@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.d.ts

@@ -1,5 +1,44 @@
 import { z } from 'zod';
-import { FileStorageAccepted } from '@wildo-ai/zod-decorators';
+/**
+ * The `z_file` storage vocabulary, as a BROWSER-SAFE declaration of the values
+ * `FileStorageAccepted` in `@wildo-ai/zod-decorators` owns.
+ *
+ * ## Why this is not an import of that enum
+ *
+ * This file sits in the `@wildo-ai/saas-models/public-runtime` closure, which
+ * browser-bound provider modules load. Importing ANYTHING from
+ * `@wildo-ai/zod-decorators` puts that package's root barrel into the bundle,
+ * and that barrel mutates Zod's prototypes as an import side effect
+ * (`ensureZodDecoratorsLoaded(z)`) — the reason K-3 forbids it, and what
+ * `public-runtime.boundary.test.ts` measures. A re-export of the enum (the
+ * previous shape, #394 P5) is an import all the same (#607).
+ *
+ * ## Why a literal union, and why it stays compatible
+ *
+ * The owning enum is the ONE runtime source of the vocabulary; this is the
+ * browser door's spelling of it, pinned member-for-member (keys AND values, at
+ * type level and at runtime) by `__tests__/file-storage-accepted.drift.test.ts`
+ * — the same arrangement `BUILTIN_PROVIDER_PROTOCOL` has with the engine's
+ * protocol enum, for the same boundary.
+ *
+ * It is `as const` rather than a second `enum` on purpose: two enums are
+ * NOMINALLY distinct, so the field side (`z_file({ storageAccepted })`, the
+ * owning enum) could not be compared with the provider side (this). A string
+ * enum IS assignable to the literal union of its values, so the owning enum
+ * flows into every slot typed with this vocabulary, and
+ * `FileStorageAccepted.GOOGLE_DRIVE` reads identically at an authoring site.
+ * The reverse is not true: a value typed here does not flow into a slot typed
+ * with the owning enum — that direction does not occur today, and the compiler
+ * reports it if it ever does.
+ */
+export declare const FileStorageAccepted: {
+    readonly WILDO_MANAGED: "wildo_managed";
+    readonly LOCAL_DIRECTORY: "local_directory";
+    readonly ONEDRIVE: "onedrive";
+    readonly GOOGLE_DRIVE: "google_drive";
+    readonly DROPBOX: "dropbox";
+};
+export type FileStorageAccepted = (typeof FileStorageAccepted)[keyof typeof FileStorageAccepted];
 /**
  * Bundle-safe frontend provider atoms shared by every browser-bound runtime.
  *
@@ -131,7 +170,13 @@ export declare const FrontendProviderEntrySchema: z.ZodObject<{
      * SERVES the storage is CODE, keyed by the same enum member and naming this
      * provider back as its `connectedProviderRef`; a pin holds the two ends equal.
      */
-    fileStorage: z.ZodOptional<z.ZodEnum<typeof FileStorageAccepted>>;
+    fileStorage: z.ZodOptional<z.ZodEnum<{
+        readonly WILDO_MANAGED: "wildo_managed";
+        readonly LOCAL_DIRECTORY: "local_directory";
+        readonly ONEDRIVE: "onedrive";
+        readonly GOOGLE_DRIVE: "google_drive";
+        readonly DROPBOX: "dropbox";
+    }>>;
 }, z.core.$loose>;
 export type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;
 export declare const FrontendProvidersBlockSchema: z.ZodObject<{
@@ -231,7 +276,13 @@ export declare const FrontendProvidersBlockSchema: z.ZodObject<{
          * SERVES the storage is CODE, keyed by the same enum member and naming this
          * provider back as its `connectedProviderRef`; a pin holds the two ends equal.
          */
-        fileStorage: z.ZodOptional<z.ZodEnum<typeof FileStorageAccepted>>;
+        fileStorage: z.ZodOptional<z.ZodEnum<{
+            readonly WILDO_MANAGED: "wildo_managed";
+            readonly LOCAL_DIRECTORY: "local_directory";
+            readonly ONEDRIVE: "onedrive";
+            readonly GOOGLE_DRIVE: "google_drive";
+            readonly DROPBOX: "dropbox";
+        }>>;
     }, z.core.$loose>>>;
 }, z.core.$strip>;
 export type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-entry.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAS/D;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;IAKtC;;;;OAIG;;;;;;;;;;;;;IAEH;;;;;OAKG;;;;;IAEH,0EAA0E;;;;;;;;IAE1E;;;;;;;;;OASG;;;;IAEH;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;;OAiBG;;iBAEH,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;QAzDvC;;;;WAIG;;;;;;;;;;;;;QAEH;;;;;WAKG;;;;;QAEH,0EAA0E;;;;;;;;QAE1E;;;;;;;;;WASG;;;;QAEH;;;;;;;WAOG;;QAEH;;;;;;;;;;;;;;;;;WAiBG;;;iBAOH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"frontend-provider-entry.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAoBH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEjG;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;IAKtC;;;;OAIG;;;;;;;;;;;;;IAEH;;;;;OAKG;;;;;IAEH,0EAA0E;;;;;;;;IAE1E;;;;;;;;;OASG;;;;IAEH;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;;OAiBG;;;;;;;;iBAEH,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;QAzDvC;;;;WAIG;;;;;;;;;;;;;QAEH;;;;;WAKG;;;;;QAEH,0EAA0E;;;;;;;;QAE1E;;;;;;;;;WASG;;;;QAEH;;;;;;;WAOG;;QAEH;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;iBAOH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.js

@@ -1,7 +1,64 @@
 import { z } from 'zod';
-import { FileStorageAccepted } from '@wildo-ai/zod-decorators';
 import { ProviderMetadataSchema } from './provider-metadata.shared.schemas.js';
 import { ProviderFrontendComponentDescriptorsSchema, ProviderFrontendCspFootprintSchema, ProviderFrontendScriptDeclarationSchema, ProviderFrontendSdkDescriptorSchema, } from './provider-frontend-surface.shared.schemas.js';
+/**
+ * The `z_file` storage vocabulary, as a BROWSER-SAFE declaration of the values
+ * `FileStorageAccepted` in `@wildo-ai/zod-decorators` owns.
+ *
+ * ## Why this is not an import of that enum
+ *
+ * This file sits in the `@wildo-ai/saas-models/public-runtime` closure, which
+ * browser-bound provider modules load. Importing ANYTHING from
+ * `@wildo-ai/zod-decorators` puts that package's root barrel into the bundle,
+ * and that barrel mutates Zod's prototypes as an import side effect
+ * (`ensureZodDecoratorsLoaded(z)`) — the reason K-3 forbids it, and what
+ * `public-runtime.boundary.test.ts` measures. A re-export of the enum (the
+ * previous shape, #394 P5) is an import all the same (#607).
+ *
+ * ## Why a literal union, and why it stays compatible
+ *
+ * The owning enum is the ONE runtime source of the vocabulary; this is the
+ * browser door's spelling of it, pinned member-for-member (keys AND values, at
+ * type level and at runtime) by `__tests__/file-storage-accepted.drift.test.ts`
+ * — the same arrangement `BUILTIN_PROVIDER_PROTOCOL` has with the engine's
+ * protocol enum, for the same boundary.
+ *
+ * It is `as const` rather than a second `enum` on purpose: two enums are
+ * NOMINALLY distinct, so the field side (`z_file({ storageAccepted })`, the
+ * owning enum) could not be compared with the provider side (this). A string
+ * enum IS assignable to the literal union of its values, so the owning enum
+ * flows into every slot typed with this vocabulary, and
+ * `FileStorageAccepted.GOOGLE_DRIVE` reads identically at an authoring site.
+ * The reverse is not true: a value typed here does not flow into a slot typed
+ * with the owning enum — that direction does not occur today, and the compiler
+ * reports it if it ever does.
+ */
+/*
+ * ## NOT every member is served, and the rule is what to trust (#460)
+ *
+ * A member is SERVED when `FileStorageRouterBackendService` registers an `IFileStorageProvider` for
+ * it; that map is the one runtime answer, and this comment is a dated reading of it rather than a
+ * second authority. Measured 2026-09-17: `WILDO_MANAGED`, `LOCAL_DIRECTORY` and `GOOGLE_DRIVE` are
+ * served; `ONEDRIVE` and `DROPBOX` are declarable and ship no provider.
+ *
+ * Declaring an unserved member is not silently ignored — the router refuses and now says WHICH of the
+ * two problems it is, because "not implemented" and "implemented but not configured" have different
+ * remedies and the old single message sent an operator looking for environment variables that cannot
+ * exist.
+ *
+ * The unserved members are NOT removed here, deliberately. `ONEDRIVE` is the subject of #570, whose
+ * open question is exactly whether to build the governed path, keep the current picker, or drop it —
+ * deleting the member would answer that by default and from the wrong place. Re-measure before
+ * quoting this paragraph; the count was "three of five" when #460 was filed and Drive has landed
+ * since.
+ */
+export const FileStorageAccepted = {
+    WILDO_MANAGED: 'wildo_managed',
+    LOCAL_DIRECTORY: 'local_directory',
+    ONEDRIVE: 'onedrive',
+    GOOGLE_DRIVE: 'google_drive',
+    DROPBOX: 'dropbox',
+};
 /**
  * Bundle-safe frontend provider atoms shared by every browser-bound runtime.
  *

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-entry.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACvD,QAAQ,EAAE,sBAAsB;IAChC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,GAAG,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACnD,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,QAAQ,EAAE;IACpE;;;;;;;;;OASG;IACH,UAAU,EAAE,0CAA0C,CAAC,QAAQ,EAAE;IACjE;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { ProviderMetadataSchema } from './provider-metadata.shared.schemas';\nimport {\n  ProviderFrontendComponentDescriptorsSchema,\n  ProviderFrontendCspFootprintSchema,\n  ProviderFrontendScriptDeclarationSchema,\n  ProviderFrontendSdkDescriptorSchema,\n} from './provider-frontend-surface.shared.schemas';\n\n/**\n * Bundle-safe frontend provider atoms shared by every browser-bound runtime.\n *\n * This file intentionally stops at the provider-entry/block level so\n * `@wildo-ai/saas-models/public-runtime` can expose the types without pulling\n * the heavier application-config bootstrap contract into browser bundles.\n */\n\n/**\n * One provider as it crosses the DATA channel: authored on a facet module,\n * projected into a companion contribution, materialized into the generated\n * frontend-services artifact, served on `/application-config`, and parsed by the\n * app, the website and the technical doc.\n *\n * ## Why this is a LOOSE object\n *\n * It is a WIRE RECORD produced by one package version and read by another, and a\n * strict object silently STRIPS what a newer producer added — which is how a\n * provider's CSP footprint would vanish between the CLI that wrote it and the\n * runtime that needs it, leaving a policy that is correct in development\n * (report-only) and wrong in production (enforcing). #328 made\n * `ProviderCompanionContributionSchema` loose for exactly this reason, one file\n * over; the entry rides INSIDE that contribution, so leaving it strict left the\n * hole one layer down. Required fields stay required; unknown keys are kept\n * rather than dropped, so a re-emitting consumer cannot silently discard what it\n * did not understand.\n *\n * ## What may and may not be added here\n *\n * Only things a JSON channel can carry. A function-valued field would be\n * stripped by `JSON.stringify` with no error anywhere — the provider would look\n * declared and do nothing. Executable provider surface (`sdk.activate`,\n * `publicConfigSchema`, and, from S4b, `components`) belongs on the facet module\n * types in `@wildo-ai/external-connectors-public`, which reach a bundle through\n * the generated `frontend-providers.generated.ts` CODE channel instead.\n */\nexport const FrontendProviderEntrySchema = z.looseObject({\n  metadata: ProviderMetadataSchema,\n  providerCapabilities: z.array(z.string().min(1)),\n  protocols: z.array(z.string().min(1)),\n  publicConfig: z.record(z.string(), z.unknown()).optional(),\n  /**\n   * Origins this provider needs the composed CSP of its service to admit.\n   * Consumed by `resolveCspPolicy`'s provider layer; absent means the provider\n   * reaches nothing beyond the surface's own origin.\n   */\n  csp: ProviderFrontendCspFootprintSchema.optional(),\n  /**\n   * The vendor SDK package this provider loads on demand — the DATA half only.\n   * Its presence tells a surface that the provider HAS executable code to\n   * activate, which is the difference between \"declared\" and \"live\" once the\n   * CODE channel is consulted.\n   */\n  sdk: ProviderFrontendSdkDescriptorSchema.optional(),\n  /** Third-party `<script>` tags the surface must add for this provider. */\n  scripts: z.array(ProviderFrontendScriptDeclarationSchema).optional(),\n  /**\n   * The components this provider contributes, by capability — the DATA half\n   * only, exactly as `sdk` is. It says a component EXISTS and what contract it\n   * commits to; the loader stays on the CODE channel, because a function does\n   * not survive `JSON.stringify` and a field that vanishes silently is worse\n   * than a field that was never declared.\n   *\n   * A surface reads this to know a chooser is worth rendering, and to know what\n   * a selection will contain, BEFORE it downloads any provider's component.\n   */\n  components: ProviderFrontendComponentDescriptorsSchema.optional(),\n  /**\n   * The public-config keys the provider module DECLARES it reads — the DATA\n   * half of its `publicConfigSchema`, mirrored here so the companion walk can\n   * refuse an application-supplied key the module never declared, without\n   * executing the module (#394 P3). Absent when the module's schema is not\n   * introspectable, which the overlay reads as \"cannot enforce here\", never as\n   * \"declares nothing\".\n   */\n  publicConfigKeys: z.array(z.string().min(1)).optional(),\n  /**\n   * The `z_file` storage this provider's file picker is the FRONT DOOR of — the\n   * join key between the provider vocabulary (`google-drive`) and the z_file\n   * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).\n   *\n   * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the\n   * vendor, so the FILES row it produces is stored in THAT storage, and a field\n   * may only receive it when its `storageAccepted` names that storage. The\n   * chooser therefore offers such a picker only to a field that accepts the\n   * storage, and the backend refuses the link otherwise — both read this\n   * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no\n   * storage: its bytes are ingested into whatever the field's own storage is,\n   * and it is offered to every field.\n   *\n   * DATA half only, like `components`: the backend storage provider that\n   * SERVES the storage is CODE, keyed by the same enum member and naming this\n   * provider back as its `connectedProviderRef`; a pin holds the two ends equal.\n   */\n  fileStorage: z.enum(FileStorageAccepted).optional(),\n});\nexport type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;\n\nexport const FrontendProvidersBlockSchema = z.object({\n  providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),\n});\nexport type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;\n"]}
+{"version":3,"file":"frontend-provider-entry.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;CACV,CAAC;AAGX;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACvD,QAAQ,EAAE,sBAAsB;IAChC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,GAAG,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACnD,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,QAAQ,EAAE;IACpE;;;;;;;;;OASG;IACH,UAAU,EAAE,0CAA0C,CAAC,QAAQ,EAAE;IACjE;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { ProviderMetadataSchema } from './provider-metadata.shared.schemas';\nimport {\n  ProviderFrontendComponentDescriptorsSchema,\n  ProviderFrontendCspFootprintSchema,\n  ProviderFrontendScriptDeclarationSchema,\n  ProviderFrontendSdkDescriptorSchema,\n} from './provider-frontend-surface.shared.schemas';\n\n/**\n * The `z_file` storage vocabulary, as a BROWSER-SAFE declaration of the values\n * `FileStorageAccepted` in `@wildo-ai/zod-decorators` owns.\n *\n * ## Why this is not an import of that enum\n *\n * This file sits in the `@wildo-ai/saas-models/public-runtime` closure, which\n * browser-bound provider modules load. Importing ANYTHING from\n * `@wildo-ai/zod-decorators` puts that package's root barrel into the bundle,\n * and that barrel mutates Zod's prototypes as an import side effect\n * (`ensureZodDecoratorsLoaded(z)`) — the reason K-3 forbids it, and what\n * `public-runtime.boundary.test.ts` measures. A re-export of the enum (the\n * previous shape, #394 P5) is an import all the same (#607).\n *\n * ## Why a literal union, and why it stays compatible\n *\n * The owning enum is the ONE runtime source of the vocabulary; this is the\n * browser door's spelling of it, pinned member-for-member (keys AND values, at\n * type level and at runtime) by `__tests__/file-storage-accepted.drift.test.ts`\n * — the same arrangement `BUILTIN_PROVIDER_PROTOCOL` has with the engine's\n * protocol enum, for the same boundary.\n *\n * It is `as const` rather than a second `enum` on purpose: two enums are\n * NOMINALLY distinct, so the field side (`z_file({ storageAccepted })`, the\n * owning enum) could not be compared with the provider side (this). A string\n * enum IS assignable to the literal union of its values, so the owning enum\n * flows into every slot typed with this vocabulary, and\n * `FileStorageAccepted.GOOGLE_DRIVE` reads identically at an authoring site.\n * The reverse is not true: a value typed here does not flow into a slot typed\n * with the owning enum — that direction does not occur today, and the compiler\n * reports it if it ever does.\n */\n/*\n * ## NOT every member is served, and the rule is what to trust (#460)\n *\n * A member is SERVED when `FileStorageRouterBackendService` registers an `IFileStorageProvider` for\n * it; that map is the one runtime answer, and this comment is a dated reading of it rather than a\n * second authority. Measured 2026-09-17: `WILDO_MANAGED`, `LOCAL_DIRECTORY` and `GOOGLE_DRIVE` are\n * served; `ONEDRIVE` and `DROPBOX` are declarable and ship no provider.\n *\n * Declaring an unserved member is not silently ignored — the router refuses and now says WHICH of the\n * two problems it is, because \"not implemented\" and \"implemented but not configured\" have different\n * remedies and the old single message sent an operator looking for environment variables that cannot\n * exist.\n *\n * The unserved members are NOT removed here, deliberately. `ONEDRIVE` is the subject of #570, whose\n * open question is exactly whether to build the governed path, keep the current picker, or drop it —\n * deleting the member would answer that by default and from the wrong place. Re-measure before\n * quoting this paragraph; the count was \"three of five\" when #460 was filed and Drive has landed\n * since.\n */\nexport const FileStorageAccepted = {\n  WILDO_MANAGED: 'wildo_managed',\n  LOCAL_DIRECTORY: 'local_directory',\n  ONEDRIVE: 'onedrive',\n  GOOGLE_DRIVE: 'google_drive',\n  DROPBOX: 'dropbox',\n} as const;\nexport type FileStorageAccepted = (typeof FileStorageAccepted)[keyof typeof FileStorageAccepted];\n\n/**\n * Bundle-safe frontend provider atoms shared by every browser-bound runtime.\n *\n * This file intentionally stops at the provider-entry/block level so\n * `@wildo-ai/saas-models/public-runtime` can expose the types without pulling\n * the heavier application-config bootstrap contract into browser bundles.\n */\n\n/**\n * One provider as it crosses the DATA channel: authored on a facet module,\n * projected into a companion contribution, materialized into the generated\n * frontend-services artifact, served on `/application-config`, and parsed by the\n * app, the website and the technical doc.\n *\n * ## Why this is a LOOSE object\n *\n * It is a WIRE RECORD produced by one package version and read by another, and a\n * strict object silently STRIPS what a newer producer added — which is how a\n * provider's CSP footprint would vanish between the CLI that wrote it and the\n * runtime that needs it, leaving a policy that is correct in development\n * (report-only) and wrong in production (enforcing). #328 made\n * `ProviderCompanionContributionSchema` loose for exactly this reason, one file\n * over; the entry rides INSIDE that contribution, so leaving it strict left the\n * hole one layer down. Required fields stay required; unknown keys are kept\n * rather than dropped, so a re-emitting consumer cannot silently discard what it\n * did not understand.\n *\n * ## What may and may not be added here\n *\n * Only things a JSON channel can carry. A function-valued field would be\n * stripped by `JSON.stringify` with no error anywhere — the provider would look\n * declared and do nothing. Executable provider surface (`sdk.activate`,\n * `publicConfigSchema`, and, from S4b, `components`) belongs on the facet module\n * types in `@wildo-ai/external-connectors-public`, which reach a bundle through\n * the generated `frontend-providers.generated.ts` CODE channel instead.\n */\nexport const FrontendProviderEntrySchema = z.looseObject({\n  metadata: ProviderMetadataSchema,\n  providerCapabilities: z.array(z.string().min(1)),\n  protocols: z.array(z.string().min(1)),\n  publicConfig: z.record(z.string(), z.unknown()).optional(),\n  /**\n   * Origins this provider needs the composed CSP of its service to admit.\n   * Consumed by `resolveCspPolicy`'s provider layer; absent means the provider\n   * reaches nothing beyond the surface's own origin.\n   */\n  csp: ProviderFrontendCspFootprintSchema.optional(),\n  /**\n   * The vendor SDK package this provider loads on demand — the DATA half only.\n   * Its presence tells a surface that the provider HAS executable code to\n   * activate, which is the difference between \"declared\" and \"live\" once the\n   * CODE channel is consulted.\n   */\n  sdk: ProviderFrontendSdkDescriptorSchema.optional(),\n  /** Third-party `<script>` tags the surface must add for this provider. */\n  scripts: z.array(ProviderFrontendScriptDeclarationSchema).optional(),\n  /**\n   * The components this provider contributes, by capability — the DATA half\n   * only, exactly as `sdk` is. It says a component EXISTS and what contract it\n   * commits to; the loader stays on the CODE channel, because a function does\n   * not survive `JSON.stringify` and a field that vanishes silently is worse\n   * than a field that was never declared.\n   *\n   * A surface reads this to know a chooser is worth rendering, and to know what\n   * a selection will contain, BEFORE it downloads any provider's component.\n   */\n  components: ProviderFrontendComponentDescriptorsSchema.optional(),\n  /**\n   * The public-config keys the provider module DECLARES it reads — the DATA\n   * half of its `publicConfigSchema`, mirrored here so the companion walk can\n   * refuse an application-supplied key the module never declared, without\n   * executing the module (#394 P3). Absent when the module's schema is not\n   * introspectable, which the overlay reads as \"cannot enforce here\", never as\n   * \"declares nothing\".\n   */\n  publicConfigKeys: z.array(z.string().min(1)).optional(),\n  /**\n   * The `z_file` storage this provider's file picker is the FRONT DOOR of — the\n   * join key between the provider vocabulary (`google-drive`) and the z_file\n   * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).\n   *\n   * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the\n   * vendor, so the FILES row it produces is stored in THAT storage, and a field\n   * may only receive it when its `storageAccepted` names that storage. The\n   * chooser therefore offers such a picker only to a field that accepts the\n   * storage, and the backend refuses the link otherwise — both read this\n   * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no\n   * storage: its bytes are ingested into whatever the field's own storage is,\n   * and it is offered to every field.\n   *\n   * DATA half only, like `components`: the backend storage provider that\n   * SERVES the storage is CODE, keyed by the same enum member and naming this\n   * provider back as its `connectedProviderRef`; a pin holds the two ends equal.\n   */\n  fileStorage: z.enum(FileStorageAccepted).optional(),\n});\nexport type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;\n\nexport const FrontendProvidersBlockSchema = z.object({\n  providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),\n});\nexport type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;\n"]}

package/dist/esm/external-providers/frontend-provider-public-config.shared.d.ts

@@ -53,9 +53,18 @@
  * The key under `providerConfigurations[providerRef]` an application uses to
  * supply a frontend provider's public configuration.
  *
- * The protocol kind, exactly as SSO's channel is keyed by ITS protocol kind
- * (`sso_oauth2`): the bag is per-provider, per-protocol, and a frontend module
- * speaks `FRONTEND_SDK`. Not a new literal — the enum member is the one source.
+ * The protocol kind's WIRE value, exactly as SSO's channel is keyed by ITS
+ * protocol kind (`sso_oauth2`): the bag is per-provider, per-protocol, and a
+ * frontend module speaks `FRONTEND_SDK`.
+ *
+ * The owning source is `ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK` in
+ * `@wildo-ai/external-connectors-models`, and this literal is pinned to it by
+ * `__tests__/frontend-provider-public-config.shared.test.ts`. It is written out
+ * rather than imported because this file is in the
+ * `@wildo-ai/saas-models/public-runtime` closure, which K-3 forbids from
+ * importing that package — an import it carried from #394 P3 until #607 put the
+ * whole external-connectors model tree into every browser provider bundle.
+ * `BUILTIN_PROVIDER_PROTOCOL` is the same arrangement for the same boundary.
  */
 export declare const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY: string;
 /** Why an application-supplied public-config bag was refused. */

package/dist/esm/external-providers/frontend-provider-public-config.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-public-config.shared.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAIH;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC,EAAE,MAA4D,CAAC;AAE/G,iEAAiE;AACjE,oBAAY,mCAAmC;IAC7C,gFAAgF;IAChF,cAAc,mBAAmB;IACjC,uFAAuF;IACvF,UAAU,eAAe;IACzB,2EAA2E;IAC3E,aAAa,kBAAkB;CAChC;AAED,qBAAa,iCAAkC,SAAQ,KAAK;IAExD,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,OAAO,EAAE,mCAAmC;IACrD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE;gBAFvB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mCAAmC,EAC5C,IAAI,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,wCAAwC,GAC9C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAiD/C;AAED;;;;;GAKG;AACH,oBAAY,6BAA6B;IACvC,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,0IAA0I;IAC1I,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrF,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,GACnB;YAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;SAAE,GAC3B;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC;KAClH,CAAC;IACF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,GAC1D,0BAA0B,CAiC5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAU3F"}
+{"version":3,"file":"frontend-provider-public-config.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,mCAAmC,EAAE,MAAuB,CAAC;AAE1E,iEAAiE;AACjE,oBAAY,mCAAmC;IAC7C,gFAAgF;IAChF,cAAc,mBAAmB;IACjC,uFAAuF;IACvF,UAAU,eAAe;IACzB,2EAA2E;IAC3E,aAAa,kBAAkB;CAChC;AAED,qBAAa,iCAAkC,SAAQ,KAAK;IAExD,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,OAAO,EAAE,mCAAmC;IACrD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE;gBAFvB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mCAAmC,EAC5C,IAAI,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,wCAAwC,GAC9C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAiD/C;AAED;;;;;GAKG;AACH,oBAAY,6BAA6B;IACvC,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,0IAA0I;IAC1I,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrF,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,GACnB;YAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;SAAE,GAC3B;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC;KAClH,CAAC;IACF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,GAC1D,0BAA0B,CAiC5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAU3F"}

package/dist/esm/external-providers/frontend-provider-public-config.shared.js

@@ -49,16 +49,25 @@
  * a projection that landed on one site and not another. A function both import
  * cannot be applied differently by each.
  */
-import { ExternalProvider_ExchangeProtocol_Kind } from '@wildo-ai/external-connectors-models';
 /**
  * The key under `providerConfigurations[providerRef]` an application uses to
  * supply a frontend provider's public configuration.
  *
- * The protocol kind, exactly as SSO's channel is keyed by ITS protocol kind
- * (`sso_oauth2`): the bag is per-provider, per-protocol, and a frontend module
- * speaks `FRONTEND_SDK`. Not a new literal — the enum member is the one source.
+ * The protocol kind's WIRE value, exactly as SSO's channel is keyed by ITS
+ * protocol kind (`sso_oauth2`): the bag is per-provider, per-protocol, and a
+ * frontend module speaks `FRONTEND_SDK`.
+ *
+ * The owning source is `ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK` in
+ * `@wildo-ai/external-connectors-models`, and this literal is pinned to it by
+ * `__tests__/frontend-provider-public-config.shared.test.ts`. It is written out
+ * rather than imported because this file is in the
+ * `@wildo-ai/saas-models/public-runtime` closure, which K-3 forbids from
+ * importing that package — an import it carried from #394 P3 until #607 put the
+ * whole external-connectors model tree into every browser provider bundle.
+ * `BUILTIN_PROVIDER_PROTOCOL` is the same arrangement for the same boundary.
  */
-export const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY = ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK;
+// semantic-literal-boundary: browser-safe wire value of ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK, pinned by test (#607)
+export const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY = 'frontend_sdk';
 /** Why an application-supplied public-config bag was refused. */
 export var FrontendProviderPublicConfigRefusal;
 (function (FrontendProviderPublicConfigRefusal) {

package/dist/esm/external-providers/frontend-provider-public-config.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-public-config.shared.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,sCAAsC,EAAE,MAAM,sCAAsC,CAAC;AAE9F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAW,sCAAsC,CAAC,YAAY,CAAC;AAE/G,iEAAiE;AACjE,MAAM,CAAN,IAAY,mCAOX;AAPD,WAAY,mCAAmC;IAC7C,gFAAgF;IAChF,wEAAiC,CAAA;IACjC,uFAAuF;IACvF,gEAAyB,CAAA;IACzB,2EAA2E;IAC3E,sEAA+B,CAAA;AACjC,CAAC,EAPW,mCAAmC,KAAnC,mCAAmC,QAO9C;AAED,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAE/C;IACA;IACA;IAHX,YACW,WAAmB,EACnB,OAA4C,EAC5C,IAAuB,EAChC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,gBAAW,GAAX,WAAW,CAAQ;QACnB,YAAO,GAAP,OAAO,CAAqC;QAC5C,SAAI,GAAJ,IAAI,CAAmB;QAIhC,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAmBD;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CACjD,KAA+C;IAE/C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAE/E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAE5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,aAAa,EACjD,EAAE,EACF,0BAA0B,WAAW,IAAI,mCAAmC,+BAA+B;cACzG,aAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,QAAQ,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE3C,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,UAAU,EAC9C,UAAU,EACV,0BAA0B,WAAW,IAAI,mCAAmC,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACtI,6BAA6B,WAAW,oEAAoE;cAC5G,sGAAsG;cACtG,eAAe,CAClB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,cAAc,EAClD,UAAU,EACV,0BAA0B,WAAW,IAAI,mCAAmC,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;kBACtI,cAAc,WAAW,qDAAqD;kBAC9E,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI;kBAC/F,sFAAsF,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAI,QAAoC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,kDAAiB,CAAA;IACjB,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAgCD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAA2D;IAE3D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,OAAO;QACL,YAAY;QACZ,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,OAAO;YACf,QAAQ,CAAC,KAAc;gBACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,EAAE,CAAC;gBAC7E,CAAC;gBACD,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,MAAM,GAAqD,EAAE,CAAC;gBAEpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;wBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;4BAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC9E,SAAS;oBACX,CAAC;oBACD,IAAI,OAAO,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,IAAI,CAAC,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC;gBAED,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC5D,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,SAAS,GAAG,MAAqD,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5G,OAAO,SAAS,CAAC,YAAiC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAgC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * How an APPLICATION supplies a frontend provider's public configuration — the\n * keys a picker needs that only the application can know (a Drive `appId`, a\n * OneDrive `clientId`) — and the two guards that keep that channel from\n * carrying anything else.\n *\n * ## The gap this closes\n *\n * A frontend provider's `publicConfig` was HARD-CODED on the engine's provider\n * module and projected verbatim onto the wire. The only way to set a picker's\n * `appId` was to edit engine code. The backend never had that problem: an\n * application authors `providerConfigurations[providerRef][protocolKind]` in\n * `wildo.saas.config.ts`, and SSO's public OAuth client id already travels that\n * way, keyed by the protocol (`sso_oauth2`).\n *\n * This file gives the frontend the same channel, keyed by the same vocabulary:\n * `providerConfigurations[providerRef][frontend_sdk]`. One authority for\n * \"what an application configured for this provider\", read by both sides.\n *\n * ## Two guards, because `publicConfig` is served to every browser\n *\n * 1. **Only DECLARED keys cross.** A provider module declares the keys it reads\n *    (`publicConfigSchema` — see `defineFrontendPublicConfigSchema` below, which\n *    is what makes those keys READABLE without running the schema). A key the\n *    module never declared is refused with the provider and key named, at the\n *    two places the overlay runs: `wildo config sync` and the backend's\n *    fallback projection. A misspelled `apiId` therefore fails where it was\n *    typed, instead of silently contributing nothing and leaving a picker that\n *    reports \"no appId\" at the moment a user opens it.\n *\n * 2. **A secret never crosses.** A frontend provider owns no secrets by\n *    construction (`secretsContractShape: []`), so the only way one reaches a\n *    browser is an author typing the BACKEND module's secret into the frontend\n *    bag. The overlay refuses any key whose name matches a slug or an\n *    environment-variable name from the same vendor's backend secrets\n *    contract — `GOOGLE_OAUTH2_CLIENT_SECRET` cannot be typed into the bag that\n *    every visitor downloads.\n *\n * Both guards are decisions about NAMES, so they run wherever the names are\n * known and need no schema execution. Value VALIDATION (is `appId` a string?)\n * is the schema's job and runs where the schema is: at hydration (FE-8) and, on\n * the backend fallback, before serving.\n *\n * ## Why the overlay is a pure function in this package\n *\n * It has THREE call sites that must agree — the companion walk in\n * `platform-config-lib`, the backend fallback in `saas-backend-lib`, and any\n * future producer of a `FrontendProviderEntry` — and #380 already paid once for\n * a projection that landed on one site and not another. A function both import\n * cannot be applied differently by each.\n */\n\nimport { ExternalProvider_ExchangeProtocol_Kind } from '@wildo-ai/external-connectors-models';\n\n/**\n * The key under `providerConfigurations[providerRef]` an application uses to\n * supply a frontend provider's public configuration.\n *\n * The protocol kind, exactly as SSO's channel is keyed by ITS protocol kind\n * (`sso_oauth2`): the bag is per-provider, per-protocol, and a frontend module\n * speaks `FRONTEND_SDK`. Not a new literal — the enum member is the one source.\n */\nexport const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY: string = ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK;\n\n/** Why an application-supplied public-config bag was refused. */\nexport enum FrontendProviderPublicConfigRefusal {\n  /** A key the provider module does not declare — almost always a misspelling. */\n  UNDECLARED_KEY = 'UNDECLARED_KEY',\n  /** A key naming a secret from the same vendor's backend contract. Never negotiable. */\n  SECRET_KEY = 'SECRET_KEY',\n  /** The supplied bag is not a plain object — a string, an array, `null`. */\n  NOT_AN_OBJECT = 'NOT_AN_OBJECT',\n}\n\nexport class FrontendProviderPublicConfigError extends Error {\n  constructor(\n    readonly providerRef: string,\n    readonly refusal: FrontendProviderPublicConfigRefusal,\n    readonly keys: readonly string[],\n    message: string,\n  ) {\n    super(message);\n    this.name = 'FrontendProviderPublicConfigError';\n  }\n}\n\nexport interface OverlayFrontendProviderPublicConfigInput {\n  readonly providerRef: string;\n  /** What the provider module authored — its own defaults, e.g. `{ authProviderRef: 'google' }`. */\n  readonly authored: Readonly<Record<string, unknown>> | undefined;\n  /** What the application supplied under `providerConfigurations[providerRef][frontend_sdk]`. */\n  readonly supplied: unknown;\n  /**\n   * The keys the provider module declares it reads. `undefined` means the\n   * module declared no introspectable schema, so guard 1 cannot run HERE and\n   * hydration's validation is the gate; an empty array means the module\n   * declares it reads NOTHING, so every supplied key is refused.\n   */\n  readonly declaredKeys: readonly string[] | undefined;\n  /** Slugs and environment-variable names of the same vendor's backend secrets. */\n  readonly forbiddenKeys: ReadonlySet<string>;\n}\n\n/**\n * Merges what the application supplied over what the module authored, refusing\n * the two classes of key that must never reach a browser.\n *\n * Supplied values WIN over authored ones for the same key: the module's value is\n * a default, and an application that names a key means it. Absent `supplied`\n * returns the authored bag untouched — an application that configured nothing\n * is the ordinary case, not a refusal.\n */\nexport function overlayFrontendProviderPublicConfig(\n  input: OverlayFrontendProviderPublicConfigInput,\n): Readonly<Record<string, unknown>> | undefined {\n  const { providerRef, authored, supplied, declaredKeys, forbiddenKeys } = input;\n\n  if (supplied === undefined) return authored;\n\n  if (typeof supplied !== 'object' || supplied === null || Array.isArray(supplied)) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.NOT_AN_OBJECT,\n      [],\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} must be an object of public `\n      + `keys, got ${Array.isArray(supplied) ? 'an array' : typeof supplied}.`,\n    );\n  }\n\n  const suppliedKeys = Object.keys(supplied);\n\n  // Guard 2 runs FIRST and unconditionally: a secret is refused even when the\n  // module has no introspectable schema, because that is not the module's call.\n  const secretKeys = suppliedKeys.filter((key) => forbiddenKeys.has(key));\n  if (secretKeys.length > 0) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.SECRET_KEY,\n      secretKeys,\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} names ${secretKeys.map((key) => `\"${key}\"`).join(', ')}, `\n      + `which is a SECRET of the \"${providerRef}\" backend provider. A frontend provider's public configuration is `\n      + 'served to every browser; a secret belongs in the deployment environment under its `envVarName`, and '\n      + 'nowhere else.',\n    );\n  }\n\n  if (declaredKeys !== undefined) {\n    const declared = new Set(declaredKeys);\n    const undeclared = suppliedKeys.filter((key) => !declared.has(key));\n    if (undeclared.length > 0) {\n      throw new FrontendProviderPublicConfigError(\n        providerRef,\n        FrontendProviderPublicConfigRefusal.UNDECLARED_KEY,\n        undeclared,\n        `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} names ${undeclared.map((key) => `\"${key}\"`).join(', ')}, `\n        + `which the \"${providerRef}\" frontend provider does not declare. It declares: `\n        + `${declaredKeys.length > 0 ? declaredKeys.map((key) => `\"${key}\"`).join(', ') : '(nothing)'}. `\n        + 'A key the provider never reads would be served to every browser and used by nothing.',\n      );\n    }\n  }\n\n  return { ...(authored ?? {}), ...(supplied as Record<string, unknown>) };\n}\n\n/**\n * The value kinds a public-config key may declare. Scalars only, on purpose: a\n * public key is an identifier or a flag, and a structured value here is a\n * design smell — a provider that needs one has a capability-level shape\n * (`FrontendFilePickerPublicConfigSchema`) to declare it in.\n */\nexport enum FrontendPublicConfigValueKind {\n  STRING = 'string',\n  NUMBER = 'number',\n  BOOLEAN = 'boolean',\n}\n\nexport interface FrontendPublicConfigKeySpec {\n  readonly kind: FrontendPublicConfigValueKind;\n  /** Absent = optional. Picker keys are usually optional: a missing one is reported when the picker opens, not by dropping the provider. */\n  readonly required?: boolean;\n  /** For the person writing `wildo.saas.config.ts`. Not validated; surfaced in refusals. */\n  readonly description?: string;\n}\n\n/** A Standard Schema v1 validator that ALSO says which keys it declares. */\nexport interface FrontendPublicConfigSchema<TOutput = Readonly<Record<string, unknown>>> {\n  readonly '~standard': {\n    readonly version: 1;\n    readonly vendor: 'wildo';\n    validate(value: unknown):\n      | { readonly value: TOutput }\n      | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey> }> };\n  };\n  /**\n   * The keys this schema admits, readable without running it.\n   *\n   * This is the DATA half of the declaration, and it is why this helper exists\n   * rather than \"use Zod\": Standard Schema v1 exposes `validate` and nothing\n   * else, so a schema alone cannot tell the companion walk which keys an\n   * application may supply — and the walk runs in Node, from a projected\n   * contribution, without the module. `projectFrontendProviderContribution`\n   * mirrors this list onto the entry as `publicConfigKeys`.\n   */\n  readonly declaredKeys: readonly string[];\n}\n\n/**\n * Declares a frontend provider's public-config keys ONCE and gets both halves:\n * a strict Standard Schema v1 validator (the CODE half hydration runs) and the\n * key list (the DATA half the companion walk reads).\n *\n * Dependency-free by design. It lives here because the engine's provider modules\n * live in `@wildo-ai/external-connectors-public`, whose bare-specifier allow-list\n * holds exactly one entry — this package's `/public-runtime` — so those modules\n * can declare a schema without that package growing a validation library. An\n * application module may still use Zod (a Zod object satisfies Standard Schema\n * and its `shape` keys are read the same way).\n *\n * Strict: an unknown key is an issue, never ignored. Silently ignoring is the\n * defect FE-8 closed — a renamed key yielding `undefined` and a picker that\n * accepts more than it should with no error anywhere.\n */\nexport function defineFrontendPublicConfigSchema(\n  keys: Readonly<Record<string, FrontendPublicConfigKeySpec>>,\n): FrontendPublicConfigSchema {\n  const declaredKeys = Object.freeze(Object.keys(keys));\n\n  return {\n    declaredKeys,\n    '~standard': {\n      version: 1,\n      vendor: 'wildo',\n      validate(value: unknown) {\n        if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n          return { issues: [{ message: 'public configuration must be an object' }] };\n        }\n        const record = value as Record<string, unknown>;\n        const issues: Array<{ message: string; path?: PropertyKey[] }> = [];\n\n        for (const key of Object.keys(record)) {\n          if (!(key in keys)) issues.push({ message: 'unknown key', path: [key] });\n        }\n        for (const [key, spec] of Object.entries(keys)) {\n          const present = record[key];\n          if (present === undefined) {\n            if (spec.required === true) issues.push({ message: 'required', path: [key] });\n            continue;\n          }\n          if (typeof present !== spec.kind) {\n            issues.push({ message: `expected a ${spec.kind}, got ${typeof present}`, path: [key] });\n          }\n        }\n\n        return issues.length > 0 ? { issues } : { value: record };\n      },\n    },\n  };\n}\n\n/**\n * Reads the declared keys off a provider's `publicConfigSchema`, whatever\n * library produced it.\n *\n * Two shapes are recognised, and the order matters: a schema built by\n * `defineFrontendPublicConfigSchema` states its keys outright; a Zod object\n * exposes them as `shape`. Anything else — a hand-written Standard Schema, a\n * library without introspection — yields `undefined`, which the overlay reads\n * as \"cannot enforce here\" rather than as \"declares nothing\". That distinction\n * is load-bearing: an empty list refuses EVERY supplied key.\n */\nexport function readDeclaredPublicConfigKeys(schema: unknown): readonly string[] | undefined {\n  if (typeof schema !== 'object' || schema === null) return undefined;\n  const candidate = schema as { declaredKeys?: unknown; shape?: unknown };\n  if (Array.isArray(candidate.declaredKeys) && candidate.declaredKeys.every((key) => typeof key === 'string')) {\n    return candidate.declaredKeys as readonly string[];\n  }\n  if (typeof candidate.shape === 'object' && candidate.shape !== null) {\n    return Object.keys(candidate.shape as Record<string, unknown>);\n  }\n  return undefined;\n}\n"]}
+{"version":3,"file":"frontend-provider-public-config.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,mIAAmI;AACnI,MAAM,CAAC,MAAM,mCAAmC,GAAW,cAAc,CAAC;AAE1E,iEAAiE;AACjE,MAAM,CAAN,IAAY,mCAOX;AAPD,WAAY,mCAAmC;IAC7C,gFAAgF;IAChF,wEAAiC,CAAA;IACjC,uFAAuF;IACvF,gEAAyB,CAAA;IACzB,2EAA2E;IAC3E,sEAA+B,CAAA;AACjC,CAAC,EAPW,mCAAmC,KAAnC,mCAAmC,QAO9C;AAED,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAE/C;IACA;IACA;IAHX,YACW,WAAmB,EACnB,OAA4C,EAC5C,IAAuB,EAChC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,gBAAW,GAAX,WAAW,CAAQ;QACnB,YAAO,GAAP,OAAO,CAAqC;QAC5C,SAAI,GAAJ,IAAI,CAAmB;QAIhC,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAmBD;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CACjD,KAA+C;IAE/C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAE/E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAE5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,aAAa,EACjD,EAAE,EACF,0BAA0B,WAAW,IAAI,mCAAmC,+BAA+B;cACzG,aAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,QAAQ,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE3C,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,UAAU,EAC9C,UAAU,EACV,0BAA0B,WAAW,IAAI,mCAAmC,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACtI,6BAA6B,WAAW,oEAAoE;cAC5G,sGAAsG;cACtG,eAAe,CAClB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,cAAc,EAClD,UAAU,EACV,0BAA0B,WAAW,IAAI,mCAAmC,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;kBACtI,cAAc,WAAW,qDAAqD;kBAC9E,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI;kBAC/F,sFAAsF,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAI,QAAoC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,kDAAiB,CAAA;IACjB,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAgCD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAA2D;IAE3D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,OAAO;QACL,YAAY;QACZ,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,OAAO;YACf,QAAQ,CAAC,KAAc;gBACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,EAAE,CAAC;gBAC7E,CAAC;gBACD,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,MAAM,GAAqD,EAAE,CAAC;gBAEpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;wBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;4BAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC9E,SAAS;oBACX,CAAC;oBACD,IAAI,OAAO,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,IAAI,CAAC,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC;gBAED,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC5D,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,SAAS,GAAG,MAAqD,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5G,OAAO,SAAS,CAAC,YAAiC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAgC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * How an APPLICATION supplies a frontend provider's public configuration — the\n * keys a picker needs that only the application can know (a Drive `appId`, a\n * OneDrive `clientId`) — and the two guards that keep that channel from\n * carrying anything else.\n *\n * ## The gap this closes\n *\n * A frontend provider's `publicConfig` was HARD-CODED on the engine's provider\n * module and projected verbatim onto the wire. The only way to set a picker's\n * `appId` was to edit engine code. The backend never had that problem: an\n * application authors `providerConfigurations[providerRef][protocolKind]` in\n * `wildo.saas.config.ts`, and SSO's public OAuth client id already travels that\n * way, keyed by the protocol (`sso_oauth2`).\n *\n * This file gives the frontend the same channel, keyed by the same vocabulary:\n * `providerConfigurations[providerRef][frontend_sdk]`. One authority for\n * \"what an application configured for this provider\", read by both sides.\n *\n * ## Two guards, because `publicConfig` is served to every browser\n *\n * 1. **Only DECLARED keys cross.** A provider module declares the keys it reads\n *    (`publicConfigSchema` — see `defineFrontendPublicConfigSchema` below, which\n *    is what makes those keys READABLE without running the schema). A key the\n *    module never declared is refused with the provider and key named, at the\n *    two places the overlay runs: `wildo config sync` and the backend's\n *    fallback projection. A misspelled `apiId` therefore fails where it was\n *    typed, instead of silently contributing nothing and leaving a picker that\n *    reports \"no appId\" at the moment a user opens it.\n *\n * 2. **A secret never crosses.** A frontend provider owns no secrets by\n *    construction (`secretsContractShape: []`), so the only way one reaches a\n *    browser is an author typing the BACKEND module's secret into the frontend\n *    bag. The overlay refuses any key whose name matches a slug or an\n *    environment-variable name from the same vendor's backend secrets\n *    contract — `GOOGLE_OAUTH2_CLIENT_SECRET` cannot be typed into the bag that\n *    every visitor downloads.\n *\n * Both guards are decisions about NAMES, so they run wherever the names are\n * known and need no schema execution. Value VALIDATION (is `appId` a string?)\n * is the schema's job and runs where the schema is: at hydration (FE-8) and, on\n * the backend fallback, before serving.\n *\n * ## Why the overlay is a pure function in this package\n *\n * It has THREE call sites that must agree — the companion walk in\n * `platform-config-lib`, the backend fallback in `saas-backend-lib`, and any\n * future producer of a `FrontendProviderEntry` — and #380 already paid once for\n * a projection that landed on one site and not another. A function both import\n * cannot be applied differently by each.\n */\n\n/**\n * The key under `providerConfigurations[providerRef]` an application uses to\n * supply a frontend provider's public configuration.\n *\n * The protocol kind's WIRE value, exactly as SSO's channel is keyed by ITS\n * protocol kind (`sso_oauth2`): the bag is per-provider, per-protocol, and a\n * frontend module speaks `FRONTEND_SDK`.\n *\n * The owning source is `ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK` in\n * `@wildo-ai/external-connectors-models`, and this literal is pinned to it by\n * `__tests__/frontend-provider-public-config.shared.test.ts`. It is written out\n * rather than imported because this file is in the\n * `@wildo-ai/saas-models/public-runtime` closure, which K-3 forbids from\n * importing that package — an import it carried from #394 P3 until #607 put the\n * whole external-connectors model tree into every browser provider bundle.\n * `BUILTIN_PROVIDER_PROTOCOL` is the same arrangement for the same boundary.\n */\n// semantic-literal-boundary: browser-safe wire value of ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK, pinned by test (#607)\nexport const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY: string = 'frontend_sdk';\n\n/** Why an application-supplied public-config bag was refused. */\nexport enum FrontendProviderPublicConfigRefusal {\n  /** A key the provider module does not declare — almost always a misspelling. */\n  UNDECLARED_KEY = 'UNDECLARED_KEY',\n  /** A key naming a secret from the same vendor's backend contract. Never negotiable. */\n  SECRET_KEY = 'SECRET_KEY',\n  /** The supplied bag is not a plain object — a string, an array, `null`. */\n  NOT_AN_OBJECT = 'NOT_AN_OBJECT',\n}\n\nexport class FrontendProviderPublicConfigError extends Error {\n  constructor(\n    readonly providerRef: string,\n    readonly refusal: FrontendProviderPublicConfigRefusal,\n    readonly keys: readonly string[],\n    message: string,\n  ) {\n    super(message);\n    this.name = 'FrontendProviderPublicConfigError';\n  }\n}\n\nexport interface OverlayFrontendProviderPublicConfigInput {\n  readonly providerRef: string;\n  /** What the provider module authored — its own defaults, e.g. `{ authProviderRef: 'google' }`. */\n  readonly authored: Readonly<Record<string, unknown>> | undefined;\n  /** What the application supplied under `providerConfigurations[providerRef][frontend_sdk]`. */\n  readonly supplied: unknown;\n  /**\n   * The keys the provider module declares it reads. `undefined` means the\n   * module declared no introspectable schema, so guard 1 cannot run HERE and\n   * hydration's validation is the gate; an empty array means the module\n   * declares it reads NOTHING, so every supplied key is refused.\n   */\n  readonly declaredKeys: readonly string[] | undefined;\n  /** Slugs and environment-variable names of the same vendor's backend secrets. */\n  readonly forbiddenKeys: ReadonlySet<string>;\n}\n\n/**\n * Merges what the application supplied over what the module authored, refusing\n * the two classes of key that must never reach a browser.\n *\n * Supplied values WIN over authored ones for the same key: the module's value is\n * a default, and an application that names a key means it. Absent `supplied`\n * returns the authored bag untouched — an application that configured nothing\n * is the ordinary case, not a refusal.\n */\nexport function overlayFrontendProviderPublicConfig(\n  input: OverlayFrontendProviderPublicConfigInput,\n): Readonly<Record<string, unknown>> | undefined {\n  const { providerRef, authored, supplied, declaredKeys, forbiddenKeys } = input;\n\n  if (supplied === undefined) return authored;\n\n  if (typeof supplied !== 'object' || supplied === null || Array.isArray(supplied)) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.NOT_AN_OBJECT,\n      [],\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} must be an object of public `\n      + `keys, got ${Array.isArray(supplied) ? 'an array' : typeof supplied}.`,\n    );\n  }\n\n  const suppliedKeys = Object.keys(supplied);\n\n  // Guard 2 runs FIRST and unconditionally: a secret is refused even when the\n  // module has no introspectable schema, because that is not the module's call.\n  const secretKeys = suppliedKeys.filter((key) => forbiddenKeys.has(key));\n  if (secretKeys.length > 0) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.SECRET_KEY,\n      secretKeys,\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} names ${secretKeys.map((key) => `\"${key}\"`).join(', ')}, `\n      + `which is a SECRET of the \"${providerRef}\" backend provider. A frontend provider's public configuration is `\n      + 'served to every browser; a secret belongs in the deployment environment under its `envVarName`, and '\n      + 'nowhere else.',\n    );\n  }\n\n  if (declaredKeys !== undefined) {\n    const declared = new Set(declaredKeys);\n    const undeclared = suppliedKeys.filter((key) => !declared.has(key));\n    if (undeclared.length > 0) {\n      throw new FrontendProviderPublicConfigError(\n        providerRef,\n        FrontendProviderPublicConfigRefusal.UNDECLARED_KEY,\n        undeclared,\n        `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} names ${undeclared.map((key) => `\"${key}\"`).join(', ')}, `\n        + `which the \"${providerRef}\" frontend provider does not declare. It declares: `\n        + `${declaredKeys.length > 0 ? declaredKeys.map((key) => `\"${key}\"`).join(', ') : '(nothing)'}. `\n        + 'A key the provider never reads would be served to every browser and used by nothing.',\n      );\n    }\n  }\n\n  return { ...(authored ?? {}), ...(supplied as Record<string, unknown>) };\n}\n\n/**\n * The value kinds a public-config key may declare. Scalars only, on purpose: a\n * public key is an identifier or a flag, and a structured value here is a\n * design smell — a provider that needs one has a capability-level shape\n * (`FrontendFilePickerPublicConfigSchema`) to declare it in.\n */\nexport enum FrontendPublicConfigValueKind {\n  STRING = 'string',\n  NUMBER = 'number',\n  BOOLEAN = 'boolean',\n}\n\nexport interface FrontendPublicConfigKeySpec {\n  readonly kind: FrontendPublicConfigValueKind;\n  /** Absent = optional. Picker keys are usually optional: a missing one is reported when the picker opens, not by dropping the provider. */\n  readonly required?: boolean;\n  /** For the person writing `wildo.saas.config.ts`. Not validated; surfaced in refusals. */\n  readonly description?: string;\n}\n\n/** A Standard Schema v1 validator that ALSO says which keys it declares. */\nexport interface FrontendPublicConfigSchema<TOutput = Readonly<Record<string, unknown>>> {\n  readonly '~standard': {\n    readonly version: 1;\n    readonly vendor: 'wildo';\n    validate(value: unknown):\n      | { readonly value: TOutput }\n      | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey> }> };\n  };\n  /**\n   * The keys this schema admits, readable without running it.\n   *\n   * This is the DATA half of the declaration, and it is why this helper exists\n   * rather than \"use Zod\": Standard Schema v1 exposes `validate` and nothing\n   * else, so a schema alone cannot tell the companion walk which keys an\n   * application may supply — and the walk runs in Node, from a projected\n   * contribution, without the module. `projectFrontendProviderContribution`\n   * mirrors this list onto the entry as `publicConfigKeys`.\n   */\n  readonly declaredKeys: readonly string[];\n}\n\n/**\n * Declares a frontend provider's public-config keys ONCE and gets both halves:\n * a strict Standard Schema v1 validator (the CODE half hydration runs) and the\n * key list (the DATA half the companion walk reads).\n *\n * Dependency-free by design. It lives here because the engine's provider modules\n * live in `@wildo-ai/external-connectors-public`, whose bare-specifier allow-list\n * holds exactly one entry — this package's `/public-runtime` — so those modules\n * can declare a schema without that package growing a validation library. An\n * application module may still use Zod (a Zod object satisfies Standard Schema\n * and its `shape` keys are read the same way).\n *\n * Strict: an unknown key is an issue, never ignored. Silently ignoring is the\n * defect FE-8 closed — a renamed key yielding `undefined` and a picker that\n * accepts more than it should with no error anywhere.\n */\nexport function defineFrontendPublicConfigSchema(\n  keys: Readonly<Record<string, FrontendPublicConfigKeySpec>>,\n): FrontendPublicConfigSchema {\n  const declaredKeys = Object.freeze(Object.keys(keys));\n\n  return {\n    declaredKeys,\n    '~standard': {\n      version: 1,\n      vendor: 'wildo',\n      validate(value: unknown) {\n        if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n          return { issues: [{ message: 'public configuration must be an object' }] };\n        }\n        const record = value as Record<string, unknown>;\n        const issues: Array<{ message: string; path?: PropertyKey[] }> = [];\n\n        for (const key of Object.keys(record)) {\n          if (!(key in keys)) issues.push({ message: 'unknown key', path: [key] });\n        }\n        for (const [key, spec] of Object.entries(keys)) {\n          const present = record[key];\n          if (present === undefined) {\n            if (spec.required === true) issues.push({ message: 'required', path: [key] });\n            continue;\n          }\n          if (typeof present !== spec.kind) {\n            issues.push({ message: `expected a ${spec.kind}, got ${typeof present}`, path: [key] });\n          }\n        }\n\n        return issues.length > 0 ? { issues } : { value: record };\n      },\n    },\n  };\n}\n\n/**\n * Reads the declared keys off a provider's `publicConfigSchema`, whatever\n * library produced it.\n *\n * Two shapes are recognised, and the order matters: a schema built by\n * `defineFrontendPublicConfigSchema` states its keys outright; a Zod object\n * exposes them as `shape`. Anything else — a hand-written Standard Schema, a\n * library without introspection — yields `undefined`, which the overlay reads\n * as \"cannot enforce here\" rather than as \"declares nothing\". That distinction\n * is load-bearing: an empty list refuses EVERY supplied key.\n */\nexport function readDeclaredPublicConfigKeys(schema: unknown): readonly string[] | undefined {\n  if (typeof schema !== 'object' || schema === null) return undefined;\n  const candidate = schema as { declaredKeys?: unknown; shape?: unknown };\n  if (Array.isArray(candidate.declaredKeys) && candidate.declaredKeys.every((key) => typeof key === 'string')) {\n    return candidate.declaredKeys as readonly string[];\n  }\n  if (typeof candidate.shape === 'object' && candidate.shape !== null) {\n    return Object.keys(candidate.shape as Record<string, unknown>);\n  }\n  return undefined;\n}\n"]}

package/dist/esm/external-providers/provider-authentication-assurance.shared.schemas.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+/** Policy for an otherwise valid external login that cannot demonstrate required MFA. */
+export declare enum ExternalAssuranceEnforcement {
+    WARN = "warn",
+    STRICT = "strict"
+}
+/** Do not collapse contractual delegation, measured MFA and warning admission into one boolean. */
+export declare enum ExternalAssuranceDecision {
+    NOT_REQUIRED = "not_required",
+    DELEGATED = "delegated",
+    VERIFIED_MFA = "verified_mfa",
+    WARNED = "warned",
+    REFUSED = "refused"
+}
+export declare enum ExternalAssuranceReason {
+    POLICY_NOT_REQUIRED = "policy_not_required",
+    ENTERPRISE_DELEGATION = "enterprise_delegation",
+    SESSION_MFA = "session_mfa",
+    EVIDENCE_MISSING = "evidence_missing",
+    EVIDENCE_INSUFFICIENT = "evidence_insufficient",
+    METHOD_REQUIREMENT_UNPROVEN = "method_requirement_unproven"
+}
+/** Safe decision summary: no upstream token, raw claims, nonce, or user profile. */
+export declare const ExternalAssuranceAssessmentSchema: z.ZodObject<{
+    decision: z.ZodEnum<typeof ExternalAssuranceDecision>;
+    reason: z.ZodEnum<typeof ExternalAssuranceReason>;
+    enforcement: z.ZodEnum<typeof ExternalAssuranceEnforcement>;
+}, z.core.$strip>;
+export type ExternalAssuranceAssessment = z.infer<typeof ExternalAssuranceAssessmentSchema>;
+//# sourceMappingURL=provider-authentication-assurance.shared.schemas.d.ts.map

package/dist/esm/external-providers/provider-authentication-assurance.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-authentication-assurance.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-authentication-assurance.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yFAAyF;AACzF,oBAAY,4BAA4B;IACtC,IAAI,SAAS;IACb,MAAM,WAAW;CAClB;AAED,mGAAmG;AACnG,oBAAY,yBAAyB;IACnC,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,YAAY,iBAAiB;IAC7B,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AACD,oBAAY,uBAAuB;IACjC,mBAAmB,wBAAwB;IAC3C,qBAAqB,0BAA0B;IAC/C,WAAW,gBAAgB;IAC3B,gBAAgB,qBAAqB;IACrC,qBAAqB,0BAA0B;IAC/C,2BAA2B,gCAAgC;CAC5D;AAED,oFAAoF;AACpF,eAAO,MAAM,iCAAiC;;;;iBAI5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/esm/external-providers/provider-authentication-assurance.shared.schemas.js

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+/** Policy for an otherwise valid external login that cannot demonstrate required MFA. */
+export var ExternalAssuranceEnforcement;
+(function (ExternalAssuranceEnforcement) {
+    ExternalAssuranceEnforcement["WARN"] = "warn";
+    ExternalAssuranceEnforcement["STRICT"] = "strict";
+})(ExternalAssuranceEnforcement || (ExternalAssuranceEnforcement = {}));
+/** Do not collapse contractual delegation, measured MFA and warning admission into one boolean. */
+export var ExternalAssuranceDecision;
+(function (ExternalAssuranceDecision) {
+    ExternalAssuranceDecision["NOT_REQUIRED"] = "not_required";
+    ExternalAssuranceDecision["DELEGATED"] = "delegated";
+    ExternalAssuranceDecision["VERIFIED_MFA"] = "verified_mfa";
+    ExternalAssuranceDecision["WARNED"] = "warned";
+    ExternalAssuranceDecision["REFUSED"] = "refused";
+})(ExternalAssuranceDecision || (ExternalAssuranceDecision = {}));
+export var ExternalAssuranceReason;
+(function (ExternalAssuranceReason) {
+    ExternalAssuranceReason["POLICY_NOT_REQUIRED"] = "policy_not_required";
+    ExternalAssuranceReason["ENTERPRISE_DELEGATION"] = "enterprise_delegation";
+    ExternalAssuranceReason["SESSION_MFA"] = "session_mfa";
+    ExternalAssuranceReason["EVIDENCE_MISSING"] = "evidence_missing";
+    ExternalAssuranceReason["EVIDENCE_INSUFFICIENT"] = "evidence_insufficient";
+    ExternalAssuranceReason["METHOD_REQUIREMENT_UNPROVEN"] = "method_requirement_unproven";
+})(ExternalAssuranceReason || (ExternalAssuranceReason = {}));
+/** Safe decision summary: no upstream token, raw claims, nonce, or user profile. */
+export const ExternalAssuranceAssessmentSchema = z.object({
+    decision: z.enum(ExternalAssuranceDecision),
+    reason: z.enum(ExternalAssuranceReason),
+    enforcement: z.enum(ExternalAssuranceEnforcement),
+});
+//# sourceMappingURL=provider-authentication-assurance.shared.schemas.js.map

package/dist/esm/external-providers/provider-authentication-assurance.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-authentication-assurance.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-authentication-assurance.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yFAAyF;AACzF,MAAM,CAAN,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IACtC,6CAAa,CAAA;IACb,iDAAiB,CAAA;AACnB,CAAC,EAHW,4BAA4B,KAA5B,4BAA4B,QAGvC;AAED,mGAAmG;AACnG,MAAM,CAAN,IAAY,yBAMX;AAND,WAAY,yBAAyB;IACnC,0DAA6B,CAAA;IAC7B,oDAAuB,CAAA;IACvB,0DAA6B,CAAA;IAC7B,8CAAiB,CAAA;IACjB,gDAAmB,CAAA;AACrB,CAAC,EANW,yBAAyB,KAAzB,yBAAyB,QAMpC;AACD,MAAM,CAAN,IAAY,uBAOX;AAPD,WAAY,uBAAuB;IACjC,sEAA2C,CAAA;IAC3C,0EAA+C,CAAA;IAC/C,sDAA2B,CAAA;IAC3B,gEAAqC,CAAA;IACrC,0EAA+C,CAAA;IAC/C,sFAA2D,CAAA;AAC7D,CAAC,EAPW,uBAAuB,KAAvB,uBAAuB,QAOlC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;CAClD,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/** Policy for an otherwise valid external login that cannot demonstrate required MFA. */\nexport enum ExternalAssuranceEnforcement {\n  WARN = 'warn',\n  STRICT = 'strict',\n}\n\n/** Do not collapse contractual delegation, measured MFA and warning admission into one boolean. */\nexport enum ExternalAssuranceDecision {\n  NOT_REQUIRED = 'not_required',\n  DELEGATED = 'delegated',\n  VERIFIED_MFA = 'verified_mfa',\n  WARNED = 'warned',\n  REFUSED = 'refused',\n}\nexport enum ExternalAssuranceReason {\n  POLICY_NOT_REQUIRED = 'policy_not_required',\n  ENTERPRISE_DELEGATION = 'enterprise_delegation',\n  SESSION_MFA = 'session_mfa',\n  EVIDENCE_MISSING = 'evidence_missing',\n  EVIDENCE_INSUFFICIENT = 'evidence_insufficient',\n  METHOD_REQUIREMENT_UNPROVEN = 'method_requirement_unproven',\n}\n\n/** Safe decision summary: no upstream token, raw claims, nonce, or user profile. */\nexport const ExternalAssuranceAssessmentSchema = z.object({\n  decision: z.enum(ExternalAssuranceDecision),\n  reason: z.enum(ExternalAssuranceReason),\n  enforcement: z.enum(ExternalAssuranceEnforcement),\n});\nexport type ExternalAssuranceAssessment = z.infer<typeof ExternalAssuranceAssessmentSchema>;\n"]}

package/dist/esm/external-providers/provider-browser-operations.shared.schemas.d.ts

@@ -0,0 +1,86 @@
+/**
+ * WHICH provider operations a signed-in person's browser may trigger — the application's decision (#367).
+ *
+ * ## The question this answers, and why nothing else did
+ *
+ * A provider operation runs on the backend, through `ProviderOperationExecutorBackendService`, because
+ * the credential it spends must never travel to a browser. A custom backend service reaches it through
+ * a generated typed client. A custom FRONTEND component had no way to reach it at all, and the door
+ * that gives it one has to answer a question no existing engine surface answers: *which operations may
+ * a browser trigger, for whom, and on whose account*.
+ *
+ * The answer is a DECLARATION, authored in the application's SaaS config beside `providers.connections`
+ * and with the same standing: both are the application's decisions about providers, as opposed to what
+ * a vendor's catalogue says it can support.
+ *
+ * ## Fail closed, by construction
+ *
+ * An operation absent from this map is NOT reachable from a browser. There is no default, no
+ * "READ operations are fine" shortcut — classification is not sufficient: a READ still spends a tenant's
+ * credential, can page a vendor's whole account, and returns whatever the vendor holds. The map is the
+ * only thing that opens the door, one operation at a time.
+ *
+ * ## Rejected: a flag on the operation in the provider catalogue
+ *
+ * The catalogue is generated from third-party sources and overwritten on every regeneration, and it
+ * describes the VENDOR. Letting it decide what a browser may trigger would let a scraped listing grant
+ * access in every application that installs the provider — and a regeneration could grant or revoke it
+ * without anyone opening the application.
+ */
+import { ExternalProvider_Connection_OwnerScope } from '@wildo-ai/external-connectors-models';
+import { z } from 'zod';
+/** @wildo_source:part:start saas.models.providers.browser-operation-policy facet:layer:shared facet:family:config facet:audience:app-developer */
+/**
+ * One browser-reachable operation.
+ *
+ * ## `connections` — whose account a browser-triggered call may spend
+ *
+ * Owner-scope × delegation pairs, in the vocabulary the catalogue, `providers.connections`, the connect
+ * leg and the resolver already share. NARROWING ONLY: a call must satisfy this list AND the provider's
+ * admissible connections as `providers.connections` narrows them. Naming a shape the provider does not
+ * admit grants nothing.
+ *
+ * Every call still passes the target-authorization port before anything is spent — a person may name
+ * only an organization they belong to organization-wide, and only their own user account. This list
+ * narrows further; it can never widen what that port allows.
+ *
+ * ## `allowedRoles` — who may trigger it
+ *
+ * Role keys, resolved through the LIVE role hierarchy (a custom role inheriting from a listed one
+ * qualifies), and read in the scope of the ACCOUNT BEING SPENT:
+ *
+ * | target | roles are read from |
+ * |---|---|
+ * | `organization` | the caller's organization-WIDE roles in THAT organization — a unit-scoped grant never counts |
+ * | `application` | the caller's application roles |
+ * | `user` | not applicable — a person acting on their own account holds no role over it, so declaring roles on a policy that admits `user` refuses those calls |
+ *
+ * Absent means any signed-in caller the target-authorization port admits. That is a legitimate choice
+ * for a person's own account or a member acting for their own tenant, and it is REFUSED at parse time
+ * when the policy admits an `application`-owned connection: without roles, every signed-in person could
+ * spend the application's own vendor account.
+ */
+export declare const ProviderBrowserOperationPolicySchema: z.ZodObject<{
+    connections: z.ZodArray<z.ZodObject<{
+        ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
+        delegation: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ExternalProvider_Connection_DelegationMode>>;
+    }, z.core.$strip>>;
+    allowedRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type ProviderBrowserOperationPolicy = z.infer<typeof ProviderBrowserOperationPolicySchema>;
+/**
+ * `providerRef` → `operationId` → policy. The operation id is the catalogue's own, exactly as a typed
+ * client or an ETL binding reference names it.
+ *
+ * Absent is an EMPTY map — nothing is browser-reachable — never "everything".
+ */
+export declare const ProviderBrowserOperationPoliciesSchema: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodObject<{
+    connections: z.ZodArray<z.ZodObject<{
+        ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
+        delegation: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ExternalProvider_Connection_DelegationMode>>;
+    }, z.core.$strip>>;
+    allowedRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>>>>;
+export type ProviderBrowserOperationPolicies = z.infer<typeof ProviderBrowserOperationPoliciesSchema>;
+/** @wildo_source:part:end saas.models.providers.browser-operation-policy */
+//# sourceMappingURL=provider-browser-operations.shared.schemas.d.ts.map

package/dist/esm/external-providers/provider-browser-operations.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-browser-operations.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-browser-operations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,sCAAsC,EAEvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kJAAkJ;AAClJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oCAAoC;;;;;;kBAgB/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC;;;;;;qBAG9B,CAAC;AACtB,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AACtG,4EAA4E"}

package/dist/esm/external-providers/provider-browser-operations.shared.schemas.js

@@ -0,0 +1,85 @@
+/**
+ * WHICH provider operations a signed-in person's browser may trigger — the application's decision (#367).
+ *
+ * ## The question this answers, and why nothing else did
+ *
+ * A provider operation runs on the backend, through `ProviderOperationExecutorBackendService`, because
+ * the credential it spends must never travel to a browser. A custom backend service reaches it through
+ * a generated typed client. A custom FRONTEND component had no way to reach it at all, and the door
+ * that gives it one has to answer a question no existing engine surface answers: *which operations may
+ * a browser trigger, for whom, and on whose account*.
+ *
+ * The answer is a DECLARATION, authored in the application's SaaS config beside `providers.connections`
+ * and with the same standing: both are the application's decisions about providers, as opposed to what
+ * a vendor's catalogue says it can support.
+ *
+ * ## Fail closed, by construction
+ *
+ * An operation absent from this map is NOT reachable from a browser. There is no default, no
+ * "READ operations are fine" shortcut — classification is not sufficient: a READ still spends a tenant's
+ * credential, can page a vendor's whole account, and returns whatever the vendor holds. The map is the
+ * only thing that opens the door, one operation at a time.
+ *
+ * ## Rejected: a flag on the operation in the provider catalogue
+ *
+ * The catalogue is generated from third-party sources and overwritten on every regeneration, and it
+ * describes the VENDOR. Letting it decide what a browser may trigger would let a scraped listing grant
+ * access in every application that installs the provider — and a regeneration could grant or revoke it
+ * without anyone opening the application.
+ */
+import { ExternalProvider_Connection_OwnerScope, ExternalProvider_ConnectionShapeSchema, } from '@wildo-ai/external-connectors-models';
+import { z } from 'zod';
+/** @wildo_source:part:start saas.models.providers.browser-operation-policy facet:layer:shared facet:family:config facet:audience:app-developer */
+/**
+ * One browser-reachable operation.
+ *
+ * ## `connections` — whose account a browser-triggered call may spend
+ *
+ * Owner-scope × delegation pairs, in the vocabulary the catalogue, `providers.connections`, the connect
+ * leg and the resolver already share. NARROWING ONLY: a call must satisfy this list AND the provider's
+ * admissible connections as `providers.connections` narrows them. Naming a shape the provider does not
+ * admit grants nothing.
+ *
+ * Every call still passes the target-authorization port before anything is spent — a person may name
+ * only an organization they belong to organization-wide, and only their own user account. This list
+ * narrows further; it can never widen what that port allows.
+ *
+ * ## `allowedRoles` — who may trigger it
+ *
+ * Role keys, resolved through the LIVE role hierarchy (a custom role inheriting from a listed one
+ * qualifies), and read in the scope of the ACCOUNT BEING SPENT:
+ *
+ * | target | roles are read from |
+ * |---|---|
+ * | `organization` | the caller's organization-WIDE roles in THAT organization — a unit-scoped grant never counts |
+ * | `application` | the caller's application roles |
+ * | `user` | not applicable — a person acting on their own account holds no role over it, so declaring roles on a policy that admits `user` refuses those calls |
+ *
+ * Absent means any signed-in caller the target-authorization port admits. That is a legitimate choice
+ * for a person's own account or a member acting for their own tenant, and it is REFUSED at parse time
+ * when the policy admits an `application`-owned connection: without roles, every signed-in person could
+ * spend the application's own vendor account.
+ */
+export const ProviderBrowserOperationPolicySchema = z.strictObject({
+    connections: z.array(ExternalProvider_ConnectionShapeSchema).min(1),
+    allowedRoles: z.array(z.string().trim().min(1)).min(1).optional(),
+}).superRefine((policy, ctx) => {
+    const admitsApplicationAccount = policy.connections.some((shape) => shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION);
+    if (admitsApplicationAccount && policy.allowedRoles === undefined) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['allowedRoles'],
+            message: 'A browser-reachable operation that may spend the APPLICATION-owned connection must declare `allowedRoles`. '
+                + 'Without it every signed-in person could spend the application\'s own vendor account.',
+        });
+    }
+});
+/**
+ * `providerRef` → `operationId` → policy. The operation id is the catalogue's own, exactly as a typed
+ * client or an ETL binding reference names it.
+ *
+ * Absent is an EMPTY map — nothing is browser-reachable — never "everything".
+ */
+export const ProviderBrowserOperationPoliciesSchema = z.record(z.string().min(1), z.record(z.string().min(1), ProviderBrowserOperationPolicySchema)).default(() => ({}));
+/** @wildo_source:part:end saas.models.providers.browser-operation-policy */
+//# sourceMappingURL=provider-browser-operations.shared.schemas.js.map