@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.js

@@ -1,7 +1,69 @@
 import { z } from 'zod';
-import { FileStorageAccepted } from '@wildo-ai/zod-decorators';
+import { ProviderComplianceProfileSchema } from './provider-compliance-profile.shared.schemas.js';
 import { ProviderMetadataSchema } from './provider-metadata.shared.schemas.js';
 import { ProviderFrontendComponentDescriptorsSchema, ProviderFrontendCspFootprintSchema, ProviderFrontendScriptDeclarationSchema, ProviderFrontendSdkDescriptorSchema, } from './provider-frontend-surface.shared.schemas.js';
+/**
+ * The `z_file` storage vocabulary, as a BROWSER-SAFE declaration of the values
+ * `FileStorageAccepted` in `@wildo-ai/zod-decorators` owns.
+ *
+ * ## Why this is not an import of that enum
+ *
+ * This file sits in the `@wildo-ai/saas-models/public-runtime` closure, which
+ * browser-bound provider modules load. Importing ANYTHING from
+ * `@wildo-ai/zod-decorators` puts that package's root barrel into the bundle,
+ * and that barrel mutates Zod's prototypes as an import side effect
+ * (`ensureZodDecoratorsLoaded(z)`) — the reason K-3 forbids it, and what
+ * `public-runtime.boundary.test.ts` measures. A re-export of the enum (the
+ * previous shape, #394 P5) is an import all the same (#607).
+ *
+ * ## Why a literal union, and why it stays compatible
+ *
+ * The owning enum is the ONE runtime source of the vocabulary; this is the
+ * browser door's spelling of it, pinned member-for-member (keys AND values, at
+ * type level and at runtime) by `__tests__/file-storage-accepted.drift.test.ts`
+ * — the same arrangement `BUILTIN_PROVIDER_PROTOCOL` has with the engine's
+ * protocol enum, for the same boundary.
+ *
+ * It is `as const` rather than a second `enum` on purpose: two enums are
+ * NOMINALLY distinct, so the field side (`z_file({ storageAccepted })`, the
+ * owning enum) could not be compared with the provider side (this). A string
+ * enum IS assignable to the literal union of its values, so the owning enum
+ * flows into every slot typed with this vocabulary, and
+ * `FileStorageAccepted.GOOGLE_DRIVE` reads identically at an authoring site.
+ * The reverse is not true: a value typed here does not flow into a slot typed
+ * with the owning enum — that direction does not occur today, and the compiler
+ * reports it if it ever does.
+ */
+/*
+ * ## NOT every member is served, and the rule is what to trust (#460)
+ *
+ * A member is SERVED when `FileStorageRouterBackendService` registers an `IFileStorageProvider` for
+ * it; that map is the one runtime answer, and this comment is a dated reading of it rather than a
+ * second authority. The engine serves `WILDO_MANAGED`, `LOCAL_DIRECTORY` and `GOOGLE_DRIVE` itself;
+ * since #1674 any other member is served when a loaded provider module CONTRIBUTES an adapter for it
+ * (`fileStorageAdapters`, `ProviderFileStorageAdapter`). A provider serves a member of this closed
+ * vocabulary; it never adds one. Measured 2026-09-29: the engine's own `microsoft-onedrive` (since #2017) contributes
+ * `ONEDRIVE` (a person's own OneDrive through Microsoft Graph, commercial cloud only); nothing contributes
+ * `DROPBOX`.
+ *
+ * Declaring an unserved member is not silently ignored — the router refuses and now says WHICH of the
+ * two problems it is, because "not implemented" and "implemented but not configured" have different
+ * remedies and the old single message sent an operator looking for environment variables that cannot
+ * exist.
+ *
+ * An unserved member is NOT removed here, deliberately: a member a package may yet serve is part of the
+ * closed vocabulary, and deleting it would decide from the wrong place that nothing ever will. (`ONEDRIVE`
+ * STORING is served since #1674; the governed OneDrive PICK path of #570 is separate and still unbuilt.)
+ * Re-measure before quoting this paragraph; the count was "three of five" when #460 was filed, and Drive and
+ * OneDrive have landed since.
+ */
+export const FileStorageAccepted = {
+    WILDO_MANAGED: 'wildo_managed',
+    LOCAL_DIRECTORY: 'local_directory',
+    ONEDRIVE: 'onedrive',
+    GOOGLE_DRIVE: 'google_drive',
+    DROPBOX: 'dropbox',
+};
 /**
  * Bundle-safe frontend provider atoms shared by every browser-bound runtime.
  *
@@ -73,8 +135,9 @@ export const FrontendProviderEntrySchema = z.looseObject({
      * half of its `publicConfigSchema`, mirrored here so the companion walk can
      * refuse an application-supplied key the module never declared, without
      * executing the module (#394 P3). Absent when the module's schema is not
-     * introspectable, which the overlay reads as "cannot enforce here", never as
-     * "declares nothing".
+     * introspectable, which the overlay REFUSES (`SCHEMA_NOT_INTROSPECTABLE`, #1705)
+     * — never read as "declares nothing". Optional on the wire only so an entry an
+     * older producer wrote still parses and is refused with a message.
      */
     publicConfigKeys: z.array(z.string().min(1)).optional(),
     /**
@@ -96,6 +159,67 @@ export const FrontendProviderEntrySchema = z.looseObject({
      * provider back as its `connectedProviderRef`; a pin holds the two ends equal.
      */
     fileStorage: z.enum(FileStorageAccepted).optional(),
+    /**
+     * The vendor's deployment model, processing regions and legal entity, as the facet module
+     * declares them (#1743) — the primitives a processor register, a recipients fact and a regional
+     * report are derived from.
+     *
+     * ## Why it rides HERE, and why the browser gets it too
+     *
+     * A frontend provider executes in the DATA SUBJECT'S BROWSER and talks to its vendor directly, so
+     * it is exactly the kind of recipient a privacy notice must name (#345). The module has carried
+     * this profile since #345, and every projection built the entry field by field and left it
+     * behind — so reCAPTCHA, Sentry and the Drive/OneDrive/Dropbox pickers stated their
+     * entity and regions in source and no compliance reader could see any of them.
+     *
+     * This entry is the one record that is materialized PER APPLICATION, PER SERVICE, for exactly the
+     * providers that service SERVES (`frontendProviderBootstraps` in the generated frontend-services
+     * artifact). That is the population a recipient derivation needs — the browser vendors this
+     * application actually runs, not every module the engine ships — and a reader gets it by parsing a
+     * generated JSON file on disk rather than by loading provider packages. A field on the
+     * contribution beside `identity` was the alternative and was rejected for that reason: the
+     * contribution is never materialized per service, so a reader would have to re-run discovery.
+     *
+     * It is therefore also served on `/application-config`. That costs a few public facts (a vendor's
+     * name and the regions it offers, which the application's own privacy notice publishes anyway)
+     * and it keeps the two producing sites — the companion projection and the backend fallback —
+     * identical, so what a compliance reader sees never depends on whether a sync ran.
+     *
+     * Not a second authority for backend providers. A provider SPECIFICATION restates its BACKEND
+     * module's profile (and is reconciled against it); this restates the FRONTEND facet's. Registering
+     * specifications for browser-only vendors was the other option and was rejected: a specification
+     * describes a backend module — protocols, secrets contract, engine slots — and a browser-only
+     * vendor has none of them.
+     *
+     * Absent means the module's author stated nothing, which a reader must report as NOT ESTABLISHED
+     * rather than skip — `listServedFrontendProviderCompliance` (beside the profile schema) returns `null` for exactly that.
+     */
+    complianceProfile: ProviderComplianceProfileSchema.optional(),
+    /**
+     * Consent purposes this PROVIDER rests on beyond its capabilities' floor (#1702) — the facet module's
+     * own `consentPurposes`, as data.
+     *
+     * ## Why it has to ride here
+     *
+     * The consent decision is taken in the browser on the HYDRATED module, whose `providerCapabilities`
+     * come from this entry, so a vendor-level purpose the entry did not carry would reach no gate at all:
+     * a provider whose vendor needs more than its capability's floor (Google reCAPTCHA, which the CNIL held
+     * is not exempt as a security measure because it also serves Google's own purposes — Délibération
+     * SAN-2023-003) would start on the floor alone. Carried by BOTH producing sites — the companion
+     * projection and the backend fallback — for the reason every field above is.
+     *
+     * ADDITIVE ONLY. It is unioned with the capabilities' floor by `consentPurposesRequiredByProvider`,
+     * so an entry can never lower what a capability requires; and hydration unions it with the CODE
+     * module's own declaration, so a stale entry cannot lower what the bundled module requires either.
+     * Absent and `[]` mean the same thing: nothing beyond the floor.
+     *
+     * Strings on the wire, like `providerCapabilities`, and for the same version-skew reason: a member an
+     * older reader does not know must not fail the parse of the whole provider block. The projection
+     * refuses an unknown member where it is authored, and the browser's consent decision FAILS CLOSED on
+     * one it meets (`isProviderPermittedByConsent`) — so an unknown purpose withholds its provider rather
+     * than being dropped, which on an additive field would lower the floor.
+     */
+    consentPurposes: z.array(z.string().min(1)).optional(),
 });
 export const FrontendProvidersBlockSchema = z.object({
     providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-entry.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACvD,QAAQ,EAAE,sBAAsB;IAChC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,GAAG,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACnD,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,QAAQ,EAAE;IACpE;;;;;;;;;OASG;IACH,UAAU,EAAE,0CAA0C,CAAC,QAAQ,EAAE;IACjE;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { FileStorageAccepted } from '@wildo-ai/zod-decorators';\nimport { ProviderMetadataSchema } from './provider-metadata.shared.schemas';\nimport {\n  ProviderFrontendComponentDescriptorsSchema,\n  ProviderFrontendCspFootprintSchema,\n  ProviderFrontendScriptDeclarationSchema,\n  ProviderFrontendSdkDescriptorSchema,\n} from './provider-frontend-surface.shared.schemas';\n\n/**\n * Bundle-safe frontend provider atoms shared by every browser-bound runtime.\n *\n * This file intentionally stops at the provider-entry/block level so\n * `@wildo-ai/saas-models/public-runtime` can expose the types without pulling\n * the heavier application-config bootstrap contract into browser bundles.\n */\n\n/**\n * One provider as it crosses the DATA channel: authored on a facet module,\n * projected into a companion contribution, materialized into the generated\n * frontend-services artifact, served on `/application-config`, and parsed by the\n * app, the website and the technical doc.\n *\n * ## Why this is a LOOSE object\n *\n * It is a WIRE RECORD produced by one package version and read by another, and a\n * strict object silently STRIPS what a newer producer added — which is how a\n * provider's CSP footprint would vanish between the CLI that wrote it and the\n * runtime that needs it, leaving a policy that is correct in development\n * (report-only) and wrong in production (enforcing). #328 made\n * `ProviderCompanionContributionSchema` loose for exactly this reason, one file\n * over; the entry rides INSIDE that contribution, so leaving it strict left the\n * hole one layer down. Required fields stay required; unknown keys are kept\n * rather than dropped, so a re-emitting consumer cannot silently discard what it\n * did not understand.\n *\n * ## What may and may not be added here\n *\n * Only things a JSON channel can carry. A function-valued field would be\n * stripped by `JSON.stringify` with no error anywhere — the provider would look\n * declared and do nothing. Executable provider surface (`sdk.activate`,\n * `publicConfigSchema`, and, from S4b, `components`) belongs on the facet module\n * types in `@wildo-ai/external-connectors-public`, which reach a bundle through\n * the generated `frontend-providers.generated.ts` CODE channel instead.\n */\nexport const FrontendProviderEntrySchema = z.looseObject({\n  metadata: ProviderMetadataSchema,\n  providerCapabilities: z.array(z.string().min(1)),\n  protocols: z.array(z.string().min(1)),\n  publicConfig: z.record(z.string(), z.unknown()).optional(),\n  /**\n   * Origins this provider needs the composed CSP of its service to admit.\n   * Consumed by `resolveCspPolicy`'s provider layer; absent means the provider\n   * reaches nothing beyond the surface's own origin.\n   */\n  csp: ProviderFrontendCspFootprintSchema.optional(),\n  /**\n   * The vendor SDK package this provider loads on demand — the DATA half only.\n   * Its presence tells a surface that the provider HAS executable code to\n   * activate, which is the difference between \"declared\" and \"live\" once the\n   * CODE channel is consulted.\n   */\n  sdk: ProviderFrontendSdkDescriptorSchema.optional(),\n  /** Third-party `<script>` tags the surface must add for this provider. */\n  scripts: z.array(ProviderFrontendScriptDeclarationSchema).optional(),\n  /**\n   * The components this provider contributes, by capability — the DATA half\n   * only, exactly as `sdk` is. It says a component EXISTS and what contract it\n   * commits to; the loader stays on the CODE channel, because a function does\n   * not survive `JSON.stringify` and a field that vanishes silently is worse\n   * than a field that was never declared.\n   *\n   * A surface reads this to know a chooser is worth rendering, and to know what\n   * a selection will contain, BEFORE it downloads any provider's component.\n   */\n  components: ProviderFrontendComponentDescriptorsSchema.optional(),\n  /**\n   * The public-config keys the provider module DECLARES it reads — the DATA\n   * half of its `publicConfigSchema`, mirrored here so the companion walk can\n   * refuse an application-supplied key the module never declared, without\n   * executing the module (#394 P3). Absent when the module's schema is not\n   * introspectable, which the overlay reads as \"cannot enforce here\", never as\n   * \"declares nothing\".\n   */\n  publicConfigKeys: z.array(z.string().min(1)).optional(),\n  /**\n   * The `z_file` storage this provider's file picker is the FRONT DOOR of — the\n   * join key between the provider vocabulary (`google-drive`) and the z_file\n   * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).\n   *\n   * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the\n   * vendor, so the FILES row it produces is stored in THAT storage, and a field\n   * may only receive it when its `storageAccepted` names that storage. The\n   * chooser therefore offers such a picker only to a field that accepts the\n   * storage, and the backend refuses the link otherwise — both read this\n   * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no\n   * storage: its bytes are ingested into whatever the field's own storage is,\n   * and it is offered to every field.\n   *\n   * DATA half only, like `components`: the backend storage provider that\n   * SERVES the storage is CODE, keyed by the same enum member and naming this\n   * provider back as its `connectedProviderRef`; a pin holds the two ends equal.\n   */\n  fileStorage: z.enum(FileStorageAccepted).optional(),\n});\nexport type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;\n\nexport const FrontendProvidersBlockSchema = z.object({\n  providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),\n});\nexport type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;\n"]}
+{"version":3,"file":"frontend-provider-entry.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,+BAA+B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;CACV,CAAC;AAGX;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACvD,QAAQ,EAAE,sBAAsB;IAChC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,GAAG,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACnD,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,QAAQ,EAAE;IACpE;;;;;;;;;OASG;IACH,UAAU,EAAE,0CAA0C,CAAC,QAAQ,EAAE;IACjE;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,iBAAiB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAC7D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { ProviderComplianceProfileSchema } from './provider-compliance-profile.shared.schemas';\nimport { ProviderMetadataSchema } from './provider-metadata.shared.schemas';\nimport {\n  ProviderFrontendComponentDescriptorsSchema,\n  ProviderFrontendCspFootprintSchema,\n  ProviderFrontendScriptDeclarationSchema,\n  ProviderFrontendSdkDescriptorSchema,\n} from './provider-frontend-surface.shared.schemas';\n\n/**\n * The `z_file` storage vocabulary, as a BROWSER-SAFE declaration of the values\n * `FileStorageAccepted` in `@wildo-ai/zod-decorators` owns.\n *\n * ## Why this is not an import of that enum\n *\n * This file sits in the `@wildo-ai/saas-models/public-runtime` closure, which\n * browser-bound provider modules load. Importing ANYTHING from\n * `@wildo-ai/zod-decorators` puts that package's root barrel into the bundle,\n * and that barrel mutates Zod's prototypes as an import side effect\n * (`ensureZodDecoratorsLoaded(z)`) — the reason K-3 forbids it, and what\n * `public-runtime.boundary.test.ts` measures. A re-export of the enum (the\n * previous shape, #394 P5) is an import all the same (#607).\n *\n * ## Why a literal union, and why it stays compatible\n *\n * The owning enum is the ONE runtime source of the vocabulary; this is the\n * browser door's spelling of it, pinned member-for-member (keys AND values, at\n * type level and at runtime) by `__tests__/file-storage-accepted.drift.test.ts`\n * — the same arrangement `BUILTIN_PROVIDER_PROTOCOL` has with the engine's\n * protocol enum, for the same boundary.\n *\n * It is `as const` rather than a second `enum` on purpose: two enums are\n * NOMINALLY distinct, so the field side (`z_file({ storageAccepted })`, the\n * owning enum) could not be compared with the provider side (this). A string\n * enum IS assignable to the literal union of its values, so the owning enum\n * flows into every slot typed with this vocabulary, and\n * `FileStorageAccepted.GOOGLE_DRIVE` reads identically at an authoring site.\n * The reverse is not true: a value typed here does not flow into a slot typed\n * with the owning enum — that direction does not occur today, and the compiler\n * reports it if it ever does.\n */\n/*\n * ## NOT every member is served, and the rule is what to trust (#460)\n *\n * A member is SERVED when `FileStorageRouterBackendService` registers an `IFileStorageProvider` for\n * it; that map is the one runtime answer, and this comment is a dated reading of it rather than a\n * second authority. The engine serves `WILDO_MANAGED`, `LOCAL_DIRECTORY` and `GOOGLE_DRIVE` itself;\n * since #1674 any other member is served when a loaded provider module CONTRIBUTES an adapter for it\n * (`fileStorageAdapters`, `ProviderFileStorageAdapter`). A provider serves a member of this closed\n * vocabulary; it never adds one. Measured 2026-09-29: the engine's own `microsoft-onedrive` (since #2017) contributes\n * `ONEDRIVE` (a person's own OneDrive through Microsoft Graph, commercial cloud only); nothing contributes\n * `DROPBOX`.\n *\n * Declaring an unserved member is not silently ignored — the router refuses and now says WHICH of the\n * two problems it is, because \"not implemented\" and \"implemented but not configured\" have different\n * remedies and the old single message sent an operator looking for environment variables that cannot\n * exist.\n *\n * An unserved member is NOT removed here, deliberately: a member a package may yet serve is part of the\n * closed vocabulary, and deleting it would decide from the wrong place that nothing ever will. (`ONEDRIVE`\n * STORING is served since #1674; the governed OneDrive PICK path of #570 is separate and still unbuilt.)\n * Re-measure before quoting this paragraph; the count was \"three of five\" when #460 was filed, and Drive and\n * OneDrive have landed since.\n */\nexport const FileStorageAccepted = {\n  WILDO_MANAGED: 'wildo_managed',\n  LOCAL_DIRECTORY: 'local_directory',\n  ONEDRIVE: 'onedrive',\n  GOOGLE_DRIVE: 'google_drive',\n  DROPBOX: 'dropbox',\n} as const;\nexport type FileStorageAccepted = (typeof FileStorageAccepted)[keyof typeof FileStorageAccepted];\n\n/**\n * Bundle-safe frontend provider atoms shared by every browser-bound runtime.\n *\n * This file intentionally stops at the provider-entry/block level so\n * `@wildo-ai/saas-models/public-runtime` can expose the types without pulling\n * the heavier application-config bootstrap contract into browser bundles.\n */\n\n/**\n * One provider as it crosses the DATA channel: authored on a facet module,\n * projected into a companion contribution, materialized into the generated\n * frontend-services artifact, served on `/application-config`, and parsed by the\n * app, the website and the technical doc.\n *\n * ## Why this is a LOOSE object\n *\n * It is a WIRE RECORD produced by one package version and read by another, and a\n * strict object silently STRIPS what a newer producer added — which is how a\n * provider's CSP footprint would vanish between the CLI that wrote it and the\n * runtime that needs it, leaving a policy that is correct in development\n * (report-only) and wrong in production (enforcing). #328 made\n * `ProviderCompanionContributionSchema` loose for exactly this reason, one file\n * over; the entry rides INSIDE that contribution, so leaving it strict left the\n * hole one layer down. Required fields stay required; unknown keys are kept\n * rather than dropped, so a re-emitting consumer cannot silently discard what it\n * did not understand.\n *\n * ## What may and may not be added here\n *\n * Only things a JSON channel can carry. A function-valued field would be\n * stripped by `JSON.stringify` with no error anywhere — the provider would look\n * declared and do nothing. Executable provider surface (`sdk.activate`,\n * `publicConfigSchema`, and, from S4b, `components`) belongs on the facet module\n * types in `@wildo-ai/external-connectors-public`, which reach a bundle through\n * the generated `frontend-providers.generated.ts` CODE channel instead.\n */\nexport const FrontendProviderEntrySchema = z.looseObject({\n  metadata: ProviderMetadataSchema,\n  providerCapabilities: z.array(z.string().min(1)),\n  protocols: z.array(z.string().min(1)),\n  publicConfig: z.record(z.string(), z.unknown()).optional(),\n  /**\n   * Origins this provider needs the composed CSP of its service to admit.\n   * Consumed by `resolveCspPolicy`'s provider layer; absent means the provider\n   * reaches nothing beyond the surface's own origin.\n   */\n  csp: ProviderFrontendCspFootprintSchema.optional(),\n  /**\n   * The vendor SDK package this provider loads on demand — the DATA half only.\n   * Its presence tells a surface that the provider HAS executable code to\n   * activate, which is the difference between \"declared\" and \"live\" once the\n   * CODE channel is consulted.\n   */\n  sdk: ProviderFrontendSdkDescriptorSchema.optional(),\n  /** Third-party `<script>` tags the surface must add for this provider. */\n  scripts: z.array(ProviderFrontendScriptDeclarationSchema).optional(),\n  /**\n   * The components this provider contributes, by capability — the DATA half\n   * only, exactly as `sdk` is. It says a component EXISTS and what contract it\n   * commits to; the loader stays on the CODE channel, because a function does\n   * not survive `JSON.stringify` and a field that vanishes silently is worse\n   * than a field that was never declared.\n   *\n   * A surface reads this to know a chooser is worth rendering, and to know what\n   * a selection will contain, BEFORE it downloads any provider's component.\n   */\n  components: ProviderFrontendComponentDescriptorsSchema.optional(),\n  /**\n   * The public-config keys the provider module DECLARES it reads — the DATA\n   * half of its `publicConfigSchema`, mirrored here so the companion walk can\n   * refuse an application-supplied key the module never declared, without\n   * executing the module (#394 P3). Absent when the module's schema is not\n   * introspectable, which the overlay REFUSES (`SCHEMA_NOT_INTROSPECTABLE`, #1705)\n   * — never read as \"declares nothing\". Optional on the wire only so an entry an\n   * older producer wrote still parses and is refused with a message.\n   */\n  publicConfigKeys: z.array(z.string().min(1)).optional(),\n  /**\n   * The `z_file` storage this provider's file picker is the FRONT DOOR of — the\n   * join key between the provider vocabulary (`google-drive`) and the z_file\n   * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).\n   *\n   * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the\n   * vendor, so the FILES row it produces is stored in THAT storage, and a field\n   * may only receive it when its `storageAccepted` names that storage. The\n   * chooser therefore offers such a picker only to a field that accepts the\n   * storage, and the backend refuses the link otherwise — both read this\n   * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no\n   * storage: its bytes are ingested into whatever the field's own storage is,\n   * and it is offered to every field.\n   *\n   * DATA half only, like `components`: the backend storage provider that\n   * SERVES the storage is CODE, keyed by the same enum member and naming this\n   * provider back as its `connectedProviderRef`; a pin holds the two ends equal.\n   */\n  fileStorage: z.enum(FileStorageAccepted).optional(),\n  /**\n   * The vendor's deployment model, processing regions and legal entity, as the facet module\n   * declares them (#1743) — the primitives a processor register, a recipients fact and a regional\n   * report are derived from.\n   *\n   * ## Why it rides HERE, and why the browser gets it too\n   *\n   * A frontend provider executes in the DATA SUBJECT'S BROWSER and talks to its vendor directly, so\n   * it is exactly the kind of recipient a privacy notice must name (#345). The module has carried\n   * this profile since #345, and every projection built the entry field by field and left it\n   * behind — so reCAPTCHA, Sentry and the Drive/OneDrive/Dropbox pickers stated their\n   * entity and regions in source and no compliance reader could see any of them.\n   *\n   * This entry is the one record that is materialized PER APPLICATION, PER SERVICE, for exactly the\n   * providers that service SERVES (`frontendProviderBootstraps` in the generated frontend-services\n   * artifact). That is the population a recipient derivation needs — the browser vendors this\n   * application actually runs, not every module the engine ships — and a reader gets it by parsing a\n   * generated JSON file on disk rather than by loading provider packages. A field on the\n   * contribution beside `identity` was the alternative and was rejected for that reason: the\n   * contribution is never materialized per service, so a reader would have to re-run discovery.\n   *\n   * It is therefore also served on `/application-config`. That costs a few public facts (a vendor's\n   * name and the regions it offers, which the application's own privacy notice publishes anyway)\n   * and it keeps the two producing sites — the companion projection and the backend fallback —\n   * identical, so what a compliance reader sees never depends on whether a sync ran.\n   *\n   * Not a second authority for backend providers. A provider SPECIFICATION restates its BACKEND\n   * module's profile (and is reconciled against it); this restates the FRONTEND facet's. Registering\n   * specifications for browser-only vendors was the other option and was rejected: a specification\n   * describes a backend module — protocols, secrets contract, engine slots — and a browser-only\n   * vendor has none of them.\n   *\n   * Absent means the module's author stated nothing, which a reader must report as NOT ESTABLISHED\n   * rather than skip — `listServedFrontendProviderCompliance` (beside the profile schema) returns `null` for exactly that.\n   */\n  complianceProfile: ProviderComplianceProfileSchema.optional(),\n  /**\n   * Consent purposes this PROVIDER rests on beyond its capabilities' floor (#1702) — the facet module's\n   * own `consentPurposes`, as data.\n   *\n   * ## Why it has to ride here\n   *\n   * The consent decision is taken in the browser on the HYDRATED module, whose `providerCapabilities`\n   * come from this entry, so a vendor-level purpose the entry did not carry would reach no gate at all:\n   * a provider whose vendor needs more than its capability's floor (Google reCAPTCHA, which the CNIL held\n   * is not exempt as a security measure because it also serves Google's own purposes — Délibération\n   * SAN-2023-003) would start on the floor alone. Carried by BOTH producing sites — the companion\n   * projection and the backend fallback — for the reason every field above is.\n   *\n   * ADDITIVE ONLY. It is unioned with the capabilities' floor by `consentPurposesRequiredByProvider`,\n   * so an entry can never lower what a capability requires; and hydration unions it with the CODE\n   * module's own declaration, so a stale entry cannot lower what the bundled module requires either.\n   * Absent and `[]` mean the same thing: nothing beyond the floor.\n   *\n   * Strings on the wire, like `providerCapabilities`, and for the same version-skew reason: a member an\n   * older reader does not know must not fail the parse of the whole provider block. The projection\n   * refuses an unknown member where it is authored, and the browser's consent decision FAILS CLOSED on\n   * one it meets (`isProviderPermittedByConsent`) — so an unknown purpose withholds its provider rather\n   * than being dropped, which on an additive field would lower the floor.\n   */\n  consentPurposes: z.array(z.string().min(1)).optional(),\n});\nexport type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;\n\nexport const FrontendProvidersBlockSchema = z.object({\n  providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),\n});\nexport type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;\n"]}

package/dist/esm/external-providers/frontend-provider-public-config.shared.d.ts

@@ -1,8 +1,8 @@
 /**
  * How an APPLICATION supplies a frontend provider's public configuration — the
  * keys a picker needs that only the application can know (a Drive `appId`, a
- * OneDrive `clientId`) — and the two guards that keep that channel from
- * carrying anything else.
+ * OneDrive `clientId`) — and the gates that keep that channel from carrying
+ * anything else.
  *
  * ## The gap this closes
  *
@@ -17,29 +17,63 @@
  * `providerConfigurations[providerRef][frontend_sdk]`. One authority for
  * "what an application configured for this provider", read by both sides.
  *
- * ## Two guards, because `publicConfig` is served to every browser
+ * ## The gates, because `publicConfig` is served to every browser
  *
  * 1. **Only DECLARED keys cross.** A provider module declares the keys it reads
  *    (`publicConfigSchema` — see `defineFrontendPublicConfigSchema` below, which
- *    is what makes those keys READABLE without running the schema). A key the
- *    module never declared is refused with the provider and key named, at the
- *    two places the overlay runs: `wildo config sync` and the backend's
- *    fallback projection. A misspelled `apiId` therefore fails where it was
- *    typed, instead of silently contributing nothing and leaving a picker that
- *    reports "no appId" at the moment a user opens it.
- *
- * 2. **A secret never crosses.** A frontend provider owns no secrets by
- *    construction (`secretsContractShape: []`), so the only way one reaches a
- *    browser is an author typing the BACKEND module's secret into the frontend
- *    bag. The overlay refuses any key whose name matches a slug or an
- *    environment-variable name from the same vendor's backend secrets
- *    contract — `GOOGLE_OAUTH2_CLIENT_SECRET` cannot be typed into the bag that
- *    every visitor downloads.
- *
- * Both guards are decisions about NAMES, so they run wherever the names are
- * known and need no schema execution. Value VALIDATION (is `appId` a string?)
- * is the schema's job and runs where the schema is: at hydration (FE-8) and, on
- * the backend fallback, before serving.
+ *    is what makes those keys READABLE without running the schema), and a
+ *    module with no readable list is refused outright. Every key an entry would
+ *    serve — authored by the module, mapped onto its contribution, or supplied
+ *    by the application — is held to that list wherever an entry is PRODUCED
+ *    (`wildo config sync`, the backend's fallback projection) and again wherever
+ *    a ready-made one is READ and served (the backend's `/application-config`,
+ *    the website and documentation build loader). A misspelled `apiId` therefore
+ *    fails where it was typed, instead of silently contributing nothing and
+ *    leaving a picker that reports "no appId" at the moment a user opens it.
+ *
+ * 2. **A secret VALUE never crosses.** Every served string is compared against
+ *    the producer's secret values — the environment's whole `secrets.json` at
+ *    sync, the registered providers' confidential slots on the backend — and a
+ *    match refuses, whatever the key is called (#1705).
+ *
+ * 3. **A secret NAME is refused early.** A key spelled like a slug or an
+ *    environment-variable name from the same vendor's backend secrets contract
+ *    (`GOOGLE_OAUTH2_CLIENT_SECRET`) is refused with that explanation before the
+ *    key-list check would call it merely undeclared. It is the clearer message,
+ *    not the gate: a browser-only vendor has no backend names to match.
+ *
+ * Value VALIDATION (is `appId` a string?) is the schema's job and runs where the
+ * schema is: at hydration (FE-8) and, on the backend fallback, before serving.
+ *
+ * ## Why names were never enough, and what closes it (#1705)
+ *
+ * The name gate draws its forbidden names from the same vendor's BACKEND contract, so a
+ * browser-only vendor (reCAPTCHA, Algolia) had an EMPTY forbidden set: its secret
+ * key under `siteKey`, or an Algolia admin key under `apiKey`, passed every name
+ * check. And the declared-key gate switched itself off for a module with no introspectable
+ * schema — 8 of the 13 engine modules — admitting any key at all. A guard that
+ * matches how a key is SPELLED looks like a control and decides almost nothing.
+ *
+ * Three changes turn it into one:
+ *
+ * - **A schema is mandatory.** `declaredKeys: undefined` is now a refusal
+ *   (`SCHEMA_NOT_INTROSPECTABLE`) rather than "cannot enforce here", and the key check
+ *   runs over the WHOLE served bag — the module's authored keys and any key an
+ *   application mapped onto its contribution — not only over what
+ *   `providerConfigurations` supplied.
+ * - **Values are compared, not shapes.** {@link assertNoSecretValueInFrontendProviders}
+ *   compares every string in every served `publicConfig` against the secret
+ *   VALUES the producer holds: `wildo config sync` against the environment's
+ *   `secrets.json`, the backend against its providers' confidential slots. It
+ *   asks "is this one of OUR secrets", which no name or shape rule can answer,
+ *   and it names the key and the slot, never the value. Gitleaks answers the
+ *   other question ("does this look like a secret") on committed files; the two
+ *   do not overlap.
+ * - **What is secret comes from a declaration.** A provider secret slot is
+ *   confidential unless its contract marks it `holdsBrowserPublicValue` (a
+ *   vendor key designed to ship to browsers, such as PostHog's project key) or
+ *   `holdsDeploymentHost`; framework-managed material is confidential by its
+ *   registry's `secretKeys`. Nothing is inferred from a key's name.
  *
  * ## Why the overlay is a pure function in this package
  *
@@ -53,11 +87,21 @@
  * The key under `providerConfigurations[providerRef]` an application uses to
  * supply a frontend provider's public configuration.
  *
- * The protocol kind, exactly as SSO's channel is keyed by ITS protocol kind
- * (`sso_oauth2`): the bag is per-provider, per-protocol, and a frontend module
- * speaks `FRONTEND_SDK`. Not a new literal — the enum member is the one source.
+ * The protocol kind's WIRE value, exactly as SSO's channel is keyed by ITS
+ * protocol kind (`sso_oauth2`): the bag is per-provider, per-protocol, and a
+ * frontend module speaks `FRONTEND_SDK`.
+ *
+ * The owning source is `ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK` in
+ * `@wildo-ai/external-connectors-models`, and this literal is pinned to it by
+ * `__tests__/frontend-provider-public-config.shared.test.ts`. It is written out
+ * rather than imported because this file is in the
+ * `@wildo-ai/saas-models/public-runtime` closure, which K-3 forbids from
+ * importing that package — an import it carried from #394 P3 until #607 put the
+ * whole external-connectors model tree into every browser provider bundle.
+ * `BUILTIN_PROVIDER_PROTOCOL` is the same arrangement for the same boundary.
  */
 export declare const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY: string;
+/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */
 /** Why an application-supplied public-config bag was refused. */
 export declare enum FrontendProviderPublicConfigRefusal {
     /** A key the provider module does not declare — almost always a misspelling. */
@@ -65,8 +109,20 @@ export declare enum FrontendProviderPublicConfigRefusal {
     /** A key naming a secret from the same vendor's backend contract. Never negotiable. */
     SECRET_KEY = "SECRET_KEY",
     /** The supplied bag is not a plain object — a string, an array, `null`. */
-    NOT_AN_OBJECT = "NOT_AN_OBJECT"
+    NOT_AN_OBJECT = "NOT_AN_OBJECT",
+    /**
+     * The module declares no `publicConfigSchema` whose keys can be read without running it
+     * (#1705). Nothing can then say which keys it takes, so nothing it is handed can be held to a
+     * list — and "admit everything" is the answer that reaches a browser.
+     */
+    SCHEMA_NOT_INTROSPECTABLE = "SCHEMA_NOT_INTROSPECTABLE",
+    /**
+     * A served value equals, or contains, one of the producer's SECRET VALUES (#1705) — whatever the
+     * key is called and whichever vendor the secret belongs to. Never negotiable.
+     */
+    SECRET_VALUE = "SECRET_VALUE"
 }
+/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */
 export declare class FrontendProviderPublicConfigError extends Error {
     readonly providerRef: string;
     readonly refusal: FrontendProviderPublicConfigRefusal;
@@ -75,15 +131,16 @@ export declare class FrontendProviderPublicConfigError extends Error {
 }
 export interface OverlayFrontendProviderPublicConfigInput {
     readonly providerRef: string;
-    /** What the provider module authored — its own defaults, e.g. `{ authProviderRef: 'google' }`. */
+    /** What the provider module authored — its own defaults, e.g. `{ integrationKind: 'captcha' }`. */
     readonly authored: Readonly<Record<string, unknown>> | undefined;
     /** What the application supplied under `providerConfigurations[providerRef][frontend_sdk]`. */
     readonly supplied: unknown;
     /**
      * The keys the provider module declares it reads. `undefined` means the
-     * module declared no introspectable schema, so guard 1 cannot run HERE and
-     * hydration's validation is the gate; an empty array means the module
-     * declares it reads NOTHING, so every supplied key is refused.
+     * module declared no introspectable schema, and is REFUSED
+     * (`SCHEMA_NOT_INTROSPECTABLE`, #1705): it used to mean "cannot enforce here",
+     * which admitted any key for 8 of the 13 engine modules. An empty array means
+     * the module declares it reads NOTHING, so every key is refused.
      */
     readonly declaredKeys: readonly string[] | undefined;
     /** Slugs and environment-variable names of the same vendor's backend secrets. */
@@ -91,14 +148,106 @@ export interface OverlayFrontendProviderPublicConfigInput {
 }
 /**
  * Merges what the application supplied over what the module authored, refusing
- * the two classes of key that must never reach a browser.
+ * the classes of key that must never reach a browser.
  *
  * Supplied values WIN over authored ones for the same key: the module's value is
  * a default, and an application that names a key means it. Absent `supplied`
- * returns the authored bag untouched — an application that configured nothing
- * is the ordinary case, not a refusal.
+ * returns the authored bag unchanged — an application that configured nothing
+ * is the ordinary case, not a refusal — but it is still HELD to the declared
+ * keys: `authored` is what the served entry carries, which includes any key an
+ * application mapped onto the contribution in its own `provider-contributions`.
+ *
+ * Call it for EVERY entry a producer serves, supplied or not; a producer that
+ * skips it when nothing was supplied skips the schema and key checks too.
  */
 export declare function overlayFrontendProviderPublicConfig(input: OverlayFrontendProviderPublicConfigInput): Readonly<Record<string, unknown>> | undefined;
+/**
+ * One secret value a producer holds, with WHERE it lives.
+ *
+ * `slot` is what a refusal names — `secrets.json → providerEnv.STRIPE_SECRET_KEY`, or the
+ * provider slot on the backend — so an operator can find it. The value itself is never printed.
+ */
+export interface FrontendPublicConfigSecretValue {
+    readonly slot: string;
+    readonly value: string;
+}
+/** One served public value found to be (or to contain) a secret. Names, never the value. */
+export interface FrontendPublicConfigSecretMatch {
+    readonly providerRef: string;
+    /** Path inside that provider's `publicConfig`, e.g. `apiKey` or `origins[1]`. */
+    readonly key: string;
+    readonly slot: string;
+}
+/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */
+/**
+ * The shortest secret a served value is searched INSIDE, not only compared to.
+ *
+ * Containment catches a secret embedded in a larger public value — a URL carrying
+ * `?key=<secret>`, a `https://user:<secret>@host` endpoint — which exact equality would miss.
+ * Below this length a secret (a six-character default password, a short database name held in a
+ * credential slot) could occur by coincidence inside an ordinary public value such as a host name,
+ * and refusing a correct configuration on that coincidence would teach operators to route around
+ * the check. Shorter secrets are still compared EXACTLY.
+ */
+export declare const FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH = 16;
+/**
+ * Every place a served `publicConfig` carries one of the producer's secret values (#1705).
+ *
+ * Pure, and total over the strings it is given: every string leaf of every provider's bag —
+ * nested objects and arrays included — against every non-blank secret. A match is EXACT equality
+ * (after trimming both sides), or CONTAINMENT for a secret at least
+ * {@link FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH} long.
+ *
+ * Deliberately blind to key names and to which vendor a secret belongs: the defect it closes is a
+ * secret under an innocent key, or one vendor's secret served under another vendor's ref.
+ *
+ * What it does NOT see: an ENCODED secret (URL- or base64-encoded, split across keys, hashed). It
+ * asks "is this one of our values", verbatim; recognising transformed forms would need a guess at
+ * every encoding an author might apply, and each guess would be a new false-positive source. The
+ * committed-file scanner (gitleaks) and review are the backstops for that.
+ */
+export declare function findSecretValuesInFrontendProviders(providers: Readonly<Record<string, {
+    readonly publicConfig?: Readonly<Record<string, unknown>>;
+}>>, secrets: readonly FrontendPublicConfigSecretValue[]): FrontendPublicConfigSecretMatch[];
+/**
+ * Refuses to serve a set of frontend providers when any served value is one of the producer's
+ * secrets (#1705). Called by BOTH producers of a served bootstrap — `wildo config sync` before it
+ * writes any artifact, and the backend before it answers `/application-config` — so the two cannot
+ * disagree about what may reach a browser.
+ *
+ * `producer` names who is refusing and where its secrets came from, for the message.
+ */
+export declare function assertNoSecretValueInFrontendProviders(input: {
+    readonly producer: string;
+    readonly providers: Readonly<Record<string, {
+        readonly publicConfig?: Readonly<Record<string, unknown>>;
+    }>>;
+    readonly secrets: readonly FrontendPublicConfigSecretValue[];
+}): void;
+/**
+ * Refuses a READY-MADE block of frontend providers whose entries do not carry their key list, or
+ * serve a key outside it (#1705).
+ *
+ * The overlay holds an entry to its declared keys at the moment it is PRODUCED. A block that is only
+ * READ — the generated bootstrap the backend serves on `/application-config`, the frontend-services
+ * artifact the website and documentation builds bake into their pages — was produced earlier, by
+ * whichever `wildo config sync` wrote it. One written before a schema was mandatory carries entries
+ * with no `publicConfigKeys` and was never held to any list, and nothing downstream would notice: the
+ * reader parses the entry (the field stays optional on the wire precisely so it CAN be read and
+ * refused with a message) and serves it. So every site that serves a ready-made block asks the same
+ * question the producer asked, through the same function, and a stale artifact is refused with the
+ * remedy — regenerate it — instead of being served.
+ *
+ * `producer` names who is refusing and what it read, for the message.
+ */
+export declare function assertFrontendProvidersServeOnlyDeclaredKeys(input: {
+    readonly producer: string;
+    readonly providers: Readonly<Record<string, {
+        readonly publicConfig?: Readonly<Record<string, unknown>>;
+        readonly publicConfigKeys?: readonly string[];
+    }>>;
+}): void;
+/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */
 /**
  * The value kinds a public-config key may declare. Scalars only, on purpose: a
  * public key is an identifier or a flag, and a structured value here is a
@@ -117,6 +266,7 @@ export interface FrontendPublicConfigKeySpec {
     /** For the person writing `wildo.saas.config.ts`. Not validated; surfaced in refusals. */
     readonly description?: string;
 }
+/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */
 /** A Standard Schema v1 validator that ALSO says which keys it declares. */
 export interface FrontendPublicConfigSchema<TOutput = Readonly<Record<string, unknown>>> {
     readonly '~standard': {
@@ -167,9 +317,10 @@ export declare function defineFrontendPublicConfigSchema(keys: Readonly<Record<s
  * Two shapes are recognised, and the order matters: a schema built by
  * `defineFrontendPublicConfigSchema` states its keys outright; a Zod object
  * exposes them as `shape`. Anything else — a hand-written Standard Schema, a
- * library without introspection — yields `undefined`, which the overlay reads
- * as "cannot enforce here" rather than as "declares nothing". That distinction
- * is load-bearing: an empty list refuses EVERY supplied key.
+ * library without introspection — yields `undefined`, which every gate REFUSES
+ * (`SCHEMA_NOT_INTROSPECTABLE`, #1705) rather than reading as "declares nothing".
+ * That distinction is load-bearing: an empty list is a readable answer and
+ * refuses EVERY key, while `undefined` means no key list exists at all.
  */
 export declare function readDeclaredPublicConfigKeys(schema: unknown): readonly string[] | undefined;
 //# sourceMappingURL=frontend-provider-public-config.shared.d.ts.map

package/dist/esm/external-providers/frontend-provider-public-config.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-public-config.shared.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAIH;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC,EAAE,MAA4D,CAAC;AAE/G,iEAAiE;AACjE,oBAAY,mCAAmC;IAC7C,gFAAgF;IAChF,cAAc,mBAAmB;IACjC,uFAAuF;IACvF,UAAU,eAAe;IACzB,2EAA2E;IAC3E,aAAa,kBAAkB;CAChC;AAED,qBAAa,iCAAkC,SAAQ,KAAK;IAExD,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,OAAO,EAAE,mCAAmC;IACrD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE;gBAFvB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mCAAmC,EAC5C,IAAI,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,wCAAwC,GAC9C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAiD/C;AAED;;;;;GAKG;AACH,oBAAY,6BAA6B;IACvC,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,0IAA0I;IAC1I,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrF,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,GACnB;YAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;SAAE,GAC3B;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC;KAClH,CAAC;IACF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,GAC1D,0BAA0B,CAiC5B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAU3F"}
+{"version":3,"file":"frontend-provider-public-config.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,mCAAmC,EAAE,MAAuB,CAAC;AAE1E,gIAAgI;AAChI,iEAAiE;AACjE,oBAAY,mCAAmC;IAC7C,gFAAgF;IAChF,cAAc,mBAAmB;IACjC,uFAAuF;IACvF,UAAU,eAAe;IACzB,2EAA2E;IAC3E,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,YAAY,iBAAiB;CAC9B;AACD,kFAAkF;AAElF,qBAAa,iCAAkC,SAAQ,KAAK;IAExD,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,OAAO,EAAE,mCAAmC;IACrD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE;gBAFvB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mCAAmC,EAC5C,IAAI,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,wCAAwC,GAC9C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAqE/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,4FAA4F;AAC5F,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gIAAgI;AAChI;;;;;;;;;GASG;AACH,eAAO,MAAM,oDAAoD,KAAK,CAAC;AAiCvE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC,EAClG,OAAO,EAAE,SAAS,+BAA+B,EAAE,GAClD,+BAA+B,EAAE,CAqBnC;AAED;;;;;;;GAOG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IAC5G,QAAQ,CAAC,OAAO,EAAE,SAAS,+BAA+B,EAAE,CAAC;CAC9D,GAAG,IAAI,CAcP;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,4CAA4C,CAAC,KAAK,EAAE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC/C,CAAC,CAAC,CAAC;CACL,GAAG,IAAI,CAsBP;AAED,gIAAgI;AAChI;;;;;GAKG;AACH,oBAAY,6BAA6B;IACvC,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,0IAA0I;IAC1I,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AACD,kFAAkF;AAElF,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrF,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,GACnB;YAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;SAAE,GAC3B;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC;KAClH,CAAC;IACF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,GAC1D,0BAA0B,CAiC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAU3F"}