@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.js

@@ -58,4 +58,153 @@ export const FrontendFilePickerPublicConfigSchema = z.looseObject({
     /** How many files one selection may return. Applies only to a `multiple` field. */
     maxSelectionCount: z.number().int().positive().optional(),
 });
+/**
+ * Every built-in capability that owns public-config keys, and the schema that
+ * owns them.
+ *
+ * A MAP rather than a list of keys, so the keys are derived from the schema that
+ * validates them and the two cannot disagree. Adding a capability's shape here
+ * is the ONE edit that makes its keys admissible everywhere — the admission,
+ * the refusal message and the validation all read this map.
+ *
+ * A capability absent from this map owns no public-config keys, which is the
+ * common case and needs no entry.
+ */
+export const FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS = Object.freeze({
+    FRONTEND_FILE_PICKER: FrontendFilePickerPublicConfigSchema,
+});
+/**
+ * The public-config keys a provider admits BY VIRTUE OF the capabilities it
+ * claims, beside whatever its own `publicConfigSchema` declares.
+ *
+ * ## Why this exists — measured 2026-09-18 (#380)
+ *
+ * `FrontendFilePickerPublicConfigSchema` declares the constraint vocabulary the
+ * FRAMEWORK reads off a picker (`acceptedMimeTypes`, `maxFileSizeMb`,
+ * `maxSelectionCount`), and `resolveFormFieldFileProviderConstraints` reads it.
+ * Three separate gates refused it, because each asked only what the PROVIDER
+ * declares:
+ *
+ * - the config overlay THREW `UNDECLARED_KEY` — *"a key the provider never reads
+ *   would be served to every browser and used by nothing"*, which is false here:
+ *   the framework reads it, for that provider, because it claims the capability;
+ * - hydration answered `unknown key` and set the provider's code to `undefined`,
+ *   so declaring a size limit DELETED the picker;
+ * - and the resolver then found nothing, because nothing had been allowed through.
+ *
+ * All three engine pickers declare a `publicConfigSchema` (`appId`, `clientId`,
+ * `appKey`), so the capability's whole vocabulary was unusable on every one of
+ * them. It worked only on an application-authored picker that declares NO
+ * schema, where the first gate is skipped — which is why the dogfood never saw it.
+ *
+ * The capability schema's own docstring asked a provider to *"EXTEND the schema
+ * for the capability it claims"*, and no affordance to do that existed. This is
+ * the affordance, DERIVED instead: a provider claiming `FRONTEND_FILE_PICKER`
+ * admits the file-picker keys with no edit to the provider, so a capability
+ * shape added tomorrow reaches every provider claiming it and none that does not.
+ */
+export function frontendCapabilityPublicConfigKeys(providerCapabilities) {
+    if (providerCapabilities === undefined)
+        return [];
+    const keys = new Set();
+    for (const capability of providerCapabilities) {
+        const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];
+        if (schema === undefined)
+            continue;
+        for (const key of Object.keys(schema.shape))
+            keys.add(key);
+    }
+    return [...keys];
+}
+/**
+ * Splits a public-config bag into the half the CAPABILITIES own and the half the
+ * provider's own schema must answer for, validating the first here.
+ *
+ * Returning the two halves rather than one merged bag is what lets a caller run
+ * the provider's schema over exactly the keys it declared — a strict provider
+ * schema would otherwise refuse the capability's keys, which is the defect this
+ * whole mechanism exists to remove.
+ */
+export function partitionFrontendCapabilityPublicConfig(input) {
+    const owned = new Set(frontendCapabilityPublicConfigKeys(input.providerCapabilities));
+    const capabilityConfig = {};
+    const providerConfig = {};
+    for (const [key, value] of Object.entries(input.publicConfig)) {
+        (owned.has(key) ? capabilityConfig : providerConfig)[key] = value;
+    }
+    const issues = [];
+    for (const capability of input.providerCapabilities ?? []) {
+        const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];
+        if (schema === undefined)
+            continue;
+        // Only the keys this capability owns: a loose schema would otherwise re-admit
+        // the provider's own keys and report nothing about them, which is correct but
+        // makes the partition pointless.
+        const subject = Object.fromEntries(Object.entries(capabilityConfig).filter(([key]) => key in schema.shape));
+        const parsed = schema.safeParse(subject);
+        if (parsed.success)
+            continue;
+        for (const issue of parsed.error.issues) {
+            issues.push({ message: issue.message, path: issue.path });
+        }
+    }
+    return { capabilityConfig, providerConfig, issues };
+}
+/**
+ * The full set of public-config keys a provider admits: what its own schema
+ * declares, UNION what the capabilities it claims own.
+ *
+ * `undefined` in, `undefined` out — and that is load-bearing. A provider with no
+ * introspectable schema has no key list, which every gate refuses
+ * (`SCHEMA_NOT_INTROSPECTABLE`, #1705); widening `undefined` to the capability
+ * keys would instead turn that refusal into "declares exactly these" and hide
+ * the missing schema behind a plausible list.
+ *
+ * It lives beside the capability map rather than beside
+ * `readDeclaredPublicConfigKeys`, because that module is deliberately
+ * dependency-free so a provider module can declare a schema without pulling a
+ * validation library in.
+ */
+export function admissibleFrontendPublicConfigKeys(input) {
+    if (input.declaredKeys === undefined)
+        return undefined;
+    return [...new Set([...input.declaredKeys, ...frontendCapabilityPublicConfigKeys(input.providerCapabilities)])];
+}
+/**
+ * Lays ONE provider's declared picker limits under the field's own, for that
+ * provider's picker and no other.
+ *
+ * ## Why this is per-provider and not resolved once (#380)
+ *
+ * The field used to resolve its picker constraints from the FIRST provider the
+ * registry returned for `FRONTEND_FILE_PICKER`, and pass that single object to
+ * whichever picker the person then chose — so a Drive limit governed a Dropbox
+ * pick, and which provider won depended on registry order. `ProviderFilePickerHost`
+ * was built so "a framework that picked one would be making a product decision in
+ * a lookup table"; the constraints were still making exactly that decision, one
+ * layer up, and it became reachable the moment a third picker shipped.
+ *
+ * It also reached the field's OWN native upload, which is wrong at any number of
+ * providers: a vendor's picker limit says nothing about a local file going to the
+ * field's own storage.
+ *
+ * Precedence is unchanged and is the part that must not move: the field's Zod
+ * metadata ALWAYS wins, and a provider only fills the gaps the schema left open.
+ * `maxSelectionCount` applies only to a `multiple` field — a single-file field
+ * never inherits a selection count.
+ */
+export function layerProviderFilePickerConstraints(input) {
+    const parsed = FrontendFilePickerPublicConfigSchema.safeParse(input.publicConfig ?? {});
+    // A provider whose own values are wrong contributes NOTHING rather than
+    // nonsense — the same choice the three hand readers this replaced could not
+    // make, because a bad value was indistinguishable from an absent one.
+    const declared = parsed.success ? parsed.data : {};
+    const maxSizeMb = declared.maxFileSizeMb;
+    return {
+        ...input.base,
+        allowedMimeTypes: input.base.allowedMimeTypes ?? declared.acceptedMimeTypes,
+        maxSize: input.base.maxSize ?? (maxSizeMb === undefined ? undefined : maxSizeMb * 1024 * 1024),
+        maxFiles: input.multiple ? (input.base.maxFiles ?? declared.maxSelectionCount) : input.base.maxFiles,
+    };
+}
 //# sourceMappingURL=frontend-capability-public-config.shared.schemas.js.map

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-public-config.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,WAAW,CAAC;IAChE;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC","sourcesContent":["/**\n * The public-config shape a BUILT-IN frontend capability expects, as a named\n * schema rather than a convention.\n *\n * ## Why the capability owns this and not each provider\n *\n * `publicConfig` is `Record<string, unknown>`, so every consuming site was\n * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter\n * for strings, a Mb-to-bytes multiplication — and a renamed key produced\n * `undefined` and a silently wrong picker rather than an error. The keys were a\n * convention nobody had written down, which is the whole defect: three ad-hoc\n * readers agreeing by luck.\n *\n * What a FILE PICKER's constraints mean is framework knowledge — the framework\n * is what applies them to its own file fields — so the shape belongs to the\n * CAPABILITY. A provider is free to carry its own keys beside these (a client\n * id, an app key); it is not free to invent a different spelling of the ones\n * the framework reads, and now it cannot.\n *\n * A provider declaring `publicConfigSchema` should EXTEND the schema for the\n * capability it claims, so hydration validates the framework's fields and its\n * own in one pass.\n */\n\nimport { z } from 'zod';\n\n/**\n * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.\n *\n * Every field is optional: a provider that constrains nothing is legitimate,\n * and the field's own Zod file metadata always wins anyway — a provider only\n * fills the gaps the schema left open.\n *\n * LOOSE, because a provider's own keys live in the same object and must survive\n * a parse that is only looking for these.\n */\nexport const FrontendFilePickerPublicConfigSchema = z.looseObject({\n  /**\n   * MIME types the picker can return.\n   *\n   * An EMPTY list is normalized to absent, and that is behaviour rather than\n   * decoration: the framework turns this into an `accept=` attribute, and an\n   * empty `accept=\"\"` does not mean \"anything\" — it means the file dialog\n   * offers nothing. A provider that declares no types is unconstrained, so the\n   * normalization happens here, once, instead of at each reader that would have\n   * to remember it.\n   */\n  acceptedMimeTypes: z\n    .array(z.string().min(1))\n    .optional()\n    .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),\n  /**\n   * Largest file the picker will hand back, in MEGABYTES.\n   *\n   * The unit is in the name because the framework's own constraint is in BYTES\n   * and the conversion is the kind of thing that is wrong by a factor of 1024²\n   * exactly once, silently, in production.\n   */\n  maxFileSizeMb: z.number().positive().optional(),\n  /** How many files one selection may return. Applies only to a `multiple` field. */\n  maxSelectionCount: z.number().int().positive().optional(),\n});\nexport type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;\n"]}
+{"version":3,"file":"frontend-capability-public-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,WAAW,CAAC;IAChE;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0C,MAAM,CAAC,MAAM,CAAC;IAC5G,oBAAoB,EAAE,oCAAoC;CAC3D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,kCAAkC,CAChD,oBAAmD;IAEnD,IAAI,oBAAoB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uCAAuC,CAAC,KAGvD;IAKC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACtF,MAAM,gBAAgB,GAA4B,EAAE,CAAC;IACrD,MAAM,cAAc,GAA4B,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAA6D,EAAE,CAAC;IAC5E,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,8EAA8E;QAC9E,8EAA8E;QAC9E,iCAAiC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CACxE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,OAAO;YAAE,SAAS;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,GAAG,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kCAAkC,CAMhD,KAID;IACC,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACxF,wEAAwE;IACxE,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC;IAEzC,OAAO;QACL,GAAG,KAAK,CAAC,IAAI;QACb,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,iBAAiB;QAC3E,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;QAC9F,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;KACrG,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The public-config shape a BUILT-IN frontend capability expects, as a named\n * schema rather than a convention.\n *\n * ## Why the capability owns this and not each provider\n *\n * `publicConfig` is `Record<string, unknown>`, so every consuming site was\n * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter\n * for strings, a Mb-to-bytes multiplication — and a renamed key produced\n * `undefined` and a silently wrong picker rather than an error. The keys were a\n * convention nobody had written down, which is the whole defect: three ad-hoc\n * readers agreeing by luck.\n *\n * What a FILE PICKER's constraints mean is framework knowledge — the framework\n * is what applies them to its own file fields — so the shape belongs to the\n * CAPABILITY. A provider is free to carry its own keys beside these (a client\n * id, an app key); it is not free to invent a different spelling of the ones\n * the framework reads, and now it cannot.\n *\n * A provider declaring `publicConfigSchema` should EXTEND the schema for the\n * capability it claims, so hydration validates the framework's fields and its\n * own in one pass.\n */\n\nimport { z } from 'zod';\n\n/**\n * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.\n *\n * Every field is optional: a provider that constrains nothing is legitimate,\n * and the field's own Zod file metadata always wins anyway — a provider only\n * fills the gaps the schema left open.\n *\n * LOOSE, because a provider's own keys live in the same object and must survive\n * a parse that is only looking for these.\n */\nexport const FrontendFilePickerPublicConfigSchema = z.looseObject({\n  /**\n   * MIME types the picker can return.\n   *\n   * An EMPTY list is normalized to absent, and that is behaviour rather than\n   * decoration: the framework turns this into an `accept=` attribute, and an\n   * empty `accept=\"\"` does not mean \"anything\" — it means the file dialog\n   * offers nothing. A provider that declares no types is unconstrained, so the\n   * normalization happens here, once, instead of at each reader that would have\n   * to remember it.\n   */\n  acceptedMimeTypes: z\n    .array(z.string().min(1))\n    .optional()\n    .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),\n  /**\n   * Largest file the picker will hand back, in MEGABYTES.\n   *\n   * The unit is in the name because the framework's own constraint is in BYTES\n   * and the conversion is the kind of thing that is wrong by a factor of 1024²\n   * exactly once, silently, in production.\n   */\n  maxFileSizeMb: z.number().positive().optional(),\n  /** How many files one selection may return. Applies only to a `multiple` field. */\n  maxSelectionCount: z.number().int().positive().optional(),\n});\nexport type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;\n\n/**\n * Every built-in capability that owns public-config keys, and the schema that\n * owns them.\n *\n * A MAP rather than a list of keys, so the keys are derived from the schema that\n * validates them and the two cannot disagree. Adding a capability's shape here\n * is the ONE edit that makes its keys admissible everywhere — the admission,\n * the refusal message and the validation all read this map.\n *\n * A capability absent from this map owns no public-config keys, which is the\n * common case and needs no entry.\n */\nexport const FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS: Readonly<Record<string, z.ZodObject>> = Object.freeze({\n  FRONTEND_FILE_PICKER: FrontendFilePickerPublicConfigSchema,\n});\n\n/**\n * The public-config keys a provider admits BY VIRTUE OF the capabilities it\n * claims, beside whatever its own `publicConfigSchema` declares.\n *\n * ## Why this exists — measured 2026-09-18 (#380)\n *\n * `FrontendFilePickerPublicConfigSchema` declares the constraint vocabulary the\n * FRAMEWORK reads off a picker (`acceptedMimeTypes`, `maxFileSizeMb`,\n * `maxSelectionCount`), and `resolveFormFieldFileProviderConstraints` reads it.\n * Three separate gates refused it, because each asked only what the PROVIDER\n * declares:\n *\n * - the config overlay THREW `UNDECLARED_KEY` — *\"a key the provider never reads\n *   would be served to every browser and used by nothing\"*, which is false here:\n *   the framework reads it, for that provider, because it claims the capability;\n * - hydration answered `unknown key` and set the provider's code to `undefined`,\n *   so declaring a size limit DELETED the picker;\n * - and the resolver then found nothing, because nothing had been allowed through.\n *\n * All three engine pickers declare a `publicConfigSchema` (`appId`, `clientId`,\n * `appKey`), so the capability's whole vocabulary was unusable on every one of\n * them. It worked only on an application-authored picker that declares NO\n * schema, where the first gate is skipped — which is why the dogfood never saw it.\n *\n * The capability schema's own docstring asked a provider to *\"EXTEND the schema\n * for the capability it claims\"*, and no affordance to do that existed. This is\n * the affordance, DERIVED instead: a provider claiming `FRONTEND_FILE_PICKER`\n * admits the file-picker keys with no edit to the provider, so a capability\n * shape added tomorrow reaches every provider claiming it and none that does not.\n */\nexport function frontendCapabilityPublicConfigKeys(\n  providerCapabilities: readonly string[] | undefined,\n): readonly string[] {\n  if (providerCapabilities === undefined) return [];\n  const keys = new Set<string>();\n  for (const capability of providerCapabilities) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    for (const key of Object.keys(schema.shape)) keys.add(key);\n  }\n  return [...keys];\n}\n\n/**\n * Splits a public-config bag into the half the CAPABILITIES own and the half the\n * provider's own schema must answer for, validating the first here.\n *\n * Returning the two halves rather than one merged bag is what lets a caller run\n * the provider's schema over exactly the keys it declared — a strict provider\n * schema would otherwise refuse the capability's keys, which is the defect this\n * whole mechanism exists to remove.\n */\nexport function partitionFrontendCapabilityPublicConfig(input: {\n  readonly providerCapabilities: readonly string[] | undefined;\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n}): {\n  readonly capabilityConfig: Readonly<Record<string, unknown>>;\n  readonly providerConfig: Readonly<Record<string, unknown>>;\n  readonly issues: ReadonlyArray<{ readonly message: string; readonly path: readonly PropertyKey[] }>;\n} {\n  const owned = new Set(frontendCapabilityPublicConfigKeys(input.providerCapabilities));\n  const capabilityConfig: Record<string, unknown> = {};\n  const providerConfig: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input.publicConfig)) {\n    (owned.has(key) ? capabilityConfig : providerConfig)[key] = value;\n  }\n\n  const issues: Array<{ message: string; path: readonly PropertyKey[] }> = [];\n  for (const capability of input.providerCapabilities ?? []) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    // Only the keys this capability owns: a loose schema would otherwise re-admit\n    // the provider's own keys and report nothing about them, which is correct but\n    // makes the partition pointless.\n    const subject = Object.fromEntries(\n      Object.entries(capabilityConfig).filter(([key]) => key in schema.shape),\n    );\n    const parsed = schema.safeParse(subject);\n    if (parsed.success) continue;\n    for (const issue of parsed.error.issues) {\n      issues.push({ message: issue.message, path: issue.path });\n    }\n  }\n\n  return { capabilityConfig, providerConfig, issues };\n}\n\n/**\n * The full set of public-config keys a provider admits: what its own schema\n * declares, UNION what the capabilities it claims own.\n *\n * `undefined` in, `undefined` out — and that is load-bearing. A provider with no\n * introspectable schema has no key list, which every gate refuses\n * (`SCHEMA_NOT_INTROSPECTABLE`, #1705); widening `undefined` to the capability\n * keys would instead turn that refusal into \"declares exactly these\" and hide\n * the missing schema behind a plausible list.\n *\n * It lives beside the capability map rather than beside\n * `readDeclaredPublicConfigKeys`, because that module is deliberately\n * dependency-free so a provider module can declare a schema without pulling a\n * validation library in.\n */\nexport function admissibleFrontendPublicConfigKeys(input: {\n  readonly declaredKeys: readonly string[] | undefined;\n  readonly providerCapabilities: readonly string[] | undefined;\n}): readonly string[] | undefined {\n  if (input.declaredKeys === undefined) return undefined;\n  return [...new Set([...input.declaredKeys, ...frontendCapabilityPublicConfigKeys(input.providerCapabilities)])];\n}\n\n/**\n * Lays ONE provider's declared picker limits under the field's own, for that\n * provider's picker and no other.\n *\n * ## Why this is per-provider and not resolved once (#380)\n *\n * The field used to resolve its picker constraints from the FIRST provider the\n * registry returned for `FRONTEND_FILE_PICKER`, and pass that single object to\n * whichever picker the person then chose — so a Drive limit governed a Dropbox\n * pick, and which provider won depended on registry order. `ProviderFilePickerHost`\n * was built so \"a framework that picked one would be making a product decision in\n * a lookup table\"; the constraints were still making exactly that decision, one\n * layer up, and it became reachable the moment a third picker shipped.\n *\n * It also reached the field's OWN native upload, which is wrong at any number of\n * providers: a vendor's picker limit says nothing about a local file going to the\n * field's own storage.\n *\n * Precedence is unchanged and is the part that must not move: the field's Zod\n * metadata ALWAYS wins, and a provider only fills the gaps the schema left open.\n * `maxSelectionCount` applies only to a `multiple` field — a single-file field\n * never inherits a selection count.\n */\nexport function layerProviderFilePickerConstraints<\n  TConstraints extends {\n    readonly allowedMimeTypes?: readonly string[];\n    readonly maxSize?: number;\n    readonly maxFiles?: number;\n  },\n>(input: {\n  readonly base: TConstraints;\n  readonly multiple: boolean;\n  readonly publicConfig: Readonly<Record<string, unknown>> | undefined;\n}): TConstraints {\n  const parsed = FrontendFilePickerPublicConfigSchema.safeParse(input.publicConfig ?? {});\n  // A provider whose own values are wrong contributes NOTHING rather than\n  // nonsense — the same choice the three hand readers this replaced could not\n  // make, because a bad value was indistinguishable from an absent one.\n  const declared = parsed.success ? parsed.data : {};\n  const maxSizeMb = declared.maxFileSizeMb;\n\n  return {\n    ...input.base,\n    allowedMimeTypes: input.base.allowedMimeTypes ?? declared.acceptedMimeTypes,\n    maxSize: input.base.maxSize ?? (maxSizeMb === undefined ? undefined : maxSizeMb * 1024 * 1024),\n    maxFiles: input.multiple ? (input.base.maxFiles ?? declared.maxSelectionCount) : input.base.maxFiles,\n  };\n}\n"]}

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.d.ts

@@ -94,4 +94,49 @@ export interface FrontendErrorMonitoringSink {
  * reported diagnostic rather than a `TypeError` thrown while handling a crash.
  */
 export declare function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink;
+/**
+ * One product-analytics event, as the framework hands it to a vendor (#1704).
+ *
+ * The same shape `AnalyticsContext.track()` has always taken — a name and flat properties — so the
+ * framework's own auto-instrumentation and an application's custom `track()` reach a vendor unchanged.
+ */
+export interface FrontendProductAnalyticsEvent {
+    readonly name: string;
+    readonly properties?: Readonly<Record<string, unknown>>;
+}
+/**
+ * What the framework calls on a `FRONTEND_PRODUCT_ANALYTICS` provider's activated handle (#1704).
+ *
+ * The application's analytics used to reach a vendor through a second registry inside
+ * `AnalyticsContext`, with its own consent gate. A vendor now arrives as a provider module, is started
+ * by the consent-based activation consumer once the person grants `ConsentPurpose.ANALYTICS`, and
+ * stopped by its `deactivate` on withdrawal or sign-out; `AnalyticsContext` only DISPATCHES to the
+ * sinks that are currently active. So there is one consent gate and one CSP footprint for a vendor.
+ *
+ * Synchronous and returning nothing, for the reason `FrontendErrorMonitoringSink` gives: a vendor
+ * queues and flushes on its own schedule, and tracking must never become something a surface awaits.
+ */
+export interface FrontendProductAnalyticsSink {
+    track(event: FrontendProductAnalyticsEvent): void;
+    page(path: string, properties?: Readonly<Record<string, unknown>>): void;
+    /** The signed-in person, by the framework's own opaque id — never an email or a name. */
+    identify(identity: {
+        readonly userId: string;
+        readonly organizationId?: string;
+    }): void;
+    /** Forget the identified person (sign-out) without stopping the provider. */
+    reset(): void;
+}
+/** Whether an activated SDK handle can receive product-analytics events — checked at the seam, like the crash sink. */
+export declare function isFrontendProductAnalyticsSink(handle: unknown): handle is FrontendProductAnalyticsSink;
+/**
+ * What the framework calls on a `FRONTEND_CAPTCHA` provider's activated handle (#1735): mint a token for
+ * one action, which the same vendor's backend part verifies. Returns `undefined` when the vendor could not
+ * produce one; the form then answers the engine's proof of work instead.
+ */
+export interface FrontendCaptchaSink {
+    execute(action: string): Promise<string | undefined>;
+}
+/** Whether an activated SDK handle can mint captcha tokens — checked at the seam, like the other sinks. */
+export declare function isFrontendCaptchaSink(handle: unknown): handle is FrontendCaptchaSink;
 //# sourceMappingURL=frontend-capability-runtime.shared.types.d.ts.map

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-runtime.shared.types.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAMpG"}
+{"version":3,"file":"frontend-capability-runtime.shared.types.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAMpG;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,KAAK,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAClD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACzE,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxF,6EAA6E;IAC7E,KAAK,IAAI,IAAI,CAAC;CACf;AAED,uHAAuH;AACvH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,4BAA4B,CAOtG;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACtD;AAED,2GAA2G;AAC3G,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,mBAAmB,CAEpF"}

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.js

@@ -38,4 +38,18 @@ export function isFrontendErrorMonitoringSink(handle) {
         && handle !== null
         && typeof handle.reportCrash === 'function');
 }
+/** Whether an activated SDK handle can receive product-analytics events — checked at the seam, like the crash sink. */
+export function isFrontendProductAnalyticsSink(handle) {
+    if (typeof handle !== 'object' || handle === null)
+        return false;
+    const candidate = handle;
+    return typeof candidate.track === 'function'
+        && typeof candidate.page === 'function'
+        && typeof candidate.identify === 'function'
+        && typeof candidate.reset === 'function';
+}
+/** Whether an activated SDK handle can mint captcha tokens — checked at the seam, like the other sinks. */
+export function isFrontendCaptchaSink(handle) {
+    return typeof handle === 'object' && handle !== null && typeof handle.execute === 'function';
+}
 //# sourceMappingURL=frontend-capability-runtime.shared.types.js.map

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-runtime.shared.types.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;WACvB,MAAM,KAAK,IAAI;WACf,OAAQ,MAAsC,CAAC,WAAW,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The RUNTIME contract a built-in frontend capability expects of whichever\n * provider fills it — the code-half sibling of\n * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.\n *\n * ## Why the capability owns the shape, and not the framework's call site\n *\n * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider\n * package must not know any vendor's type, and \"a consumer that needs one narrows\n * it at the point where it also knows which provider it asked for.\"\n *\n * That reasoning holds for a picker, where the surface really did ask for Drive.\n * It inverts for an OBSERVABILITY capability: the framework reports a crash without\n * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted\n * collector is listening. Narrowing at the call site would mean a `switch` over\n * vendors inside the engine, which is precisely what the capability model exists to\n * prevent.\n *\n * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,\n * and the framework calls one method it owns the definition of.\n *\n * ## Bundle-safe by construction\n *\n * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from\n * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take\n * a handful of atoms without the decorator-bound schema graph.\n */\n\n/**\n * One crash, as the framework describes it to whichever provider is listening.\n *\n * ## What is in it, and why that is the whole list\n *\n * `name`, `message`, `stack` and `componentStack` are exactly what\n * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught\n * crash. Nothing new is collected to fill this shape; what changes is only that the\n * report can now leave the browser.\n *\n * **`message` is sent as authored, and that is a decision rather than an oversight.**\n * It is the field most likely to carry user content — `new Error(\\`Invalid value:\n * ${input}\\`)` — and it is also the field without which a crash report is close to\n * useless. Every mainstream crash reporter sends the exception message and scrubs by\n * KEY rather than by free-text inspection, because a scrubber over prose either\n * destroys the diagnostic or gives false assurance. An application that cannot accept\n * that should not declare `FRONTEND_ERROR_MONITORING`.\n *\n * ## What is deliberately NOT in it\n *\n * No user identity, no session or organisation id, no request or form payload, and no\n * resource content. A crash report is a diagnostic about CODE; attributing it to a\n * PERSON is a separate decision an application would have to take deliberately, and\n * there is no field here through which it could happen by accident.\n */\nexport interface FrontendCrashReport {\n  /** The error's class name — `TypeError`, `WildoFrontendError`. */\n  readonly name: string;\n  /** The error's own message, unmodified. See the note above before changing this. */\n  readonly message: string;\n  /** The JavaScript stack, when the runtime produced one. */\n  readonly stack?: string;\n  /**\n   * React's component stack for a crash a boundary caught. Component NAMES only —\n   * no props, no state — so it says which screen broke without saying what was on it.\n   */\n  readonly componentStack?: string;\n  /**\n   * Framework classification, flattened to strings at this boundary.\n   *\n   * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,\n   * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must\n   * not pull in, and every mainstream vendor models exactly this as string tags. The\n   * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one\n   * named runtime source and only its serialization is local to this contract.\n   */\n  readonly tags?: Readonly<Record<string, string>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated\n * handle.\n *\n * Synchronous and returning nothing, deliberately. Reporting a crash must never\n * become something a crashing surface has to await or handle: a vendor SDK queues and\n * flushes on its own schedule, and a rejected promise here would be a second error\n * raised from inside the first one's handler.\n */\nexport interface FrontendErrorMonitoringSink {\n  reportCrash(report: FrontendCrashReport): void;\n}\n\n/**\n * Whether an activated SDK handle can receive crash reports.\n *\n * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor\n * namespace that does not implement this contract — a mistake no type can catch,\n * because `handle` is `unknown` by design. Checked at the seam so the failure is a\n * reported diagnostic rather than a `TypeError` thrown while handling a crash.\n */\nexport function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink {\n  return (\n    typeof handle === 'object'\n    && handle !== null\n    && typeof (handle as FrontendErrorMonitoringSink).reportCrash === 'function'\n  );\n}\n"]}
+{"version":3,"file":"frontend-capability-runtime.shared.types.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;WACvB,MAAM,KAAK,IAAI;WACf,OAAQ,MAAsC,CAAC,WAAW,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC;AAkCD,uHAAuH;AACvH,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,SAAS,GAAG,MAAsE,CAAC;IACzF,OAAO,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU;WACvC,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;WACpC,OAAO,SAAS,CAAC,QAAQ,KAAK,UAAU;WACxC,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,CAAC;AAC7C,CAAC;AAWD,2GAA2G;AAC3G,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAQ,MAA8B,CAAC,OAAO,KAAK,UAAU,CAAC;AACxH,CAAC","sourcesContent":["/**\n * The RUNTIME contract a built-in frontend capability expects of whichever\n * provider fills it — the code-half sibling of\n * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.\n *\n * ## Why the capability owns the shape, and not the framework's call site\n *\n * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider\n * package must not know any vendor's type, and \"a consumer that needs one narrows\n * it at the point where it also knows which provider it asked for.\"\n *\n * That reasoning holds for a picker, where the surface really did ask for Drive.\n * It inverts for an OBSERVABILITY capability: the framework reports a crash without\n * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted\n * collector is listening. Narrowing at the call site would mean a `switch` over\n * vendors inside the engine, which is precisely what the capability model exists to\n * prevent.\n *\n * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,\n * and the framework calls one method it owns the definition of.\n *\n * ## Bundle-safe by construction\n *\n * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from\n * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take\n * a handful of atoms without the decorator-bound schema graph.\n */\n\n/**\n * One crash, as the framework describes it to whichever provider is listening.\n *\n * ## What is in it, and why that is the whole list\n *\n * `name`, `message`, `stack` and `componentStack` are exactly what\n * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught\n * crash. Nothing new is collected to fill this shape; what changes is only that the\n * report can now leave the browser.\n *\n * **`message` is sent as authored, and that is a decision rather than an oversight.**\n * It is the field most likely to carry user content — `new Error(\\`Invalid value:\n * ${input}\\`)` — and it is also the field without which a crash report is close to\n * useless. Every mainstream crash reporter sends the exception message and scrubs by\n * KEY rather than by free-text inspection, because a scrubber over prose either\n * destroys the diagnostic or gives false assurance. An application that cannot accept\n * that should not declare `FRONTEND_ERROR_MONITORING`.\n *\n * ## What is deliberately NOT in it\n *\n * No user identity, no session or organisation id, no request or form payload, and no\n * resource content. A crash report is a diagnostic about CODE; attributing it to a\n * PERSON is a separate decision an application would have to take deliberately, and\n * there is no field here through which it could happen by accident.\n */\nexport interface FrontendCrashReport {\n  /** The error's class name — `TypeError`, `WildoFrontendError`. */\n  readonly name: string;\n  /** The error's own message, unmodified. See the note above before changing this. */\n  readonly message: string;\n  /** The JavaScript stack, when the runtime produced one. */\n  readonly stack?: string;\n  /**\n   * React's component stack for a crash a boundary caught. Component NAMES only —\n   * no props, no state — so it says which screen broke without saying what was on it.\n   */\n  readonly componentStack?: string;\n  /**\n   * Framework classification, flattened to strings at this boundary.\n   *\n   * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,\n   * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must\n   * not pull in, and every mainstream vendor models exactly this as string tags. The\n   * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one\n   * named runtime source and only its serialization is local to this contract.\n   */\n  readonly tags?: Readonly<Record<string, string>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated\n * handle.\n *\n * Synchronous and returning nothing, deliberately. Reporting a crash must never\n * become something a crashing surface has to await or handle: a vendor SDK queues and\n * flushes on its own schedule, and a rejected promise here would be a second error\n * raised from inside the first one's handler.\n */\nexport interface FrontendErrorMonitoringSink {\n  reportCrash(report: FrontendCrashReport): void;\n}\n\n/**\n * Whether an activated SDK handle can receive crash reports.\n *\n * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor\n * namespace that does not implement this contract — a mistake no type can catch,\n * because `handle` is `unknown` by design. Checked at the seam so the failure is a\n * reported diagnostic rather than a `TypeError` thrown while handling a crash.\n */\nexport function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink {\n  return (\n    typeof handle === 'object'\n    && handle !== null\n    && typeof (handle as FrontendErrorMonitoringSink).reportCrash === 'function'\n  );\n}\n\n/**\n * One product-analytics event, as the framework hands it to a vendor (#1704).\n *\n * The same shape `AnalyticsContext.track()` has always taken — a name and flat properties — so the\n * framework's own auto-instrumentation and an application's custom `track()` reach a vendor unchanged.\n */\nexport interface FrontendProductAnalyticsEvent {\n  readonly name: string;\n  readonly properties?: Readonly<Record<string, unknown>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_PRODUCT_ANALYTICS` provider's activated handle (#1704).\n *\n * The application's analytics used to reach a vendor through a second registry inside\n * `AnalyticsContext`, with its own consent gate. A vendor now arrives as a provider module, is started\n * by the consent-based activation consumer once the person grants `ConsentPurpose.ANALYTICS`, and\n * stopped by its `deactivate` on withdrawal or sign-out; `AnalyticsContext` only DISPATCHES to the\n * sinks that are currently active. So there is one consent gate and one CSP footprint for a vendor.\n *\n * Synchronous and returning nothing, for the reason `FrontendErrorMonitoringSink` gives: a vendor\n * queues and flushes on its own schedule, and tracking must never become something a surface awaits.\n */\nexport interface FrontendProductAnalyticsSink {\n  track(event: FrontendProductAnalyticsEvent): void;\n  page(path: string, properties?: Readonly<Record<string, unknown>>): void;\n  /** The signed-in person, by the framework's own opaque id — never an email or a name. */\n  identify(identity: { readonly userId: string; readonly organizationId?: string }): void;\n  /** Forget the identified person (sign-out) without stopping the provider. */\n  reset(): void;\n}\n\n/** Whether an activated SDK handle can receive product-analytics events — checked at the seam, like the crash sink. */\nexport function isFrontendProductAnalyticsSink(handle: unknown): handle is FrontendProductAnalyticsSink {\n  if (typeof handle !== 'object' || handle === null) return false;\n  const candidate = handle as Partial<Record<keyof FrontendProductAnalyticsSink, unknown>>;\n  return typeof candidate.track === 'function'\n    && typeof candidate.page === 'function'\n    && typeof candidate.identify === 'function'\n    && typeof candidate.reset === 'function';\n}\n\n/**\n * What the framework calls on a `FRONTEND_CAPTCHA` provider's activated handle (#1735): mint a token for\n * one action, which the same vendor's backend part verifies. Returns `undefined` when the vendor could not\n * produce one; the form then answers the engine's proof of work instead.\n */\nexport interface FrontendCaptchaSink {\n  execute(action: string): Promise<string | undefined>;\n}\n\n/** Whether an activated SDK handle can mint captcha tokens — checked at the seam, like the other sinks. */\nexport function isFrontendCaptchaSink(handle: unknown): handle is FrontendCaptchaSink {\n  return typeof handle === 'object' && handle !== null && typeof (handle as FrontendCaptchaSink).execute === 'function';\n}\n\n"]}

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.d.ts

@@ -1,5 +1,44 @@
 import { z } from 'zod';
-import { FileStorageAccepted } from '@wildo-ai/zod-decorators';
+/**
+ * The `z_file` storage vocabulary, as a BROWSER-SAFE declaration of the values
+ * `FileStorageAccepted` in `@wildo-ai/zod-decorators` owns.
+ *
+ * ## Why this is not an import of that enum
+ *
+ * This file sits in the `@wildo-ai/saas-models/public-runtime` closure, which
+ * browser-bound provider modules load. Importing ANYTHING from
+ * `@wildo-ai/zod-decorators` puts that package's root barrel into the bundle,
+ * and that barrel mutates Zod's prototypes as an import side effect
+ * (`ensureZodDecoratorsLoaded(z)`) — the reason K-3 forbids it, and what
+ * `public-runtime.boundary.test.ts` measures. A re-export of the enum (the
+ * previous shape, #394 P5) is an import all the same (#607).
+ *
+ * ## Why a literal union, and why it stays compatible
+ *
+ * The owning enum is the ONE runtime source of the vocabulary; this is the
+ * browser door's spelling of it, pinned member-for-member (keys AND values, at
+ * type level and at runtime) by `__tests__/file-storage-accepted.drift.test.ts`
+ * — the same arrangement `BUILTIN_PROVIDER_PROTOCOL` has with the engine's
+ * protocol enum, for the same boundary.
+ *
+ * It is `as const` rather than a second `enum` on purpose: two enums are
+ * NOMINALLY distinct, so the field side (`z_file({ storageAccepted })`, the
+ * owning enum) could not be compared with the provider side (this). A string
+ * enum IS assignable to the literal union of its values, so the owning enum
+ * flows into every slot typed with this vocabulary, and
+ * `FileStorageAccepted.GOOGLE_DRIVE` reads identically at an authoring site.
+ * The reverse is not true: a value typed here does not flow into a slot typed
+ * with the owning enum — that direction does not occur today, and the compiler
+ * reports it if it ever does.
+ */
+export declare const FileStorageAccepted: {
+    readonly WILDO_MANAGED: "wildo_managed";
+    readonly LOCAL_DIRECTORY: "local_directory";
+    readonly ONEDRIVE: "onedrive";
+    readonly GOOGLE_DRIVE: "google_drive";
+    readonly DROPBOX: "dropbox";
+};
+export type FileStorageAccepted = (typeof FileStorageAccepted)[keyof typeof FileStorageAccepted];
 /**
  * Bundle-safe frontend provider atoms shared by every browser-bound runtime.
  *
@@ -68,6 +107,8 @@ export declare const FrontendProviderEntrySchema: z.ZodObject<{
         imgOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
         styleOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
         fontOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        workerOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        mediaOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
         derivedOrigins: z.ZodDefault<z.ZodArray<z.ZodObject<{
             publicConfigKey: z.ZodString;
             bucket: z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendCspOriginBucket>;
@@ -103,14 +144,22 @@ export declare const FrontendProviderEntrySchema: z.ZodObject<{
      */
     components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
+        placeIdRetention: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderAddressLookupPlaceIdRetention>>;
+        addressLookup: z.ZodOptional<z.ZodObject<{
+            suggestOperationId: z.ZodString;
+            retrieveOperationId: z.ZodString;
+            sessionTokenInput: z.ZodOptional<z.ZodString>;
+            attributionMark: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>>;
     /**
      * The public-config keys the provider module DECLARES it reads — the DATA
      * half of its `publicConfigSchema`, mirrored here so the companion walk can
      * refuse an application-supplied key the module never declared, without
      * executing the module (#394 P3). Absent when the module's schema is not
-     * introspectable, which the overlay reads as "cannot enforce here", never as
-     * "declares nothing".
+     * introspectable, which the overlay REFUSES (`SCHEMA_NOT_INTROSPECTABLE`, #1705)
+     * — never read as "declares nothing". Optional on the wire only so an entry an
+     * older producer wrote still parses and is refused with a message.
      */
     publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
     /**
@@ -131,7 +180,95 @@ export declare const FrontendProviderEntrySchema: z.ZodObject<{
      * SERVES the storage is CODE, keyed by the same enum member and naming this
      * provider back as its `connectedProviderRef`; a pin holds the two ends equal.
      */
-    fileStorage: z.ZodOptional<z.ZodEnum<typeof FileStorageAccepted>>;
+    fileStorage: z.ZodOptional<z.ZodEnum<{
+        readonly WILDO_MANAGED: "wildo_managed";
+        readonly LOCAL_DIRECTORY: "local_directory";
+        readonly ONEDRIVE: "onedrive";
+        readonly GOOGLE_DRIVE: "google_drive";
+        readonly DROPBOX: "dropbox";
+    }>>;
+    /**
+     * The vendor's deployment model, processing regions and legal entity, as the facet module
+     * declares them (#1743) — the primitives a processor register, a recipients fact and a regional
+     * report are derived from.
+     *
+     * ## Why it rides HERE, and why the browser gets it too
+     *
+     * A frontend provider executes in the DATA SUBJECT'S BROWSER and talks to its vendor directly, so
+     * it is exactly the kind of recipient a privacy notice must name (#345). The module has carried
+     * this profile since #345, and every projection built the entry field by field and left it
+     * behind — so reCAPTCHA, Sentry and the Drive/OneDrive/Dropbox pickers stated their
+     * entity and regions in source and no compliance reader could see any of them.
+     *
+     * This entry is the one record that is materialized PER APPLICATION, PER SERVICE, for exactly the
+     * providers that service SERVES (`frontendProviderBootstraps` in the generated frontend-services
+     * artifact). That is the population a recipient derivation needs — the browser vendors this
+     * application actually runs, not every module the engine ships — and a reader gets it by parsing a
+     * generated JSON file on disk rather than by loading provider packages. A field on the
+     * contribution beside `identity` was the alternative and was rejected for that reason: the
+     * contribution is never materialized per service, so a reader would have to re-run discovery.
+     *
+     * It is therefore also served on `/application-config`. That costs a few public facts (a vendor's
+     * name and the regions it offers, which the application's own privacy notice publishes anyway)
+     * and it keeps the two producing sites — the companion projection and the backend fallback —
+     * identical, so what a compliance reader sees never depends on whether a sync ran.
+     *
+     * Not a second authority for backend providers. A provider SPECIFICATION restates its BACKEND
+     * module's profile (and is reconciled against it); this restates the FRONTEND facet's. Registering
+     * specifications for browser-only vendors was the other option and was rejected: a specification
+     * describes a backend module — protocols, secrets contract, engine slots — and a browser-only
+     * vendor has none of them.
+     *
+     * Absent means the module's author stated nothing, which a reader must report as NOT ESTABLISHED
+     * rather than skip — `listServedFrontendProviderCompliance` (beside the profile schema) returns `null` for exactly that.
+     */
+    complianceProfile: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        determination: z.ZodOptional<z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.ESTABLISHED>>;
+        deploymentModels: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderDeploymentModel>>;
+        processingRegions: z.ZodArray<z.ZodString>;
+        vendorLegalEntityName: z.ZodOptional<z.ZodString>;
+        subprocessorListUrl: z.ZodOptional<z.ZodURL>;
+        dataProcessingAgreementUrl: z.ZodOptional<z.ZodURL>;
+        evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            facts: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderComplianceFact>>;
+            source: z.ZodURL;
+            verifiedAt: z.ZodISODate;
+        }, z.core.$strict>>>;
+        subjectErasure: z.ZodOptional<z.ZodObject<{
+            stance: z.ZodEnum<{
+                readonly NO_SUBJECT_DATA: import("..").HttpApiErasureStance.NO_SUBJECT_DATA;
+                readonly EXTERNAL_ERASURE_OPERATION: import("..").HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION;
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        determination: z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.UNDETERMINED>;
+        reason: z.ZodString;
+    }, z.core.$strict>]>>;
+    /**
+     * Consent purposes this PROVIDER rests on beyond its capabilities' floor (#1702) — the facet module's
+     * own `consentPurposes`, as data.
+     *
+     * ## Why it has to ride here
+     *
+     * The consent decision is taken in the browser on the HYDRATED module, whose `providerCapabilities`
+     * come from this entry, so a vendor-level purpose the entry did not carry would reach no gate at all:
+     * a provider whose vendor needs more than its capability's floor (Google reCAPTCHA, which the CNIL held
+     * is not exempt as a security measure because it also serves Google's own purposes — Délibération
+     * SAN-2023-003) would start on the floor alone. Carried by BOTH producing sites — the companion
+     * projection and the backend fallback — for the reason every field above is.
+     *
+     * ADDITIVE ONLY. It is unioned with the capabilities' floor by `consentPurposesRequiredByProvider`,
+     * so an entry can never lower what a capability requires; and hydration unions it with the CODE
+     * module's own declaration, so a stale entry cannot lower what the bundled module requires either.
+     * Absent and `[]` mean the same thing: nothing beyond the floor.
+     *
+     * Strings on the wire, like `providerCapabilities`, and for the same version-skew reason: a member an
+     * older reader does not know must not fail the parse of the whole provider block. The projection
+     * refuses an unknown member where it is authored, and the browser's consent decision FAILS CLOSED on
+     * one it meets (`isProviderPermittedByConsent`) — so an unknown purpose withholds its provider rather
+     * than being dropped, which on an additive field would lower the floor.
+     */
+    consentPurposes: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$loose>;
 export type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;
 export declare const FrontendProvidersBlockSchema: z.ZodObject<{
@@ -168,6 +305,8 @@ export declare const FrontendProvidersBlockSchema: z.ZodObject<{
             imgOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
             styleOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
             fontOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            workerOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            mediaOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
             derivedOrigins: z.ZodDefault<z.ZodArray<z.ZodObject<{
                 publicConfigKey: z.ZodString;
                 bucket: z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendCspOriginBucket>;
@@ -203,14 +342,22 @@ export declare const FrontendProvidersBlockSchema: z.ZodObject<{
          */
         components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
+            placeIdRetention: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderAddressLookupPlaceIdRetention>>;
+            addressLookup: z.ZodOptional<z.ZodObject<{
+                suggestOperationId: z.ZodString;
+                retrieveOperationId: z.ZodString;
+                sessionTokenInput: z.ZodOptional<z.ZodString>;
+                attributionMark: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>>;
         /**
          * The public-config keys the provider module DECLARES it reads — the DATA
          * half of its `publicConfigSchema`, mirrored here so the companion walk can
          * refuse an application-supplied key the module never declared, without
          * executing the module (#394 P3). Absent when the module's schema is not
-         * introspectable, which the overlay reads as "cannot enforce here", never as
-         * "declares nothing".
+         * introspectable, which the overlay REFUSES (`SCHEMA_NOT_INTROSPECTABLE`, #1705)
+         * — never read as "declares nothing". Optional on the wire only so an entry an
+         * older producer wrote still parses and is refused with a message.
          */
         publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
         /**
@@ -231,7 +378,95 @@ export declare const FrontendProvidersBlockSchema: z.ZodObject<{
          * SERVES the storage is CODE, keyed by the same enum member and naming this
          * provider back as its `connectedProviderRef`; a pin holds the two ends equal.
          */
-        fileStorage: z.ZodOptional<z.ZodEnum<typeof FileStorageAccepted>>;
+        fileStorage: z.ZodOptional<z.ZodEnum<{
+            readonly WILDO_MANAGED: "wildo_managed";
+            readonly LOCAL_DIRECTORY: "local_directory";
+            readonly ONEDRIVE: "onedrive";
+            readonly GOOGLE_DRIVE: "google_drive";
+            readonly DROPBOX: "dropbox";
+        }>>;
+        /**
+         * The vendor's deployment model, processing regions and legal entity, as the facet module
+         * declares them (#1743) — the primitives a processor register, a recipients fact and a regional
+         * report are derived from.
+         *
+         * ## Why it rides HERE, and why the browser gets it too
+         *
+         * A frontend provider executes in the DATA SUBJECT'S BROWSER and talks to its vendor directly, so
+         * it is exactly the kind of recipient a privacy notice must name (#345). The module has carried
+         * this profile since #345, and every projection built the entry field by field and left it
+         * behind — so reCAPTCHA, Sentry and the Drive/OneDrive/Dropbox pickers stated their
+         * entity and regions in source and no compliance reader could see any of them.
+         *
+         * This entry is the one record that is materialized PER APPLICATION, PER SERVICE, for exactly the
+         * providers that service SERVES (`frontendProviderBootstraps` in the generated frontend-services
+         * artifact). That is the population a recipient derivation needs — the browser vendors this
+         * application actually runs, not every module the engine ships — and a reader gets it by parsing a
+         * generated JSON file on disk rather than by loading provider packages. A field on the
+         * contribution beside `identity` was the alternative and was rejected for that reason: the
+         * contribution is never materialized per service, so a reader would have to re-run discovery.
+         *
+         * It is therefore also served on `/application-config`. That costs a few public facts (a vendor's
+         * name and the regions it offers, which the application's own privacy notice publishes anyway)
+         * and it keeps the two producing sites — the companion projection and the backend fallback —
+         * identical, so what a compliance reader sees never depends on whether a sync ran.
+         *
+         * Not a second authority for backend providers. A provider SPECIFICATION restates its BACKEND
+         * module's profile (and is reconciled against it); this restates the FRONTEND facet's. Registering
+         * specifications for browser-only vendors was the other option and was rejected: a specification
+         * describes a backend module — protocols, secrets contract, engine slots — and a browser-only
+         * vendor has none of them.
+         *
+         * Absent means the module's author stated nothing, which a reader must report as NOT ESTABLISHED
+         * rather than skip — `listServedFrontendProviderCompliance` (beside the profile schema) returns `null` for exactly that.
+         */
+        complianceProfile: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            determination: z.ZodOptional<z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.ESTABLISHED>>;
+            deploymentModels: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderDeploymentModel>>;
+            processingRegions: z.ZodArray<z.ZodString>;
+            vendorLegalEntityName: z.ZodOptional<z.ZodString>;
+            subprocessorListUrl: z.ZodOptional<z.ZodURL>;
+            dataProcessingAgreementUrl: z.ZodOptional<z.ZodURL>;
+            evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                facts: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderComplianceFact>>;
+                source: z.ZodURL;
+                verifiedAt: z.ZodISODate;
+            }, z.core.$strict>>>;
+            subjectErasure: z.ZodOptional<z.ZodObject<{
+                stance: z.ZodEnum<{
+                    readonly NO_SUBJECT_DATA: import("..").HttpApiErasureStance.NO_SUBJECT_DATA;
+                    readonly EXTERNAL_ERASURE_OPERATION: import("..").HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION;
+                }>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            determination: z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.UNDETERMINED>;
+            reason: z.ZodString;
+        }, z.core.$strict>]>>;
+        /**
+         * Consent purposes this PROVIDER rests on beyond its capabilities' floor (#1702) — the facet module's
+         * own `consentPurposes`, as data.
+         *
+         * ## Why it has to ride here
+         *
+         * The consent decision is taken in the browser on the HYDRATED module, whose `providerCapabilities`
+         * come from this entry, so a vendor-level purpose the entry did not carry would reach no gate at all:
+         * a provider whose vendor needs more than its capability's floor (Google reCAPTCHA, which the CNIL held
+         * is not exempt as a security measure because it also serves Google's own purposes — Délibération
+         * SAN-2023-003) would start on the floor alone. Carried by BOTH producing sites — the companion
+         * projection and the backend fallback — for the reason every field above is.
+         *
+         * ADDITIVE ONLY. It is unioned with the capabilities' floor by `consentPurposesRequiredByProvider`,
+         * so an entry can never lower what a capability requires; and hydration unions it with the CODE
+         * module's own declaration, so a stale entry cannot lower what the bundled module requires either.
+         * Absent and `[]` mean the same thing: nothing beyond the floor.
+         *
+         * Strings on the wire, like `providerCapabilities`, and for the same version-skew reason: a member an
+         * older reader does not know must not fail the parse of the whole provider block. The projection
+         * refuses an unknown member where it is authored, and the browser's consent decision FAILS CLOSED on
+         * one it meets (`isProviderPermittedByConsent`) — so an unknown purpose withholds its provider rather
+         * than being dropped, which on an additive field would lower the floor.
+         */
+        consentPurposes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$loose>>>;
 }, z.core.$strip>;
 export type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-entry.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAS/D;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;IAKtC;;;;OAIG;;;;;;;;;;;;;IAEH;;;;;OAKG;;;;;IAEH,0EAA0E;;;;;;;;IAE1E;;;;;;;;;OASG;;;;IAEH;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;;OAiBG;;iBAEH,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;QAzDvC;;;;WAIG;;;;;;;;;;;;;QAEH;;;;;WAKG;;;;;QAEH,0EAA0E;;;;;;;;QAE1E;;;;;;;;;WASG;;;;QAEH;;;;;;;WAOG;;QAEH;;;;;;;;;;;;;;;;;WAiBG;;;iBAOH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"frontend-provider-entry.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAwBH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEjG;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;IAKtC;;;;OAIG;;;;;;;;;;;;;;;IAEH;;;;;OAKG;;;;;IAEH,0EAA0E;;;;;;;;IAE1E;;;;;;;;;OASG;;;;;;;;;;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;;;;;;;;OAiBG;;;;;;;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;;;;;;;;;;;;;;;;;;;;;;;IAEH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;;iBAEH,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;QAvHvC;;;;WAIG;;;;;;;;;;;;;;;QAEH;;;;;WAKG;;;;;QAEH,0EAA0E;;;;;;;;QAE1E;;;;;;;;;WASG;;;;;;;;;;;QAEH;;;;;;;;WAQG;;QAEH;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;QAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCG;;;;;;;;;;;;;;;;;;;;;;;QAEH;;;;;;;;;;;;;;;;;;;;;;;WAuBG;;;iBAOH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}