@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/external-providers/external-providers.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-providers.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EACd,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,uCAAuC;IACvC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAElE,oDAAoD;IACpD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjE,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,4EAA4E;IAC5E,kBAAkB,EAAE,+BAA+B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,MAAM,EAAE,EACV,qCAAqC,CACtC,CAAC;AAGF,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAEpB,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,8CAA8C;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;IAE9D,8CAA8C;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,mCAAmC;IACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,MAAM,EAAE,EACV,iCAAiC,CAClC,CAAC","sourcesContent":["/**\n * External Providers Shared Schemas\n *\n * Provides application-level registry schemas for external providers.\n * OAuth2 configurations are defined per-provider in @wildo-ai/external-connectors-models.\n */\n\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  OAuth2_Purpose,\n  OAuth2_ProviderDefinitionSchema,\n} from \"@wildo-ai/external-connectors-models\";\nimport { z } from \"zod\";\nimport { EngineCapability } from \"./engine-capabilities.shared.schemas\";\n\n// =============================================================================\n// EXTERNAL PROVIDERS REGISTRY\n// =============================================================================\n\n/**\n * External Providers Registry Item\n * Defines what protocols and capabilities a provider supports\n *\n * Note: This is a COMPUTED structure populated from:\n * - BackendProviderModule.providerCapabilities (what provider actually supports)\n * - Materialized provider scope selection (what capabilities are assigned to this provider)\n * - Capability requirements validation\n */\nexport const External_Providers_RegistryItemSchema = z.object({\n  /** Reference to the provider (string identifier) */\n  providerRef: z.string(),\n\n  /** Protocols this provider supports */\n  protocols: z.array(z.enum(ExternalProvider_ExchangeProtocol_Kind)),\n\n  /** Engine capabilities enabled for this provider */\n  engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n\n  /** Does this provider support OAuth2? */\n  supportsOAuth2: z.boolean().optional(),\n\n  /** Custom OAuth2 configuration (if needed to override provider defaults) */\n  customOAuth2Config: OAuth2_ProviderDefinitionSchema.partial().optional(),\n});\nexport type External_Providers_RegistryItem = z.infer<typeof External_Providers_RegistryItemSchema>;\n\n/**\n * External Providers Registry\n * Maps provider references to their configurations\n */\nexport const External_Providers_Registry_Schema = z.record(\n  z.string(),\n  External_Providers_RegistryItemSchema\n);\nexport type External_Providers_Registry = z.infer<typeof External_Providers_Registry_Schema>;\n\n// =============================================================================\n// OAUTH2 ENABLED PROVIDERS CONFIGURATION\n// =============================================================================\n\n/**\n * OAuth2 Enabled Provider Configuration\n * For configuring OAuth2 providers at the application level\n *\n * Note: OAuth2 protocol definitions are in each provider folder in external-connectors.\n * This schema is for application-level enabling/customization of OAuth2 providers.\n */\nexport const OAuth2EnabledProviderConfigSchema = z.object({\n  /** Provider reference (string identifier) */\n  provider: z.string(),\n\n  /** Is this provider enabled? */\n  enabled: z.boolean().default(true),\n\n  /** Allowed email domains for this provider */\n  allowedDomains: z.array(z.string()).optional(),\n\n  /** Purpose: SSO only, API only, or both */\n  purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.HYBRID),\n\n  /** Custom display name (overrides default) */\n  displayName: z.string().optional(),\n\n  /** Custom icon URL (overrides default) */\n  iconUrl: z.url().optional(),\n\n  /** Additional scopes to request */\n  additionalScopes: z.array(z.string()).optional(),\n});\nexport type OAuth2EnabledProviderConfig = z.infer<typeof OAuth2EnabledProviderConfigSchema>;\n\n/**\n * OAuth2 Providers Configuration Map\n * Application-level configuration for all enabled OAuth2 providers\n */\nexport const OAuth2ProvidersConfigSchema = z.record(\n  z.string(),\n  OAuth2EnabledProviderConfigSchema\n);\nexport type OAuth2ProvidersConfig = z.infer<typeof OAuth2ProvidersConfigSchema>;\n"]}
+{"version":3,"file":"external-providers.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/external-providers.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,sCAAsC,EACtC,cAAc,EACd,+BAA+B,GAChC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AAExE,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,oDAAoD;IACpD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvB,uCAAuC;IACvC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAElE,oDAAoD;IACpD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAEjE,yCAAyC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC,4EAA4E;IAC5E,kBAAkB,EAAE,+BAA+B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CACxD,CAAC,CAAC,MAAM,EAAE,EACV,qCAAqC,CACtC,CAAC;AAGF,gFAAgF;AAChF,yCAAyC;AACzC,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,6CAA6C;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAEpB,gCAAgC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElC,8CAA8C;IAC9C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE9C,2CAA2C;IAC3C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;IAE9D,8CAA8C;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAElC,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAE3B,mCAAmC;IACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEhD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpD,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,MAAM,EAAE,EACV,iCAAiC,CAClC,CAAC","sourcesContent":["/**\n * External Providers Shared Schemas\n *\n * Provides application-level registry schemas for external providers.\n * OAuth2 configurations are defined per-provider in @wildo-ai/external-connectors-models.\n */\n\nimport {\n  ExternalProvider_ExchangeProtocol_Kind,\n  OAuth2_Purpose,\n  OAuth2_ProviderDefinitionSchema,\n} from \"@wildo-ai/external-connectors-models\";\nimport { z } from \"zod\";\nimport { EngineCapability } from \"./engine-capabilities.shared.schemas\";\n\n// =============================================================================\n// EXTERNAL PROVIDERS REGISTRY\n// =============================================================================\n\n/**\n * External Providers Registry Item\n * Defines what protocols and capabilities a provider supports\n *\n * Note: This is a COMPUTED structure populated from:\n * - BackendProviderModule.providerCapabilities (what provider actually supports)\n * - Materialized provider scope selection (what capabilities are assigned to this provider)\n * - Capability requirements validation\n */\nexport const External_Providers_RegistryItemSchema = z.object({\n  /** Reference to the provider (string identifier) */\n  providerRef: z.string(),\n\n  /** Protocols this provider supports */\n  protocols: z.array(z.enum(ExternalProvider_ExchangeProtocol_Kind)),\n\n  /** Engine capabilities enabled for this provider */\n  engineCapabilities: z.array(z.enum(EngineCapability)).default([]),\n\n  /** Does this provider support OAuth2? */\n  supportsOAuth2: z.boolean().optional(),\n\n  /** Custom OAuth2 configuration (if needed to override provider defaults) */\n  customOAuth2Config: OAuth2_ProviderDefinitionSchema.partial().optional(),\n});\nexport type External_Providers_RegistryItem = z.infer<typeof External_Providers_RegistryItemSchema>;\n\n/**\n * External Providers Registry\n * Maps provider references to their configurations\n */\nexport const External_Providers_Registry_Schema = z.record(\n  z.string(),\n  External_Providers_RegistryItemSchema\n);\nexport type External_Providers_Registry = z.infer<typeof External_Providers_Registry_Schema>;\n\n// =============================================================================\n// OAUTH2 ENABLED PROVIDERS CONFIGURATION\n// =============================================================================\n\n/**\n * OAuth2 Enabled Provider Configuration\n * For configuring OAuth2 providers at the application level\n *\n * Note: OAuth2 protocol definitions are in each provider folder in external-connectors.\n * This schema is for application-level enabling/customization of OAuth2 providers.\n */\nexport const OAuth2EnabledProviderConfigSchema = z.object({\n  /** Provider reference (string identifier) */\n  provider: z.string(),\n\n  /** Is this provider enabled? */\n  enabled: z.boolean().default(true),\n\n  /** Allowed email domains for this provider */\n  allowedDomains: z.array(z.string()).optional(),\n\n  /** Purpose: SSO only, API only, or both */\n  purpose: z.enum(OAuth2_Purpose).default(OAuth2_Purpose.HYBRID),\n\n  /** Custom display name (overrides default) */\n  displayName: z.string().optional(),\n\n  /** Custom icon URL (overrides default) */\n  iconUrl: z.url().optional(),\n\n  /** Additional scopes to request */\n  additionalScopes: z.array(z.string()).optional(),\n\n  /**\n   * May an account re-prove who it is through this identity provider (#1441)?\n   *\n   * When on, an account whose link to this provider is an OIDC link can answer a re-authentication\n   * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in\n   * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`\n   * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the\n   * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is\n   * refused, never trusted.\n   *\n   * OFF by default, and it should be switched on only for a provider that honours those parameters.\n   * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`\n   * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value\n   * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security\n   * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.\n   * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from\n   * https://openid.net/specs/openid-connect-core-1_0.html\n   * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched\n   * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect\n   */\n  reAuthenticationEnabled: z.boolean().default(false),\n});\nexport type OAuth2EnabledProviderConfig = z.infer<typeof OAuth2EnabledProviderConfigSchema>;\n\n/**\n * OAuth2 Providers Configuration Map\n * Application-level configuration for all enabled OAuth2 providers\n */\nexport const OAuth2ProvidersConfigSchema = z.record(\n  z.string(),\n  OAuth2EnabledProviderConfigSchema\n);\nexport type OAuth2ProvidersConfig = z.infer<typeof OAuth2ProvidersConfigSchema>;\n"]}

package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.d.ts

@@ -50,7 +50,13 @@ export declare const FrontendAppBootstrapPayloadSchema: z.ZodObject<{
                 selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
             }, z.core.$strict>>>;
             publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            fileStorage: z.ZodOptional<z.ZodEnum<typeof import("@wildo-ai/zod-decorators").FileStorageAccepted>>;
+            fileStorage: z.ZodOptional<z.ZodEnum<{
+                readonly WILDO_MANAGED: "wildo_managed";
+                readonly LOCAL_DIRECTORY: "local_directory";
+                readonly ONEDRIVE: "onedrive";
+                readonly GOOGLE_DRIVE: "google_drive";
+                readonly DROPBOX: "dropbox";
+            }>>;
         }, z.core.$loose>>>;
     }, z.core.$strip>;
 }, z.core.$strip>;
@@ -70,11 +76,11 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
         applicationId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     brandAssets: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        composition: z.ZodEnum<typeof import("..").BrandAssetComposition>;
-        theme: z.ZodEnum<typeof import("..").BrandAssetTheme>;
-        purpose: z.ZodEnum<typeof import("..").BrandAssetPurpose>;
+        composition: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").BrandAssetComposition>>;
+        theme: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").BrandAssetTheme>>;
+        purpose: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").BrandAssetPurpose>>;
         url: z.ZodString;
-        format: z.ZodEnum<typeof import("..").BrandAssetFormat>;
+        format: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").BrandAssetFormat>>;
         width: z.ZodOptional<z.ZodNumber>;
         height: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>>;
@@ -115,6 +121,7 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
                 enabled: z.ZodBoolean;
             }, z.core.$strip>]>>>;
             mfaPolicy: z.ZodDefault<z.ZodObject<{
+                externalAssuranceEnforcement: z.ZodOptional<z.ZodEnum<typeof import("./provider-authentication-assurance.shared.schemas").ExternalAssuranceEnforcement>>;
                 requireMFA: z.ZodDefault<z.ZodBoolean>;
                 requireStrongMFA: z.ZodDefault<z.ZodBoolean>;
                 acceptableMFAMethods: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof import("..").AuthMethod>>>;
@@ -126,6 +133,18 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
                 allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").AuthMethod>>>;
                 emailVerification: z.ZodDefault<z.ZodEnum<typeof import("..").EmailVerificationMode>>;
                 blockForSSODomains: z.ZodDefault<z.ZodBoolean>;
+                allowedEmailDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                additionalProfileQuestions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    id: z.ZodString;
+                    ref: z.ZodOptional<z.ZodString>;
+                    type: z.ZodEnum<typeof import("..").OnboardingSurveyQuestionType>;
+                    options: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                        ref: z.ZodString;
+                    }, z.core.$strip>>>;
+                    required: z.ZodDefault<z.ZodBoolean>;
+                    bindToField: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>>;
+                profileNamesCollectedAt: z.ZodOptional<z.ZodEnum<typeof import("..").ProfileNamesCollectionMoment>>;
             }, z.core.$strict>;
             passwordPolicy: z.ZodDefault<z.ZodObject<{
                 minLength: z.ZodDefault<z.ZodNumber>;
@@ -158,7 +177,6 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
             oneOffSessionAllowed: z.ZodOptional<z.ZodBoolean>;
             oneOffSessionMaxDurationMinutes: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strip>;
-        uniqueIdentifier: z.ZodDefault<z.ZodString>;
         defaultAppRoles: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<typeof import("..").CORE_APP_ROLES>, z.ZodString]>>>;
         requiresOrgMembership: z.ZodOptional<z.ZodObject<{
             orgTypes: z.ZodArray<z.ZodString>;
@@ -181,6 +199,7 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
                 enabled: z.ZodBoolean;
             }, z.core.$strip>]>>>;
             mfaPolicy: z.ZodOptional<z.ZodObject<{
+                externalAssuranceEnforcement: z.ZodOptional<z.ZodOptional<z.ZodEnum<typeof import("./provider-authentication-assurance.shared.schemas").ExternalAssuranceEnforcement>>>;
                 requireMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
                 requireStrongMFA: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
                 acceptableMFAMethods: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodEnum<typeof import("..").AuthMethod>>>>;
@@ -204,18 +223,112 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
         }, z.core.$strip>>;
         scimProvisioning: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
-            syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
         creationPolicy: z.ZodOptional<z.ZodObject<{
             createOnUserTypeRegistration: z.ZodArray<z.ZodString>;
             orgNameSource: z.ZodEnum<typeof import("..").OrganizationNameSource>;
             defaultOwnerRole: z.ZodDefault<z.ZodString>;
         }, z.core.$strip>>;
+        ownsApplication: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strip>>>;
     compliance: z.ZodObject<{
         userProfileVisibility: z.ZodDefault<z.ZodEnum<typeof import("..").UserProfileVisibility>>;
         organizationProfileVisibility: z.ZodDefault<z.ZodEnum<typeof import("..").OrganizationProfileVisibility>>;
         clientInstanceIdScope: z.ZodDefault<z.ZodEnum<typeof import("..").ClientInstanceIdScope>>;
+        governedDocumentReleases: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            identity: z.ZodObject<{
+                document: z.ZodObject<{
+                    documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    documentVersion: z.ZodNumber;
+                }, z.core.$strict>;
+                releaseId: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                releaseVersion: z.ZodNumber;
+            }, z.core.$strict>;
+            documentClass: z.ZodEnum<typeof import("..").GovernedDocumentClass>;
+            locale: z.ZodString;
+            jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+            allowedInteractionKinds: z.ZodArray<z.ZodEnum<typeof import("..").GovernedDocumentInteractionKind>>;
+            approvalState: z.ZodEnum<typeof import("..").GovernedDocumentReleaseApprovalState>;
+            effectiveAt: z.ZodISODateTime;
+            expiresAt: z.ZodOptional<z.ZodISODateTime>;
+            renewedInteractionKinds: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").GovernedDocumentInteractionKind>>>;
+        }, z.core.$strict>>>;
+        publicDocuments: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            kind: z.ZodLiteral<import("..").GovernedDocumentPublicDocumentKind.RELEASED>;
+            release: z.ZodObject<{
+                schemaVersion: z.ZodLiteral<1>;
+                identity: z.ZodObject<{
+                    document: z.ZodObject<{
+                        documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                        documentVersion: z.ZodNumber;
+                    }, z.core.$strict>;
+                    releaseId: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    releaseVersion: z.ZodNumber;
+                }, z.core.$strict>;
+                definition: z.ZodObject<{
+                    definitionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    definitionVersion: z.ZodNumber;
+                }, z.core.$strict>;
+                documentClass: z.ZodEnum<typeof import("..").GovernedDocumentClass>;
+                locale: z.ZodString;
+                jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+                contentMediaType: z.ZodLiteral<"application/vnd.wildo.governed-document.public+json;version=1">;
+                issuedAt: z.ZodISODateTime;
+                effectiveAt: z.ZodISODateTime;
+                expiresAt: z.ZodOptional<z.ZodISODateTime>;
+                allowedInteractionKinds: z.ZodArray<z.ZodEnum<typeof import("..").GovernedDocumentInteractionKind>>;
+            }, z.core.$strict>;
+            content: z.ZodObject<{
+                schemaVersion: z.ZodLiteral<1>;
+                title: z.ZodString;
+                locale: z.ZodString;
+                jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+                sections: z.ZodArray<z.ZodObject<{
+                    sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    order: z.ZodNumber;
+                    title: z.ZodString;
+                    clauses: z.ZodArray<z.ZodObject<{
+                        clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                        order: z.ZodNumber;
+                        bodyMarkdown: z.ZodString;
+                        standing: z.ZodEnum<typeof import("..").GovernedDocumentPublicClauseStanding>;
+                        missingInformation: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            approvalState: z.ZodEnum<typeof import("..").GovernedDocumentReleaseApprovalState>;
+        }, z.core.$strict>, z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            kind: z.ZodLiteral<import("..").GovernedDocumentPublicDocumentKind.UNRELEASED_DRAFT>;
+            documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            content: z.ZodObject<{
+                schemaVersion: z.ZodLiteral<1>;
+                title: z.ZodString;
+                locale: z.ZodString;
+                jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+                sections: z.ZodArray<z.ZodObject<{
+                    sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                    order: z.ZodNumber;
+                    title: z.ZodString;
+                    clauses: z.ZodArray<z.ZodObject<{
+                        clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                        order: z.ZodNumber;
+                        bodyMarkdown: z.ZodString;
+                        standing: z.ZodEnum<typeof import("..").GovernedDocumentPublicClauseStanding>;
+                        missingInformation: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "kind">>>;
+        governedDocumentAcceptanceMode: z.ZodDefault<z.ZodEnum<typeof import("..").GovernedDocumentAcceptanceMode>>;
+        governedDocumentApprovalGate: z.ZodDefault<z.ZodEnum<typeof import("..").GovernedDocumentApprovalGate>>;
+        serviceConsentRequirement: z.ZodOptional<z.ZodObject<{
+            requiredPurposes: z.ZodArray<z.ZodEnum<typeof import("..").ConsentPurpose>>;
+            gatedProcessing: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        capabilityDeclaredConsentPurposes: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").ConsentPurpose>>>;
     }, z.core.$strip>;
     billing: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -248,7 +361,7 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
             providerType: z.ZodEnum<typeof import("..").AnalyticsProviderType>;
             config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         }, z.core.$strip>>>;
-        requiredConsent: z.ZodDefault<z.ZodEnum<typeof import("..").DataProcessingConsent>>;
+        requiresConsent: z.ZodDefault<z.ZodBoolean>;
         valueMoments: z.ZodOptional<z.ZodArray<z.ZodObject<{
             identifier: z.ZodString;
             role: z.ZodEnum<typeof import("..").ValueMomentRole>;
@@ -340,6 +453,7 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
         runRetentionDays: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
     auditTrail: z.ZodOptional<z.ZodObject<{
+        applicationReadAccess: z.ZodOptional<z.ZodEnum<typeof import("..").AuditApplicationReadAccess>>;
         archiveAfterDays: z.ZodOptional<z.ZodNumber>;
         allowPrivateNetworkSiemCollectors: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
@@ -392,7 +506,13 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
                 selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
             }, z.core.$strict>>>;
             publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            fileStorage: z.ZodOptional<z.ZodEnum<typeof import("@wildo-ai/zod-decorators").FileStorageAccepted>>;
+            fileStorage: z.ZodOptional<z.ZodEnum<{
+                readonly WILDO_MANAGED: "wildo_managed";
+                readonly LOCAL_DIRECTORY: "local_directory";
+                readonly ONEDRIVE: "onedrive";
+                readonly GOOGLE_DRIVE: "google_drive";
+                readonly DROPBOX: "dropbox";
+            }>>;
         }, z.core.$loose>>>;
     }, z.core.$strip>;
 }, z.core.$strip>;

package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-bootstrap.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1D,CAAC;AACL,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC9D,OAAO,iDAAiD,CACzD,CAAC"}
+{"version":3,"file":"frontend-bootstrap.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1D,CAAC;AACL,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC9D,OAAO,iDAAiD,CACzD,CAAC"}

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.d.ts

@@ -56,4 +56,118 @@ export declare const FrontendFilePickerPublicConfigSchema: z.ZodObject<{
     maxSelectionCount: z.ZodOptional<z.ZodNumber>;
 }, z.core.$loose>;
 export type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;
+/**
+ * Every built-in capability that owns public-config keys, and the schema that
+ * owns them.
+ *
+ * A MAP rather than a list of keys, so the keys are derived from the schema that
+ * validates them and the two cannot disagree. Adding a capability's shape here
+ * is the ONE edit that makes its keys admissible everywhere — the admission,
+ * the refusal message and the validation all read this map.
+ *
+ * A capability absent from this map owns no public-config keys, which is the
+ * common case and needs no entry.
+ */
+export declare const FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS: Readonly<Record<string, z.ZodObject>>;
+/**
+ * The public-config keys a provider admits BY VIRTUE OF the capabilities it
+ * claims, beside whatever its own `publicConfigSchema` declares.
+ *
+ * ## Why this exists — measured 2026-09-18 (#380)
+ *
+ * `FrontendFilePickerPublicConfigSchema` declares the constraint vocabulary the
+ * FRAMEWORK reads off a picker (`acceptedMimeTypes`, `maxFileSizeMb`,
+ * `maxSelectionCount`), and `resolveFormFieldFileProviderConstraints` reads it.
+ * Three separate gates refused it, because each asked only what the PROVIDER
+ * declares:
+ *
+ * - the config overlay THREW `UNDECLARED_KEY` — *"a key the provider never reads
+ *   would be served to every browser and used by nothing"*, which is false here:
+ *   the framework reads it, for that provider, because it claims the capability;
+ * - hydration answered `unknown key` and set the provider's code to `undefined`,
+ *   so declaring a size limit DELETED the picker;
+ * - and the resolver then found nothing, because nothing had been allowed through.
+ *
+ * All three engine pickers declare a `publicConfigSchema` (`appId`, `clientId`,
+ * `appKey`), so the capability's whole vocabulary was unusable on every one of
+ * them. It worked only on an application-authored picker that declares NO
+ * schema, where the first gate is skipped — which is why the dogfood never saw it.
+ *
+ * The capability schema's own docstring asked a provider to *"EXTEND the schema
+ * for the capability it claims"*, and no affordance to do that existed. This is
+ * the affordance, DERIVED instead: a provider claiming `FRONTEND_FILE_PICKER`
+ * admits the file-picker keys with no edit to the provider, so a capability
+ * shape added tomorrow reaches every provider claiming it and none that does not.
+ */
+export declare function frontendCapabilityPublicConfigKeys(providerCapabilities: readonly string[] | undefined): readonly string[];
+/**
+ * Splits a public-config bag into the half the CAPABILITIES own and the half the
+ * provider's own schema must answer for, validating the first here.
+ *
+ * Returning the two halves rather than one merged bag is what lets a caller run
+ * the provider's schema over exactly the keys it declared — a strict provider
+ * schema would otherwise refuse the capability's keys, which is the defect this
+ * whole mechanism exists to remove.
+ */
+export declare function partitionFrontendCapabilityPublicConfig(input: {
+    readonly providerCapabilities: readonly string[] | undefined;
+    readonly publicConfig: Readonly<Record<string, unknown>>;
+}): {
+    readonly capabilityConfig: Readonly<Record<string, unknown>>;
+    readonly providerConfig: Readonly<Record<string, unknown>>;
+    readonly issues: ReadonlyArray<{
+        readonly message: string;
+        readonly path: readonly PropertyKey[];
+    }>;
+};
+/**
+ * The full set of public-config keys a provider admits: what its own schema
+ * declares, UNION what the capabilities it claims own.
+ *
+ * `undefined` in, `undefined` out — and that is load-bearing. A provider with no
+ * introspectable schema cannot be held to a key list at all, and widening
+ * `undefined` to the capability keys would turn "cannot enforce here" into
+ * "declares exactly these", refusing every vendor key such a provider reads.
+ *
+ * It lives beside the capability map rather than beside
+ * `readDeclaredPublicConfigKeys`, because that module is deliberately
+ * dependency-free so a provider module can declare a schema without pulling a
+ * validation library in.
+ */
+export declare function admissibleFrontendPublicConfigKeys(input: {
+    readonly declaredKeys: readonly string[] | undefined;
+    readonly providerCapabilities: readonly string[] | undefined;
+}): readonly string[] | undefined;
+/**
+ * Lays ONE provider's declared picker limits under the field's own, for that
+ * provider's picker and no other.
+ *
+ * ## Why this is per-provider and not resolved once (#380)
+ *
+ * The field used to resolve its picker constraints from the FIRST provider the
+ * registry returned for `FRONTEND_FILE_PICKER`, and pass that single object to
+ * whichever picker the person then chose — so a Drive limit governed a Dropbox
+ * pick, and which provider won depended on registry order. `ProviderFilePickerHost`
+ * was built so "a framework that picked one would be making a product decision in
+ * a lookup table"; the constraints were still making exactly that decision, one
+ * layer up, and it became reachable the moment a third picker shipped.
+ *
+ * It also reached the field's OWN native upload, which is wrong at any number of
+ * providers: a vendor's picker limit says nothing about a local file going to the
+ * field's own storage.
+ *
+ * Precedence is unchanged and is the part that must not move: the field's Zod
+ * metadata ALWAYS wins, and a provider only fills the gaps the schema left open.
+ * `maxSelectionCount` applies only to a `multiple` field — a single-file field
+ * never inherits a selection count.
+ */
+export declare function layerProviderFilePickerConstraints<TConstraints extends {
+    readonly allowedMimeTypes?: readonly string[];
+    readonly maxSize?: number;
+    readonly maxFiles?: number;
+}>(input: {
+    readonly base: TConstraints;
+    readonly multiple: boolean;
+    readonly publicConfig: Readonly<Record<string, unknown>> | undefined;
+}): TConstraints;
 //# sourceMappingURL=frontend-capability-public-config.shared.schemas.d.ts.map

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-public-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC;IAC/C;;;;;;;;;OASG;;IAKH;;;;;;OAMG;;IAEH,mFAAmF;;iBAEnF,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}
+{"version":3,"file":"frontend-capability-public-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC;IAC/C;;;;;;;;;OASG;;IAKH;;;;;;OAMG;;IAEH,mFAAmF;;iBAEnF,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAE1F,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAClD,SAAS,MAAM,EAAE,CASnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CAAC,KAAK,EAAE;IAC7D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1D,GAAG;IACF,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAA;KAAE,CAAC,CAAC;CACrG,CA0BA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9D,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAGhC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kCAAkC,CAChD,YAAY,SAAS;IACnB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,EACD,KAAK,EAAE;IACP,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACtE,GAAG,YAAY,CAcf"}

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.js

@@ -58,4 +58,152 @@ export const FrontendFilePickerPublicConfigSchema = z.looseObject({
     /** How many files one selection may return. Applies only to a `multiple` field. */
     maxSelectionCount: z.number().int().positive().optional(),
 });
+/**
+ * Every built-in capability that owns public-config keys, and the schema that
+ * owns them.
+ *
+ * A MAP rather than a list of keys, so the keys are derived from the schema that
+ * validates them and the two cannot disagree. Adding a capability's shape here
+ * is the ONE edit that makes its keys admissible everywhere — the admission,
+ * the refusal message and the validation all read this map.
+ *
+ * A capability absent from this map owns no public-config keys, which is the
+ * common case and needs no entry.
+ */
+export const FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS = Object.freeze({
+    FRONTEND_FILE_PICKER: FrontendFilePickerPublicConfigSchema,
+});
+/**
+ * The public-config keys a provider admits BY VIRTUE OF the capabilities it
+ * claims, beside whatever its own `publicConfigSchema` declares.
+ *
+ * ## Why this exists — measured 2026-09-18 (#380)
+ *
+ * `FrontendFilePickerPublicConfigSchema` declares the constraint vocabulary the
+ * FRAMEWORK reads off a picker (`acceptedMimeTypes`, `maxFileSizeMb`,
+ * `maxSelectionCount`), and `resolveFormFieldFileProviderConstraints` reads it.
+ * Three separate gates refused it, because each asked only what the PROVIDER
+ * declares:
+ *
+ * - the config overlay THREW `UNDECLARED_KEY` — *"a key the provider never reads
+ *   would be served to every browser and used by nothing"*, which is false here:
+ *   the framework reads it, for that provider, because it claims the capability;
+ * - hydration answered `unknown key` and set the provider's code to `undefined`,
+ *   so declaring a size limit DELETED the picker;
+ * - and the resolver then found nothing, because nothing had been allowed through.
+ *
+ * All three engine pickers declare a `publicConfigSchema` (`appId`, `clientId`,
+ * `appKey`), so the capability's whole vocabulary was unusable on every one of
+ * them. It worked only on an application-authored picker that declares NO
+ * schema, where the first gate is skipped — which is why the dogfood never saw it.
+ *
+ * The capability schema's own docstring asked a provider to *"EXTEND the schema
+ * for the capability it claims"*, and no affordance to do that existed. This is
+ * the affordance, DERIVED instead: a provider claiming `FRONTEND_FILE_PICKER`
+ * admits the file-picker keys with no edit to the provider, so a capability
+ * shape added tomorrow reaches every provider claiming it and none that does not.
+ */
+export function frontendCapabilityPublicConfigKeys(providerCapabilities) {
+    if (providerCapabilities === undefined)
+        return [];
+    const keys = new Set();
+    for (const capability of providerCapabilities) {
+        const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];
+        if (schema === undefined)
+            continue;
+        for (const key of Object.keys(schema.shape))
+            keys.add(key);
+    }
+    return [...keys];
+}
+/**
+ * Splits a public-config bag into the half the CAPABILITIES own and the half the
+ * provider's own schema must answer for, validating the first here.
+ *
+ * Returning the two halves rather than one merged bag is what lets a caller run
+ * the provider's schema over exactly the keys it declared — a strict provider
+ * schema would otherwise refuse the capability's keys, which is the defect this
+ * whole mechanism exists to remove.
+ */
+export function partitionFrontendCapabilityPublicConfig(input) {
+    const owned = new Set(frontendCapabilityPublicConfigKeys(input.providerCapabilities));
+    const capabilityConfig = {};
+    const providerConfig = {};
+    for (const [key, value] of Object.entries(input.publicConfig)) {
+        (owned.has(key) ? capabilityConfig : providerConfig)[key] = value;
+    }
+    const issues = [];
+    for (const capability of input.providerCapabilities ?? []) {
+        const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];
+        if (schema === undefined)
+            continue;
+        // Only the keys this capability owns: a loose schema would otherwise re-admit
+        // the provider's own keys and report nothing about them, which is correct but
+        // makes the partition pointless.
+        const subject = Object.fromEntries(Object.entries(capabilityConfig).filter(([key]) => key in schema.shape));
+        const parsed = schema.safeParse(subject);
+        if (parsed.success)
+            continue;
+        for (const issue of parsed.error.issues) {
+            issues.push({ message: issue.message, path: issue.path });
+        }
+    }
+    return { capabilityConfig, providerConfig, issues };
+}
+/**
+ * The full set of public-config keys a provider admits: what its own schema
+ * declares, UNION what the capabilities it claims own.
+ *
+ * `undefined` in, `undefined` out — and that is load-bearing. A provider with no
+ * introspectable schema cannot be held to a key list at all, and widening
+ * `undefined` to the capability keys would turn "cannot enforce here" into
+ * "declares exactly these", refusing every vendor key such a provider reads.
+ *
+ * It lives beside the capability map rather than beside
+ * `readDeclaredPublicConfigKeys`, because that module is deliberately
+ * dependency-free so a provider module can declare a schema without pulling a
+ * validation library in.
+ */
+export function admissibleFrontendPublicConfigKeys(input) {
+    if (input.declaredKeys === undefined)
+        return undefined;
+    return [...new Set([...input.declaredKeys, ...frontendCapabilityPublicConfigKeys(input.providerCapabilities)])];
+}
+/**
+ * Lays ONE provider's declared picker limits under the field's own, for that
+ * provider's picker and no other.
+ *
+ * ## Why this is per-provider and not resolved once (#380)
+ *
+ * The field used to resolve its picker constraints from the FIRST provider the
+ * registry returned for `FRONTEND_FILE_PICKER`, and pass that single object to
+ * whichever picker the person then chose — so a Drive limit governed a Dropbox
+ * pick, and which provider won depended on registry order. `ProviderFilePickerHost`
+ * was built so "a framework that picked one would be making a product decision in
+ * a lookup table"; the constraints were still making exactly that decision, one
+ * layer up, and it became reachable the moment a third picker shipped.
+ *
+ * It also reached the field's OWN native upload, which is wrong at any number of
+ * providers: a vendor's picker limit says nothing about a local file going to the
+ * field's own storage.
+ *
+ * Precedence is unchanged and is the part that must not move: the field's Zod
+ * metadata ALWAYS wins, and a provider only fills the gaps the schema left open.
+ * `maxSelectionCount` applies only to a `multiple` field — a single-file field
+ * never inherits a selection count.
+ */
+export function layerProviderFilePickerConstraints(input) {
+    const parsed = FrontendFilePickerPublicConfigSchema.safeParse(input.publicConfig ?? {});
+    // A provider whose own values are wrong contributes NOTHING rather than
+    // nonsense — the same choice the three hand readers this replaced could not
+    // make, because a bad value was indistinguishable from an absent one.
+    const declared = parsed.success ? parsed.data : {};
+    const maxSizeMb = declared.maxFileSizeMb;
+    return {
+        ...input.base,
+        allowedMimeTypes: input.base.allowedMimeTypes ?? declared.acceptedMimeTypes,
+        maxSize: input.base.maxSize ?? (maxSizeMb === undefined ? undefined : maxSizeMb * 1024 * 1024),
+        maxFiles: input.multiple ? (input.base.maxFiles ?? declared.maxSelectionCount) : input.base.maxFiles,
+    };
+}
 //# sourceMappingURL=frontend-capability-public-config.shared.schemas.js.map

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-public-config.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,WAAW,CAAC;IAChE;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC","sourcesContent":["/**\n * The public-config shape a BUILT-IN frontend capability expects, as a named\n * schema rather than a convention.\n *\n * ## Why the capability owns this and not each provider\n *\n * `publicConfig` is `Record<string, unknown>`, so every consuming site was\n * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter\n * for strings, a Mb-to-bytes multiplication — and a renamed key produced\n * `undefined` and a silently wrong picker rather than an error. The keys were a\n * convention nobody had written down, which is the whole defect: three ad-hoc\n * readers agreeing by luck.\n *\n * What a FILE PICKER's constraints mean is framework knowledge — the framework\n * is what applies them to its own file fields — so the shape belongs to the\n * CAPABILITY. A provider is free to carry its own keys beside these (a client\n * id, an app key); it is not free to invent a different spelling of the ones\n * the framework reads, and now it cannot.\n *\n * A provider declaring `publicConfigSchema` should EXTEND the schema for the\n * capability it claims, so hydration validates the framework's fields and its\n * own in one pass.\n */\n\nimport { z } from 'zod';\n\n/**\n * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.\n *\n * Every field is optional: a provider that constrains nothing is legitimate,\n * and the field's own Zod file metadata always wins anyway — a provider only\n * fills the gaps the schema left open.\n *\n * LOOSE, because a provider's own keys live in the same object and must survive\n * a parse that is only looking for these.\n */\nexport const FrontendFilePickerPublicConfigSchema = z.looseObject({\n  /**\n   * MIME types the picker can return.\n   *\n   * An EMPTY list is normalized to absent, and that is behaviour rather than\n   * decoration: the framework turns this into an `accept=` attribute, and an\n   * empty `accept=\"\"` does not mean \"anything\" — it means the file dialog\n   * offers nothing. A provider that declares no types is unconstrained, so the\n   * normalization happens here, once, instead of at each reader that would have\n   * to remember it.\n   */\n  acceptedMimeTypes: z\n    .array(z.string().min(1))\n    .optional()\n    .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),\n  /**\n   * Largest file the picker will hand back, in MEGABYTES.\n   *\n   * The unit is in the name because the framework's own constraint is in BYTES\n   * and the conversion is the kind of thing that is wrong by a factor of 1024²\n   * exactly once, silently, in production.\n   */\n  maxFileSizeMb: z.number().positive().optional(),\n  /** How many files one selection may return. Applies only to a `multiple` field. */\n  maxSelectionCount: z.number().int().positive().optional(),\n});\nexport type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;\n"]}
+{"version":3,"file":"frontend-capability-public-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,WAAW,CAAC;IAChE;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0C,MAAM,CAAC,MAAM,CAAC;IAC5G,oBAAoB,EAAE,oCAAoC;CAC3D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,kCAAkC,CAChD,oBAAmD;IAEnD,IAAI,oBAAoB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uCAAuC,CAAC,KAGvD;IAKC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACtF,MAAM,gBAAgB,GAA4B,EAAE,CAAC;IACrD,MAAM,cAAc,GAA4B,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAA6D,EAAE,CAAC;IAC5E,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,8EAA8E;QAC9E,8EAA8E;QAC9E,iCAAiC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CACxE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,OAAO;YAAE,SAAS;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,GAAG,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kCAAkC,CAMhD,KAID;IACC,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACxF,wEAAwE;IACxE,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC;IAEzC,OAAO;QACL,GAAG,KAAK,CAAC,IAAI;QACb,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,iBAAiB;QAC3E,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;QAC9F,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;KACrG,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The public-config shape a BUILT-IN frontend capability expects, as a named\n * schema rather than a convention.\n *\n * ## Why the capability owns this and not each provider\n *\n * `publicConfig` is `Record<string, unknown>`, so every consuming site was\n * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter\n * for strings, a Mb-to-bytes multiplication — and a renamed key produced\n * `undefined` and a silently wrong picker rather than an error. The keys were a\n * convention nobody had written down, which is the whole defect: three ad-hoc\n * readers agreeing by luck.\n *\n * What a FILE PICKER's constraints mean is framework knowledge — the framework\n * is what applies them to its own file fields — so the shape belongs to the\n * CAPABILITY. A provider is free to carry its own keys beside these (a client\n * id, an app key); it is not free to invent a different spelling of the ones\n * the framework reads, and now it cannot.\n *\n * A provider declaring `publicConfigSchema` should EXTEND the schema for the\n * capability it claims, so hydration validates the framework's fields and its\n * own in one pass.\n */\n\nimport { z } from 'zod';\n\n/**\n * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.\n *\n * Every field is optional: a provider that constrains nothing is legitimate,\n * and the field's own Zod file metadata always wins anyway — a provider only\n * fills the gaps the schema left open.\n *\n * LOOSE, because a provider's own keys live in the same object and must survive\n * a parse that is only looking for these.\n */\nexport const FrontendFilePickerPublicConfigSchema = z.looseObject({\n  /**\n   * MIME types the picker can return.\n   *\n   * An EMPTY list is normalized to absent, and that is behaviour rather than\n   * decoration: the framework turns this into an `accept=` attribute, and an\n   * empty `accept=\"\"` does not mean \"anything\" — it means the file dialog\n   * offers nothing. A provider that declares no types is unconstrained, so the\n   * normalization happens here, once, instead of at each reader that would have\n   * to remember it.\n   */\n  acceptedMimeTypes: z\n    .array(z.string().min(1))\n    .optional()\n    .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),\n  /**\n   * Largest file the picker will hand back, in MEGABYTES.\n   *\n   * The unit is in the name because the framework's own constraint is in BYTES\n   * and the conversion is the kind of thing that is wrong by a factor of 1024²\n   * exactly once, silently, in production.\n   */\n  maxFileSizeMb: z.number().positive().optional(),\n  /** How many files one selection may return. Applies only to a `multiple` field. */\n  maxSelectionCount: z.number().int().positive().optional(),\n});\nexport type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;\n\n/**\n * Every built-in capability that owns public-config keys, and the schema that\n * owns them.\n *\n * A MAP rather than a list of keys, so the keys are derived from the schema that\n * validates them and the two cannot disagree. Adding a capability's shape here\n * is the ONE edit that makes its keys admissible everywhere — the admission,\n * the refusal message and the validation all read this map.\n *\n * A capability absent from this map owns no public-config keys, which is the\n * common case and needs no entry.\n */\nexport const FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS: Readonly<Record<string, z.ZodObject>> = Object.freeze({\n  FRONTEND_FILE_PICKER: FrontendFilePickerPublicConfigSchema,\n});\n\n/**\n * The public-config keys a provider admits BY VIRTUE OF the capabilities it\n * claims, beside whatever its own `publicConfigSchema` declares.\n *\n * ## Why this exists — measured 2026-09-18 (#380)\n *\n * `FrontendFilePickerPublicConfigSchema` declares the constraint vocabulary the\n * FRAMEWORK reads off a picker (`acceptedMimeTypes`, `maxFileSizeMb`,\n * `maxSelectionCount`), and `resolveFormFieldFileProviderConstraints` reads it.\n * Three separate gates refused it, because each asked only what the PROVIDER\n * declares:\n *\n * - the config overlay THREW `UNDECLARED_KEY` — *\"a key the provider never reads\n *   would be served to every browser and used by nothing\"*, which is false here:\n *   the framework reads it, for that provider, because it claims the capability;\n * - hydration answered `unknown key` and set the provider's code to `undefined`,\n *   so declaring a size limit DELETED the picker;\n * - and the resolver then found nothing, because nothing had been allowed through.\n *\n * All three engine pickers declare a `publicConfigSchema` (`appId`, `clientId`,\n * `appKey`), so the capability's whole vocabulary was unusable on every one of\n * them. It worked only on an application-authored picker that declares NO\n * schema, where the first gate is skipped — which is why the dogfood never saw it.\n *\n * The capability schema's own docstring asked a provider to *\"EXTEND the schema\n * for the capability it claims\"*, and no affordance to do that existed. This is\n * the affordance, DERIVED instead: a provider claiming `FRONTEND_FILE_PICKER`\n * admits the file-picker keys with no edit to the provider, so a capability\n * shape added tomorrow reaches every provider claiming it and none that does not.\n */\nexport function frontendCapabilityPublicConfigKeys(\n  providerCapabilities: readonly string[] | undefined,\n): readonly string[] {\n  if (providerCapabilities === undefined) return [];\n  const keys = new Set<string>();\n  for (const capability of providerCapabilities) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    for (const key of Object.keys(schema.shape)) keys.add(key);\n  }\n  return [...keys];\n}\n\n/**\n * Splits a public-config bag into the half the CAPABILITIES own and the half the\n * provider's own schema must answer for, validating the first here.\n *\n * Returning the two halves rather than one merged bag is what lets a caller run\n * the provider's schema over exactly the keys it declared — a strict provider\n * schema would otherwise refuse the capability's keys, which is the defect this\n * whole mechanism exists to remove.\n */\nexport function partitionFrontendCapabilityPublicConfig(input: {\n  readonly providerCapabilities: readonly string[] | undefined;\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n}): {\n  readonly capabilityConfig: Readonly<Record<string, unknown>>;\n  readonly providerConfig: Readonly<Record<string, unknown>>;\n  readonly issues: ReadonlyArray<{ readonly message: string; readonly path: readonly PropertyKey[] }>;\n} {\n  const owned = new Set(frontendCapabilityPublicConfigKeys(input.providerCapabilities));\n  const capabilityConfig: Record<string, unknown> = {};\n  const providerConfig: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input.publicConfig)) {\n    (owned.has(key) ? capabilityConfig : providerConfig)[key] = value;\n  }\n\n  const issues: Array<{ message: string; path: readonly PropertyKey[] }> = [];\n  for (const capability of input.providerCapabilities ?? []) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    // Only the keys this capability owns: a loose schema would otherwise re-admit\n    // the provider's own keys and report nothing about them, which is correct but\n    // makes the partition pointless.\n    const subject = Object.fromEntries(\n      Object.entries(capabilityConfig).filter(([key]) => key in schema.shape),\n    );\n    const parsed = schema.safeParse(subject);\n    if (parsed.success) continue;\n    for (const issue of parsed.error.issues) {\n      issues.push({ message: issue.message, path: issue.path });\n    }\n  }\n\n  return { capabilityConfig, providerConfig, issues };\n}\n\n/**\n * The full set of public-config keys a provider admits: what its own schema\n * declares, UNION what the capabilities it claims own.\n *\n * `undefined` in, `undefined` out — and that is load-bearing. A provider with no\n * introspectable schema cannot be held to a key list at all, and widening\n * `undefined` to the capability keys would turn \"cannot enforce here\" into\n * \"declares exactly these\", refusing every vendor key such a provider reads.\n *\n * It lives beside the capability map rather than beside\n * `readDeclaredPublicConfigKeys`, because that module is deliberately\n * dependency-free so a provider module can declare a schema without pulling a\n * validation library in.\n */\nexport function admissibleFrontendPublicConfigKeys(input: {\n  readonly declaredKeys: readonly string[] | undefined;\n  readonly providerCapabilities: readonly string[] | undefined;\n}): readonly string[] | undefined {\n  if (input.declaredKeys === undefined) return undefined;\n  return [...new Set([...input.declaredKeys, ...frontendCapabilityPublicConfigKeys(input.providerCapabilities)])];\n}\n\n/**\n * Lays ONE provider's declared picker limits under the field's own, for that\n * provider's picker and no other.\n *\n * ## Why this is per-provider and not resolved once (#380)\n *\n * The field used to resolve its picker constraints from the FIRST provider the\n * registry returned for `FRONTEND_FILE_PICKER`, and pass that single object to\n * whichever picker the person then chose — so a Drive limit governed a Dropbox\n * pick, and which provider won depended on registry order. `ProviderFilePickerHost`\n * was built so \"a framework that picked one would be making a product decision in\n * a lookup table\"; the constraints were still making exactly that decision, one\n * layer up, and it became reachable the moment a third picker shipped.\n *\n * It also reached the field's OWN native upload, which is wrong at any number of\n * providers: a vendor's picker limit says nothing about a local file going to the\n * field's own storage.\n *\n * Precedence is unchanged and is the part that must not move: the field's Zod\n * metadata ALWAYS wins, and a provider only fills the gaps the schema left open.\n * `maxSelectionCount` applies only to a `multiple` field — a single-file field\n * never inherits a selection count.\n */\nexport function layerProviderFilePickerConstraints<\n  TConstraints extends {\n    readonly allowedMimeTypes?: readonly string[];\n    readonly maxSize?: number;\n    readonly maxFiles?: number;\n  },\n>(input: {\n  readonly base: TConstraints;\n  readonly multiple: boolean;\n  readonly publicConfig: Readonly<Record<string, unknown>> | undefined;\n}): TConstraints {\n  const parsed = FrontendFilePickerPublicConfigSchema.safeParse(input.publicConfig ?? {});\n  // A provider whose own values are wrong contributes NOTHING rather than\n  // nonsense — the same choice the three hand readers this replaced could not\n  // make, because a bad value was indistinguishable from an absent one.\n  const declared = parsed.success ? parsed.data : {};\n  const maxSizeMb = declared.maxFileSizeMb;\n\n  return {\n    ...input.base,\n    allowedMimeTypes: input.base.allowedMimeTypes ?? declared.acceptedMimeTypes,\n    maxSize: input.base.maxSize ?? (maxSizeMb === undefined ? undefined : maxSizeMb * 1024 * 1024),\n    maxFiles: input.multiple ? (input.base.maxFiles ?? declared.maxSelectionCount) : input.base.maxFiles,\n  };\n}\n"]}

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-runtime.shared.types.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAMpG"}
+{"version":3,"file":"frontend-capability-runtime.shared.types.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAMpG"}

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-runtime.shared.types.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;WACvB,MAAM,KAAK,IAAI;WACf,OAAQ,MAAsC,CAAC,WAAW,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The RUNTIME contract a built-in frontend capability expects of whichever\n * provider fills it — the code-half sibling of\n * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.\n *\n * ## Why the capability owns the shape, and not the framework's call site\n *\n * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider\n * package must not know any vendor's type, and \"a consumer that needs one narrows\n * it at the point where it also knows which provider it asked for.\"\n *\n * That reasoning holds for a picker, where the surface really did ask for Drive.\n * It inverts for an OBSERVABILITY capability: the framework reports a crash without\n * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted\n * collector is listening. Narrowing at the call site would mean a `switch` over\n * vendors inside the engine, which is precisely what the capability model exists to\n * prevent.\n *\n * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,\n * and the framework calls one method it owns the definition of.\n *\n * ## Bundle-safe by construction\n *\n * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from\n * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take\n * a handful of atoms without the decorator-bound schema graph.\n */\n\n/**\n * One crash, as the framework describes it to whichever provider is listening.\n *\n * ## What is in it, and why that is the whole list\n *\n * `name`, `message`, `stack` and `componentStack` are exactly what\n * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught\n * crash. Nothing new is collected to fill this shape; what changes is only that the\n * report can now leave the browser.\n *\n * **`message` is sent as authored, and that is a decision rather than an oversight.**\n * It is the field most likely to carry user content — `new Error(\\`Invalid value:\n * ${input}\\`)` — and it is also the field without which a crash report is close to\n * useless. Every mainstream crash reporter sends the exception message and scrubs by\n * KEY rather than by free-text inspection, because a scrubber over prose either\n * destroys the diagnostic or gives false assurance. An application that cannot accept\n * that should not declare `FRONTEND_ERROR_MONITORING`.\n *\n * ## What is deliberately NOT in it\n *\n * No user identity, no session or organisation id, no request or form payload, and no\n * resource content. A crash report is a diagnostic about CODE; attributing it to a\n * PERSON is a separate decision an application would have to take deliberately, and\n * there is no field here through which it could happen by accident.\n */\nexport interface FrontendCrashReport {\n  /** The error's class name — `TypeError`, `WildoFrontendError`. */\n  readonly name: string;\n  /** The error's own message, unmodified. See the note above before changing this. */\n  readonly message: string;\n  /** The JavaScript stack, when the runtime produced one. */\n  readonly stack?: string;\n  /**\n   * React's component stack for a crash a boundary caught. Component NAMES only —\n   * no props, no state — so it says which screen broke without saying what was on it.\n   */\n  readonly componentStack?: string;\n  /**\n   * Framework classification, flattened to strings at this boundary.\n   *\n   * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,\n   * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must\n   * not pull in, and every mainstream vendor models exactly this as string tags. The\n   * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one\n   * named runtime source and only its serialization is local to this contract.\n   */\n  readonly tags?: Readonly<Record<string, string>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated\n * handle.\n *\n * Synchronous and returning nothing, deliberately. Reporting a crash must never\n * become something a crashing surface has to await or handle: a vendor SDK queues and\n * flushes on its own schedule, and a rejected promise here would be a second error\n * raised from inside the first one's handler.\n */\nexport interface FrontendErrorMonitoringSink {\n  reportCrash(report: FrontendCrashReport): void;\n}\n\n/**\n * Whether an activated SDK handle can receive crash reports.\n *\n * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor\n * namespace that does not implement this contract — a mistake no type can catch,\n * because `handle` is `unknown` by design. Checked at the seam so the failure is a\n * reported diagnostic rather than a `TypeError` thrown while handling a crash.\n */\nexport function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink {\n  return (\n    typeof handle === 'object'\n    && handle !== null\n    && typeof (handle as FrontendErrorMonitoringSink).reportCrash === 'function'\n  );\n}\n"]}
+{"version":3,"file":"frontend-capability-runtime.shared.types.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;WACvB,MAAM,KAAK,IAAI;WACf,OAAQ,MAAsC,CAAC,WAAW,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The RUNTIME contract a built-in frontend capability expects of whichever\n * provider fills it — the code-half sibling of\n * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.\n *\n * ## Why the capability owns the shape, and not the framework's call site\n *\n * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider\n * package must not know any vendor's type, and \"a consumer that needs one narrows\n * it at the point where it also knows which provider it asked for.\"\n *\n * That reasoning holds for a picker, where the surface really did ask for Drive.\n * It inverts for an OBSERVABILITY capability: the framework reports a crash without\n * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted\n * collector is listening. Narrowing at the call site would mean a `switch` over\n * vendors inside the engine, which is precisely what the capability model exists to\n * prevent.\n *\n * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,\n * and the framework calls one method it owns the definition of.\n *\n * ## Bundle-safe by construction\n *\n * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from\n * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take\n * a handful of atoms without the decorator-bound schema graph.\n */\n\n/**\n * One crash, as the framework describes it to whichever provider is listening.\n *\n * ## What is in it, and why that is the whole list\n *\n * `name`, `message`, `stack` and `componentStack` are exactly what\n * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught\n * crash. Nothing new is collected to fill this shape; what changes is only that the\n * report can now leave the browser.\n *\n * **`message` is sent as authored, and that is a decision rather than an oversight.**\n * It is the field most likely to carry user content — `new Error(\\`Invalid value:\n * ${input}\\`)` — and it is also the field without which a crash report is close to\n * useless. Every mainstream crash reporter sends the exception message and scrubs by\n * KEY rather than by free-text inspection, because a scrubber over prose either\n * destroys the diagnostic or gives false assurance. An application that cannot accept\n * that should not declare `FRONTEND_ERROR_MONITORING`.\n *\n * ## What is deliberately NOT in it\n *\n * No user identity, no session or organisation id, no request or form payload, and no\n * resource content. A crash report is a diagnostic about CODE; attributing it to a\n * PERSON is a separate decision an application would have to take deliberately, and\n * there is no field here through which it could happen by accident.\n */\nexport interface FrontendCrashReport {\n  /** The error's class name — `TypeError`, `WildoFrontendError`. */\n  readonly name: string;\n  /** The error's own message, unmodified. See the note above before changing this. */\n  readonly message: string;\n  /** The JavaScript stack, when the runtime produced one. */\n  readonly stack?: string;\n  /**\n   * React's component stack for a crash a boundary caught. Component NAMES only —\n   * no props, no state — so it says which screen broke without saying what was on it.\n   */\n  readonly componentStack?: string;\n  /**\n   * Framework classification, flattened to strings at this boundary.\n   *\n   * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,\n   * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must\n   * not pull in, and every mainstream vendor models exactly this as string tags. The\n   * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one\n   * named runtime source and only its serialization is local to this contract.\n   */\n  readonly tags?: Readonly<Record<string, string>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated\n * handle.\n *\n * Synchronous and returning nothing, deliberately. Reporting a crash must never\n * become something a crashing surface has to await or handle: a vendor SDK queues and\n * flushes on its own schedule, and a rejected promise here would be a second error\n * raised from inside the first one's handler.\n */\nexport interface FrontendErrorMonitoringSink {\n  reportCrash(report: FrontendCrashReport): void;\n}\n\n/**\n * Whether an activated SDK handle can receive crash reports.\n *\n * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor\n * namespace that does not implement this contract — a mistake no type can catch,\n * because `handle` is `unknown` by design. Checked at the seam so the failure is a\n * reported diagnostic rather than a `TypeError` thrown while handling a crash.\n */\nexport function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink {\n  return (\n    typeof handle === 'object'\n    && handle !== null\n    && typeof (handle as FrontendErrorMonitoringSink).reportCrash === 'function'\n  );\n}\n"]}