nothing third-party is installed or executed by a generated\n * application. (An earlier revision of this enum described Activepieces as a set of executable\n * bundles Wildo would WRAP; that model was built, measured and deleted on 2026-09-06 — see\n * `providers-are-scraped-never-wrapped`.)\n *\n * - `ACTIVEPIECES` — the community pieces monorepo. Each piece's actions and triggers call\n *   `httpClient.sendRequest({ method, url, body })` in plain TypeScript an AST pass can read.\n *   Note the PUBLISHED bundle is NOT a usable input: its metadata carries name, inputs and auth\n *   but not the endpoint, which lives inside the compiled `run`.\n * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.\n *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response\n *   shaping stays Wildo's.\n * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the\n *   same output shape. Authoritative where it exists, since it is the vendor's own description.\n */\nexport enum ProviderCatalogueSource {\n  ACTIVEPIECES = 'ACTIVEPIECES',\n  SIM = 'SIM',\n  OPENAPI_DOCUMENT = 'OPENAPI_DOCUMENT',\n}\n\nexport const ProviderCatalogueProvenanceSchema = z.object({\n  source: z.enum(ProviderCatalogueSource),\n  /**\n   * The upstream artifact read, addressed the way its catalogue addresses it: the piece's\n   * directory or package name, the Sim tool's module, the OpenAPI document's path.\n   */\n  sourceRef: z.string().min(1),\n  /**\n   * The exact upstream revision read — a source-control revision for a monorepo catalogue, a\n   * document version for an OpenAPI input. A re-generation pins a new one, which is what makes a\n   * regenerated package's diff attributable to a specific upstream movement.\n   */\n  sourceVersion: z.string().min(1),\n});\nexport type ProviderCatalogueProvenance = z.infer<typeof ProviderCatalogueProvenanceSchema>;\n\n/**\n * Origin as ONE object with a `kind` and a provenance that is REQUIRED exactly when the kind is\n * `GENERATED` (and forbidden otherwise), enforced by the refinement below.\n *\n * Not a `z.discriminatedUnion`, deliberately: under `strictNullChecks: false` — how the engine\n * packages compile — Zod 4 infers a union-typed object key as OPTIONAL (the members' `optout`\n * collapses to `\"optional\"` once `undefined` is erased), so `metadata.origin` would type as\n * omittable in every engine consumer while the runtime refused its absence. A plain object\n * infers as required in both modes; the invariant the union expressed lives in the refinement\n * and in the `ProviderOrigin` type below.\n */\nexport const ProviderOriginSchema = z\n  .object({\n    kind: z.enum(ProviderOriginKind),\n    /** Present iff `kind === GENERATED`. */\n    catalogue: ProviderCatalogueProvenanceSchema.optional(),\n  })\n  .superRefine((origin, ctx) => {\n    if (origin.kind === ProviderOriginKind.GENERATED && origin.catalogue === undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: 'A GENERATED origin must carry its catalogue provenance.' });\n    }\n    if (origin.kind !== ProviderOriginKind.GENERATED && origin.catalogue !== undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: `Only a GENERATED origin carries catalogue provenance (kind is ${origin.kind}).` });\n    }\n  });\nexport type ProviderOrigin =\n  | { kind: ProviderOriginKind.ENGINE; catalogue?: undefined }\n  | { kind: ProviderOriginKind.APPLICATION; catalogue?: undefined }\n  | { kind: ProviderOriginKind.GENERATED; catalogue: ProviderCatalogueProvenance };\n\n/** The one engine origin value, so 22 modules do not each spell it. */\nexport const ENGINE_PROVIDER_ORIGIN: ProviderOrigin = Object.freeze({ kind: ProviderOriginKind.ENGINE });\n\nexport const ProviderMetadataSchema = z.object({\n  /**\n   * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,\n   * `'openai'`. Used as the join key across facet modules and as the\n   * map key inside `BackendProviderRegistry.modules`.\n   */\n  ref: z.string().min(1),\n  /**\n   * The npm package that ships this provider's module(s), e.g.\n   * `@wildo-ai/external-connectors-private` for an engine provider or\n   * `@wildo-ai/provider-slack` for a per-provider package. One package,\n   * several facet barrels — this is the package, not a barrel.\n   */\n  packageName: z.string().min(1),\n  /** See {@link ProviderTier}. A recorded decision, never inferred. */\n  tier: z.enum(ProviderTier),\n  /**\n   * Vendor grouping. Equal to `ref` for a single-package vendor; the shared\n   * name for a sub-cut vendor (`vendor: 'microsoft'` on both\n   * `microsoft-graph-mail` and `microsoft-teams`), which is what lets an\n   * OAuth client or a secret be shared by reference across sub-packages.\n   */\n  vendor: z.string().min(1),\n  /** See {@link ProviderOriginSchema}. */\n  origin: ProviderOriginSchema,\n  /**\n   * Translation-ready key for the provider display name.\n   *\n   * Frontend/public surfaces should prefer this field over embedding\n   * locale-bound copy in provider modules or runtime artifacts.\n   */\n  displayNameLabelKey: z.string().optional(),\n  /**\n   * Legacy human-readable fallback label for non-i18n-aware consumers.\n   * When absent, consumers fall back to the `ref`.\n   */\n  displayName: z.string().optional(),\n  /**\n   * Optional icon reference resolved through the frontend icon registry.\n   * Stays a string (not a URL or component reference) to keep this type\n   * frontend-safe AND portable to non-React surfaces.\n   */\n  iconRef: z.string().optional(),\n});\n\nexport type ProviderMetadata = Omit<z.infer<typeof ProviderMetadataSchema>, 'origin'> & { origin: ProviderOrigin };\n\n/**\n * The identity half of {@link ProviderMetadataSchema} on its own — what a\n * companion contribution carries so tooling can display tiers and group\n * vendors without loading a provider's runtime module.\n */\nexport const ProviderIdentitySchema = ProviderMetadataSchema.pick({\n  packageName: true,\n  tier: true,\n  vendor: true,\n  origin: true,\n});\nexport type ProviderIdentity = Omit<z.infer<typeof ProviderIdentitySchema>, 'origin'> & { origin: ProviderOrigin };\n\nexport interface DefineProviderMetadataInput {\n  ref: string;\n  packageName: string;\n  tier: ProviderTier;\n  origin: ProviderOrigin;\n  /** Defaults to `ref` — the single-package vendor case. */\n  vendor?: string;\n  displayName?: string;\n  iconRef?: string;\n}\n\n/**\n * The one way a provider module authors its metadata.\n *\n * Derives `displayNameLabelKey` from the ref (every module used to call\n * `buildProviderDisplayNameLabelKey` by hand), defaults `vendor` to the ref,\n * and parses the result so an incomplete identity fails at MODULE LOAD —\n * in the package that owns the module — rather than at the first consumer\n * that reads a field which is not there.\n */\nexport function defineProviderMetadata(input: DefineProviderMetadataInput): ProviderMetadata {\n  return ProviderMetadataSchema.parse({\n    ref: input.ref,\n    packageName: input.packageName,\n    tier: input.tier,\n    vendor: input.vendor ?? input.ref,\n    origin: input.origin,\n    displayNameLabelKey: buildProviderDisplayNameLabelKey(input.ref),\n    ...(input.displayName === undefined ? {} : { displayName: input.displayName }),\n    ...(input.iconRef === undefined ? {} : { iconRef: input.iconRef }),\n  }) as ProviderMetadata;\n}\n"]}
+{"version":3,"file":"provider-metadata.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,OAAO,aAAa,WAAW,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,YAuBX;AAvBD,WAAY,YAAY;IACtB;;;;;;OAMG;IACH,6BAAa,CAAA;IACb;;;;;OAKG;IACH,uCAAuB,CAAA;IACvB;;;;;OAKG;IACH,uCAAuB,CAAA;AACzB,CAAC,EAvBW,YAAY,KAAZ,YAAY,QAuBvB;AAED,iDAAiD;AACjD,MAAM,CAAN,IAAY,kBAWX;AAXD,WAAY,kBAAkB;IAC5B,yDAAyD;IACzD,uCAAiB,CAAA;IACjB,yEAAyE;IACzE,iDAA2B,CAAA;IAC3B;;;;OAIG;IACH,6CAAuB,CAAA;AACzB,CAAC,EAXW,kBAAkB,KAAlB,kBAAkB,QAW7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAN,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,wDAA6B,CAAA;IAC7B,sCAAW,CAAA;IACX,gEAAqC,CAAA;AACvC,CAAC,EAJW,uBAAuB,KAAvB,uBAAuB,QAIlC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,wCAAwC;IACxC,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,iEAAiE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC,CAAC,CAAC;AAML,uEAAuE;AACvE,MAAM,CAAC,MAAM,sBAAsB,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C;;;;OAIG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,qEAAqE;IACrE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC1B;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,wCAAwC;IACxC,MAAM,EAAE,oBAAoB;IAC5B;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC;IAChE,WAAW,EAAE,IAAI;IACjB,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,IAAI;CACb,CAAC,CAAC;AAcH;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkC;IACvE,OAAO,sBAAsB,CAAC,KAAK,CAAC;QAClC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB,EAAE,gCAAgC,CAAC,KAAK,CAAC,GAAG,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACnE,CAAqB,CAAC;AACzB,CAAC","sourcesContent":["/**\n * `ProviderMetadata` — shared, frontend-safe header carried by every\n * provider module across every facet (backend, frontend-app, techdoc,\n * website).\n *\n * Intentionally **frontend-safe**: holds no secrets, no protocol\n * contracts, no backend behavior. The fields are exactly what a UI needs\n * to render a provider entry (translation-ready display-name key, optional\n * legacy fallback label, optional icon ref) plus the stable `ref` used as\n * the join key between facet modules — and, since #328, the provider's\n * IDENTITY: which package ships it, which tier it belongs to, which vendor\n * groups it, and where it came from.\n *\n * ## Why identity lives here and not on the ref\n *\n * A bare `ref` string cannot say whether a provider is one the engine\n * REQUIRES (a MAIN provider binding an `EngineCapability` slot), one that\n * merely MAY bind a slot as a substitute (EXTENSION), or one of the bulk\n * loaded on demand that must never claim a slot (CATALOGUE). Nor can it say\n * that `microsoft-graph-mail` and `microsoft-teams` are two packages of one\n * vendor sharing an OAuth client. Encoding any of that in the ref's\n * spelling is invisible to the compiler and to every consumer; encoding it\n * as fields is what lets composition ENFORCE the tier rule\n * (`assertProviderTierCoherence`) and lets tooling display and group.\n *\n * The identity fields are REQUIRED. A provider without a tier is a provider\n * nobody has decided about, and \"undecided\" must not parse as \"fine\".\n */\n\nimport { z } from 'zod';\n\n\n/**\n * Translation key builder for provider display names.\n *\n * Provider modules stay locale-neutral by exporting this stable label key;\n * consuming frontend surfaces resolve it via the app i18n service at render\n * time instead of freezing human copy into generated/runtime artifacts.\n */\nexport function buildProviderDisplayNameLabelKey(providerRef: string): string {\n  return `providers.${providerRef}.displayName`;\n}\n\n/**\n * The three provider tiers (decided 2026-09-05, epic #337).\n *\n * The tier is a DECISION recorded on the module, never inferred from its\n * capabilities at runtime — inference is silent and wrong for a provider\n * such as Odoo, whose empty capability list says nothing about whether the\n * engine depends on it.\n */\nexport enum ProviderTier {\n  /**\n   * Mandatory, engine-shipped. Binds an `EngineCapability` slot the engine\n   * itself consumes (email, billing, SMS, the AI slots) or is an SSO login\n   * provider the auth subsystem consumes. MAIN is the engine's own set:\n   * its origin is always `ENGINE`, and it is what stays in the static\n   * engine registry when everything else loads on demand.\n   */\n  MAIN = 'MAIN',\n  /**\n   * May ALSO bind an engine slot, as a substitute for a MAIN provider\n   * (a second email sink, a telemetry sink, an audit sink). Kept distinct\n   * from MAIN so the engine's floor is not confused with what happens to\n   * be installed.\n   */\n  EXTENSION = 'EXTENSION',\n  /**\n   * The bulk: integrations with no engine slot, loaded on demand when an\n   * application declares them. A CATALOGUE provider may claim only OPEN\n   * `ProviderCapability` tokens — never one that maps to an engine slot —\n   * which composition enforces.\n   */\n  CATALOGUE = 'CATALOGUE',\n}\n\n/** Where a provider module's code comes from. */\nexport enum ProviderOriginKind {\n  /** Shipped by the framework's own connector packages. */\n  ENGINE = 'ENGINE',\n  /** Authored inside an application (its own `provider-contributions`). */\n  APPLICATION = 'APPLICATION',\n  /**\n   * Emitted by the framework packager from an external catalogue source;\n   * carries the catalogue provenance so the wrapped upstream artifact can\n   * be named, attributed and re-generated.\n   */\n  GENERATED = 'GENERATED',\n}\n\n/**\n * External catalogues a build-time MAPPER reads to emit a native Wildo provider package.\n *\n * Every member is a SOURCE that is read, never a runtime the application depends on: the mapper\n * extracts each operation's method, URL template, parameters and auth shape as DATA, and Wildo's\n * own HTTP client executes them. Nothing third-party is installed or executed by a generated\n * application. (An earlier revision of this enum described Activepieces as a set of executable\n * bundles Wildo would WRAP; that model was built, measured and deleted on 2026-09-06 — see\n * `providers-are-scraped-never-wrapped`.)\n *\n * - `ACTIVEPIECES` — the community pieces monorepo. Each piece's actions and triggers call\n *   `httpClient.sendRequest({ method, url, body })` in plain TypeScript an AST pass can read.\n *   Note the PUBLISHED bundle is NOT a usable input: its metadata carries name, inputs and auth\n *   but not the endpoint, which lives inside the compiled `run`.\n * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.\n *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response\n *   shaping stays Wildo's.\n * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the\n *   same output shape. Authoritative where it exists, since it is the vendor's own description.\n */\nexport enum ProviderCatalogueSource {\n  ACTIVEPIECES = 'ACTIVEPIECES',\n  SIM = 'SIM',\n  OPENAPI_DOCUMENT = 'OPENAPI_DOCUMENT',\n}\n\nexport const ProviderCatalogueProvenanceSchema = z.object({\n  source: z.enum(ProviderCatalogueSource),\n  /**\n   * The upstream artifact read, addressed the way its catalogue addresses it: the piece's\n   * directory or package name, the Sim tool's module, the OpenAPI document's path.\n   */\n  sourceRef: z.string().min(1),\n  /**\n   * The exact upstream revision read — a source-control revision for a monorepo catalogue, a\n   * document version for an OpenAPI input. A re-generation pins a new one, which is what makes a\n   * regenerated package's diff attributable to a specific upstream movement.\n   */\n  sourceVersion: z.string().min(1),\n});\nexport type ProviderCatalogueProvenance = z.infer<typeof ProviderCatalogueProvenanceSchema>;\n\n/**\n * Origin as ONE object with a `kind` and a provenance that is REQUIRED exactly when the kind is\n * `GENERATED` (and forbidden otherwise), enforced by the refinement below.\n *\n * Not a `z.discriminatedUnion`, deliberately: under `strictNullChecks: false` — how the engine\n * packages compile — Zod 4 infers a union-typed object key as OPTIONAL (the members' `optout`\n * collapses to `\"optional\"` once `undefined` is erased), so `metadata.origin` would type as\n * omittable in every engine consumer while the runtime refused its absence. A plain object\n * infers as required in both modes; the invariant the union expressed lives in the refinement\n * and in the `ProviderOrigin` type below.\n */\nexport const ProviderOriginSchema = z\n  .object({\n    kind: z.enum(ProviderOriginKind),\n    /** Present iff `kind === GENERATED`. */\n    catalogue: ProviderCatalogueProvenanceSchema.optional(),\n  })\n  .superRefine((origin, ctx) => {\n    if (origin.kind === ProviderOriginKind.GENERATED && origin.catalogue === undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: 'A GENERATED origin must carry its catalogue provenance.' });\n    }\n    if (origin.kind !== ProviderOriginKind.GENERATED && origin.catalogue !== undefined) {\n      ctx.addIssue({ code: 'custom', path: ['catalogue'], message: `Only a GENERATED origin carries catalogue provenance (kind is ${origin.kind}).` });\n    }\n  });\nexport type ProviderOrigin =\n  | { kind: ProviderOriginKind.ENGINE; catalogue?: undefined }\n  | { kind: ProviderOriginKind.APPLICATION; catalogue?: undefined }\n  | { kind: ProviderOriginKind.GENERATED; catalogue: ProviderCatalogueProvenance };\n\n/** The one engine origin value, so 22 modules do not each spell it. */\nexport const ENGINE_PROVIDER_ORIGIN: ProviderOrigin = Object.freeze({ kind: ProviderOriginKind.ENGINE });\n\nexport const ProviderMetadataSchema = z.object({\n  /**\n   * Stable identifier for the provider, e.g. `'resend'`, `'stripe'`,\n   * `'openai'`. Used as the join key across facet modules and as the\n   * map key inside `BackendProviderRegistry.modules`.\n   */\n  ref: z.string().min(1),\n  /**\n   * The npm package that ships this provider's module(s), e.g.\n   * `@wildo-ai/external-connectors-private` for an engine provider or\n   * `@wildo-ai/provider-slack` for a per-provider package. One package,\n   * several facet barrels — this is the package, not a barrel.\n   */\n  packageName: z.string().min(1),\n  /** See {@link ProviderTier}. A recorded decision, never inferred. */\n  tier: z.enum(ProviderTier),\n  /**\n   * Vendor grouping. Equal to `ref` for a single-package vendor; the shared\n   * name for a sub-cut vendor (`vendor: 'microsoft'` on both\n   * `microsoft-graph-mail` and `microsoft-teams`), which is what lets an\n   * OAuth client or a secret be shared by reference across sub-packages.\n   */\n  vendor: z.string().min(1),\n  /** See {@link ProviderOriginSchema}. */\n  origin: ProviderOriginSchema,\n  /**\n   * Translation-ready key for the provider display name.\n   *\n   * Frontend/public surfaces should prefer this field over embedding\n   * locale-bound copy in provider modules or runtime artifacts.\n   */\n  displayNameLabelKey: z.string().optional(),\n  /**\n   * Legacy human-readable fallback label for non-i18n-aware consumers.\n   * When absent, consumers fall back to the `ref`.\n   */\n  displayName: z.string().optional(),\n  /**\n   * Optional icon reference resolved through the frontend icon registry.\n   * Stays a string (not a URL or component reference) to keep this type\n   * frontend-safe AND portable to non-React surfaces.\n   */\n  iconRef: z.string().optional(),\n});\n\nexport type ProviderMetadata = Omit<z.infer<typeof ProviderMetadataSchema>, 'origin'> & { origin: ProviderOrigin };\n\n/**\n * The identity half of {@link ProviderMetadataSchema} on its own — what a\n * companion contribution carries so tooling can display tiers and group\n * vendors without loading a provider's runtime module.\n */\nexport const ProviderIdentitySchema = ProviderMetadataSchema.pick({\n  packageName: true,\n  tier: true,\n  vendor: true,\n  origin: true,\n});\nexport type ProviderIdentity = Omit<z.infer<typeof ProviderIdentitySchema>, 'origin'> & { origin: ProviderOrigin };\n\nexport interface DefineProviderMetadataInput {\n  ref: string;\n  packageName: string;\n  tier: ProviderTier;\n  origin: ProviderOrigin;\n  /** Defaults to `ref` — the single-package vendor case. */\n  vendor?: string;\n  displayName?: string;\n  iconRef?: string;\n}\n\n/**\n * The one way a provider module authors its metadata.\n *\n * Derives `displayNameLabelKey` from the ref (every module used to call\n * `buildProviderDisplayNameLabelKey` by hand), defaults `vendor` to the ref,\n * and parses the result so an incomplete identity fails at MODULE LOAD —\n * in the package that owns the module — rather than at the first consumer\n * that reads a field which is not there.\n */\nexport function defineProviderMetadata(input: DefineProviderMetadataInput): ProviderMetadata {\n  return ProviderMetadataSchema.parse({\n    ref: input.ref,\n    packageName: input.packageName,\n    tier: input.tier,\n    vendor: input.vendor ?? input.ref,\n    origin: input.origin,\n    displayNameLabelKey: buildProviderDisplayNameLabelKey(input.ref),\n    ...(input.displayName === undefined ? {} : { displayName: input.displayName }),\n    ...(input.iconRef === undefined ? {} : { iconRef: input.iconRef }),\n  }) as ProviderMetadata;\n}\n"]}

package/dist/esm/external-providers/provider-protocol.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-protocol.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB;;;;;IAKpC;;;OAGG;;IAEH;;;;;;OAMG;;IAEH;;;;OAIG;;;;;;;CAOK,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}
+{"version":3,"file":"provider-protocol.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB;;;;;IAKpC;;;OAGG;;IAEH;;;;;;OAMG;;IAEH;;;;OAIG;;;;;;;CAOK,CAAC;AAEX,MAAM,MAAM,uBAAuB,GACjC,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,OAAO,yBAAyB,CAAC,CAAC;AAE7E,MAAM,MAAM,gBAAgB,GAAG,uBAAuB,CAAC"}

package/dist/esm/external-providers/provider-protocol.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-protocol.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C;;;OAGG;IACH,cAAc,EAAE,gBAAgB;IAChC;;;;;;OAMG;IACH,mBAAmB,EAAE,qBAAqB;IAC1C;;;;OAIG;IACH,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,YAAY;IACxB,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC","sourcesContent":["/**\n * Closed built-in provider protocol vocabulary used by app authoring and\n * runtime-provider declarations.\n *\n * This is intentionally a pure `as const` object + union type so browser-bound\n * packages can consume it through `@wildo-ai/saas-models/public-runtime`\n * without pulling decorators or broader config-authoring seams. Do NOT add an\n * import here — not even an `import type` of the engine enum this list mirrors.\n *\n * ## Relationship to `ExternalProvider_ExchangeProtocol_Kind`\n *\n * This list re-states a population the engine owns: every member of\n * `ExternalProvider_ExchangeProtocol_Kind`\n * (`@wildo-ai/external-connectors-models`) that an application may legally\n * WRITE in `wildo.saas.config.ts > providers.scopes.<scope>.providers.<ref>`.\n * Two hand-maintained enumerations of one population is the shape that drifts,\n * and this one did: `IMAGE_PROVIDER` and `EMBEDDINGS_PROVIDER` shipped as live\n * engine protocols — a provider module declares them, discovery reports them,\n * the backend registry resolves them — while this list had no legal value for\n * either, so no application could declare what those transports speak.\n *\n * The keys are therefore checked against the engine enum by\n * `__tests__/provider-protocol-vocabulary.drift.test.ts`, which also owns the\n * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and\n * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and\n * for the exact condition under which they are admitted.\n *\n * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,\n * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,\n * declared by no provider module, resolvable by no runtime arm. An application that still\n * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts\n * ONLY these keys (the engine's snake_case wire values were also accepted before, a second\n * spelling nothing else understood).\n */\nexport const BUILTIN_PROVIDER_PROTOCOL = {\n  REST_API: 'REST_API',\n  WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',\n  LLM_PROVIDER: 'LLM_PROVIDER',\n  AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',\n  /**\n   * Text-to-image generation (wired: gpt-image, via the OpenAI provider's\n   * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.\n   */\n  IMAGE_PROVIDER: 'IMAGE_PROVIDER',\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the\n   * RAG derived-data tier — corpus embedding in the `rag:embedding-drain`\n   * worker, query-time embedding in retrieval. Its own protocol rather than an\n   * `LLM_PROVIDER` operation so a provider can be selected for embeddings\n   * independently of chat.\n   */\n  EMBEDDINGS_PROVIDER: 'EMBEDDINGS_PROVIDER',\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves file text extraction and\n   * the `.ragSource()` corpus built on it, and fills `EngineCapability.AI_DOCUMENT_EXTRACTION` so\n   * an OCR provider is selected independently of chat and embeddings.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',\n  EMAIL_PROVIDER: 'EMAIL_PROVIDER',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  BILLING_PROVIDER: 'BILLING_PROVIDER',\n  SMS_PROVIDER: 'SMS_PROVIDER',\n  FRONTEND_SDK: 'FRONTEND_SDK',\n} as const;\n\nexport type BuiltinProviderProtocol =\n  (typeof BUILTIN_PROVIDER_PROTOCOL)[keyof typeof BUILTIN_PROVIDER_PROTOCOL];\n\nexport type ProviderProtocol = BuiltinProviderProtocol;\n"]}
+{"version":3,"file":"provider-protocol.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-protocol.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE,UAAU;IACpB,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAC5B,qBAAqB,EAAE,uBAAuB;IAC9C;;;OAGG;IACH,cAAc,EAAE,gBAAgB;IAChC;;;;;;OAMG;IACH,mBAAmB,EAAE,qBAAqB;IAC1C;;;;OAIG;IACH,4BAA4B,EAAE,8BAA8B;IAC5D,cAAc,EAAE,gBAAgB;IAChC,UAAU,EAAE,YAAY;IACxB,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;CACpB,CAAC","sourcesContent":["/**\n * Closed built-in provider protocol vocabulary used by app authoring and\n * runtime-provider declarations.\n *\n * This is intentionally a pure `as const` object + union type so browser-bound\n * packages can consume it through `@wildo-ai/saas-models/public-runtime`\n * without pulling decorators or broader config-authoring seams. Do NOT add an\n * import here — not even an `import type` of the engine enum this list mirrors.\n *\n * ## Relationship to `ExternalProvider_ExchangeProtocol_Kind`\n *\n * This list re-states a population the engine owns: every member of\n * `ExternalProvider_ExchangeProtocol_Kind`\n * (`@wildo-ai/external-connectors-models`) that an application may legally\n * WRITE in `wildo.saas.config.ts > providers.scopes.<scope>.providers.<ref>`.\n * Two hand-maintained enumerations of one population is the shape that drifts,\n * and this one did: `IMAGE_PROVIDER` and `EMBEDDINGS_PROVIDER` shipped as live\n * engine protocols — a provider module declares them, discovery reports them,\n * the backend registry resolves them — while this list had no legal value for\n * either, so no application could declare what those transports speak.\n *\n * The keys are therefore checked against the engine enum by\n * `__tests__/provider-protocol-vocabulary.drift.test.ts`, which also owns the\n * documented allow-list of deliberate exclusions. **`AUDIO_PROVIDER` and\n * `VIDEO_PROVIDER` are deliberately absent** — see that file for the reason and\n * for the exact condition under which they are admitted.\n *\n * RETIRED 2026-09-05 (#327) together with the engine enum members: `MCP_CONNECTOR`,\n * `A2A_CONNECTOR`, `GIT_PROVIDER`, `GRPC`, `SSO_SAML` — authorable here, typed in the union,\n * declared by no provider module, resolvable by no runtime arm. An application that still\n * writes one is refused at config time by `ProviderProtocolSelectorSchema`, which now accepts\n * ONLY these keys (the engine's snake_case wire values were also accepted before, a second\n * spelling nothing else understood).\n */\nexport const BUILTIN_PROVIDER_PROTOCOL = {\n  REST_API: 'REST_API',\n  WEBHOOK_ORIGINATOR: 'WEBHOOK_ORIGINATOR',\n  LLM_PROVIDER: 'LLM_PROVIDER',\n  AGENT_CLIENT_PROTOCOL: 'AGENT_CLIENT_PROTOCOL',\n  /**\n   * Text-to-image generation (wired: gpt-image, via the OpenAI provider's\n   * `IMAGE_PROVIDER` transport). Serves the IMAGE artifact modality.\n   */\n  IMAGE_PROVIDER: 'IMAGE_PROVIDER',\n  /**\n   * Text → vector embeddings (wired: OpenAI `text-embedding-3-*`). Serves the\n   * RAG derived-data tier — corpus embedding in the `rag:embedding-drain`\n   * worker, query-time embedding in retrieval. Its own protocol rather than an\n   * `LLM_PROVIDER` operation so a provider can be selected for embeddings\n   * independently of chat.\n   */\n  EMBEDDINGS_PROVIDER: 'EMBEDDINGS_PROVIDER',\n  /**\n   * Document bytes → text (wired: Mistral `mistral-ocr-latest`). Serves file text extraction and\n   * the `.ragSource()` corpus built on it, and fills `EngineCapability.AI_DOCUMENT_EXTRACTION` so\n   * an OCR provider is selected independently of chat and embeddings.\n   */\n  DOCUMENT_EXTRACTION_PROVIDER: 'DOCUMENT_EXTRACTION_PROVIDER',\n  EMAIL_PROVIDER: 'EMAIL_PROVIDER',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  BILLING_PROVIDER: 'BILLING_PROVIDER',\n  SMS_PROVIDER: 'SMS_PROVIDER',\n  FRONTEND_SDK: 'FRONTEND_SDK',\n} as const;\n\nexport type BuiltinProviderProtocol =\n  (typeof BUILTIN_PROVIDER_PROTOCOL)[keyof typeof BUILTIN_PROVIDER_PROTOCOL];\n\nexport type ProviderProtocol = BuiltinProviderProtocol;\n"]}

package/dist/esm/external-providers/provider-tier-rule.shared.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-tier-rule.shared.utils.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-tier-rule.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAG7G,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,mEAAmE;AACnE,wBAAgB,8BAA8B,CAC5C,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1C,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAOvD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,GAAG,MAAM,EAAE,CAuC/F;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAOhH"}
+{"version":3,"file":"provider-tier-rule.shared.utils.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-tier-rule.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAG7G,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,mEAAmE;AACnE,wBAAgB,8BAA8B,CAC5C,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,GAC1C,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAOvD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,GAAG,MAAM,EAAE,CAuC/F;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAOhH"}

package/dist/esm/external-providers/provider-tier-rule.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-tier-rule.shared.utils.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-tier-rule.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,wCAAwC,GAEzC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAyB,MAAM,oCAAoC,CAAC;AAS7G,mEAAmE;AACnE,MAAM,UAAU,8BAA8B,CAC5C,oBAA2C;IAE3C,MAAM,KAAK,GAA0D,EAAE,CAAC;IACxE,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,wCAAwC,CAAC,UAAuC,CAAC,CAAC;QAC/F,IAAI,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA0C;IACnF,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,8FAA8F;YAC9F,UAAU,CAAC,IAAI,CAAC,uGAAuG,CAAC,CAAC;YACzH,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC9C,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,8BAA8B,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC1E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,UAAU,CAAC,IAAI,CACb,GAAG,GAAG,sEAAsE;0BACxE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,eAAe,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;0BAC5F,oFAAoF,CACzF,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvB,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,MAAM,EAAE,CAAC;oBAC9C,UAAU,CAAC,IAAI,CACb,GAAG,GAAG,0DAA0D,MAAM,CAAC,IAAI,IAAI;0BAC3E,8EAA8E,CACnF,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,YAAY,CAAC,SAAS;gBACzB,MAAM;YACR,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,SAAS,GAAU,IAAI,CAAC;gBAC9B,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,4BAA4B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB,EAAE,OAA0C;IACxG,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,oDAAoD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * The provider TIER RULE, enforced at composition on every facet (#328).\n *\n * - A `CATALOGUE` provider may claim only OPEN `ProviderCapability` tokens.\n *   It must never bind an `EngineCapability` slot: the engine's floor is\n *   the MAIN set, and a bulk-loaded integration that quietly filled the\n *   billing or email slot would make \"mandatory\" mean \"whatever happened\n *   to be installed\".\n * - A `MAIN` provider is the engine's own: its origin is `ENGINE`. An\n *   application or a generated package cannot declare itself MAIN.\n * - An `EXTENSION` provider may bind a slot through\n *   `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` — that is what the tier is for.\n *\n * Lives in `saas-models` (not in the private package) because the rule is\n * facet-neutral: the three browser-bound registries compose through it too,\n * and they reach this package only through `/public-runtime`.\n */\n\nimport {\n  PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY,\n  type EngineCapability,\n} from './engine-capabilities.shared.schemas';\nimport { ProviderOriginKind, ProviderTier, type ProviderMetadata } from './provider-metadata.shared.schemas';\nimport type { BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** What the rule needs from a module, on any facet. */\nexport interface ProviderTierRuleSubject {\n  metadata: ProviderMetadata;\n  providerCapabilities: ReadonlyArray<string>;\n}\n\n/** Engine slots a capability list binds through the closed map. */\nexport function engineSlotsBoundByCapabilities(\n  providerCapabilities: ReadonlyArray<string>,\n): Array<{ capability: string; slot: EngineCapability }> {\n  const bound: Array<{ capability: string; slot: EngineCapability }> = [];\n  for (const capability of providerCapabilities) {\n    const slot = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability as BuiltinProviderCapability];\n    if (slot !== undefined) bound.push({ capability, slot });\n  }\n  return bound;\n}\n\n/**\n * Every tier-rule violation across the given modules, as human sentences\n * naming the ref, the tier and the offending fact. Empty when coherent.\n */\nexport function findProviderTierViolations(modules: Iterable<ProviderTierRuleSubject>): string[] {\n  const violations: string[] = [];\n  for (const module of modules) {\n    if (!module.metadata) {\n      // A module with no metadata has no ref to name; refuse in words rather than with a TypeError.\n      violations.push('(module without metadata): every provider module declares ProviderMetadata via defineProviderMetadata');\n      continue;\n    }\n    const { ref, tier, origin } = module.metadata;\n    switch (tier) {\n      case ProviderTier.CATALOGUE: {\n        const bound = engineSlotsBoundByCapabilities(module.providerCapabilities);\n        if (bound.length > 0) {\n          violations.push(\n            `${ref}: tier CATALOGUE may claim only open ProviderCapability tokens, but `\n              + bound.map((entry) => `\"${entry.capability}\" binds the ${entry.slot} engine slot`).join(', ')\n              + '. Declare the provider EXTENSION if it is meant to substitute for a MAIN provider.',\n          );\n        }\n        break;\n      }\n      case ProviderTier.MAIN: {\n        if (origin.kind !== ProviderOriginKind.ENGINE) {\n          violations.push(\n            `${ref}: tier MAIN is the engine's own set, but its origin is ${origin.kind}. `\n              + 'A package or application provider that binds an engine slot is an EXTENSION.',\n          );\n        }\n        break;\n      }\n      case ProviderTier.EXTENSION:\n        break;\n      default: {\n        const unhandled: never = tier;\n        violations.push(`${ref}: unknown provider tier \"${String(unhandled)}\".`);\n      }\n    }\n  }\n  return violations;\n}\n\n/**\n * Refuse a registry whose modules break the tier rule. Called by every\n * facet's `compose*Providers` so the rule holds wherever modules meet.\n */\nexport function assertProviderTierCoherence(facetLabel: string, modules: Iterable<ProviderTierRuleSubject>): void {\n  const violations = findProviderTierViolations(modules);\n  if (violations.length > 0) {\n    throw new Error(\n      `${facetLabel} provider composition refused by the tier rule — ${violations.join('; ')}`,\n    );\n  }\n}\n"]}
+{"version":3,"file":"provider-tier-rule.shared.utils.js","sourceRoot":"","sources":["../../../src/external-providers/provider-tier-rule.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,wCAAwC,GAEzC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAyB,MAAM,oCAAoC,CAAC;AAS7G,mEAAmE;AACnE,MAAM,UAAU,8BAA8B,CAC5C,oBAA2C;IAE3C,MAAM,KAAK,GAA0D,EAAE,CAAC;IACxE,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,wCAAwC,CAAC,UAAuC,CAAC,CAAC;QAC/F,IAAI,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAA0C;IACnF,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,8FAA8F;YAC9F,UAAU,CAAC,IAAI,CAAC,uGAAuG,CAAC,CAAC;YACzH,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC9C,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,8BAA8B,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC1E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,UAAU,CAAC,IAAI,CACb,GAAG,GAAG,sEAAsE;0BACxE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,eAAe,KAAK,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;0BAC5F,oFAAoF,CACzF,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvB,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,MAAM,EAAE,CAAC;oBAC9C,UAAU,CAAC,IAAI,CACb,GAAG,GAAG,0DAA0D,MAAM,CAAC,IAAI,IAAI;0BAC3E,8EAA8E,CACnF,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,YAAY,CAAC,SAAS;gBACzB,MAAM;YACR,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,SAAS,GAAU,IAAI,CAAC;gBAC9B,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,4BAA4B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,UAAkB,EAAE,OAA0C;IACxG,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,oDAAoD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzF,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * The provider TIER RULE, enforced at composition on every facet (#328).\n *\n * - A `CATALOGUE` provider may claim only OPEN `ProviderCapability` tokens.\n *   It must never bind an `EngineCapability` slot: the engine's floor is\n *   the MAIN set, and a bulk-loaded integration that quietly filled the\n *   billing or email slot would make \"mandatory\" mean \"whatever happened\n *   to be installed\".\n * - A `MAIN` provider is the engine's own: its origin is `ENGINE`. An\n *   application or a generated package cannot declare itself MAIN.\n * - An `EXTENSION` provider may bind a slot through\n *   `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` — that is what the tier is for.\n *\n * Lives in `saas-models` (not in the private package) because the rule is\n * facet-neutral: the three browser-bound registries compose through it too,\n * and they reach this package only through `/public-runtime`.\n */\n\nimport {\n  PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY,\n  type EngineCapability,\n} from './engine-capabilities.shared.schemas';\nimport { ProviderOriginKind, ProviderTier, type ProviderMetadata } from './provider-metadata.shared.schemas';\nimport type { BuiltinProviderCapability } from './provider-capability.shared.schemas';\n\n/** What the rule needs from a module, on any facet. */\nexport interface ProviderTierRuleSubject {\n  metadata: ProviderMetadata;\n  providerCapabilities: ReadonlyArray<string>;\n}\n\n/** Engine slots a capability list binds through the closed map. */\nexport function engineSlotsBoundByCapabilities(\n  providerCapabilities: ReadonlyArray<string>,\n): Array<{ capability: string; slot: EngineCapability }> {\n  const bound: Array<{ capability: string; slot: EngineCapability }> = [];\n  for (const capability of providerCapabilities) {\n    const slot = PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY[capability as BuiltinProviderCapability];\n    if (slot !== undefined) bound.push({ capability, slot });\n  }\n  return bound;\n}\n\n/**\n * Every tier-rule violation across the given modules, as human sentences\n * naming the ref, the tier and the offending fact. Empty when coherent.\n */\nexport function findProviderTierViolations(modules: Iterable<ProviderTierRuleSubject>): string[] {\n  const violations: string[] = [];\n  for (const module of modules) {\n    if (!module.metadata) {\n      // A module with no metadata has no ref to name; refuse in words rather than with a TypeError.\n      violations.push('(module without metadata): every provider module declares ProviderMetadata via defineProviderMetadata');\n      continue;\n    }\n    const { ref, tier, origin } = module.metadata;\n    switch (tier) {\n      case ProviderTier.CATALOGUE: {\n        const bound = engineSlotsBoundByCapabilities(module.providerCapabilities);\n        if (bound.length > 0) {\n          violations.push(\n            `${ref}: tier CATALOGUE may claim only open ProviderCapability tokens, but `\n              + bound.map((entry) => `\"${entry.capability}\" binds the ${entry.slot} engine slot`).join(', ')\n              + '. Declare the provider EXTENSION if it is meant to substitute for a MAIN provider.',\n          );\n        }\n        break;\n      }\n      case ProviderTier.MAIN: {\n        if (origin.kind !== ProviderOriginKind.ENGINE) {\n          violations.push(\n            `${ref}: tier MAIN is the engine's own set, but its origin is ${origin.kind}. `\n              + 'A package or application provider that binds an engine slot is an EXTENSION.',\n          );\n        }\n        break;\n      }\n      case ProviderTier.EXTENSION:\n        break;\n      default: {\n        const unhandled: never = tier;\n        violations.push(`${ref}: unknown provider tier \"${String(unhandled)}\".`);\n      }\n    }\n  }\n  return violations;\n}\n\n/**\n * Refuse a registry whose modules break the tier rule. Called by every\n * facet's `compose*Providers` so the rule holds wherever modules meet.\n */\nexport function assertProviderTierCoherence(facetLabel: string, modules: Iterable<ProviderTierRuleSubject>): void {\n  const violations = findProviderTierViolations(modules);\n  if (violations.length > 0) {\n    throw new Error(\n      `${facetLabel} provider composition refused by the tier rule — ${violations.join('; ')}`,\n    );\n  }\n}\n"]}