@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/external-providers/provider-browser-operations.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-browser-operations.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-browser-operations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,kJAAkJ;AAClJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,wBAAwB,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CACtD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CACnF,CAAC;IACF,IAAI,wBAAwB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EACL,6GAA6G;kBAC3G,sFAAsF;SAC3F,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAClE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtB,4EAA4E","sourcesContent":["/**\n * WHICH provider operations a signed-in person's browser may trigger — the application's decision (#367).\n *\n * ## The question this answers, and why nothing else did\n *\n * A provider operation runs on the backend, through `ProviderOperationExecutorBackendService`, because\n * the credential it spends must never travel to a browser. A custom backend service reaches it through\n * a generated typed client. A custom FRONTEND component had no way to reach it at all, and the door\n * that gives it one has to answer a question no existing engine surface answers: *which operations may\n * a browser trigger, for whom, and on whose account*.\n *\n * The answer is a DECLARATION, authored in the application's SaaS config beside `providers.connections`\n * and with the same standing: both are the application's decisions about providers, as opposed to what\n * a vendor's catalogue says it can support.\n *\n * ## Fail closed, by construction\n *\n * An operation absent from this map is NOT reachable from a browser. There is no default, no\n * \"READ operations are fine\" shortcut — classification is not sufficient: a READ still spends a tenant's\n * credential, can page a vendor's whole account, and returns whatever the vendor holds. The map is the\n * only thing that opens the door, one operation at a time.\n *\n * ## Rejected: a flag on the operation in the provider catalogue\n *\n * The catalogue is generated from third-party sources and overwritten on every regeneration, and it\n * describes the VENDOR. Letting it decide what a browser may trigger would let a scraped listing grant\n * access in every application that installs the provider — and a regeneration could grant or revoke it\n * without anyone opening the application.\n */\n\nimport {\n  ExternalProvider_Connection_OwnerScope,\n  ExternalProvider_ConnectionShapeSchema,\n} from '@wildo-ai/external-connectors-models';\nimport { z } from 'zod';\n\n/** @wildo_source:part:start saas.models.providers.browser-operation-policy facet:layer:shared facet:family:config facet:audience:app-developer */\n/**\n * One browser-reachable operation.\n *\n * ## `connections` — whose account a browser-triggered call may spend\n *\n * Owner-scope × delegation pairs, in the vocabulary the catalogue, `providers.connections`, the connect\n * leg and the resolver already share. NARROWING ONLY: a call must satisfy this list AND the provider's\n * admissible connections as `providers.connections` narrows them. Naming a shape the provider does not\n * admit grants nothing.\n *\n * Every call still passes the target-authorization port before anything is spent — a person may name\n * only an organization they belong to organization-wide, and only their own user account. This list\n * narrows further; it can never widen what that port allows.\n *\n * ## `allowedRoles` — who may trigger it\n *\n * Role keys, resolved through the LIVE role hierarchy (a custom role inheriting from a listed one\n * qualifies), and read in the scope of the ACCOUNT BEING SPENT:\n *\n * | target | roles are read from |\n * |---|---|\n * | `organization` | the caller's organization-WIDE roles in THAT organization — a unit-scoped grant never counts |\n * | `application` | the caller's application roles |\n * | `user` | not applicable — a person acting on their own account holds no role over it, so declaring roles on a policy that admits `user` refuses those calls |\n *\n * Absent means any signed-in caller the target-authorization port admits. That is a legitimate choice\n * for a person's own account or a member acting for their own tenant, and it is REFUSED at parse time\n * when the policy admits an `application`-owned connection: without roles, every signed-in person could\n * spend the application's own vendor account.\n */\nexport const ProviderBrowserOperationPolicySchema = z.strictObject({\n  connections: z.array(ExternalProvider_ConnectionShapeSchema).min(1),\n  allowedRoles: z.array(z.string().trim().min(1)).min(1).optional(),\n}).superRefine((policy, ctx) => {\n  const admitsApplicationAccount = policy.connections.some(\n    (shape) => shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION,\n  );\n  if (admitsApplicationAccount && policy.allowedRoles === undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['allowedRoles'],\n      message:\n        'A browser-reachable operation that may spend the APPLICATION-owned connection must declare `allowedRoles`. '\n        + 'Without it every signed-in person could spend the application\\'s own vendor account.',\n    });\n  }\n});\nexport type ProviderBrowserOperationPolicy = z.infer<typeof ProviderBrowserOperationPolicySchema>;\n\n/**\n * `providerRef` → `operationId` → policy. The operation id is the catalogue's own, exactly as a typed\n * client or an ETL binding reference names it.\n *\n * Absent is an EMPTY map — nothing is browser-reachable — never \"everything\".\n */\nexport const ProviderBrowserOperationPoliciesSchema = z.record(\n  z.string().min(1),\n  z.record(z.string().min(1), ProviderBrowserOperationPolicySchema),\n).default(() => ({}));\nexport type ProviderBrowserOperationPolicies = z.infer<typeof ProviderBrowserOperationPoliciesSchema>;\n/** @wildo_source:part:end saas.models.providers.browser-operation-policy */\n"]}

package/dist/esm/external-providers/provider-capability.shared.schemas.d.ts

@@ -1,17 +1,17 @@
 /**
- * `ProviderCapability` — open, app-extensible enum of standardized
- * behaviors that providers implement.
+ * `ProviderCapability` — the closed vocabulary of standardized behaviors
+ * a provider claims to implement.
  *
  * Distinct from `EngineCapability` (closed, engine-defined slots that
- * may require fulfillment). See the analysis glossary in
- * `.cursor/plans/provider-registration-refactor-draft-analysis.md` §14
- * for the full naming rationale; this file is the canonical Phase-0
- * authoring surface called out in §Phase 0.2 of the implementation
- * plan.
+ * may require fulfillment): a provider CLAIMS a `ProviderCapability`, and
+ * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` projects the claims that fill
+ * an engine slot.
  *
- * Built-in values use SCREAMING_SNAKE_CASE; app-augmented values SHOULD
- * use kebab-case + domain prefix (e.g. `'live-chat-handoff'`,
- * `'search-index'`). The two namespaces never collide by construction.
+ * This header described the vocabulary as "open, app-extensible", with a
+ * kebab-case convention for app-augmented values, until 2026-09-12. The
+ * augmentation point was removed by #502 (see below), so no second namespace
+ * exists; the `.cursor/plans/` citation it carried named a directory that no
+ * longer exists.
  */
 /** @wildo_source:part:start saas.models.provider-capabilities facet:kind:api facet:audience:app-developer
  *
@@ -105,9 +105,10 @@ export declare const BUILTIN_PROVIDER_CAPABILITY: {
 /** @wildo_source:part:end saas.models.provider-capabilities */
 export type BuiltinProviderCapability = (typeof BUILTIN_PROVIDER_CAPABILITY)[keyof typeof BUILTIN_PROVIDER_CAPABILITY];
 /**
- * Union of every possible provider capability — the closed built-in set
- * plus any app-side augmentations. Consumers (registries, transformers,
- * lock-file digests) accept this union.
+ * Every provider capability — exactly the closed built-in set. There is no
+ * app-side augmentation (removed by #502, see above), so this is a name for
+ * `BuiltinProviderCapability` that consumers (the provider registries, the
+ * provider component registry, lock-file digests) accept.
  */
 export type ProviderCapability = BuiltinProviderCapability;
 //# sourceMappingURL=provider-capability.shared.schemas.d.ts.map

package/dist/esm/external-providers/provider-capability.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-capability.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-capability.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B;;;;IAItC;;;;;;;;OAQG;;;IAGH,sEAAsE;;;;IAItE;;;;;;;;;;;;;;OAcG;;IAEH;;;;;;;;;;OAUG;;;;;;;;IAQH;;;;;OAKG;;IAEH;;;;;OAKG;;IAEH;;;;;;;OAOG;;CAEK,CAAC;AACX,+DAA+D;AAE/D,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAiBjF;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"provider-capability.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-capability.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B;;;;IAItC;;;;;;;;OAQG;;;IAGH,sEAAsE;;;;IAItE;;;;;;;;;;;;;;OAcG;;IAEH;;;;;;;;;;OAUG;;;;;;;;IAQH;;;;;OAKG;;IAEH;;;;;OAKG;;IAEH;;;;;;;OAOG;;CAEK,CAAC;AACX,+DAA+D;AAE/D,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAiBjF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC"}

package/dist/esm/external-providers/provider-capability.shared.schemas.js

@@ -1,17 +1,17 @@
 /**
- * `ProviderCapability` — open, app-extensible enum of standardized
- * behaviors that providers implement.
+ * `ProviderCapability` — the closed vocabulary of standardized behaviors
+ * a provider claims to implement.
  *
  * Distinct from `EngineCapability` (closed, engine-defined slots that
- * may require fulfillment). See the analysis glossary in
- * `.cursor/plans/provider-registration-refactor-draft-analysis.md` §14
- * for the full naming rationale; this file is the canonical Phase-0
- * authoring surface called out in §Phase 0.2 of the implementation
- * plan.
+ * may require fulfillment): a provider CLAIMS a `ProviderCapability`, and
+ * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` projects the claims that fill
+ * an engine slot.
  *
- * Built-in values use SCREAMING_SNAKE_CASE; app-augmented values SHOULD
- * use kebab-case + domain prefix (e.g. `'live-chat-handoff'`,
- * `'search-index'`). The two namespaces never collide by construction.
+ * This header described the vocabulary as "open, app-extensible", with a
+ * kebab-case convention for app-augmented values, until 2026-09-12. The
+ * augmentation point was removed by #502 (see below), so no second namespace
+ * exists; the `.cursor/plans/` citation it carried named a directory that no
+ * longer exists.
  */
 /** @wildo_source:part:start saas.models.provider-capabilities facet:kind:api facet:audience:app-developer
  *

package/dist/esm/external-providers/provider-capability.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-capability.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-capability.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,eAAe,EAAE,iBAAiB;IAClC,GAAG,EAAE,KAAK;IACV;;;;;;;;OAQG;IACH,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,YAAY;IACxB,sEAAsE;IACtE,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;IAChC;;;;;;;;;;;;;;OAcG;IACH,wBAAwB,EAAE,0BAA0B;IACpD;;;;;;;;;;OAUG;IACH,YAAY,EAAE,cAAc;IAC5B,gBAAgB,EAAE,kBAAkB;IACpC,yBAAyB,EAAE,2BAA2B;IACtD,0BAA0B,EAAE,4BAA4B;IACxD,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,gBAAgB,EAAE,kBAAkB;IACpC;;;;;OAKG;IACH,iBAAiB,EAAE,mBAAmB;IACtC;;;;;OAKG;IACH,uBAAuB,EAAE,yBAAyB;IAClD;;;;;;;OAOG;IACH,sBAAsB,EAAE,wBAAwB;CACxC,CAAC","sourcesContent":["/**\n * `ProviderCapability` — open, app-extensible enum of standardized\n * behaviors that providers implement.\n *\n * Distinct from `EngineCapability` (closed, engine-defined slots that\n * may require fulfillment). See the analysis glossary in\n * `.cursor/plans/provider-registration-refactor-draft-analysis.md` §14\n * for the full naming rationale; this file is the canonical Phase-0\n * authoring surface called out in §Phase 0.2 of the implementation\n * plan.\n *\n * Built-in values use SCREAMING_SNAKE_CASE; app-augmented values SHOULD\n * use kebab-case + domain prefix (e.g. `'live-chat-handoff'`,\n * `'search-index'`). The two namespaces never collide by construction.\n */\n\n/** @wildo_source:part:start saas.models.provider-capabilities facet:kind:api facet:audience:app-developer\n *\n * Built-in provider capabilities shipped by the framework.\n *\n * Authoring rule: keep this list narrow and stable. Adding a new\n * built-in capability is a framework-level decision (it implies the\n * engine knows how to consume the capability via a transformer or a\n * platform binding). There is no app-side extension point: an application\n * needing a capability this vocabulary does not name is a decision to widen\n * the vocabulary, taken with the resolution path that would make it mean\n * something (#502).\n */\nexport const BUILTIN_PROVIDER_CAPABILITY = {\n  EMAIL_TRANSACTIONAL: 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING: 'EMAIL_MARKETING',\n  SMS: 'SMS',\n  /**\n   * Single billing-engagement capability covering everything from\n   * Checkout-style hosted flows to first-party PaymentIntent flows.\n   * Webhook delivery is NOT a separate capability — it is modelled at\n   * the protocol layer (e.g. Stripe declares both a `BILLING_PROVIDER`\n   * and a `WEBHOOK_ORIGINATOR` protocol but a single `BILLING`\n   * capability). This 1:1 matches the billing slot from the older\n   * external connector transformer vocabulary.\n   */\n  BILLING: 'BILLING',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  /** Reserved for future SAML-based SSO providers (none ship today). */\n  SSO_SAML: 'SSO_SAML',\n  LLM_CHAT: 'LLM_CHAT',\n  LLM_EMBEDDINGS: 'LLM_EMBEDDINGS',\n  /**\n   * Provider turns DOCUMENT BYTES into text — OCR over scans and photographs of pages, not merely\n   * a read of a PDF's existing text layer. Maps to `EngineCapability.AI_DOCUMENT_EXTRACTION`.\n   *\n   * A NEW token was genuinely required rather than convenient: `IMAGE_GENERATION` is an OUTPUT\n   * capability (text → image), and PDF *generation* — the `pdfTemplates` surface — is this\n   * capability's exact opposite. Nothing in the existing vocabulary claimed the document-INPUT\n   * slot. (This paragraph used to name `EngineCapability.DOCUMENT_GENERATION`; that member was\n   * withdrawn because no provider capability could fill it.)\n   *\n   * Distinct from `LLM_CHAT` even where a vendor serves both from one API key: the work is\n   * different (a page-layout model, billed per page, with no sampling parameters), and fusing\n   * them would make the OCR provider unselectable independently of the chat provider — the exact\n   * defect that splitting `AI_EMBEDDINGS` out of `AI_LLM` existed to fix.\n   */\n  DOCUMENT_TEXT_EXTRACTION: 'DOCUMENT_TEXT_EXTRACTION',\n  /**\n   * Provider ships an autonomous CODING AGENT: a process that reads and writes\n   * a workspace, runs commands, and requests authorisation, reachable over the\n   * Agent Client Protocol.\n   *\n   * Distinct from `LLM_CHAT` because the WORK is\n   * different, not merely its transport. A chat model returns text for a caller\n   * to act on; a coding agent acts, and the resulting obligations — permission\n   * decisions, mutation scope, change attribution, verification — have no\n   * counterpart in a completion call.\n   */\n  CODING_AGENT: 'CODING_AGENT',\n  IMAGE_GENERATION: 'IMAGE_GENERATION',\n  FRONTEND_ERROR_MONITORING: 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS: 'FRONTEND_PRODUCT_ANALYTICS',\n  FRONTEND_SEARCH: 'FRONTEND_SEARCH',\n  FRONTEND_FILE_PICKER: 'FRONTEND_FILE_PICKER',\n  FRONTEND_CAPTCHA: 'FRONTEND_CAPTCHA',\n  /**\n   * Backend LLM-call observability — a provider that ingests per-`invokeAgent`\n   * generation traces (model / tokens / cost / latency), e.g. PostHog\n   * `$ai_generation`. Maps to `EngineCapability.LLM_OBSERVABILITY`. The engine\n   * consumes it via the `AgentCallTraceSink` (not a request/response transformer).\n   */\n  LLM_OBSERVABILITY: 'LLM_OBSERVABILITY',\n  /**\n   * Operational-telemetry sink — a provider that ingests OpenTelemetry traces,\n   * metrics, and logs over OTLP (e.g. BetterStack). Maps to\n   * `EngineCapability.OBSERVABILITY_TELEMETRY`. Consumed by the OTel SDK preload\n   * (env-var-driven), NOT a request/response transformer or a DI sink.\n   */\n  OBSERVABILITY_TELEMETRY: 'OBSERVABILITY_TELEMETRY',\n  /**\n   * Audit-log sink — a provider that stores or forwards compliance audit\n   * events (who-did-what-when), e.g. immudb (tamper-evident) or a SIEM\n   * webhook. Maps to `EngineCapability.COMPLIANCE_AUDIT_TRAIL`, a FAN_OUT\n   * capability: every declared audit provider receives every event (see\n   * `getEngineCapabilityResolutionMode`). The engine consumes it via the\n   * `AuditLogSink` DI fan-out, layered on the always-on database audit store.\n   */\n  COMPLIANCE_AUDIT_TRAIL: 'COMPLIANCE_AUDIT_TRAIL',\n} as const;\n/** @wildo_source:part:end saas.models.provider-capabilities */\n\nexport type BuiltinProviderCapability =\n  (typeof BUILTIN_PROVIDER_CAPABILITY)[keyof typeof BUILTIN_PROVIDER_CAPABILITY];\n\n/*\n * The app-side augmentation point was REMOVED here (#502, decided 2026-09-08).\n *\n * `AppCustomProviderCapabilities` was an empty interface, extended by no application in the\n * repository, whose own docstring described wiring it into `getProvidersByProviderCapability()` as a\n * later phase nobody scheduled. It offered a choice that did not exist: `keyof` an empty interface is\n * `never`, so the union below already resolved to `BuiltinProviderCapability` and removing it changes\n * the resolved type for none of its consumers.\n *\n * If an application genuinely needs a capability the built-in vocabulary does not name, that is a\n * decision about widening a CLOSED semantic vocabulary — with a resolution path built at the same\n * time — not an empty interface left open in advance. An extension point with no resolver is not\n * extensibility; it is a promise nothing can keep.\n */\n\n/**\n * Union of every possible provider capability — the closed built-in set\n * plus any app-side augmentations. Consumers (registries, transformers,\n * lock-file digests) accept this union.\n */\nexport type ProviderCapability = BuiltinProviderCapability;\n"]}
+{"version":3,"file":"provider-capability.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-capability.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,eAAe,EAAE,iBAAiB;IAClC,GAAG,EAAE,KAAK;IACV;;;;;;;;OAQG;IACH,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,YAAY;IACxB,sEAAsE;IACtE,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;IAChC;;;;;;;;;;;;;;OAcG;IACH,wBAAwB,EAAE,0BAA0B;IACpD;;;;;;;;;;OAUG;IACH,YAAY,EAAE,cAAc;IAC5B,gBAAgB,EAAE,kBAAkB;IACpC,yBAAyB,EAAE,2BAA2B;IACtD,0BAA0B,EAAE,4BAA4B;IACxD,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,gBAAgB,EAAE,kBAAkB;IACpC;;;;;OAKG;IACH,iBAAiB,EAAE,mBAAmB;IACtC;;;;;OAKG;IACH,uBAAuB,EAAE,yBAAyB;IAClD;;;;;;;OAOG;IACH,sBAAsB,EAAE,wBAAwB;CACxC,CAAC","sourcesContent":["/**\n * `ProviderCapability` — the closed vocabulary of standardized behaviors\n * a provider claims to implement.\n *\n * Distinct from `EngineCapability` (closed, engine-defined slots that\n * may require fulfillment): a provider CLAIMS a `ProviderCapability`, and\n * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` projects the claims that fill\n * an engine slot.\n *\n * This header described the vocabulary as \"open, app-extensible\", with a\n * kebab-case convention for app-augmented values, until 2026-09-12. The\n * augmentation point was removed by #502 (see below), so no second namespace\n * exists; the `.cursor/plans/` citation it carried named a directory that no\n * longer exists.\n */\n\n/** @wildo_source:part:start saas.models.provider-capabilities facet:kind:api facet:audience:app-developer\n *\n * Built-in provider capabilities shipped by the framework.\n *\n * Authoring rule: keep this list narrow and stable. Adding a new\n * built-in capability is a framework-level decision (it implies the\n * engine knows how to consume the capability via a transformer or a\n * platform binding). There is no app-side extension point: an application\n * needing a capability this vocabulary does not name is a decision to widen\n * the vocabulary, taken with the resolution path that would make it mean\n * something (#502).\n */\nexport const BUILTIN_PROVIDER_CAPABILITY = {\n  EMAIL_TRANSACTIONAL: 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING: 'EMAIL_MARKETING',\n  SMS: 'SMS',\n  /**\n   * Single billing-engagement capability covering everything from\n   * Checkout-style hosted flows to first-party PaymentIntent flows.\n   * Webhook delivery is NOT a separate capability — it is modelled at\n   * the protocol layer (e.g. Stripe declares both a `BILLING_PROVIDER`\n   * and a `WEBHOOK_ORIGINATOR` protocol but a single `BILLING`\n   * capability). This 1:1 matches the billing slot from the older\n   * external connector transformer vocabulary.\n   */\n  BILLING: 'BILLING',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  /** Reserved for future SAML-based SSO providers (none ship today). */\n  SSO_SAML: 'SSO_SAML',\n  LLM_CHAT: 'LLM_CHAT',\n  LLM_EMBEDDINGS: 'LLM_EMBEDDINGS',\n  /**\n   * Provider turns DOCUMENT BYTES into text — OCR over scans and photographs of pages, not merely\n   * a read of a PDF's existing text layer. Maps to `EngineCapability.AI_DOCUMENT_EXTRACTION`.\n   *\n   * A NEW token was genuinely required rather than convenient: `IMAGE_GENERATION` is an OUTPUT\n   * capability (text → image), and PDF *generation* — the `pdfTemplates` surface — is this\n   * capability's exact opposite. Nothing in the existing vocabulary claimed the document-INPUT\n   * slot. (This paragraph used to name `EngineCapability.DOCUMENT_GENERATION`; that member was\n   * withdrawn because no provider capability could fill it.)\n   *\n   * Distinct from `LLM_CHAT` even where a vendor serves both from one API key: the work is\n   * different (a page-layout model, billed per page, with no sampling parameters), and fusing\n   * them would make the OCR provider unselectable independently of the chat provider — the exact\n   * defect that splitting `AI_EMBEDDINGS` out of `AI_LLM` existed to fix.\n   */\n  DOCUMENT_TEXT_EXTRACTION: 'DOCUMENT_TEXT_EXTRACTION',\n  /**\n   * Provider ships an autonomous CODING AGENT: a process that reads and writes\n   * a workspace, runs commands, and requests authorisation, reachable over the\n   * Agent Client Protocol.\n   *\n   * Distinct from `LLM_CHAT` because the WORK is\n   * different, not merely its transport. A chat model returns text for a caller\n   * to act on; a coding agent acts, and the resulting obligations — permission\n   * decisions, mutation scope, change attribution, verification — have no\n   * counterpart in a completion call.\n   */\n  CODING_AGENT: 'CODING_AGENT',\n  IMAGE_GENERATION: 'IMAGE_GENERATION',\n  FRONTEND_ERROR_MONITORING: 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS: 'FRONTEND_PRODUCT_ANALYTICS',\n  FRONTEND_SEARCH: 'FRONTEND_SEARCH',\n  FRONTEND_FILE_PICKER: 'FRONTEND_FILE_PICKER',\n  FRONTEND_CAPTCHA: 'FRONTEND_CAPTCHA',\n  /**\n   * Backend LLM-call observability — a provider that ingests per-`invokeAgent`\n   * generation traces (model / tokens / cost / latency), e.g. PostHog\n   * `$ai_generation`. Maps to `EngineCapability.LLM_OBSERVABILITY`. The engine\n   * consumes it via the `AgentCallTraceSink` (not a request/response transformer).\n   */\n  LLM_OBSERVABILITY: 'LLM_OBSERVABILITY',\n  /**\n   * Operational-telemetry sink — a provider that ingests OpenTelemetry traces,\n   * metrics, and logs over OTLP (e.g. BetterStack). Maps to\n   * `EngineCapability.OBSERVABILITY_TELEMETRY`. Consumed by the OTel SDK preload\n   * (env-var-driven), NOT a request/response transformer or a DI sink.\n   */\n  OBSERVABILITY_TELEMETRY: 'OBSERVABILITY_TELEMETRY',\n  /**\n   * Audit-log sink — a provider that stores or forwards compliance audit\n   * events (who-did-what-when), e.g. immudb (tamper-evident) or a SIEM\n   * webhook. Maps to `EngineCapability.COMPLIANCE_AUDIT_TRAIL`, a FAN_OUT\n   * capability: every declared audit provider receives every event (see\n   * `getEngineCapabilityResolutionMode`). The engine consumes it via the\n   * `AuditLogSink` DI fan-out, layered on the always-on database audit store.\n   */\n  COMPLIANCE_AUDIT_TRAIL: 'COMPLIANCE_AUDIT_TRAIL',\n} as const;\n/** @wildo_source:part:end saas.models.provider-capabilities */\n\nexport type BuiltinProviderCapability =\n  (typeof BUILTIN_PROVIDER_CAPABILITY)[keyof typeof BUILTIN_PROVIDER_CAPABILITY];\n\n/*\n * The app-side augmentation point was REMOVED here (#502, decided 2026-09-08).\n *\n * `AppCustomProviderCapabilities` was an empty interface, extended by no application in the\n * repository, whose own docstring described wiring it into `getProvidersByProviderCapability()` as a\n * later phase nobody scheduled. It offered a choice that did not exist: `keyof` an empty interface is\n * `never`, so the union below already resolved to `BuiltinProviderCapability` and removing it changes\n * the resolved type for none of its consumers.\n *\n * If an application genuinely needs a capability the built-in vocabulary does not name, that is a\n * decision about widening a CLOSED semantic vocabulary — with a resolution path built at the same\n * time — not an empty interface left open in advance. An extension point with no resolver is not\n * extensibility; it is a promise nothing can keep.\n */\n\n/**\n * Every provider capability — exactly the closed built-in set. There is no\n * app-side augmentation (removed by #502, see above), so this is a name for\n * `BuiltinProviderCapability` that consumers (the provider registries, the\n * provider component registry, lock-file digests) accept.\n */\nexport type ProviderCapability = BuiltinProviderCapability;\n"]}

package/dist/esm/external-providers/provider-compliance-profile.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-compliance-profile.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,oBAAY,uBAAuB;IACjC;;;OAGG;IACH,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,WAAW,gBAAgB;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;OAMG;;IAEH;;;;;;;;;;;;;OAaG;;IAEH;;;;;;;OAOG;;kBAkBH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,yCAAyC,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAErG;AAED,uHAAuH;AACvH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;kBAyBH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G,qEAAqE;AACrE,eAAO,MAAM,0CAA0C;IAtDrD;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;mBAgCJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE;IACnD,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC;IACvD,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;CACrF,GAAG,aAAa,CAAC;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAc3E;AACD,qEAAqE;AAErE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oCAAoC,GAAG,SAAS,MAAM,EAAE,CAKzG"}
+{"version":3,"file":"provider-compliance-profile.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,oBAAY,uBAAuB;IACjC;;;OAGG;IACH,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,WAAW,gBAAgB;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,+BAA+B;IAC1C;;;;;;OAMG;;IAEH;;;;;;;;;;;;;OAaG;;IAEH;;;;;;;OAOG;;kBAkBH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,yCAAyC,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAErG;AAED,uHAAuH;AACvH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;kBAyBH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G,qEAAqE;AACrE,eAAO,MAAM,0CAA0C;IAtDrD;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;mBAgCJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE;IACnD,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC;IACvD,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;CACrF,GAAG,aAAa,CAAC;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAc3E;AACD,qEAAqE;AAErE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oCAAoC,GAAG,SAAS,MAAM,EAAE,CAKzG"}

package/dist/esm/external-providers/provider-compliance-profile.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-compliance-profile.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,uBAYX;AAZD,WAAY,uBAAuB;IACjC;;;OAGG;IACH,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;AAC7B,CAAC,EAZW,uBAAuB,KAAvB,uBAAuB,QAYlC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAClC;;;;;;;OAOG;IACH,IAAI,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvH,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,mIAAmI;SAC7I,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,4GAA4G;AAC5G,MAAM,UAAU,0BAA0B,CAAC,OAAkC;IAC3E,OAAO,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yCAAyC,CAAC,OAAkC;IAC1F,OAAO,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,uHAAuH;AACvH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAChD;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC;;;;;;;OAOG;IACH,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC9G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,qIAAqI;SAC/I,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC5G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,wIAAwI;SAClJ,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,qEAAqE;AACrE,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACxB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAG5C;IACC,MAAM,QAAQ,GAAmD,EAAE,CAAC;IAEpE,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAAE,SAAS;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC1D,+FAA+F;QAC/F,gFAAgF;QAChF,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,qEAAqE;AAErE;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA6C;IACpF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,CAAC;SACxF,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;SACnC,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHO RUNS the software a provider module drives.\n *\n * This is the axis that decides whether a provider is a third-party RECIPIENT of personal data at\n * all, and until 2026-08-30 it did not exist anywhere in the provider model. immudb is described in\n * `BUILTIN_PROVIDER_CAPABILITY` as an audit-trail provider with nothing separating the container an\n * operator runs themselves from a hosted service — so the first privacy notice to ENUMERATE\n * recipients would have named a self-hosted audit ledger as a third party. That is false, and false\n * in the direction that alarms a reader rather than the direction they can check.\n *\n * ⚠️ NOT a hosting-topology field and not an infrastructure concern. It answers one compliance\n * question — does personal data leave the operator's control by reaching this provider — and a\n * consumer must not read it as \"where is it deployed\".\n */\nexport enum ProviderDeploymentModel {\n  /**\n   * The vendor runs it. Data reaching this provider reaches a third party, so it is a processor\n   * under Art. 28 and belongs in the subprocessor register.\n   */\n  VENDOR_HOSTED = 'VENDOR_HOSTED',\n  /**\n   * The operator runs it — their own container, their own infrastructure. No third party receives\n   * anything, so it is NOT a recipient. A notice states it as processing under the operator's own\n   * control, which is a different sentence and a stronger one.\n   */\n  SELF_HOSTED = 'SELF_HOSTED',\n}\n\n/**\n * The compliance-relevant facts a PROVIDER MODULE knows about itself.\n *\n * ## Why these live on the provider and not on the application\n *\n * The processor register shipped by issue #88 was fully application-authored, and that made every\n * application restate facts the framework already holds. What a provider IS — who runs it, which\n * regions its vendor offers, what legal entity stands behind it — does not vary per application, and\n * an application asked to restate it will eventually get it wrong. What DOES vary is the operator's\n * CHOICE among those possibilities, and that is configuration.\n *\n * So the split is: possibilities here, choice in `wildo.saas.config.ts`, and the register entry\n * derived from both (issue #130).\n *\n * ## What is deliberately NOT here\n *\n * **A transfer mechanism.** Adequacy decisions move by court ruling rather than by release cycle, so\n * a list baked into the engine goes stale silently and emits a false compliance statement — the worst\n * failure mode in this lane. The mechanism is a legal determination with a shelf life, recorded per\n * subprocessor entry by a human, never derived here (issue #126).\n *\n * **What the provider RECEIVES.** That is already implied by the capability it serves —\n * `BUILTIN_PROVIDER_CAPABILITY` describes the data flow per member. Restating it here would be a\n * second authority for one fact.\n */\nexport const ProviderComplianceProfileSchema = z.strictObject({\n  /**\n   * The deployment models this provider SUPPORTS — one, or both where the provider genuinely offers\n   * a choice (immudb: a hosted service and a container you run).\n   *\n   * A single entry means the answer is not the operator's to make and no configuration should offer\n   * it. Two means the application must choose, and a register entry cannot be derived until it has.\n   */\n  deploymentModels: z.array(z.enum(ProviderDeploymentModel)).min(1),\n  /**\n   * The regions this vendor can process in — POSSIBILITIES the operator chooses from, never a\n   * choice already made.\n   *\n   * Open strings, deliberately, because these are the VENDOR's own labels (`eu-west-1`,\n   * `us-east-1`, `EU`) and a closed enum here would be this repository inventing a vocabulary it\n   * does not own. The compliance question a transfer statement asks is about JURISDICTION rather\n   * than datacentre, and mapping one to the other is part of the legal determination that is\n   * deliberately not modelled (see above).\n   *\n   * EMPTY is meaningful and is the honest answer for a provider that is only ever self-hosted: the\n   * region is wherever the operator runs it, which the framework cannot know. A configuration\n   * choosing `SELF_HOSTED` therefore needs no region from this list.\n   */\n  processingRegions: z.array(z.string().trim().min(1)),\n  /**\n   * The vendor's legal entity, where the provider module's author can state it.\n   *\n   * OPTIONAL, and the reason is that this is the field most likely to go stale: vendors reorganise,\n   * and a stale legal entity published as a current one is worse than an absent one. Absent means\n   * the application must declare it on the register entry, which is where an operator's own contract\n   * makes it checkable.\n   */\n  vendorLegalEntityName: z.string().trim().min(1).optional(),\n}).superRefine((profile, context) => {\n  /*\n   * A VENDOR_HOSTED provider that offers no region cannot support a transfer statement, and the\n   * whole point of carrying regions is that a transfer statement becomes derivable. Refused at the\n   * schema so the gap surfaces where the provider module is authored, rather than as an\n   * unexplainable hole in a produced notice months later.\n   *\n   * The SELF_HOSTED-only case is exempt above: its region is wherever the operator runs it.\n   */\n  if (profile.deploymentModels.includes(ProviderDeploymentModel.VENDOR_HOSTED) && profile.processingRegions.length === 0) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegions'],\n      message: 'a VENDOR_HOSTED provider must declare at least one processing region — without one, no transfer statement about it can be derived',\n    });\n  }\n});\nexport type ProviderComplianceProfile = z.infer<typeof ProviderComplianceProfileSchema>;\n\n/** True when this provider can only ever be run by the operator, so it is never a third-party recipient. */\nexport function providerIsAlwaysSelfHosted(profile: ProviderComplianceProfile): boolean {\n  return profile.deploymentModels.every((model) => model === ProviderDeploymentModel.SELF_HOSTED);\n}\n\n/**\n * True when the operator must CHOOSE, because the provider supports both.\n *\n * A register entry for such a provider cannot be derived from the provider module alone — the\n * application's configuration decides whether it is a recipient at all.\n */\nexport function providerDeploymentModelIsAnOperatorChoice(profile: ProviderComplianceProfile): boolean {\n  return profile.deploymentModels.length > 1;\n}\n\n/** @wildo_source:part:start saas.models.providers.compliance-choice facet:layer:shared facet:audience:app-developer */\n/**\n * The application's CHOICE among what a provider offers — one entry per configured provider.\n *\n * The provider declares possibilities ({@link ProviderComplianceProfileSchema}); this is where an\n * operator says which of them applies to their deployment. Keeping the two apart is the whole point\n * of the layering: a vendor's regions change when it opens a data centre, an operator's choice\n * changes when they migrate, and collapsing them would make one edit look like the other.\n *\n * Not carried inside `providerConfigurations`, which is an opaque `Record<string, unknown>` bag for a\n * provider's own runtime profile. A compliance answer must not live somewhere nothing can read it\n * without knowing the provider.\n */\nexport const ApplicationProviderComplianceChoiceSchema = z.strictObject({\n  /**\n   * Who runs this provider in THIS deployment.\n   *\n   * Required even when the provider supports only one model. The redundancy is deliberate: whether\n   * personal data leaves the operator's control is the single most consequential fact a notice states\n   * about a provider, and reading it out of a framework default rather than an operator's declaration\n   * is how a wrong one goes unnoticed.\n   */\n  deploymentModel: z.enum(ProviderDeploymentModel),\n  /**\n   * Which region this provider processes in, chosen from what the provider declares possible.\n   *\n   * NOT validated here, and NOT validated at boot either. This schema cannot see the provider\n   * registry, and refusing an unlisted region would make a vendor's new data centre an application\n   * build failure, so the intended posture is warn-do-not-block: a region outside the provider's\n   * declared list is APP-ASSERTED and reported, never refused.\n   *\n   * WIRED since 2026-09-10 (issue #308). `appAssertedProcessingRegions` below computes exactly that\n   * set, and the companion's compliance-primary-facts section reports it per provider, naming both the\n   * configured value and what the provider declares — because a divergence is either a typo or a stale\n   * provider module, and those are opposite work. It took this long only because of a DATA PATH: the\n   * vendor's region list lives on the backend provider module and the renderer reads provider\n   * SPECIFICATIONS, so the helper could not be called until `complianceProfile` was mirrored onto the\n   * specification contract. Any future report must call this helper rather than re-derive the\n   * comparison.\n   */\n  processingRegion: z.string().trim().min(1).optional(),\n}).superRefine((choice, context) => {\n  /*\n   * The pairing, in both directions.\n   *\n   * A VENDOR_HOSTED choice with no region leaves the notice unable to state where the data goes,\n   * which is the question this whole layer exists to answer. A SELF_HOSTED choice WITH one is the\n   * fiction the provider layer already refuses: the operator runs it, so its region is wherever they\n   * run it, and a value here would be a guess presented as a configuration.\n   */\n  if (choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED && choice.processingRegion === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a VENDOR_HOSTED provider must be configured with the region it processes in — without one, no notice can state where this data goes',\n    });\n  }\n  if (choice.deploymentModel === ProviderDeploymentModel.SELF_HOSTED && choice.processingRegion !== undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a SELF_HOSTED provider runs wherever the operator runs it, so a processing region here is a guess presented as configuration — drop it',\n    });\n  }\n});\nexport type ApplicationProviderComplianceChoice = z.infer<typeof ApplicationProviderComplianceChoiceSchema>;\n\n/** Per configured provider ref, the operator's compliance choice. */\nexport const ApplicationProviderComplianceChoicesSchema = z.record(\n  z.string().trim().min(1),\n  ApplicationProviderComplianceChoiceSchema,\n);\nexport type ApplicationProviderComplianceChoices = z.infer<typeof ApplicationProviderComplianceChoicesSchema>;\n\n/**\n * Regions an application asserts that the provider does not declare.\n *\n * Reported, never refused — a vendor opening a data centre must not become a build failure, and an\n * operator who genuinely knows better than a stale framework list should be able to say so. What the\n * framework owes is that the divergence is VISIBLE, which is the same trade the personal-data\n * declaration report makes.\n */\nexport function appAssertedProcessingRegions(params: {\n  readonly choices: ApplicationProviderComplianceChoices;\n  readonly profilesByProviderRef: Readonly<Record<string, ProviderComplianceProfile>>;\n}): ReadonlyArray<{ readonly providerRef: string; readonly region: string }> {\n  const asserted: Array<{ providerRef: string; region: string }> = [];\n\n  for (const [providerRef, choice] of Object.entries(params.choices)) {\n    if (choice.processingRegion === undefined) continue;\n    const profile = params.profilesByProviderRef[providerRef];\n    // No profile is not an assertion about a region — it is a provider that declares no compliance\n    // profile at all, which is a different gap and belongs to whoever reports THAT.\n    if (profile === undefined) continue;\n    if (profile.processingRegions.includes(choice.processingRegion)) continue;\n    asserted.push({ providerRef, region: choice.processingRegion });\n  }\n\n  return asserted;\n}\n/** @wildo_source:part:end saas.models.providers.compliance-choice */\n\n/**\n * The configured providers that are THIRD-PARTY RECIPIENTS — vendor-hosted, and therefore processors.\n *\n * A self-hosted provider is excluded by construction rather than by a filter a caller must remember:\n * no data leaves the operator, so it is not a recipient and must never be enumerated as one.\n */\nexport function vendorHostedProviderRefs(choices: ApplicationProviderComplianceChoices): readonly string[] {\n  return Object.entries(choices)\n    .filter(([, choice]) => choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED)\n    .map(([providerRef]) => providerRef)\n    .sort();\n}\n"]}
+{"version":3,"file":"provider-compliance-profile.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,uBAYX;AAZD,WAAY,uBAAuB;IACjC;;;OAGG;IACH,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;AAC7B,CAAC,EAZW,uBAAuB,KAAvB,uBAAuB,QAYlC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAClC;;;;;;;OAOG;IACH,IAAI,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvH,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,mIAAmI;SAC7I,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,4GAA4G;AAC5G,MAAM,UAAU,0BAA0B,CAAC,OAAkC;IAC3E,OAAO,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yCAAyC,CAAC,OAAkC;IAC1F,OAAO,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,uHAAuH;AACvH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAChD;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC;;;;;;;OAOG;IACH,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC9G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,qIAAqI;SAC/I,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC5G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,wIAAwI;SAClJ,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,qEAAqE;AACrE,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACxB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAG5C;IACC,MAAM,QAAQ,GAAmD,EAAE,CAAC;IAEpE,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAAE,SAAS;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC1D,+FAA+F;QAC/F,gFAAgF;QAChF,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,qEAAqE;AAErE;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA6C;IACpF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,CAAC;SACxF,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;SACnC,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHO RUNS the software a provider module drives.\n *\n * This is the axis that decides whether a provider is a third-party RECIPIENT of personal data at\n * all, and until 2026-08-30 it did not exist anywhere in the provider model. immudb is described in\n * `BUILTIN_PROVIDER_CAPABILITY` as an audit-trail provider with nothing separating the container an\n * operator runs themselves from a hosted service — so the first privacy notice to ENUMERATE\n * recipients would have named a self-hosted audit ledger as a third party. That is false, and false\n * in the direction that alarms a reader rather than the direction they can check.\n *\n * ⚠️ NOT a hosting-topology field and not an infrastructure concern. It answers one compliance\n * question — does personal data leave the operator's control by reaching this provider — and a\n * consumer must not read it as \"where is it deployed\".\n */\nexport enum ProviderDeploymentModel {\n  /**\n   * The vendor runs it. Data reaching this provider reaches a third party, so it is a processor\n   * under Art. 28 and belongs in the subprocessor register.\n   */\n  VENDOR_HOSTED = 'VENDOR_HOSTED',\n  /**\n   * The operator runs it — their own container, their own infrastructure. No third party receives\n   * anything, so it is NOT a recipient. A notice states it as processing under the operator's own\n   * control, which is a different sentence and a stronger one.\n   */\n  SELF_HOSTED = 'SELF_HOSTED',\n}\n\n/**\n * The compliance-relevant facts a PROVIDER MODULE knows about itself.\n *\n * ## Why these live on the provider and not on the application\n *\n * The processor register shipped by issue #88 was fully application-authored, and that made every\n * application restate facts the framework already holds. What a provider IS — who runs it, which\n * regions its vendor offers, what legal entity stands behind it — does not vary per application, and\n * an application asked to restate it will eventually get it wrong. What DOES vary is the operator's\n * CHOICE among those possibilities, and that is configuration.\n *\n * So the split is: possibilities here, choice in `wildo.saas.config.ts`, and the register entry\n * derived from both (issue #130).\n *\n * ## What is deliberately NOT here\n *\n * **A transfer mechanism.** Adequacy decisions move by court ruling rather than by release cycle, so\n * a list baked into the engine goes stale silently and emits a false compliance statement — the worst\n * failure mode in this lane. The mechanism is a legal determination with a shelf life, recorded per\n * subprocessor entry by a human, never derived here (issue #126).\n *\n * **What the provider RECEIVES.** That is already implied by the capability it serves —\n * `BUILTIN_PROVIDER_CAPABILITY` describes the data flow per member. Restating it here would be a\n * second authority for one fact.\n */\nexport const ProviderComplianceProfileSchema = z.strictObject({\n  /**\n   * The deployment models this provider SUPPORTS — one, or both where the provider genuinely offers\n   * a choice (immudb: a hosted service and a container you run).\n   *\n   * A single entry means the answer is not the operator's to make and no configuration should offer\n   * it. Two means the application must choose, and a register entry cannot be derived until it has.\n   */\n  deploymentModels: z.array(z.enum(ProviderDeploymentModel)).min(1),\n  /**\n   * The regions this vendor can process in — POSSIBILITIES the operator chooses from, never a\n   * choice already made.\n   *\n   * Open strings, deliberately, because these are the VENDOR's own labels (`eu-west-1`,\n   * `us-east-1`, `EU`) and a closed enum here would be this repository inventing a vocabulary it\n   * does not own. The compliance question a transfer statement asks is about JURISDICTION rather\n   * than datacentre, and mapping one to the other is part of the legal determination that is\n   * deliberately not modelled (see above).\n   *\n   * EMPTY is meaningful and is the honest answer for a provider that is only ever self-hosted: the\n   * region is wherever the operator runs it, which the framework cannot know. A configuration\n   * choosing `SELF_HOSTED` therefore needs no region from this list.\n   */\n  processingRegions: z.array(z.string().trim().min(1)),\n  /**\n   * The vendor's legal entity, where the provider module's author can state it.\n   *\n   * OPTIONAL, and the reason is that this is the field most likely to go stale: vendors reorganise,\n   * and a stale legal entity published as a current one is worse than an absent one. Absent means\n   * the application must declare it on the register entry, which is where an operator's own contract\n   * makes it checkable.\n   */\n  vendorLegalEntityName: z.string().trim().min(1).optional(),\n}).superRefine((profile, context) => {\n  /*\n   * A VENDOR_HOSTED provider that offers no region cannot support a transfer statement, and the\n   * whole point of carrying regions is that a transfer statement becomes derivable. Refused at the\n   * schema so the gap surfaces where the provider module is authored, rather than as an\n   * unexplainable hole in a produced notice months later.\n   *\n   * The SELF_HOSTED-only case is exempt above: its region is wherever the operator runs it.\n   */\n  if (profile.deploymentModels.includes(ProviderDeploymentModel.VENDOR_HOSTED) && profile.processingRegions.length === 0) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegions'],\n      message: 'a VENDOR_HOSTED provider must declare at least one processing region — without one, no transfer statement about it can be derived',\n    });\n  }\n});\nexport type ProviderComplianceProfile = z.infer<typeof ProviderComplianceProfileSchema>;\n\n/** True when this provider can only ever be run by the operator, so it is never a third-party recipient. */\nexport function providerIsAlwaysSelfHosted(profile: ProviderComplianceProfile): boolean {\n  return profile.deploymentModels.every((model) => model === ProviderDeploymentModel.SELF_HOSTED);\n}\n\n/**\n * True when the operator must CHOOSE, because the provider supports both.\n *\n * A register entry for such a provider cannot be derived from the provider module alone — the\n * application's configuration decides whether it is a recipient at all.\n */\nexport function providerDeploymentModelIsAnOperatorChoice(profile: ProviderComplianceProfile): boolean {\n  return profile.deploymentModels.length > 1;\n}\n\n/** @wildo_source:part:start saas.models.providers.compliance-choice facet:layer:shared facet:audience:app-developer */\n/**\n * The application's CHOICE among what a provider offers — one entry per configured provider.\n *\n * The provider declares possibilities ({@link ProviderComplianceProfileSchema}); this is where an\n * operator says which of them applies to their deployment. Keeping the two apart is the whole point\n * of the layering: a vendor's regions change when it opens a data centre, an operator's choice\n * changes when they migrate, and collapsing them would make one edit look like the other.\n *\n * Not carried inside `providerConfigurations`, which is an opaque `Record<string, unknown>` bag for a\n * provider's own runtime profile. A compliance answer must not live somewhere nothing can read it\n * without knowing the provider.\n */\nexport const ApplicationProviderComplianceChoiceSchema = z.strictObject({\n  /**\n   * Who runs this provider in THIS deployment.\n   *\n   * Required even when the provider supports only one model. The redundancy is deliberate: whether\n   * personal data leaves the operator's control is the single most consequential fact a notice states\n   * about a provider, and reading it out of a framework default rather than an operator's declaration\n   * is how a wrong one goes unnoticed.\n   */\n  deploymentModel: z.enum(ProviderDeploymentModel),\n  /**\n   * Which region this provider processes in, chosen from what the provider declares possible.\n   *\n   * NOT validated here, and NOT validated at boot either. This schema cannot see the provider\n   * registry, and refusing an unlisted region would make a vendor's new data centre an application\n   * build failure, so the intended posture is warn-do-not-block: a region outside the provider's\n   * declared list is APP-ASSERTED and reported, never refused.\n   *\n   * WIRED since 2026-09-10 (issue #308). `appAssertedProcessingRegions` below computes exactly that\n   * set, and the companion's compliance-primary-facts section reports it per provider, naming both the\n   * configured value and what the provider declares — because a divergence is either a typo or a stale\n   * provider module, and those are opposite work. It took this long only because of a DATA PATH: the\n   * vendor's region list lives on the backend provider module and the renderer reads provider\n   * SPECIFICATIONS, so the helper could not be called until `complianceProfile` was mirrored onto the\n   * specification contract. Any future report must call this helper rather than re-derive the\n   * comparison.\n   */\n  processingRegion: z.string().trim().min(1).optional(),\n}).superRefine((choice, context) => {\n  /*\n   * The pairing, in both directions.\n   *\n   * A VENDOR_HOSTED choice with no region leaves the notice unable to state where the data goes,\n   * which is the question this whole layer exists to answer. A SELF_HOSTED choice WITH one is the\n   * fiction the provider layer already refuses: the operator runs it, so its region is wherever they\n   * run it, and a value here would be a guess presented as a configuration.\n   */\n  if (choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED && choice.processingRegion === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a VENDOR_HOSTED provider must be configured with the region it processes in — without one, no notice can state where this data goes',\n    });\n  }\n  if (choice.deploymentModel === ProviderDeploymentModel.SELF_HOSTED && choice.processingRegion !== undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a SELF_HOSTED provider runs wherever the operator runs it, so a processing region here is a guess presented as configuration — drop it',\n    });\n  }\n});\nexport type ApplicationProviderComplianceChoice = z.infer<typeof ApplicationProviderComplianceChoiceSchema>;\n\n/** Per configured provider ref, the operator's compliance choice. */\nexport const ApplicationProviderComplianceChoicesSchema = z.record(\n  z.string().trim().min(1),\n  ApplicationProviderComplianceChoiceSchema,\n);\nexport type ApplicationProviderComplianceChoices = z.infer<typeof ApplicationProviderComplianceChoicesSchema>;\n\n/**\n * Regions an application asserts that the provider does not declare.\n *\n * Reported, never refused — a vendor opening a data centre must not become a build failure, and an\n * operator who genuinely knows better than a stale framework list should be able to say so. What the\n * framework owes is that the divergence is VISIBLE, which is the same trade the personal-data\n * declaration report makes.\n */\nexport function appAssertedProcessingRegions(params: {\n  readonly choices: ApplicationProviderComplianceChoices;\n  readonly profilesByProviderRef: Readonly<Record<string, ProviderComplianceProfile>>;\n}): ReadonlyArray<{ readonly providerRef: string; readonly region: string }> {\n  const asserted: Array<{ providerRef: string; region: string }> = [];\n\n  for (const [providerRef, choice] of Object.entries(params.choices)) {\n    if (choice.processingRegion === undefined) continue;\n    const profile = params.profilesByProviderRef[providerRef];\n    // No profile is not an assertion about a region — it is a provider that declares no compliance\n    // profile at all, which is a different gap and belongs to whoever reports THAT.\n    if (profile === undefined) continue;\n    if (profile.processingRegions.includes(choice.processingRegion)) continue;\n    asserted.push({ providerRef, region: choice.processingRegion });\n  }\n\n  return asserted;\n}\n/** @wildo_source:part:end saas.models.providers.compliance-choice */\n\n/**\n * The configured providers that are THIRD-PARTY RECIPIENTS — vendor-hosted, and therefore processors.\n *\n * A self-hosted provider is excluded by construction rather than by a filter a caller must remember:\n * no data leaves the operator, so it is not a recipient and must never be enumerated as one.\n */\nexport function vendorHostedProviderRefs(choices: ApplicationProviderComplianceChoices): readonly string[] {\n  return Object.entries(choices)\n    .filter(([, choice]) => choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED)\n    .map(([providerRef]) => providerRef)\n    .sort();\n}\n"]}

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-component-contract.shared.types.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IACA,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,gBAAgB,CAAC;IAClE,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GACC;IACA,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,qBAAqB,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACC;IACA,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,oBAAoB,CAAC;IACtE,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,qBAAqB,EAAE,GAAG,IAAI,CAAC;IAC7D,sDAAsD;IACtD,QAAQ,IAAI,IAAI,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC7B"}
+{"version":3,"file":"provider-frontend-component-contract.shared.types.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IACA,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,gBAAgB,CAAC;IAClE,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GACC;IACA,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,qBAAqB,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACC;IACA,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,oBAAoB,CAAC;IACtE,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,qBAAqB,EAAE,GAAG,IAAI,CAAC;IAC7D,sDAAsD;IACtD,QAAQ,IAAI,IAAI,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC7B"}

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-component-contract.shared.types.js","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG","sourcesContent":["/**\n * The contract between a provider's frontend COMPONENT and the framework surface\n * that mounts it.\n *\n * ## Why it lives here and not beside the module types it serves\n *\n * These types were written in `@wildo-ai/external-connectors-public`, next to the\n * facet module types that declare a component — which reads as the right place\n * until you follow what depends on what:\n *\n *   - a component lives in its own package (`@wildo-ai/providers-frontend-<vendor>`,\n *     issue #394) because it carries React, which the connectors package must not;\n *   - that package needs this contract to type its component;\n *   - the connectors package needs to RESOLVE that package, because it reaches the\n *     component by a bare dynamic import.\n *\n * With the contract in the connectors package that is a cycle *through emitted\n * declarations*: the component package's `.d.ts` references the connectors\n * package's `.d.ts`, which makes the connectors package's own `dist` an INPUT of\n * its own build. Measured, not predicted — `tsc` refuses with `TS5055 Cannot\n * write file … because it would overwrite input file`, once per emitted\n * declaration.\n *\n * So the contract belongs BELOW both, and `saas-models` is where \"below both\"\n * already is.\n *\n * ## Why function-valued types are allowed in this package\n *\n * The sibling `provider-frontend-surface.shared.schemas.ts` states that\n * everything in it is the DATA half, and that nothing function-valued may join\n * it. That rule is about VALUES crossing a JSON channel — a projected `activate`\n * would be dropped by `JSON.stringify` with no error anywhere. A TYPE crosses\n * nothing. `onSelect` here is a compile-time obligation on two parties, and it\n * never appears in a wire record.\n *\n * `File` is a DOM type, which this package already uses\n * (`files.shared.utils.ts`), so nothing new is required of its lib.\n */\n\nimport type { ProviderFrontendSelectionDelivery } from './provider-frontend-surface.shared.schemas';\n\n/**\n * What a provider's file picker hands back for ONE chosen file.\n *\n * The three arms are the three answers to issue #383, and the union exists\n * because the decision was **per vendor**: a picker for a credentialed vendor and\n * a picker for a vendor with a browser-safe public token genuinely cannot return\n * the same thing, and both must ship.\n *\n * `kind` is not a runtime choice. Each arm corresponds to exactly one\n * `ProviderFrontendSelectionDelivery`, the provider DECLARES which one it emits,\n * and the framework refuses a selection whose `kind` contradicts that\n * declaration. Without the refusal the union would be the hedge the decision\n * rejected — a contract that says \"one of these three, we will find out at\n * runtime\" is not one an application's file field can be written against.\n */\nexport type ProviderFileSelection =\n  | {\n    /** @see ProviderFrontendSelectionDelivery.REMOTE_REFERENCE */\n    readonly kind: ProviderFrontendSelectionDelivery.REMOTE_REFERENCE;\n    /** Opaque to everything in the browser. Only the application backend can resolve it. */\n    readonly externalId: string;\n    /** What to show the user before the backend has resolved anything. */\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE;\n    readonly file: File;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL;\n    /** Fetchable by the browser. Its origin must be admitted by the surface's composed CSP. */\n    readonly url: string;\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  };\n\n/**\n * The constraints a framework file field imposes on a picker.\n *\n * Resolved by the framework — schema metadata first, then the provider's own\n * `publicConfig` through the capability's named schema — so a picker never\n * re-reads either. `maxSize` is BYTES; a provider stating megabytes in its public\n * config (`maxFileSizeMb`) is converted before it reaches here.\n *\n * ## Why the field names are these and not clearer ones\n *\n * They are the framework file field's OWN names:\n * `resolveFormFieldFileProviderConstraints` in `@wildo-ai/saas-frontend-lib`\n * produces exactly this shape and its `ResolvedFormFieldFileProviderConstraints`\n * is an alias of this type, so there is one source rather than two spellings of\n * one contract.\n *\n * That is not tidiness. The first draft called the size cap `maxSizeBytes` while\n * the resolver called it `maxSize` — both BYTES, both optional — and TypeScript\n * accepts the assignment: the weak-type check is satisfied by the two names that\n * DO match, so wiring the resolver into a picker would have compiled and silently\n * dropped the size cap. A picker would then accept files the field rejects, and\n * the user finds out after choosing one.\n */\nexport interface ProviderFilePickerConstraints {\n  /**\n   * A MUTABLE array, deliberately: `@wildo-ai/zod-decorators`' MIME helpers\n   * (`isMimeTypeAllowed`, `buildAcceptAttribute`) take `string[]`, and this\n   * type's whole reason for existing is to BE the framework file field's own\n   * shape rather than a second one. A `readonly string[]` here would be a better\n   * type in isolation and would force a cast at every one of those call sites,\n   * which is how the drift this type prevents starts again.\n   */\n  allowedMimeTypes?: string[];\n  /** BYTES, not megabytes. */\n  maxSize?: number;\n  maxFiles?: number;\n}\n\n/**\n * The props every `FRONTEND_FILE_PICKER` component receives.\n *\n * `onSelect` takes an ARRAY even for a single-file field. A picker that supports\n * multi-select otherwise needs a second callback or a hidden convention, and a\n * field that allows one file can reject a second selection with a message instead\n * of silently keeping whichever arrived first — which is what a single-value\n * callback forces it to do.\n */\nexport interface ProviderFilePickerProps {\n  /** The provider's own `ref`, so a picker can label what it renders without being told twice. */\n  readonly providerRef: string;\n  /**\n   * The provider's public configuration, already validated against the module's\n   * `publicConfigSchema` when it declares one. A picker never re-coerces it.\n   */\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n  readonly constraints: ProviderFilePickerConstraints;\n  /**\n   * An access token for THIS provider, on behalf of the current user, when the\n   * application has one.\n   *\n   * Optional, and its absence is a real state rather than a defect: a picker that\n   * authenticates through its own vendor popup (OneDrive's does) needs nothing\n   * here, and an application that has not connected a user's account to this\n   * provider has nothing to give. A picker that does need one must call this and\n   * report through `onError` when it is absent — never fall back to a token from\n   * `publicConfig`, which is served to every browser.\n   *\n   * Supplying it is the account-connection surface's job (issue #333), which does\n   * not exist yet; until it does, the framework passes nothing and a picker that\n   * requires a token says so. The prop is declared now so that the dependency is\n   * VISIBLE in the contract rather than discovered by whoever writes the second\n   * picker.\n   */\n  getAccessToken?(): Promise<string | undefined>;\n  /**\n   * Called with everything the user chose. May be called once with several files;\n   * must not be called after `onCancel`.\n   */\n  onSelect(selections: readonly ProviderFileSelection[]): void;\n  /** The user dismissed the picker without choosing. */\n  onCancel(): void;\n  /**\n   * The picker could not run — the vendor SDK failed to load, a grant was\n   * refused, the vendor returned an error. Reported rather than thrown: a throw\n   * inside a picker's own event handler does not reach a React error boundary, so\n   * it would be a surface that silently stops responding.\n   */\n  onError(error: Error): void;\n}\n"]}
+{"version":3,"file":"provider-frontend-component-contract.shared.types.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG","sourcesContent":["/**\n * The contract between a provider's frontend COMPONENT and the framework surface\n * that mounts it.\n *\n * ## Why it lives here and not beside the module types it serves\n *\n * These types were written in `@wildo-ai/external-connectors-public`, next to the\n * facet module types that declare a component — which reads as the right place\n * until you follow what depends on what:\n *\n *   - a component lives in its own package (`@wildo-ai/providers-frontend-<vendor>`,\n *     issue #394) because it carries React, which the connectors package must not;\n *   - that package needs this contract to type its component;\n *   - the connectors package needs to RESOLVE that package, because it reaches the\n *     component by a bare dynamic import.\n *\n * With the contract in the connectors package that is a cycle *through emitted\n * declarations*: the component package's `.d.ts` references the connectors\n * package's `.d.ts`, which makes the connectors package's own `dist` an INPUT of\n * its own build. Measured, not predicted — `tsc` refuses with `TS5055 Cannot\n * write file … because it would overwrite input file`, once per emitted\n * declaration.\n *\n * So the contract belongs BELOW both, and `saas-models` is where \"below both\"\n * already is.\n *\n * ## Why function-valued types are allowed in this package\n *\n * The sibling `provider-frontend-surface.shared.schemas.ts` states that\n * everything in it is the DATA half, and that nothing function-valued may join\n * it. That rule is about VALUES crossing a JSON channel — a projected `activate`\n * would be dropped by `JSON.stringify` with no error anywhere. A TYPE crosses\n * nothing. `onSelect` here is a compile-time obligation on two parties, and it\n * never appears in a wire record.\n *\n * `File` is a DOM type, which this package already uses\n * (`files.shared.utils.ts`), so nothing new is required of its lib.\n */\n\nimport type { ProviderFrontendSelectionDelivery } from './provider-frontend-surface.shared.schemas';\n\n/**\n * What a provider's file picker hands back for ONE chosen file.\n *\n * The three arms are the three answers to issue #383, and the union exists\n * because the decision was **per vendor**: a picker for a credentialed vendor and\n * a picker for a vendor with a browser-safe public token genuinely cannot return\n * the same thing, and both must ship.\n *\n * `kind` is not a runtime choice. Each arm corresponds to exactly one\n * `ProviderFrontendSelectionDelivery`, the provider DECLARES which one it emits,\n * and the framework refuses a selection whose `kind` contradicts that\n * declaration. Without the refusal the union would be the hedge the decision\n * rejected — a contract that says \"one of these three, we will find out at\n * runtime\" is not one an application's file field can be written against.\n */\nexport type ProviderFileSelection =\n  | {\n    /** @see ProviderFrontendSelectionDelivery.REMOTE_REFERENCE */\n    readonly kind: ProviderFrontendSelectionDelivery.REMOTE_REFERENCE;\n    /** Opaque to everything in the browser. Only the application backend can resolve it. */\n    readonly externalId: string;\n    /** What to show the user before the backend has resolved anything. */\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE;\n    readonly file: File;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL;\n    /** Fetchable by the browser. Its origin must be admitted by the surface's composed CSP. */\n    readonly url: string;\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  };\n\n/**\n * The constraints a framework file field imposes on a picker.\n *\n * Resolved by the framework — schema metadata first, then the provider's own\n * `publicConfig` through the capability's named schema — so a picker never\n * re-reads either. `maxSize` is BYTES; a provider stating megabytes in its public\n * config (`maxFileSizeMb`) is converted before it reaches here.\n *\n * ## Why the field names are these and not clearer ones\n *\n * They are the framework file field's OWN names:\n * `resolveFormFieldFileProviderConstraints` in `@wildo-ai/saas-frontend-lib`\n * produces exactly this shape and its `ResolvedFormFieldFileProviderConstraints`\n * is an alias of this type, so there is one source rather than two spellings of\n * one contract.\n *\n * That is not tidiness. The first draft called the size cap `maxSizeBytes` while\n * the resolver called it `maxSize` — both BYTES, both optional — and TypeScript\n * accepts the assignment: the weak-type check is satisfied by the two names that\n * DO match, so wiring the resolver into a picker would have compiled and silently\n * dropped the size cap. A picker would then accept files the field rejects, and\n * the user finds out after choosing one.\n */\nexport interface ProviderFilePickerConstraints {\n  /**\n   * A MUTABLE array, deliberately: `@wildo-ai/zod-decorators`' MIME helpers\n   * (`isMimeTypeAllowed`, `buildAcceptAttribute`) take `string[]`, and this\n   * type's whole reason for existing is to BE the framework file field's own\n   * shape rather than a second one. A `readonly string[]` here would be a better\n   * type in isolation and would force a cast at every one of those call sites,\n   * which is how the drift this type prevents starts again.\n   */\n  allowedMimeTypes?: string[];\n  /** BYTES, not megabytes. */\n  maxSize?: number;\n  maxFiles?: number;\n}\n\n/**\n * The props every `FRONTEND_FILE_PICKER` component receives.\n *\n * `onSelect` takes an ARRAY even for a single-file field. A picker that supports\n * multi-select otherwise needs a second callback or a hidden convention, and a\n * field that allows one file can reject a second selection with a message instead\n * of silently keeping whichever arrived first — which is what a single-value\n * callback forces it to do.\n */\nexport interface ProviderFilePickerProps {\n  /** The provider's own `ref`, so a picker can label what it renders without being told twice. */\n  readonly providerRef: string;\n  /**\n   * The provider's public configuration, already validated against the module's\n   * `publicConfigSchema` when it declares one. A picker never re-coerces it.\n   */\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n  readonly constraints: ProviderFilePickerConstraints;\n  /**\n   * An access token for THIS provider, on behalf of the current user, when the\n   * application has one.\n   *\n   * Optional, and its absence is a real state rather than a defect: a picker that\n   * authenticates through its own vendor popup (OneDrive's does) needs nothing\n   * here, and an application that has not connected a user's account to this\n   * provider has nothing to give. A picker that does need one must call this and\n   * report through `onError` when it is absent — never fall back to a token from\n   * `publicConfig`, which is served to every browser.\n   *\n   * Supplying it is the account-connection surface's job (issue #333), which does\n   * not exist yet; until it does, the framework passes nothing and a picker that\n   * requires a token says so. The prop is declared now so that the dependency is\n   * VISIBLE in the contract rather than discovered by whoever writes the second\n   * picker.\n   */\n  getAccessToken?(): Promise<string | undefined>;\n  /**\n   * Called with everything the user chose. May be called once with several files;\n   * must not be called after `onCancel`.\n   */\n  onSelect(selections: readonly ProviderFileSelection[]): void;\n  /** The user dismissed the picker without choosing. */\n  onCancel(): void;\n  /**\n   * The picker could not run — the vendor SDK failed to load, a grant was\n   * refused, the vendor returned an error. Reported rather than thrown: a throw\n   * inside a picker's own event handler does not reach a React error boundary, so\n   * it would be a surface that silently stops responding.\n   */\n  onError(error: Error): void;\n}\n"]}

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.d.ts

@@ -320,11 +320,13 @@ export type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFronten
 /**
  * A provider's component descriptors, keyed by the CAPABILITY each fills.
  *
- * The key is a capability token rather than a member of a closed enum because
- * `ProviderCapability` is OPEN — an application extends it by module
- * augmentation — so a `z.enum` here would refuse an application's own
- * capability. The registry that consumes this makes the same choice for the same
- * reason.
+ * The key is validated as a non-empty string, not as a `ProviderCapability`
+ * member. The reason this gave until 2026-09-12 — that `ProviderCapability` is
+ * OPEN through module augmentation, so a `z.enum` would refuse an application's
+ * own capability — stopped being true with #502: the vocabulary is the closed
+ * built-in set. A member-checked key is now possible and has NOT been adopted;
+ * until it is, an unknown capability key parses here and simply never matches a
+ * surface that asks for a real one.
  */
 export declare const ProviderFrontendComponentDescriptorsSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     /**

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-surface.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,MAAM,kBAAkB;IACxB,OAAO,mBAAmB;IAC1B,KAAK,iBAAiB;IACtB,GAAG,eAAe;IAClB,KAAK,iBAAiB;IACtB,IAAI,gBAAgB;CACrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC;IACjD,kEAAkE;;;kBAGlE,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,kCAAkC;IAC7C,uEAAuE;;IAEvE,gGAAgG;;IAEhG,gGAAgG;;IAEhG,oEAAoE;;IAEpE,iEAAiE;;IAEjE,8DAA8D;;IAE9D;;;;OAIG;;QAvBH,kEAAkE;;;;kBAyBlE,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAEzG;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,uCAAuC,GACnD,4BAA4B,CAE9B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mCAAmC;IAC9C,kEAAkE;;IAElE;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,oBAAY,iCAAiC;IAC3C,gIAAgI;IAChI,SAAS,cAAc;IACvB,kHAAkH;IAClH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uCAAuC;IAEhD,sFAAsF;;IAEtF,mDAAmD;;;;;kBAgBnD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,gBAAgB,qBAAqB;IACrC;;;;;;OAMG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G;;;;;;;;GAQG;AACH,eAAO,MAAM,0CAA0C;IAlBrD;;;;OAIG;;mBAiBJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}
+{"version":3,"file":"provider-frontend-surface.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,MAAM,kBAAkB;IACxB,OAAO,mBAAmB;IAC1B,KAAK,iBAAiB;IACtB,GAAG,eAAe;IAClB,KAAK,iBAAiB;IACtB,IAAI,gBAAgB;CACrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC;IACjD,kEAAkE;;;kBAGlE,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,kCAAkC;IAC7C,uEAAuE;;IAEvE,gGAAgG;;IAEhG,gGAAgG;;IAEhG,oEAAoE;;IAEpE,iEAAiE;;IAEjE,8DAA8D;;IAE9D;;;;OAIG;;QAvBH,kEAAkE;;;;kBAyBlE,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAEzG;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,uCAAuC,GACnD,4BAA4B,CAE9B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mCAAmC;IAC9C,kEAAkE;;IAElE;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,oBAAY,iCAAiC;IAC3C,gIAAgI;IAChI,SAAS,cAAc;IACvB,kHAAkH;IAClH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uCAAuC;IAEhD,sFAAsF;;IAEtF,mDAAmD;;;;;kBAgBnD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,gBAAgB,qBAAqB;IACrC;;;;;;OAMG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0CAA0C;IApBrD;;;;OAIG;;mBAmBJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.js

@@ -306,11 +306,13 @@ export const ProviderFrontendComponentDescriptorSchema = z.strictObject({
 /**
  * A provider's component descriptors, keyed by the CAPABILITY each fills.
  *
- * The key is a capability token rather than a member of a closed enum because
- * `ProviderCapability` is OPEN — an application extends it by module
- * augmentation — so a `z.enum` here would refuse an application's own
- * capability. The registry that consumes this makes the same choice for the same
- * reason.
+ * The key is validated as a non-empty string, not as a `ProviderCapability`
+ * member. The reason this gave until 2026-09-12 — that `ProviderCapability` is
+ * OPEN through module augmentation, so a `z.enum` would refuse an application's
+ * own capability — stopped being true with #502: the vocabulary is the closed
+ * built-in set. A member-checked key is now possible and has NOT been adopted;
+ * until it is, an unknown capability key parses here and simply never matches a
+ * surface that asks for a real one.
  */
 export const ProviderFrontendComponentDescriptorsSchema = z.record(z.string().min(1), ProviderFrontendComponentDescriptorSchema);
 /**

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-surface.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,2DAAwB,CAAA;IACxB,6DAA0B,CAAA;IAC1B,yDAAsB,CAAA;IACtB,qDAAkB,CAAA;IAClB,yDAAsB,CAAA;IACtB,uDAAoB,CAAA;AACtB,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,8DAA8D;IAC9D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAyBH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAoD;IAEpD,OAAO,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,kEAAkE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,gIAAgI;IAChI,4DAAuB,CAAA;IACvB,kHAAkH;IAClH,wEAAmC,CAAA;AACrC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,mDAAmD;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACjE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mGAAmG;kBACjG,+EAA+E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,iCAuBX;AAvBD,WAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,0EAAqC,CAAA;IACrC;;;;;;OAMG;IACH,oFAA+C,CAAA;IAC/C;;;;;OAKG;IACH,kFAA6C,CAAA;AAC/C,CAAC,EAvBW,iCAAiC,KAAjC,iCAAiC,QAuB5C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,gCAAgC,GAGlC;IACF,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,gBAAgB;IAC3D,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,GAAG,CAAC,EAAE,YAAY;IACnD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,aAAa;CACtD,CAAC;AACF,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * Frontend-surface atoms a provider declares: what it needs the page to be\n * ALLOWED to reach (its CSP footprint), which vendor SDK package it loads, and\n * which third-party `<script>` tags it asks the surface to add.\n *\n * ## Why these are DATA and live here\n *\n * A frontend provider reaches its surface through TWO channels, and only one of\n * them can carry code:\n *\n *   - the **DATA** channel — `FrontendProviderEntry`, projected by the backend\n *     into `/application-config` and materialized into the generated\n *     frontend-services artifact. It is JSON end to end, so nothing\n *     function-valued survives it (it used to be cast to a module type anyway,\n *     which is the defect this split closes);\n *   - the **CODE** channel — the provider package's own facet barrel, imported\n *     by the bundle through the generated `frontend-providers.generated.ts`.\n *\n * Everything in this file is the DATA half. It is what the CLI, the CSP\n * composer and the bundle-isolation policy need to SEE without executing any\n * frontend module — and the CLI genuinely cannot execute one: it is a Node\n * process and these modules are browser-bound. The executable half (`sdk.activate`,\n * `publicConfigSchema`) lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this boundary.\n *\n * Added by slice S4a of epic #337 (issue #332).\n */\n\nimport { z } from 'zod';\n\n/**\n * The origins a provider needs the composed Content-Security-Policy to admit,\n * grouped by WHAT THE PROVIDER IS REACHING rather than by CSP directive name.\n *\n * ## Why semantic buckets and not directive names\n *\n * `CSP_DIRECTIVE_NAMES` is a closed vocabulary that already has one named\n * runtime source, in `@wildo-ai/platform-config-lib`. That package DEPENDS on\n * this one, so this file cannot reference it, and re-declaring the list here\n * would create a second source for one vocabulary — precisely what the\n * one-named-source rule exists to prevent, and the way the two copies would\n * drift the first time a directive is added.\n *\n * Keying on intent instead is also the better contract. A provider author knows\n * \"my SDK is fetched from `https://js.stripe.com` and it calls back to\n * `https://api.stripe.com`\"; which directive grades which fetch is framework\n * knowledge, and it lives in exactly one place — the bucket-to-directive\n * mapping in `platform-config-lib`'s `csp-emit.ts`.\n *\n * ## Why it is STRICT while the entry that carries it is loose\n *\n * The entry is a WIRE record read by a possibly-older consumer, so it tolerates\n * unknown keys (see `frontend-provider-entry.shared.schemas.ts`). This footprint\n * is AUTHORED, by a provider package, and validated where it is authored — so a\n * misspelled bucket must fail loudly rather than contribute nothing. That\n * distinction matters more here than anywhere else in the frontend surface:\n * CSP is enforced in production and report-only in development, so a bucket that\n * silently contributes nothing is invisible until the provider breaks in\n * production only.\n *\n * Adding a bucket is not a one-sided producer change either — a new bucket is\n * useless until `csp-emit.ts` maps it to a directive — so strictness costs no\n * version-skew tolerance that was ever available.\n *\n * Every field defaults to `[]`: a provider that declares a footprint at all is\n * making a complete statement about the buckets it did not name.\n */\n/**\n * Which bucket an origin lands in, as a value a provider can name.\n *\n * The bucket names are already the footprint's field names; this enum is what\n * lets a provider REFER to one — a derived origin has to say where it goes, and\n * a bare string there would be a second, unexplained spelling of a closed\n * vocabulary. A compile-time check below pins the two together.\n */\nexport enum ProviderFrontendCspOriginBucket {\n  SCRIPT = 'scriptOrigins',\n  CONNECT = 'connectOrigins',\n  FRAME = 'frameOrigins',\n  IMG = 'imgOrigins',\n  STYLE = 'styleOrigins',\n  FONT = 'fontOrigins',\n}\n\n/**\n * An origin the framework must READ OUT OF the provider's own public config,\n * because the provider cannot know it.\n *\n * The case that forced this: an error-monitoring provider sends to the host\n * inside its DSN, and a product-analytics provider to whatever `apiHost` the\n * application configured — including a self-hosted one. Both are per\n * APPLICATION, and often per ENVIRONMENT, so no static list on the provider\n * module can contain them. Without this the application would have to author\n * the same host twice — once as the provider's config and once in its CSP — and\n * the copy that drifts fails in production only, because development is\n * report-only.\n *\n * Resolution is data, not code: the CLI takes `publicConfig[publicConfigKey]`,\n * reads its URL origin, and adds it to `bucket`. An absent key contributes\n * nothing (the provider simply is not configured for that service); a key that\n * is present and is NOT a URL fails the sync loudly, because silently dropping\n * it is the exact failure this exists to prevent.\n */\nexport const ProviderFrontendCspDerivedOriginSchema = z.strictObject({\n  /** Key in this provider's `publicConfig` whose value is a URL. */\n  publicConfigKey: z.string().min(1),\n  bucket: z.enum(ProviderFrontendCspOriginBucket),\n});\nexport type ProviderFrontendCspDerivedOrigin = z.infer<typeof ProviderFrontendCspDerivedOriginSchema>;\n\nexport const ProviderFrontendCspFootprintSchema = z.strictObject({\n  /** Origins the surface loads executable script from (`script-src`). */\n  scriptOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider's code opens fetch / XHR / WebSocket connections to (`connect-src`). */\n  connectOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider embeds in an iframe — a picker, a checkout, a meeting (`frame-src`). */\n  frameOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads images or pixels from (`img-src`). */\n  imgOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads stylesheets from (`style-src`). */\n  styleOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads web fonts from (`font-src`). */\n  fontOrigins: z.array(z.string().min(1)).default([]),\n  /**\n   * Origins the framework reads out of this provider's own `publicConfig`,\n   * for the endpoints a provider cannot know in advance. See\n   * {@link ProviderFrontendCspDerivedOriginSchema}.\n   */\n  derivedOrigins: z.array(ProviderFrontendCspDerivedOriginSchema).default([]),\n});\nexport type ProviderFrontendCspFootprint = z.infer<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * The footprint as a provider AUTHORS it: name only the buckets you reach.\n *\n * Authoring and the wire are deliberately different shapes, and the asymmetry\n * is the point.\n *\n *   - **Authoring is partial.** A provider that only loads a script should write\n *     `{ scriptOrigins: ['https://js.acme.com'] }`, not that plus four empty\n *     arrays. Four empty arrays are noise at exactly the place the declaration\n *     should be readable, and noise is what stops a reviewer noticing the one\n *     line that grants an origin.\n *   - **The wire is total.** Every bucket is present by the time the footprint\n *     reaches an entry, so the CSP composer never branches on absence and the\n *     staleness comparison between a served footprint and its module's has two\n *     comparable shapes rather than a partial and a total that differ in every\n *     bucket nobody named.\n *\n * Derived as `z.input` rather than written as a `Partial<…>`, so it cannot drift\n * from the schema: adding a bucket makes it optional here automatically.\n */\nexport type ProviderFrontendCspFootprintDeclaration = z.input<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * Fills in the buckets a declaration did not name.\n *\n * The ONE place that normalization happens, used by the projection that builds\n * an entry and by the hydration join that compares one against a module. Two\n * copies would eventually disagree about whether an unnamed bucket is `[]` or\n * absent, and the join reads that difference as a stale artifact — a false\n * alarm on the diagnostic whose whole job is to be believed.\n */\nexport function normalizeProviderFrontendCspFootprint(\n  declaration: ProviderFrontendCspFootprintDeclaration,\n): ProviderFrontendCspFootprint {\n  return ProviderFrontendCspFootprintSchema.parse(declaration);\n}\n\n/**\n * The DATA half of a provider's `sdk` declaration: WHICH npm package carries the\n * vendor SDK, and at which range.\n *\n * The CODE half — the dynamic import and the vendor's initialization call — is\n * `ProviderFrontendSdk.activate` on the facet module type, and is deliberately\n * absent here: a function cannot cross a JSON channel, and a channel that\n * silently drops one is worse than a channel that never carried it.\n *\n * The descriptor is not decoration. It is what the bundle-isolation policy reads\n * to decide whether a bare specifier a provider package imports was DECLARED,\n * what an application's dependency alignment needs in order to install the SDK\n * as an optional peer, and what a human reads when asking why a bundle grew.\n *\n * Who authors it, since the epic's bulk-integration model was reversed on\n * 2026-09-06: a FIRST-CLASS provider package or an application's own provider\n * module. The scraper-mapper that fills the catalogue emits identity, auth, a\n * secrets contract and an operation catalogue on the `rest` arm — a\n * backend-only package — so a scraped provider has no frontend facet to carry\n * this. That is a narrowing of the population, not of the contract: the pickers\n * and embeds this surface exists for were always the hand-authored kind.\n */\nexport const ProviderFrontendSdkDescriptorSchema = z.strictObject({\n  /** npm package name of the vendor SDK, e.g. `@sentry/browser`. */\n  packageName: z.string().min(1),\n  /**\n   * Semver range the provider was built against. Optional because a provider\n   * that pins its SDK as a direct dependency has already said so in its own\n   * manifest; stating it here as well would be a second copy of that pin.\n   */\n  versionRange: z.string().min(1).optional(),\n});\nexport type ProviderFrontendSdkDescriptor = z.infer<typeof ProviderFrontendSdkDescriptorSchema>;\n\n/**\n * `crossorigin` attribute values for a provider-declared `<script>`.\n *\n * A closed vocabulary with a named runtime source rather than a bare literal\n * union, so each member can carry why it exists — and there are exactly two\n * reasons to pick one over the other.\n */\nexport enum ProviderFrontendScriptCrossOrigin {\n  /** No credentials are sent; the response must carry `Access-Control-Allow-Origin`. The right choice for a public CDN script. */\n  ANONYMOUS = 'anonymous',\n  /** Cookies and TLS client certificates are sent. Only for a vendor that authenticates the script fetch itself. */\n  USE_CREDENTIALS = 'use-credentials',\n}\n\n/**\n * A third-party `<script>` a provider asks its surface to add — the case a\n * dynamic `import()` cannot serve, because the vendor ships a global-installing\n * tag rather than an npm module (reCAPTCHA, most tag managers, several chat\n * widgets).\n *\n * `integrity` is Subresource Integrity. It is optional because a vendor that\n * versionless-serves a mutable URL (again, reCAPTCHA) cannot publish a stable\n * hash — but when it IS given the surface must also send `crossorigin`, or the\n * browser refuses the integrity check outright. That coupling is enforced below\n * rather than left to each surface to remember.\n */\nexport const ProviderFrontendScriptDeclarationSchema = z\n  .strictObject({\n    /** Absolute URL of the script. Its origin must also appear in `csp.scriptOrigins`. */\n    src: z.string().min(1),\n    /** Subresource-integrity hash, e.g. `sha384-…`. */\n    integrity: z.string().min(1).optional(),\n    crossOrigin: z.enum(ProviderFrontendScriptCrossOrigin).optional(),\n    async: z.boolean().optional(),\n    defer: z.boolean().optional(),\n  })\n  .superRefine((declaration, context) => {\n    if (declaration.integrity !== undefined && declaration.crossOrigin === undefined) {\n      context.addIssue({\n        code: 'custom',\n        path: ['crossOrigin'],\n        message:\n          'A script declaring `integrity` must also declare `crossOrigin`; without it the browser skips the '\n          + 'integrity check for a cross-origin script, so the hash would protect nothing.',\n      });\n    }\n  });\nexport type ProviderFrontendScriptDeclaration = z.infer<typeof ProviderFrontendScriptDeclarationSchema>;\n\n/**\n * WHAT a provider's component hands back, when what it hands back is a thing\n * rather than a value.\n *\n * ## The question this answers, and why it is a DECLARATION\n *\n * An application's objective is that it calls third-party APIs directly from\n * custom frontend components. On the backend that is unambiguous. In a browser\n * it is not, because a tenant credential must never get there — so a picker for\n * a credentialed vendor and a picker for a vendor with a browser-safe public\n * token cannot hand back the same thing, and the framework surface that\n * receives a selection has to know which before it mounts anything.\n *\n * Settled 2026-09-07 (issue #383, recorded as Q5 of the provider-architecture\n * plan): **per vendor, DECLARED.** Both shapes are real and both ship; which one\n * a provider emits is a static fact about that provider, stated here and\n * visible on the DATA channel without executing a line of its code.\n *\n * The word doing the work is *declared*. A discriminated union alone would let a\n * provider decide at runtime, which is the shape the decision explicitly\n * rejected — so the framework REFUSES a selection whose discriminant contradicts\n * this field. Without that refusal the declaration is decoration, and a reviewer\n * reading a provider's manifest would be reading a wish.\n *\n * ## Why a single value and not a set\n *\n * A provider that genuinely could emit either — Google's Picker hands back both\n * a file id and a URL, and which is usable depends on the granted OAuth scope —\n * was the argument for `selectionDelivery: [...]`. Rejected: an array puts the\n * choice back at runtime, which is the half of the decision that carries all the\n * weight. A vendor whose two modes are both wanted contributes two components,\n * and the chooser then shows them as what they are — two different things a user\n * can pick between — rather than one component whose behaviour a reader cannot\n * predict.\n *\n * ## What it means for CSP\n *\n * `REMOTE_REFERENCE` does NOT imply a provider needs no `connectOrigins`: a\n * picker still talks to its vendor to RENDER, even when the bytes it selects are\n * fetched later by the backend. So this field does not gate the CSP buckets, and\n * a guard inferring otherwise would break every real picker. What it does gate\n * is where the SELECTED OBJECT travels.\n */\nexport enum ProviderFrontendSelectionDelivery {\n  /**\n   * An opaque handle only the application backend can resolve — a Drive file id,\n   * a DAM asset key. The browser never holds the bytes and never authenticates\n   * to the vendor for them; the framework routes the reference to the\n   * application's executor door, which holds the tenant credential.\n   */\n  REMOTE_REFERENCE = 'REMOTE_REFERENCE',\n  /**\n   * Bytes the browser already holds, as a `File`. Available only to a vendor\n   * whose picker runs on a browser-safe grant — a publishable key, a\n   * user-consented OAuth token, a picker's own scoped grant — so nothing\n   * tenant-secret is involved. The framework uploads it exactly as it uploads a\n   * file chosen from disk.\n   */\n  BROWSER_READABLE_FILE = 'BROWSER_READABLE_FILE',\n  /**\n   * A URL the browser may fetch, under the same browser-safe-grant condition as\n   * `BROWSER_READABLE_FILE`. Distinct from it because the framework must fetch\n   * before it can upload, and that fetch is a network call the composed CSP has\n   * to admit — a difference the surface cannot discover from a `File`.\n   */\n  BROWSER_READABLE_URL = 'BROWSER_READABLE_URL',\n}\n\n/**\n * The DATA half of one component a provider contributes — everything about it\n * that a reviewer, the CLI or a build step can read without running a browser.\n *\n * The loader is the CODE half and stays on the facet module in\n * `@wildo-ai/external-connectors-public`, exactly as `sdk.activate` does. What\n * crosses the wire is the fact that a component EXISTS for this capability, plus\n * the contract it commits to.\n *\n * Strict, and for the same reason the CSP footprint is: this is AUTHORED by a\n * provider package rather than received from an older producer, so a misspelled\n * key must fail where it is written instead of contributing nothing.\n */\nexport const ProviderFrontendComponentDescriptorSchema = z.strictObject({\n  /**\n   * What a selection from this component contains. Absent for a capability whose\n   * component returns a plain value rather than a thing — a captcha widget hands\n   * back a token, and there is no delivery question to answer about a string.\n   */\n  selectionDelivery: z.enum(ProviderFrontendSelectionDelivery).optional(),\n});\nexport type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFrontendComponentDescriptorSchema>;\n\n/**\n * A provider's component descriptors, keyed by the CAPABILITY each fills.\n *\n * The key is a capability token rather than a member of a closed enum because\n * `ProviderCapability` is OPEN — an application extends it by module\n * augmentation — so a `z.enum` here would refuse an application's own\n * capability. The registry that consumes this makes the same choice for the same\n * reason.\n */\nexport const ProviderFrontendComponentDescriptorsSchema = z.record(\n  z.string().min(1),\n  ProviderFrontendComponentDescriptorSchema,\n);\nexport type ProviderFrontendComponentDescriptors = z.infer<typeof ProviderFrontendComponentDescriptorsSchema>;\n\n/**\n * Pins every bucket member to a real field of the footprint.\n *\n * A member whose value is not a footprint key would be authorable, would parse,\n * and would contribute nothing — in production only, because CSP is report-only\n * in development. This makes it a compile error instead.\n */\nconst _everyBucketNamesAFootprintField: Record<\n  ProviderFrontendCspOriginBucket,\n  keyof Omit<ProviderFrontendCspFootprint, 'derivedOrigins'>\n> = {\n  [ProviderFrontendCspOriginBucket.SCRIPT]: 'scriptOrigins',\n  [ProviderFrontendCspOriginBucket.CONNECT]: 'connectOrigins',\n  [ProviderFrontendCspOriginBucket.FRAME]: 'frameOrigins',\n  [ProviderFrontendCspOriginBucket.IMG]: 'imgOrigins',\n  [ProviderFrontendCspOriginBucket.STYLE]: 'styleOrigins',\n  [ProviderFrontendCspOriginBucket.FONT]: 'fontOrigins',\n};\nvoid _everyBucketNamesAFootprintField;\n"]}
+{"version":3,"file":"provider-frontend-surface.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,2DAAwB,CAAA;IACxB,6DAA0B,CAAA;IAC1B,yDAAsB,CAAA;IACtB,qDAAkB,CAAA;IAClB,yDAAsB,CAAA;IACtB,uDAAoB,CAAA;AACtB,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,8DAA8D;IAC9D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAyBH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAoD;IAEpD,OAAO,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,kEAAkE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,gIAAgI;IAChI,4DAAuB,CAAA;IACvB,kHAAkH;IAClH,wEAAmC,CAAA;AACrC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,mDAAmD;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACjE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mGAAmG;kBACjG,+EAA+E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,iCAuBX;AAvBD,WAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,0EAAqC,CAAA;IACrC;;;;;;OAMG;IACH,oFAA+C,CAAA;IAC/C;;;;;OAKG;IACH,kFAA6C,CAAA;AAC/C,CAAC,EAvBW,iCAAiC,KAAjC,iCAAiC,QAuB5C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,gCAAgC,GAGlC;IACF,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,gBAAgB;IAC3D,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,GAAG,CAAC,EAAE,YAAY;IACnD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,aAAa;CACtD,CAAC;AACF,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * Frontend-surface atoms a provider declares: what it needs the page to be\n * ALLOWED to reach (its CSP footprint), which vendor SDK package it loads, and\n * which third-party `<script>` tags it asks the surface to add.\n *\n * ## Why these are DATA and live here\n *\n * A frontend provider reaches its surface through TWO channels, and only one of\n * them can carry code:\n *\n *   - the **DATA** channel — `FrontendProviderEntry`, projected by the backend\n *     into `/application-config` and materialized into the generated\n *     frontend-services artifact. It is JSON end to end, so nothing\n *     function-valued survives it (it used to be cast to a module type anyway,\n *     which is the defect this split closes);\n *   - the **CODE** channel — the provider package's own facet barrel, imported\n *     by the bundle through the generated `frontend-providers.generated.ts`.\n *\n * Everything in this file is the DATA half. It is what the CLI, the CSP\n * composer and the bundle-isolation policy need to SEE without executing any\n * frontend module — and the CLI genuinely cannot execute one: it is a Node\n * process and these modules are browser-bound. The executable half (`sdk.activate`,\n * `publicConfigSchema`) lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this boundary.\n *\n * Added by slice S4a of epic #337 (issue #332).\n */\n\nimport { z } from 'zod';\n\n/**\n * The origins a provider needs the composed Content-Security-Policy to admit,\n * grouped by WHAT THE PROVIDER IS REACHING rather than by CSP directive name.\n *\n * ## Why semantic buckets and not directive names\n *\n * `CSP_DIRECTIVE_NAMES` is a closed vocabulary that already has one named\n * runtime source, in `@wildo-ai/platform-config-lib`. That package DEPENDS on\n * this one, so this file cannot reference it, and re-declaring the list here\n * would create a second source for one vocabulary — precisely what the\n * one-named-source rule exists to prevent, and the way the two copies would\n * drift the first time a directive is added.\n *\n * Keying on intent instead is also the better contract. A provider author knows\n * \"my SDK is fetched from `https://js.stripe.com` and it calls back to\n * `https://api.stripe.com`\"; which directive grades which fetch is framework\n * knowledge, and it lives in exactly one place — the bucket-to-directive\n * mapping in `platform-config-lib`'s `csp-emit.ts`.\n *\n * ## Why it is STRICT while the entry that carries it is loose\n *\n * The entry is a WIRE record read by a possibly-older consumer, so it tolerates\n * unknown keys (see `frontend-provider-entry.shared.schemas.ts`). This footprint\n * is AUTHORED, by a provider package, and validated where it is authored — so a\n * misspelled bucket must fail loudly rather than contribute nothing. That\n * distinction matters more here than anywhere else in the frontend surface:\n * CSP is enforced in production and report-only in development, so a bucket that\n * silently contributes nothing is invisible until the provider breaks in\n * production only.\n *\n * Adding a bucket is not a one-sided producer change either — a new bucket is\n * useless until `csp-emit.ts` maps it to a directive — so strictness costs no\n * version-skew tolerance that was ever available.\n *\n * Every field defaults to `[]`: a provider that declares a footprint at all is\n * making a complete statement about the buckets it did not name.\n */\n/**\n * Which bucket an origin lands in, as a value a provider can name.\n *\n * The bucket names are already the footprint's field names; this enum is what\n * lets a provider REFER to one — a derived origin has to say where it goes, and\n * a bare string there would be a second, unexplained spelling of a closed\n * vocabulary. A compile-time check below pins the two together.\n */\nexport enum ProviderFrontendCspOriginBucket {\n  SCRIPT = 'scriptOrigins',\n  CONNECT = 'connectOrigins',\n  FRAME = 'frameOrigins',\n  IMG = 'imgOrigins',\n  STYLE = 'styleOrigins',\n  FONT = 'fontOrigins',\n}\n\n/**\n * An origin the framework must READ OUT OF the provider's own public config,\n * because the provider cannot know it.\n *\n * The case that forced this: an error-monitoring provider sends to the host\n * inside its DSN, and a product-analytics provider to whatever `apiHost` the\n * application configured — including a self-hosted one. Both are per\n * APPLICATION, and often per ENVIRONMENT, so no static list on the provider\n * module can contain them. Without this the application would have to author\n * the same host twice — once as the provider's config and once in its CSP — and\n * the copy that drifts fails in production only, because development is\n * report-only.\n *\n * Resolution is data, not code: the CLI takes `publicConfig[publicConfigKey]`,\n * reads its URL origin, and adds it to `bucket`. An absent key contributes\n * nothing (the provider simply is not configured for that service); a key that\n * is present and is NOT a URL fails the sync loudly, because silently dropping\n * it is the exact failure this exists to prevent.\n */\nexport const ProviderFrontendCspDerivedOriginSchema = z.strictObject({\n  /** Key in this provider's `publicConfig` whose value is a URL. */\n  publicConfigKey: z.string().min(1),\n  bucket: z.enum(ProviderFrontendCspOriginBucket),\n});\nexport type ProviderFrontendCspDerivedOrigin = z.infer<typeof ProviderFrontendCspDerivedOriginSchema>;\n\nexport const ProviderFrontendCspFootprintSchema = z.strictObject({\n  /** Origins the surface loads executable script from (`script-src`). */\n  scriptOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider's code opens fetch / XHR / WebSocket connections to (`connect-src`). */\n  connectOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider embeds in an iframe — a picker, a checkout, a meeting (`frame-src`). */\n  frameOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads images or pixels from (`img-src`). */\n  imgOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads stylesheets from (`style-src`). */\n  styleOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads web fonts from (`font-src`). */\n  fontOrigins: z.array(z.string().min(1)).default([]),\n  /**\n   * Origins the framework reads out of this provider's own `publicConfig`,\n   * for the endpoints a provider cannot know in advance. See\n   * {@link ProviderFrontendCspDerivedOriginSchema}.\n   */\n  derivedOrigins: z.array(ProviderFrontendCspDerivedOriginSchema).default([]),\n});\nexport type ProviderFrontendCspFootprint = z.infer<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * The footprint as a provider AUTHORS it: name only the buckets you reach.\n *\n * Authoring and the wire are deliberately different shapes, and the asymmetry\n * is the point.\n *\n *   - **Authoring is partial.** A provider that only loads a script should write\n *     `{ scriptOrigins: ['https://js.acme.com'] }`, not that plus four empty\n *     arrays. Four empty arrays are noise at exactly the place the declaration\n *     should be readable, and noise is what stops a reviewer noticing the one\n *     line that grants an origin.\n *   - **The wire is total.** Every bucket is present by the time the footprint\n *     reaches an entry, so the CSP composer never branches on absence and the\n *     staleness comparison between a served footprint and its module's has two\n *     comparable shapes rather than a partial and a total that differ in every\n *     bucket nobody named.\n *\n * Derived as `z.input` rather than written as a `Partial<…>`, so it cannot drift\n * from the schema: adding a bucket makes it optional here automatically.\n */\nexport type ProviderFrontendCspFootprintDeclaration = z.input<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * Fills in the buckets a declaration did not name.\n *\n * The ONE place that normalization happens, used by the projection that builds\n * an entry and by the hydration join that compares one against a module. Two\n * copies would eventually disagree about whether an unnamed bucket is `[]` or\n * absent, and the join reads that difference as a stale artifact — a false\n * alarm on the diagnostic whose whole job is to be believed.\n */\nexport function normalizeProviderFrontendCspFootprint(\n  declaration: ProviderFrontendCspFootprintDeclaration,\n): ProviderFrontendCspFootprint {\n  return ProviderFrontendCspFootprintSchema.parse(declaration);\n}\n\n/**\n * The DATA half of a provider's `sdk` declaration: WHICH npm package carries the\n * vendor SDK, and at which range.\n *\n * The CODE half — the dynamic import and the vendor's initialization call — is\n * `ProviderFrontendSdk.activate` on the facet module type, and is deliberately\n * absent here: a function cannot cross a JSON channel, and a channel that\n * silently drops one is worse than a channel that never carried it.\n *\n * The descriptor is not decoration. It is what the bundle-isolation policy reads\n * to decide whether a bare specifier a provider package imports was DECLARED,\n * what an application's dependency alignment needs in order to install the SDK\n * as an optional peer, and what a human reads when asking why a bundle grew.\n *\n * Who authors it, since the epic's bulk-integration model was reversed on\n * 2026-09-06: a FIRST-CLASS provider package or an application's own provider\n * module. The scraper-mapper that fills the catalogue emits identity, auth, a\n * secrets contract and an operation catalogue on the `rest` arm — a\n * backend-only package — so a scraped provider has no frontend facet to carry\n * this. That is a narrowing of the population, not of the contract: the pickers\n * and embeds this surface exists for were always the hand-authored kind.\n */\nexport const ProviderFrontendSdkDescriptorSchema = z.strictObject({\n  /** npm package name of the vendor SDK, e.g. `@sentry/browser`. */\n  packageName: z.string().min(1),\n  /**\n   * Semver range the provider was built against. Optional because a provider\n   * that pins its SDK as a direct dependency has already said so in its own\n   * manifest; stating it here as well would be a second copy of that pin.\n   */\n  versionRange: z.string().min(1).optional(),\n});\nexport type ProviderFrontendSdkDescriptor = z.infer<typeof ProviderFrontendSdkDescriptorSchema>;\n\n/**\n * `crossorigin` attribute values for a provider-declared `<script>`.\n *\n * A closed vocabulary with a named runtime source rather than a bare literal\n * union, so each member can carry why it exists — and there are exactly two\n * reasons to pick one over the other.\n */\nexport enum ProviderFrontendScriptCrossOrigin {\n  /** No credentials are sent; the response must carry `Access-Control-Allow-Origin`. The right choice for a public CDN script. */\n  ANONYMOUS = 'anonymous',\n  /** Cookies and TLS client certificates are sent. Only for a vendor that authenticates the script fetch itself. */\n  USE_CREDENTIALS = 'use-credentials',\n}\n\n/**\n * A third-party `<script>` a provider asks its surface to add — the case a\n * dynamic `import()` cannot serve, because the vendor ships a global-installing\n * tag rather than an npm module (reCAPTCHA, most tag managers, several chat\n * widgets).\n *\n * `integrity` is Subresource Integrity. It is optional because a vendor that\n * versionless-serves a mutable URL (again, reCAPTCHA) cannot publish a stable\n * hash — but when it IS given the surface must also send `crossorigin`, or the\n * browser refuses the integrity check outright. That coupling is enforced below\n * rather than left to each surface to remember.\n */\nexport const ProviderFrontendScriptDeclarationSchema = z\n  .strictObject({\n    /** Absolute URL of the script. Its origin must also appear in `csp.scriptOrigins`. */\n    src: z.string().min(1),\n    /** Subresource-integrity hash, e.g. `sha384-…`. */\n    integrity: z.string().min(1).optional(),\n    crossOrigin: z.enum(ProviderFrontendScriptCrossOrigin).optional(),\n    async: z.boolean().optional(),\n    defer: z.boolean().optional(),\n  })\n  .superRefine((declaration, context) => {\n    if (declaration.integrity !== undefined && declaration.crossOrigin === undefined) {\n      context.addIssue({\n        code: 'custom',\n        path: ['crossOrigin'],\n        message:\n          'A script declaring `integrity` must also declare `crossOrigin`; without it the browser skips the '\n          + 'integrity check for a cross-origin script, so the hash would protect nothing.',\n      });\n    }\n  });\nexport type ProviderFrontendScriptDeclaration = z.infer<typeof ProviderFrontendScriptDeclarationSchema>;\n\n/**\n * WHAT a provider's component hands back, when what it hands back is a thing\n * rather than a value.\n *\n * ## The question this answers, and why it is a DECLARATION\n *\n * An application's objective is that it calls third-party APIs directly from\n * custom frontend components. On the backend that is unambiguous. In a browser\n * it is not, because a tenant credential must never get there — so a picker for\n * a credentialed vendor and a picker for a vendor with a browser-safe public\n * token cannot hand back the same thing, and the framework surface that\n * receives a selection has to know which before it mounts anything.\n *\n * Settled 2026-09-07 (issue #383, recorded as Q5 of the provider-architecture\n * plan): **per vendor, DECLARED.** Both shapes are real and both ship; which one\n * a provider emits is a static fact about that provider, stated here and\n * visible on the DATA channel without executing a line of its code.\n *\n * The word doing the work is *declared*. A discriminated union alone would let a\n * provider decide at runtime, which is the shape the decision explicitly\n * rejected — so the framework REFUSES a selection whose discriminant contradicts\n * this field. Without that refusal the declaration is decoration, and a reviewer\n * reading a provider's manifest would be reading a wish.\n *\n * ## Why a single value and not a set\n *\n * A provider that genuinely could emit either — Google's Picker hands back both\n * a file id and a URL, and which is usable depends on the granted OAuth scope —\n * was the argument for `selectionDelivery: [...]`. Rejected: an array puts the\n * choice back at runtime, which is the half of the decision that carries all the\n * weight. A vendor whose two modes are both wanted contributes two components,\n * and the chooser then shows them as what they are — two different things a user\n * can pick between — rather than one component whose behaviour a reader cannot\n * predict.\n *\n * ## What it means for CSP\n *\n * `REMOTE_REFERENCE` does NOT imply a provider needs no `connectOrigins`: a\n * picker still talks to its vendor to RENDER, even when the bytes it selects are\n * fetched later by the backend. So this field does not gate the CSP buckets, and\n * a guard inferring otherwise would break every real picker. What it does gate\n * is where the SELECTED OBJECT travels.\n */\nexport enum ProviderFrontendSelectionDelivery {\n  /**\n   * An opaque handle only the application backend can resolve — a Drive file id,\n   * a DAM asset key. The browser never holds the bytes and never authenticates\n   * to the vendor for them; the framework routes the reference to the\n   * application's executor door, which holds the tenant credential.\n   */\n  REMOTE_REFERENCE = 'REMOTE_REFERENCE',\n  /**\n   * Bytes the browser already holds, as a `File`. Available only to a vendor\n   * whose picker runs on a browser-safe grant — a publishable key, a\n   * user-consented OAuth token, a picker's own scoped grant — so nothing\n   * tenant-secret is involved. The framework uploads it exactly as it uploads a\n   * file chosen from disk.\n   */\n  BROWSER_READABLE_FILE = 'BROWSER_READABLE_FILE',\n  /**\n   * A URL the browser may fetch, under the same browser-safe-grant condition as\n   * `BROWSER_READABLE_FILE`. Distinct from it because the framework must fetch\n   * before it can upload, and that fetch is a network call the composed CSP has\n   * to admit — a difference the surface cannot discover from a `File`.\n   */\n  BROWSER_READABLE_URL = 'BROWSER_READABLE_URL',\n}\n\n/**\n * The DATA half of one component a provider contributes — everything about it\n * that a reviewer, the CLI or a build step can read without running a browser.\n *\n * The loader is the CODE half and stays on the facet module in\n * `@wildo-ai/external-connectors-public`, exactly as `sdk.activate` does. What\n * crosses the wire is the fact that a component EXISTS for this capability, plus\n * the contract it commits to.\n *\n * Strict, and for the same reason the CSP footprint is: this is AUTHORED by a\n * provider package rather than received from an older producer, so a misspelled\n * key must fail where it is written instead of contributing nothing.\n */\nexport const ProviderFrontendComponentDescriptorSchema = z.strictObject({\n  /**\n   * What a selection from this component contains. Absent for a capability whose\n   * component returns a plain value rather than a thing — a captcha widget hands\n   * back a token, and there is no delivery question to answer about a string.\n   */\n  selectionDelivery: z.enum(ProviderFrontendSelectionDelivery).optional(),\n});\nexport type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFrontendComponentDescriptorSchema>;\n\n/**\n * A provider's component descriptors, keyed by the CAPABILITY each fills.\n *\n * The key is validated as a non-empty string, not as a `ProviderCapability`\n * member. The reason this gave until 2026-09-12 — that `ProviderCapability` is\n * OPEN through module augmentation, so a `z.enum` would refuse an application's\n * own capability — stopped being true with #502: the vocabulary is the closed\n * built-in set. A member-checked key is now possible and has NOT been adopted;\n * until it is, an unknown capability key parses here and simply never matches a\n * surface that asks for a real one.\n */\nexport const ProviderFrontendComponentDescriptorsSchema = z.record(\n  z.string().min(1),\n  ProviderFrontendComponentDescriptorSchema,\n);\nexport type ProviderFrontendComponentDescriptors = z.infer<typeof ProviderFrontendComponentDescriptorsSchema>;\n\n/**\n * Pins every bucket member to a real field of the footprint.\n *\n * A member whose value is not a footprint key would be authorable, would parse,\n * and would contribute nothing — in production only, because CSP is report-only\n * in development. This makes it a compile error instead.\n */\nconst _everyBucketNamesAFootprintField: Record<\n  ProviderFrontendCspOriginBucket,\n  keyof Omit<ProviderFrontendCspFootprint, 'derivedOrigins'>\n> = {\n  [ProviderFrontendCspOriginBucket.SCRIPT]: 'scriptOrigins',\n  [ProviderFrontendCspOriginBucket.CONNECT]: 'connectOrigins',\n  [ProviderFrontendCspOriginBucket.FRAME]: 'frameOrigins',\n  [ProviderFrontendCspOriginBucket.IMG]: 'imgOrigins',\n  [ProviderFrontendCspOriginBucket.STYLE]: 'styleOrigins',\n  [ProviderFrontendCspOriginBucket.FONT]: 'fontOrigins',\n};\nvoid _everyBucketNamesAFootprintField;\n"]}

package/dist/esm/external-providers/provider-metadata.shared.schemas.d.ts

@@ -97,8 +97,11 @@ export declare enum ProviderOriginKind {
  * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.
  *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response
  *   shaping stays Wildo's.
- * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the
- *   same output shape. Authoritative where it exists, since it is the vendor's own description.
+ * - `OPENAPI_DOCUMENT` — a vendor's OpenAPI document, read as an ORACLE rather than as a catalogue:
+ *   it never decides WHICH operations exist, and answers questions about the operations the two
+ *   catalogues chose — the response shape, and the names of path holes a catalogue could only name
+ *   by position (#1572). Consulted on every full batch, from a public corpus or from a URL a
+ *   provider decision pins.
  */
 export declare enum ProviderCatalogueSource {
     ACTIVEPIECES = "ACTIVEPIECES",
@@ -168,6 +171,9 @@ export type ProviderMetadata = Omit<z.infer<typeof ProviderMetadataSchema>, 'ori
  * vendors without loading a provider's runtime module.
  */
 export declare const ProviderIdentitySchema: z.ZodObject<{
+    packageName: z.ZodString;
+    tier: z.ZodEnum<typeof ProviderTier>;
+    vendor: z.ZodString;
     origin: z.ZodObject<{
         kind: z.ZodEnum<typeof ProviderOriginKind>;
         catalogue: z.ZodOptional<z.ZodObject<{
@@ -176,9 +182,6 @@ export declare const ProviderIdentitySchema: z.ZodObject<{
             sourceVersion: z.ZodString;
         }, z.core.$strip>>;
     }, z.core.$strip>;
-    packageName: z.ZodString;
-    tier: z.ZodEnum<typeof ProviderTier>;
-    vendor: z.ZodString;
 }, z.core.$strip>;
 export type ProviderIdentity = Omit<z.infer<typeof ProviderIdentitySchema>, 'origin'> & {
     origin: ProviderOrigin;

package/dist/esm/external-providers/provider-metadata.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED,iDAAiD;AACjD,oBAAY,kBAAkB;IAC5B,yDAAyD;IACzD,MAAM,WAAW;IACjB,yEAAyE;IACzE,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,uBAAuB;IACjC,YAAY,iBAAiB;IAC7B,GAAG,QAAQ;IACX,gBAAgB,qBAAqB;CACtC;AAED,eAAO,MAAM,iCAAiC;;;;iBAa5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAa7B,CAAC;AACL,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEnF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,EAAE,cAAmE,CAAC;AAEzG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBA2CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAW3F"}
+{"version":3,"file":"provider-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED,iDAAiD;AACjD,oBAAY,kBAAkB;IAC5B,yDAAyD;IACzD,MAAM,WAAW;IACjB,yEAAyE;IACzE,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,uBAAuB;IACjC,YAAY,iBAAiB;IAC7B,GAAG,QAAQ;IACX,gBAAgB,qBAAqB;CACtC;AAED,eAAO,MAAM,iCAAiC;;;;iBAa5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAa7B,CAAC;AACL,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEnF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,EAAE,cAAmE,CAAC;AAEzG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBA2CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAW3F"}

package/dist/esm/external-providers/provider-metadata.shared.schemas.js

@@ -101,8 +101,11 @@ export var ProviderOriginKind;
  * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.
  *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response
  *   shaping stays Wildo's.
- * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the
- *   same output shape. Authoritative where it exists, since it is the vendor's own description.
+ * - `OPENAPI_DOCUMENT` — a vendor's OpenAPI document, read as an ORACLE rather than as a catalogue:
+ *   it never decides WHICH operations exist, and answers questions about the operations the two
+ *   catalogues chose — the response shape, and the names of path holes a catalogue could only name
+ *   by position (#1572). Consulted on every full batch, from a public corpus or from a URL a
+ *   provider decision pins.
  */
 export var ProviderCatalogueSource;
 (function (ProviderCatalogueSource) {