@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/external-providers/provider-compliance-profile.shared.schemas.js

@@ -1,4 +1,6 @@
 import { z } from 'zod';
+import { LawfulBasisPurposeRefSchema } from '../compliance/privacy/purpose-ref.shared.schemas.js';
+import { ProviderSubjectErasureAcknowledgementSchema, ProviderSubjectErasureDeclarationSchema, } from '../compliance/privacy/subject-data-recipients.shared.schemas.js';
 /**
  * WHO RUNS the software a provider module drives.
  *
@@ -28,7 +30,54 @@ export var ProviderDeploymentModel;
     ProviderDeploymentModel["SELF_HOSTED"] = "SELF_HOSTED";
 })(ProviderDeploymentModel || (ProviderDeploymentModel = {}));
 /**
- * The compliance-relevant facts a PROVIDER MODULE knows about itself.
+ * Whether a provider's compliance facts have been ESTABLISHED at all (#1708).
+ *
+ * The profile could only be a guess or absent until this existed: `deploymentModels` is non-empty and a
+ * vendor-hosted profile must name a region, so a catalogue vendor nobody has researched had two options —
+ * invent a profile, or carry none, which every reader reports as NOT ESTABLISHED with no way to tell "nobody
+ * looked" from "the module forgot". UNDETERMINED is that first answer, stated: the provider is known, its facts
+ * are not, and a reader treats it as a gap to fill — never as an empty answer, and never as vendor-hosted.
+ */
+export var ProviderComplianceDetermination;
+(function (ProviderComplianceDetermination) {
+    /** The facts below were stated by the module's author or the catalogue record, from a source. */
+    ProviderComplianceDetermination["ESTABLISHED"] = "ESTABLISHED";
+    /** Nobody has established who runs this provider or where it processes. A gap, reported as one. */
+    ProviderComplianceDetermination["UNDETERMINED"] = "UNDETERMINED";
+})(ProviderComplianceDetermination || (ProviderComplianceDetermination = {}));
+/**
+ * The facts an ESTABLISHED profile can state, each of which a piece of {@link ProviderComplianceFactEvidenceSchema}
+ * can cite. Named so a staleness report can say WHICH fact is old, not merely that "the profile" is.
+ */
+export var ProviderComplianceFact;
+(function (ProviderComplianceFact) {
+    ProviderComplianceFact["DEPLOYMENT_MODELS"] = "DEPLOYMENT_MODELS";
+    ProviderComplianceFact["PROCESSING_REGIONS"] = "PROCESSING_REGIONS";
+    ProviderComplianceFact["VENDOR_LEGAL_ENTITY"] = "VENDOR_LEGAL_ENTITY";
+    ProviderComplianceFact["SUBPROCESSOR_LIST"] = "SUBPROCESSOR_LIST";
+    ProviderComplianceFact["DATA_PROCESSING_AGREEMENT"] = "DATA_PROCESSING_AGREEMENT";
+})(ProviderComplianceFact || (ProviderComplianceFact = {}));
+/**
+ * Where one or more facts of a profile were READ, and when (#1708, #1744).
+ *
+ * A vendor fact has a shelf life: vendors reorganise, open data centres and change their sub-processors, and a
+ * fact that was true when a module was written can be false when a notice is published. So a researched fact
+ * carries the page it was read from and the date it was read, which is what makes a staleness report possible
+ * and what lets an operator check the suggestion before adopting it into its own register.
+ *
+ * Required for every fact a CATALOGUE vendor states (the transposer refuses a profile without it); optional on
+ * an engine module, whose author states facts in code review, and reported as UNDATED there.
+ */
+export const ProviderComplianceFactEvidenceSchema = z.strictObject({
+    /** The facts this source establishes. */
+    facts: z.array(z.enum(ProviderComplianceFact)).min(1),
+    /** The vendor page the facts were read from — its own legal, trust or documentation page. */
+    source: z.url({ protocol: /^https$/ }),
+    /** The day the page was read, `YYYY-MM-DD`. */
+    verifiedAt: z.iso.date(),
+});
+/**
+ * The compliance-relevant facts a PROVIDER MODULE knows about itself, once they are ESTABLISHED.
  *
  * ## Why these live on the provider and not on the application
  *
@@ -41,6 +90,13 @@ export var ProviderDeploymentModel;
  * So the split is: possibilities here, choice in `wildo.saas.config.ts`, and the register entry
  * derived from both (issue #130).
  *
+ * ## These are SUGGESTIONS to the operator, never the operator's answer (#1744)
+ *
+ * The legal facts below (entity, sub-processor list, data processing agreement) are what the framework READ,
+ * on a date, at a URL. They reach a published document only after the operator copies them into its own
+ * processor register and commits it — Paul's decision of 2026-09-25. A reader offers them as the question
+ * to answer, never as the answer.
+ *
  * ## What is deliberately NOT here
  *
  * **A transfer mechanism.** Adequacy decisions move by court ruling rather than by release cycle, so
@@ -52,7 +108,13 @@ export var ProviderDeploymentModel;
  * `BUILTIN_PROVIDER_CAPABILITY` describes the data flow per member. Restating it here would be a
  * second authority for one fact.
  */
-export const ProviderComplianceProfileSchema = z.strictObject({
+export const EstablishedProviderComplianceProfileSchema = z.strictObject({
+    /**
+     * Optional, and absent reads as ESTABLISHED: the facts below ARE the establishment, and the engine's own
+     * modules state them without the marker. The transposer always writes it, so a generated profile is
+     * explicit either way.
+     */
+    determination: z.literal(ProviderComplianceDetermination.ESTABLISHED).optional(),
     /**
      * The deployment models this provider SUPPORTS — one, or both where the provider genuinely offers
      * a choice (immudb: a hosted service and a container you run).
@@ -85,6 +147,24 @@ export const ProviderComplianceProfileSchema = z.strictObject({
      * makes it checkable.
      */
     vendorLegalEntityName: z.string().trim().min(1).optional(),
+    /** Where the vendor publishes its own list of sub-processors. A suggestion for the register entry's `subprocessors`. */
+    subprocessorListUrl: z.url({ protocol: /^https$/ }).optional(),
+    /**
+     * Where the vendor offers its data processing agreement — its AVAILABILITY. Whether THIS operator signed one
+     * is the operator's fact and lives on its register entry (#1709), never here.
+     */
+    dataProcessingAgreementUrl: z.url({ protocol: /^https$/ }).optional(),
+    /** Where each stated fact was read, and when. See {@link ProviderComplianceFactEvidenceSchema}. */
+    evidence: z.array(ProviderComplianceFactEvidenceSchema).min(1).optional(),
+    /**
+     * What the VENDOR keeps about a data subject, and whether an erasure can reach it (#1710) — the D6 stance
+     * vocabulary: `NO_SUBJECT_DATA`, or `EXTERNAL_ERASURE_OPERATION` when an erasure effect reaches this vendor.
+     *
+     * Optional, and absent means UNDECLARED: a subject erasure then reports this vendor UNMEASURED — incomplete, never
+     * a silent pass. Declare it only with a source: `NO_SUBJECT_DATA` is a claim about the vendor's product that a
+     * reviewer must be able to check, and it closes the erasure question for every application using the provider.
+     */
+    subjectErasure: ProviderSubjectErasureDeclarationSchema.optional(),
 }).superRefine((profile, context) => {
     /*
      * A VENDOR_HOSTED provider that offers no region cannot support a transfer statement, and the
@@ -101,19 +181,82 @@ export const ProviderComplianceProfileSchema = z.strictObject({
             message: 'a VENDOR_HOSTED provider must declare at least one processing region — without one, no transfer statement about it can be derived',
         });
     }
+    /*
+     * Evidence may cite only a fact the profile STATES. A source cited for a sub-processor list the profile does
+     * not carry is a citation of nothing, and would make the staleness report date a fact that is not there.
+     */
+    const stated = statedProviderComplianceFacts(profile);
+    (profile.evidence ?? []).forEach((entry, index) => {
+        for (const fact of entry.facts) {
+            if (!stated.has(fact)) {
+                context.addIssue({ code: 'custom', path: ['evidence', index, 'facts'], message: `evidence cites ${fact}, which this profile does not state` });
+            }
+        }
+    });
 });
-/** True when this provider can only ever be run by the operator, so it is never a third-party recipient. */
+/**
+ * A provider whose compliance facts nobody has established (#1708). A provider carries this until its facts are
+ * researched — for a registry provider, into its module's own profile in `providers-registry/<ref>/` (the archived
+ * catalogue's vendors kept theirs in `_code_archive/providers/catalogue-record/`) — and a reader reports it as a gap
+ * to fill.
+ */
+export const UndeterminedProviderComplianceProfileSchema = z.strictObject({
+    determination: z.literal(ProviderComplianceDetermination.UNDETERMINED),
+    /** Why the facts are not established, and where the operator establishes them instead. */
+    reason: z.string().trim().min(1),
+});
+/**
+ * What a provider declares about who runs it and where it processes: ESTABLISHED facts, or UNDETERMINED.
+ *
+ * A provider that declares NO profile at all is a third state, and a different gap: its author said nothing.
+ * Every reader keeps the three apart — UNDETERMINED names research owed, absence names a module to fix.
+ */
+export const ProviderComplianceProfileSchema = z.union([EstablishedProviderComplianceProfileSchema, UndeterminedProviderComplianceProfileSchema]);
+/** The facts an established profile states — the population its evidence may cite and a staleness report dates. */
+export function statedProviderComplianceFacts(profile) {
+    const stated = new Set([ProviderComplianceFact.DEPLOYMENT_MODELS, ProviderComplianceFact.PROCESSING_REGIONS]);
+    if (profile.vendorLegalEntityName !== undefined)
+        stated.add(ProviderComplianceFact.VENDOR_LEGAL_ENTITY);
+    if (profile.subprocessorListUrl !== undefined)
+        stated.add(ProviderComplianceFact.SUBPROCESSOR_LIST);
+    if (profile.dataProcessingAgreementUrl !== undefined)
+        stated.add(ProviderComplianceFact.DATA_PROCESSING_AGREEMENT);
+    return stated;
+}
+/** The established profile, or `null` for an UNDETERMINED one or none. The one narrowing every reader uses. */
+export function establishedProviderComplianceProfile(profile) {
+    if (profile === null || profile === undefined)
+        return null;
+    return profile.determination === ProviderComplianceDetermination.UNDETERMINED ? null : profile;
+}
+/**
+ * The oldest `verifiedAt` across an established profile's evidence, or `null` when it cites none (UNDATED).
+ *
+ * The OLDEST, because a profile is only as current as its most stale fact: a fresh region list beside a legal
+ * entity read two years ago is a profile whose entity may be wrong.
+ */
+export function oldestProviderComplianceEvidenceDate(profile) {
+    const dates = (profile.evidence ?? []).map((entry) => entry.verifiedAt).sort();
+    return dates[0] ?? null;
+}
+/**
+ * True when this provider can only ever be run by the operator, so it is never a third-party recipient.
+ * An UNDETERMINED profile answers `false`: nobody established it, so it is not established as operator-run.
+ */
 export function providerIsAlwaysSelfHosted(profile) {
-    return profile.deploymentModels.every((model) => model === ProviderDeploymentModel.SELF_HOSTED);
+    const established = establishedProviderComplianceProfile(profile);
+    return established !== null && established.deploymentModels.every((model) => model === ProviderDeploymentModel.SELF_HOSTED);
 }
 /**
  * True when the operator must CHOOSE, because the provider supports both.
  *
  * A register entry for such a provider cannot be derived from the provider module alone — the
- * application's configuration decides whether it is a recipient at all.
+ * application's configuration decides whether it is a recipient at all. An UNDETERMINED profile answers
+ * `false`: what it offers is unknown, which is a research gap rather than a known choice.
  */
 export function providerDeploymentModelIsAnOperatorChoice(profile) {
-    return profile.deploymentModels.length > 1;
+    const established = establishedProviderComplianceProfile(profile);
+    return established !== null && established.deploymentModels.length > 1;
 }
 /** @wildo_source:part:start saas.models.providers.compliance-choice facet:layer:shared facet:audience:app-developer */
 /**
@@ -156,6 +299,25 @@ export const ApplicationProviderComplianceChoiceSchema = z.strictObject({
      * comparison.
      */
     processingRegion: z.string().trim().min(1).optional(),
+    /**
+     * The processing PURPOSES sending data to this recipient serves, by the `purposeRef` of a lawful basis in
+     * `operatorComplianceIdentity.lawfulBases` (#1709). Keyed like every choice: a provider ref, or a
+     * `systemsOfRecord.<name>` instance.
+     *
+     * Here, on the operator's compliance statement about the recipient, and deliberately NOT on the runtime provider
+     * selection (`providers.scopes.<scope>.providers.<ref>`): a purpose is a compliance fact no runtime reads, and the
+     * selection schema has four strict copies (config, backend app-config, runtime artifact, lockfile) that would each
+     * refuse a key the others admit. Absent means no purpose is linked, which the recipients report names as such;
+     * a ref naming no declared purpose is reported as a broken link, never refused.
+     */
+    purposeRefs: z.array(LawfulBasisPurposeRefSchema).min(1).optional(),
+    /**
+     * The operator ACKNOWLEDGES that erasure does not reach this recipient (#1710) — the D6 stance
+     * CONTROLLER_ACKNOWLEDGED_NON_ERASURE for a provider. An erasure then reports ACKNOWLEDGED_NON_ERASURE for it,
+     * which is still incomplete: the data stays live at the vendor. The controller's decision, which is why it lives
+     * here on the operator's statement and never on the provider's profile.
+     */
+    subjectErasureAcknowledgement: ProviderSubjectErasureAcknowledgementSchema.optional(),
 }).superRefine((choice, context) => {
     /*
      * The pairing, in both directions.
@@ -182,6 +344,65 @@ export const ApplicationProviderComplianceChoiceSchema = z.strictObject({
 });
 /** Per configured provider ref, the operator's compliance choice. */
 export const ApplicationProviderComplianceChoicesSchema = z.record(z.string().trim().min(1), ApplicationProviderComplianceChoiceSchema);
+/**
+ * How an operator's compliance CHOICE for one provider stands against what the provider DECLARES possible (#1708).
+ *
+ * Five answers, because they are five different pieces of work and a reader must not round one into another:
+ * a region the vendor does not list is a typo or a stale profile; a deployment model it does not offer is a
+ * configuration error; an UNDETERMINED profile is research owed; no profile at all is a module that states
+ * nothing. Reported, never refused — the choice schema's own rule.
+ */
+export var ProviderComplianceChoiceAssessment;
+(function (ProviderComplianceChoiceAssessment) {
+    /** The chosen deployment model is offered, and a vendor-hosted choice names a region the provider lists. */
+    ProviderComplianceChoiceAssessment["WITHIN_DECLARED_POSSIBILITIES"] = "WITHIN_DECLARED_POSSIBILITIES";
+    /** The provider does not offer the deployment model the operator chose. */
+    ProviderComplianceChoiceAssessment["DEPLOYMENT_MODEL_NOT_OFFERED"] = "DEPLOYMENT_MODEL_NOT_OFFERED";
+    /** A vendor-hosted choice names a region the provider does not list — APP-ASSERTED. */
+    ProviderComplianceChoiceAssessment["REGION_NOT_OFFERED"] = "REGION_NOT_OFFERED";
+    /** The provider's profile is UNDETERMINED, so the choice cannot be checked against anything. */
+    ProviderComplianceChoiceAssessment["PROFILE_UNDETERMINED"] = "PROFILE_UNDETERMINED";
+    /** The provider declares no compliance profile at all. */
+    ProviderComplianceChoiceAssessment["NO_PROFILE"] = "NO_PROFILE";
+})(ProviderComplianceChoiceAssessment || (ProviderComplianceChoiceAssessment = {}));
+/** Assess ONE choice against the provider's profile. See {@link ProviderComplianceChoiceAssessment}. */
+export function assessProviderComplianceChoice(choice, profile) {
+    if (profile === null || profile === undefined)
+        return ProviderComplianceChoiceAssessment.NO_PROFILE;
+    const established = establishedProviderComplianceProfile(profile);
+    if (established === null)
+        return ProviderComplianceChoiceAssessment.PROFILE_UNDETERMINED;
+    if (!established.deploymentModels.includes(choice.deploymentModel))
+        return ProviderComplianceChoiceAssessment.DEPLOYMENT_MODEL_NOT_OFFERED;
+    // A self-hosted choice names no region (the choice schema refuses one), so only a vendor-hosted one is compared.
+    if (choice.processingRegion !== undefined && !established.processingRegions.includes(choice.processingRegion)) {
+        return ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED;
+    }
+    return ProviderComplianceChoiceAssessment.WITHIN_DECLARED_POSSIBILITIES;
+}
+/**
+ * Every choice assessed against the profiles the application's providers declare, sorted by provider ref.
+ *
+ * `profilesByProviderRef` maps a ref to what its package declares; a ref absent from it declares nothing
+ * ({@link ProviderComplianceChoiceAssessment.NO_PROFILE}). The one comparison the brief, the recipient population
+ * and the evidence collector all make — never re-derived beside it.
+ *
+ * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING — each operator choice of a processor's deployment and
+ * region is checked against what the processor declares possible, and an unresearched processor is named.
+ */
+export function assessProviderComplianceChoices(params) {
+    return Object.entries(params.choices)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([providerRef, choice]) => {
+        const established = establishedProviderComplianceProfile(params.profilesByProviderRef[providerRef]);
+        return {
+            providerRef,
+            choice,
+            assessment: assessProviderComplianceChoice(choice, params.profilesByProviderRef[providerRef]),
+            offered: established === null ? null : { deploymentModels: established.deploymentModels, processingRegions: established.processingRegions },
+        };
+    });
+}
 /**
  * Regions an application asserts that the provider does not declare.
  *
@@ -189,24 +410,53 @@ export const ApplicationProviderComplianceChoicesSchema = z.record(z.string().tr
  * operator who genuinely knows better than a stale framework list should be able to say so. What the
  * framework owes is that the divergence is VISIBLE, which is the same trade the personal-data
  * declaration report makes.
+ *
+ * The {@link ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED} slice of {@link assessProviderComplianceChoices};
+ * an UNDETERMINED profile or none is a different gap and is not reported here.
  */
 export function appAssertedProcessingRegions(params) {
-    const asserted = [];
-    for (const [providerRef, choice] of Object.entries(params.choices)) {
-        if (choice.processingRegion === undefined)
-            continue;
-        const profile = params.profilesByProviderRef[providerRef];
-        // No profile is not an assertion about a region — it is a provider that declares no compliance
-        // profile at all, which is a different gap and belongs to whoever reports THAT.
-        if (profile === undefined)
-            continue;
-        if (profile.processingRegions.includes(choice.processingRegion))
-            continue;
-        asserted.push({ providerRef, region: choice.processingRegion });
+    return assessProviderComplianceChoices(params)
+        .filter((entry) => entry.assessment === ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED && entry.choice.processingRegion !== undefined)
+        .map((entry) => ({ providerRef: entry.providerRef, region: entry.choice.processingRegion }));
+}
+/**
+ * Every provider the application's frontend services SERVE, with the profile its facet declares
+ * (#1743) — the browser half of a recipient population.
+ *
+ * ## The join point
+ *
+ * The input is `frontendProviderBootstraps` from the application's generated frontend-services
+ * runtime artifact (`.wildo-saas/generated/providers/frontend-services.runtime-providers.generated.json`,
+ * written by `wildo config sync`), i.e. a `Record<serviceKey, { providers: Record<ref, entry> }>`.
+ * Each entry is a `FrontendProviderEntry`, and since #1743 it carries the facet module's
+ * `complianceProfile`. That record is the right population on its own: materialized per service,
+ * for exactly the providers the service is configured to serve, and readable as JSON without
+ * loading a provider package.
+ *
+ * Typed STRUCTURALLY rather than as `FrontendProvidersBlock`, so this module does not import the
+ * frontend-entry module that imports it, and so a caller holding raw parsed JSON can pass it.
+ *
+ * ## What it does NOT decide
+ *
+ * Whether a browser vendor is the operator's sub-processor or the person's own vendor. A browser SDK
+ * the application keys with its OWN public key (an error-monitoring DSN, an analytics project key, a
+ * captcha site key, a search app id) is engaged by the operator; a file picker opening a person's own
+ * Drive under THEIR vendor account is not. That classification belongs to the recipient population
+ * (#1707), which reads this list rather than re-walking the artifact.
+ *
+ * The same ref served on two services appears twice, deliberately — a per-service record is what
+ * lets a reader say WHICH surface loads the vendor, and the two facets of one vendor may declare
+ * different profiles. Sorted by service, then provider, so the output is deterministic.
+ */
+export function listServedFrontendProviderCompliance(bootstraps) {
+    const served = [];
+    for (const [serviceKey, block] of Object.entries(bootstraps ?? {})) {
+        for (const [providerRef, entry] of Object.entries(block?.providers ?? {})) {
+            served.push({ serviceKey, providerRef, complianceProfile: entry?.complianceProfile ?? null });
+        }
     }
-    return asserted;
+    return served.sort((left, right) => left.serviceKey.localeCompare(right.serviceKey) || left.providerRef.localeCompare(right.providerRef));
 }
-/** @wildo_source:part:end saas.models.providers.compliance-choice */
 /**
  * The configured providers that are THIRD-PARTY RECIPIENTS — vendor-hosted, and therefore processors.
  *

package/dist/esm/external-providers/provider-compliance-profile.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-compliance-profile.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,uBAYX;AAZD,WAAY,uBAAuB;IACjC;;;OAGG;IACH,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;AAC7B,CAAC,EAZW,uBAAuB,KAAvB,uBAAuB,QAYlC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAClC;;;;;;;OAOG;IACH,IAAI,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvH,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,mIAAmI;SAC7I,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,4GAA4G;AAC5G,MAAM,UAAU,0BAA0B,CAAC,OAAkC;IAC3E,OAAO,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yCAAyC,CAAC,OAAkC;IAC1F,OAAO,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,uHAAuH;AACvH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAChD;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC;;;;;;;OAOG;IACH,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC9G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,qIAAqI;SAC/I,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC5G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,wIAAwI;SAClJ,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,qEAAqE;AACrE,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACxB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAG5C;IACC,MAAM,QAAQ,GAAmD,EAAE,CAAC;IAEpE,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnE,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS;YAAE,SAAS;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC1D,+FAA+F;QAC/F,gFAAgF;QAChF,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,IAAI,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAAE,SAAS;QAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,qEAAqE;AAErE;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA6C;IACpF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,CAAC;SACxF,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;SACnC,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import { z } from 'zod';\n\n/**\n * WHO RUNS the software a provider module drives.\n *\n * This is the axis that decides whether a provider is a third-party RECIPIENT of personal data at\n * all, and until 2026-08-30 it did not exist anywhere in the provider model. immudb is described in\n * `BUILTIN_PROVIDER_CAPABILITY` as an audit-trail provider with nothing separating the container an\n * operator runs themselves from a hosted service — so the first privacy notice to ENUMERATE\n * recipients would have named a self-hosted audit ledger as a third party. That is false, and false\n * in the direction that alarms a reader rather than the direction they can check.\n *\n * ⚠️ NOT a hosting-topology field and not an infrastructure concern. It answers one compliance\n * question — does personal data leave the operator's control by reaching this provider — and a\n * consumer must not read it as \"where is it deployed\".\n */\nexport enum ProviderDeploymentModel {\n  /**\n   * The vendor runs it. Data reaching this provider reaches a third party, so it is a processor\n   * under Art. 28 and belongs in the subprocessor register.\n   */\n  VENDOR_HOSTED = 'VENDOR_HOSTED',\n  /**\n   * The operator runs it — their own container, their own infrastructure. No third party receives\n   * anything, so it is NOT a recipient. A notice states it as processing under the operator's own\n   * control, which is a different sentence and a stronger one.\n   */\n  SELF_HOSTED = 'SELF_HOSTED',\n}\n\n/**\n * The compliance-relevant facts a PROVIDER MODULE knows about itself.\n *\n * ## Why these live on the provider and not on the application\n *\n * The processor register shipped by issue #88 was fully application-authored, and that made every\n * application restate facts the framework already holds. What a provider IS — who runs it, which\n * regions its vendor offers, what legal entity stands behind it — does not vary per application, and\n * an application asked to restate it will eventually get it wrong. What DOES vary is the operator's\n * CHOICE among those possibilities, and that is configuration.\n *\n * So the split is: possibilities here, choice in `wildo.saas.config.ts`, and the register entry\n * derived from both (issue #130).\n *\n * ## What is deliberately NOT here\n *\n * **A transfer mechanism.** Adequacy decisions move by court ruling rather than by release cycle, so\n * a list baked into the engine goes stale silently and emits a false compliance statement — the worst\n * failure mode in this lane. The mechanism is a legal determination with a shelf life, recorded per\n * subprocessor entry by a human, never derived here (issue #126).\n *\n * **What the provider RECEIVES.** That is already implied by the capability it serves —\n * `BUILTIN_PROVIDER_CAPABILITY` describes the data flow per member. Restating it here would be a\n * second authority for one fact.\n */\nexport const ProviderComplianceProfileSchema = z.strictObject({\n  /**\n   * The deployment models this provider SUPPORTS — one, or both where the provider genuinely offers\n   * a choice (immudb: a hosted service and a container you run).\n   *\n   * A single entry means the answer is not the operator's to make and no configuration should offer\n   * it. Two means the application must choose, and a register entry cannot be derived until it has.\n   */\n  deploymentModels: z.array(z.enum(ProviderDeploymentModel)).min(1),\n  /**\n   * The regions this vendor can process in — POSSIBILITIES the operator chooses from, never a\n   * choice already made.\n   *\n   * Open strings, deliberately, because these are the VENDOR's own labels (`eu-west-1`,\n   * `us-east-1`, `EU`) and a closed enum here would be this repository inventing a vocabulary it\n   * does not own. The compliance question a transfer statement asks is about JURISDICTION rather\n   * than datacentre, and mapping one to the other is part of the legal determination that is\n   * deliberately not modelled (see above).\n   *\n   * EMPTY is meaningful and is the honest answer for a provider that is only ever self-hosted: the\n   * region is wherever the operator runs it, which the framework cannot know. A configuration\n   * choosing `SELF_HOSTED` therefore needs no region from this list.\n   */\n  processingRegions: z.array(z.string().trim().min(1)),\n  /**\n   * The vendor's legal entity, where the provider module's author can state it.\n   *\n   * OPTIONAL, and the reason is that this is the field most likely to go stale: vendors reorganise,\n   * and a stale legal entity published as a current one is worse than an absent one. Absent means\n   * the application must declare it on the register entry, which is where an operator's own contract\n   * makes it checkable.\n   */\n  vendorLegalEntityName: z.string().trim().min(1).optional(),\n}).superRefine((profile, context) => {\n  /*\n   * A VENDOR_HOSTED provider that offers no region cannot support a transfer statement, and the\n   * whole point of carrying regions is that a transfer statement becomes derivable. Refused at the\n   * schema so the gap surfaces where the provider module is authored, rather than as an\n   * unexplainable hole in a produced notice months later.\n   *\n   * The SELF_HOSTED-only case is exempt above: its region is wherever the operator runs it.\n   */\n  if (profile.deploymentModels.includes(ProviderDeploymentModel.VENDOR_HOSTED) && profile.processingRegions.length === 0) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegions'],\n      message: 'a VENDOR_HOSTED provider must declare at least one processing region — without one, no transfer statement about it can be derived',\n    });\n  }\n});\nexport type ProviderComplianceProfile = z.infer<typeof ProviderComplianceProfileSchema>;\n\n/** True when this provider can only ever be run by the operator, so it is never a third-party recipient. */\nexport function providerIsAlwaysSelfHosted(profile: ProviderComplianceProfile): boolean {\n  return profile.deploymentModels.every((model) => model === ProviderDeploymentModel.SELF_HOSTED);\n}\n\n/**\n * True when the operator must CHOOSE, because the provider supports both.\n *\n * A register entry for such a provider cannot be derived from the provider module alone — the\n * application's configuration decides whether it is a recipient at all.\n */\nexport function providerDeploymentModelIsAnOperatorChoice(profile: ProviderComplianceProfile): boolean {\n  return profile.deploymentModels.length > 1;\n}\n\n/** @wildo_source:part:start saas.models.providers.compliance-choice facet:layer:shared facet:audience:app-developer */\n/**\n * The application's CHOICE among what a provider offers — one entry per configured provider.\n *\n * The provider declares possibilities ({@link ProviderComplianceProfileSchema}); this is where an\n * operator says which of them applies to their deployment. Keeping the two apart is the whole point\n * of the layering: a vendor's regions change when it opens a data centre, an operator's choice\n * changes when they migrate, and collapsing them would make one edit look like the other.\n *\n * Not carried inside `providerConfigurations`, which is an opaque `Record<string, unknown>` bag for a\n * provider's own runtime profile. A compliance answer must not live somewhere nothing can read it\n * without knowing the provider.\n */\nexport const ApplicationProviderComplianceChoiceSchema = z.strictObject({\n  /**\n   * Who runs this provider in THIS deployment.\n   *\n   * Required even when the provider supports only one model. The redundancy is deliberate: whether\n   * personal data leaves the operator's control is the single most consequential fact a notice states\n   * about a provider, and reading it out of a framework default rather than an operator's declaration\n   * is how a wrong one goes unnoticed.\n   */\n  deploymentModel: z.enum(ProviderDeploymentModel),\n  /**\n   * Which region this provider processes in, chosen from what the provider declares possible.\n   *\n   * NOT validated here, and NOT validated at boot either. This schema cannot see the provider\n   * registry, and refusing an unlisted region would make a vendor's new data centre an application\n   * build failure, so the intended posture is warn-do-not-block: a region outside the provider's\n   * declared list is APP-ASSERTED and reported, never refused.\n   *\n   * WIRED since 2026-09-10 (issue #308). `appAssertedProcessingRegions` below computes exactly that\n   * set, and the companion's compliance-primary-facts section reports it per provider, naming both the\n   * configured value and what the provider declares — because a divergence is either a typo or a stale\n   * provider module, and those are opposite work. It took this long only because of a DATA PATH: the\n   * vendor's region list lives on the backend provider module and the renderer reads provider\n   * SPECIFICATIONS, so the helper could not be called until `complianceProfile` was mirrored onto the\n   * specification contract. Any future report must call this helper rather than re-derive the\n   * comparison.\n   */\n  processingRegion: z.string().trim().min(1).optional(),\n}).superRefine((choice, context) => {\n  /*\n   * The pairing, in both directions.\n   *\n   * A VENDOR_HOSTED choice with no region leaves the notice unable to state where the data goes,\n   * which is the question this whole layer exists to answer. A SELF_HOSTED choice WITH one is the\n   * fiction the provider layer already refuses: the operator runs it, so its region is wherever they\n   * run it, and a value here would be a guess presented as a configuration.\n   */\n  if (choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED && choice.processingRegion === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a VENDOR_HOSTED provider must be configured with the region it processes in — without one, no notice can state where this data goes',\n    });\n  }\n  if (choice.deploymentModel === ProviderDeploymentModel.SELF_HOSTED && choice.processingRegion !== undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a SELF_HOSTED provider runs wherever the operator runs it, so a processing region here is a guess presented as configuration — drop it',\n    });\n  }\n});\nexport type ApplicationProviderComplianceChoice = z.infer<typeof ApplicationProviderComplianceChoiceSchema>;\n\n/** Per configured provider ref, the operator's compliance choice. */\nexport const ApplicationProviderComplianceChoicesSchema = z.record(\n  z.string().trim().min(1),\n  ApplicationProviderComplianceChoiceSchema,\n);\nexport type ApplicationProviderComplianceChoices = z.infer<typeof ApplicationProviderComplianceChoicesSchema>;\n\n/**\n * Regions an application asserts that the provider does not declare.\n *\n * Reported, never refused — a vendor opening a data centre must not become a build failure, and an\n * operator who genuinely knows better than a stale framework list should be able to say so. What the\n * framework owes is that the divergence is VISIBLE, which is the same trade the personal-data\n * declaration report makes.\n */\nexport function appAssertedProcessingRegions(params: {\n  readonly choices: ApplicationProviderComplianceChoices;\n  readonly profilesByProviderRef: Readonly<Record<string, ProviderComplianceProfile>>;\n}): ReadonlyArray<{ readonly providerRef: string; readonly region: string }> {\n  const asserted: Array<{ providerRef: string; region: string }> = [];\n\n  for (const [providerRef, choice] of Object.entries(params.choices)) {\n    if (choice.processingRegion === undefined) continue;\n    const profile = params.profilesByProviderRef[providerRef];\n    // No profile is not an assertion about a region — it is a provider that declares no compliance\n    // profile at all, which is a different gap and belongs to whoever reports THAT.\n    if (profile === undefined) continue;\n    if (profile.processingRegions.includes(choice.processingRegion)) continue;\n    asserted.push({ providerRef, region: choice.processingRegion });\n  }\n\n  return asserted;\n}\n/** @wildo_source:part:end saas.models.providers.compliance-choice */\n\n/**\n * The configured providers that are THIRD-PARTY RECIPIENTS — vendor-hosted, and therefore processors.\n *\n * A self-hosted provider is excluded by construction rather than by a filter a caller must remember:\n * no data leaves the operator, so it is not a recipient and must never be enumerated as one.\n */\nexport function vendorHostedProviderRefs(choices: ApplicationProviderComplianceChoices): readonly string[] {\n  return Object.entries(choices)\n    .filter(([, choice]) => choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED)\n    .map(([providerRef]) => providerRef)\n    .sort();\n}\n"]}
+{"version":3,"file":"provider-compliance-profile.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EACL,2CAA2C,EAC3C,uCAAuC,GACxC,MAAM,8DAA8D,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,uBAYX;AAZD,WAAY,uBAAuB;IACjC;;;OAGG;IACH,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;AAC7B,CAAC,EAZW,uBAAuB,KAAvB,uBAAuB,QAYlC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,iGAAiG;IACjG,8DAA2B,CAAA;IAC3B,mGAAmG;IACnG,gEAA6B,CAAA;AAC/B,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,sBAMX;AAND,WAAY,sBAAsB;IAChC,iEAAuC,CAAA;IACvC,mEAAyC,CAAA;IACzC,qEAA2C,CAAA;IAC3C,iEAAuC,CAAA;IACvC,iFAAuD,CAAA;AACzD,CAAC,EANW,sBAAsB,KAAtB,sBAAsB,QAMjC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,yCAAyC;IACzC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,6FAA6F;IAC7F,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtC,+CAA+C;IAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;CACzB,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,YAAY,CAAC;IACvE;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;IAChF;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,wHAAwH;IACxH,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9D;;;OAGG;IACH,0BAA0B,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzE;;;;;;;OAOG;IACH,cAAc,EAAE,uCAAuC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAClC;;;;;;;OAOG;IACH,IAAI,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvH,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,mIAAmI;SAC7I,CAAC,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAChD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,kBAAkB,IAAI,qCAAqC,EAAE,CAAC,CAAC;YACjJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,YAAY,CAAC;IACtE,0FAA0F;IAC1F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,0CAA0C,EAAE,2CAA2C,CAAC,CAAC,CAAC;AAGlJ,mHAAmH;AACnH,MAAM,UAAU,6BAA6B,CAC3C,OAAmI;IAEnI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAyB,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACtI,IAAI,OAAO,CAAC,qBAAqB,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IACpG,IAAI,OAAO,CAAC,0BAA0B,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,CAAC;IACnH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,oCAAoC,CAClD,OAAqD;IAErD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,OAAO,CAAC,aAAa,KAAK,+BAA+B,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAA6C;IAChG,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAkC;IAC3E,MAAM,WAAW,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAC9H,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yCAAyC,CAAC,OAAkC;IAC1F,MAAM,WAAW,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,uHAAuH;AACvH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAChD;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;;;;;;OAUG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnE;;;;;OAKG;IACH,6BAA6B,EAAE,2CAA2C,CAAC,QAAQ,EAAE;CACtF,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC;;;;;;;OAOG;IACH,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC9G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,qIAAqI;SAC/I,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC5G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,wIAAwI;SAClJ,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,qEAAqE;AACrE,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACxB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kCAWX;AAXD,WAAY,kCAAkC;IAC5C,4GAA4G;IAC5G,qGAA+D,CAAA;IAC/D,2EAA2E;IAC3E,mGAA6D,CAAA;IAC7D,uFAAuF;IACvF,+EAAyC,CAAA;IACzC,gGAAgG;IAChG,mFAA6C,CAAA;IAC7C,0DAA0D;IAC1D,+DAAyB,CAAA;AAC3B,CAAC,EAXW,kCAAkC,KAAlC,kCAAkC,QAW7C;AAWD,wGAAwG;AACxG,MAAM,UAAU,8BAA8B,CAC5C,MAA2C,EAC3C,OAAqD;IAErD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,kCAAkC,CAAC,UAAU,CAAC;IACpG,MAAM,WAAW,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,kCAAkC,CAAC,oBAAoB,CAAC;IACzF,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC;QAAE,OAAO,kCAAkC,CAAC,4BAA4B,CAAC;IAC3I,iHAAiH;IACjH,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9G,OAAO,kCAAkC,CAAC,kBAAkB,CAAC;IAC/D,CAAC;IACD,OAAO,kCAAkC,CAAC,6BAA6B,CAAC;AAC1E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAG/C;IACC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,oCAAoC,CAAC,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;QACpG,OAAO;YACL,WAAW;YACX,MAAM;YACN,UAAU,EAAE,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAC7F,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,EAAE;SAC5I,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAG5C;IACC,OAAO,+BAA+B,CAAC,MAAM,CAAC;SAC3C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,kCAAkC,CAAC,kBAAkB,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC;SAC5I,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAiB,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,oCAAoC,CAClD,UAEa;IAEb,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,IAAI,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA6C;IACpF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,CAAC;SACxF,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;SACnC,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { LawfulBasisPurposeRefSchema } from '../compliance/privacy/purpose-ref.shared.schemas';\nimport {\n  ProviderSubjectErasureAcknowledgementSchema,\n  ProviderSubjectErasureDeclarationSchema,\n} from '../compliance/privacy/subject-data-recipients.shared.schemas';\n\n/**\n * WHO RUNS the software a provider module drives.\n *\n * This is the axis that decides whether a provider is a third-party RECIPIENT of personal data at\n * all, and until 2026-08-30 it did not exist anywhere in the provider model. immudb is described in\n * `BUILTIN_PROVIDER_CAPABILITY` as an audit-trail provider with nothing separating the container an\n * operator runs themselves from a hosted service — so the first privacy notice to ENUMERATE\n * recipients would have named a self-hosted audit ledger as a third party. That is false, and false\n * in the direction that alarms a reader rather than the direction they can check.\n *\n * ⚠️ NOT a hosting-topology field and not an infrastructure concern. It answers one compliance\n * question — does personal data leave the operator's control by reaching this provider — and a\n * consumer must not read it as \"where is it deployed\".\n */\nexport enum ProviderDeploymentModel {\n  /**\n   * The vendor runs it. Data reaching this provider reaches a third party, so it is a processor\n   * under Art. 28 and belongs in the subprocessor register.\n   */\n  VENDOR_HOSTED = 'VENDOR_HOSTED',\n  /**\n   * The operator runs it — their own container, their own infrastructure. No third party receives\n   * anything, so it is NOT a recipient. A notice states it as processing under the operator's own\n   * control, which is a different sentence and a stronger one.\n   */\n  SELF_HOSTED = 'SELF_HOSTED',\n}\n\n/**\n * Whether a provider's compliance facts have been ESTABLISHED at all (#1708).\n *\n * The profile could only be a guess or absent until this existed: `deploymentModels` is non-empty and a\n * vendor-hosted profile must name a region, so a catalogue vendor nobody has researched had two options —\n * invent a profile, or carry none, which every reader reports as NOT ESTABLISHED with no way to tell \"nobody\n * looked\" from \"the module forgot\". UNDETERMINED is that first answer, stated: the provider is known, its facts\n * are not, and a reader treats it as a gap to fill — never as an empty answer, and never as vendor-hosted.\n */\nexport enum ProviderComplianceDetermination {\n  /** The facts below were stated by the module's author or the catalogue record, from a source. */\n  ESTABLISHED = 'ESTABLISHED',\n  /** Nobody has established who runs this provider or where it processes. A gap, reported as one. */\n  UNDETERMINED = 'UNDETERMINED',\n}\n\n/**\n * The facts an ESTABLISHED profile can state, each of which a piece of {@link ProviderComplianceFactEvidenceSchema}\n * can cite. Named so a staleness report can say WHICH fact is old, not merely that \"the profile\" is.\n */\nexport enum ProviderComplianceFact {\n  DEPLOYMENT_MODELS = 'DEPLOYMENT_MODELS',\n  PROCESSING_REGIONS = 'PROCESSING_REGIONS',\n  VENDOR_LEGAL_ENTITY = 'VENDOR_LEGAL_ENTITY',\n  SUBPROCESSOR_LIST = 'SUBPROCESSOR_LIST',\n  DATA_PROCESSING_AGREEMENT = 'DATA_PROCESSING_AGREEMENT',\n}\n\n/**\n * Where one or more facts of a profile were READ, and when (#1708, #1744).\n *\n * A vendor fact has a shelf life: vendors reorganise, open data centres and change their sub-processors, and a\n * fact that was true when a module was written can be false when a notice is published. So a researched fact\n * carries the page it was read from and the date it was read, which is what makes a staleness report possible\n * and what lets an operator check the suggestion before adopting it into its own register.\n *\n * Required for every fact a CATALOGUE vendor states (the transposer refuses a profile without it); optional on\n * an engine module, whose author states facts in code review, and reported as UNDATED there.\n */\nexport const ProviderComplianceFactEvidenceSchema = z.strictObject({\n  /** The facts this source establishes. */\n  facts: z.array(z.enum(ProviderComplianceFact)).min(1),\n  /** The vendor page the facts were read from — its own legal, trust or documentation page. */\n  source: z.url({ protocol: /^https$/ }),\n  /** The day the page was read, `YYYY-MM-DD`. */\n  verifiedAt: z.iso.date(),\n});\nexport type ProviderComplianceFactEvidence = z.infer<typeof ProviderComplianceFactEvidenceSchema>;\n\n/**\n * The compliance-relevant facts a PROVIDER MODULE knows about itself, once they are ESTABLISHED.\n *\n * ## Why these live on the provider and not on the application\n *\n * The processor register shipped by issue #88 was fully application-authored, and that made every\n * application restate facts the framework already holds. What a provider IS — who runs it, which\n * regions its vendor offers, what legal entity stands behind it — does not vary per application, and\n * an application asked to restate it will eventually get it wrong. What DOES vary is the operator's\n * CHOICE among those possibilities, and that is configuration.\n *\n * So the split is: possibilities here, choice in `wildo.saas.config.ts`, and the register entry\n * derived from both (issue #130).\n *\n * ## These are SUGGESTIONS to the operator, never the operator's answer (#1744)\n *\n * The legal facts below (entity, sub-processor list, data processing agreement) are what the framework READ,\n * on a date, at a URL. They reach a published document only after the operator copies them into its own\n * processor register and commits it — Paul's decision of 2026-09-25. A reader offers them as the question\n * to answer, never as the answer.\n *\n * ## What is deliberately NOT here\n *\n * **A transfer mechanism.** Adequacy decisions move by court ruling rather than by release cycle, so\n * a list baked into the engine goes stale silently and emits a false compliance statement — the worst\n * failure mode in this lane. The mechanism is a legal determination with a shelf life, recorded per\n * subprocessor entry by a human, never derived here (issue #126).\n *\n * **What the provider RECEIVES.** That is already implied by the capability it serves —\n * `BUILTIN_PROVIDER_CAPABILITY` describes the data flow per member. Restating it here would be a\n * second authority for one fact.\n */\nexport const EstablishedProviderComplianceProfileSchema = z.strictObject({\n  /**\n   * Optional, and absent reads as ESTABLISHED: the facts below ARE the establishment, and the engine's own\n   * modules state them without the marker. The transposer always writes it, so a generated profile is\n   * explicit either way.\n   */\n  determination: z.literal(ProviderComplianceDetermination.ESTABLISHED).optional(),\n  /**\n   * The deployment models this provider SUPPORTS — one, or both where the provider genuinely offers\n   * a choice (immudb: a hosted service and a container you run).\n   *\n   * A single entry means the answer is not the operator's to make and no configuration should offer\n   * it. Two means the application must choose, and a register entry cannot be derived until it has.\n   */\n  deploymentModels: z.array(z.enum(ProviderDeploymentModel)).min(1),\n  /**\n   * The regions this vendor can process in — POSSIBILITIES the operator chooses from, never a\n   * choice already made.\n   *\n   * Open strings, deliberately, because these are the VENDOR's own labels (`eu-west-1`,\n   * `us-east-1`, `EU`) and a closed enum here would be this repository inventing a vocabulary it\n   * does not own. The compliance question a transfer statement asks is about JURISDICTION rather\n   * than datacentre, and mapping one to the other is part of the legal determination that is\n   * deliberately not modelled (see above).\n   *\n   * EMPTY is meaningful and is the honest answer for a provider that is only ever self-hosted: the\n   * region is wherever the operator runs it, which the framework cannot know. A configuration\n   * choosing `SELF_HOSTED` therefore needs no region from this list.\n   */\n  processingRegions: z.array(z.string().trim().min(1)),\n  /**\n   * The vendor's legal entity, where the provider module's author can state it.\n   *\n   * OPTIONAL, and the reason is that this is the field most likely to go stale: vendors reorganise,\n   * and a stale legal entity published as a current one is worse than an absent one. Absent means\n   * the application must declare it on the register entry, which is where an operator's own contract\n   * makes it checkable.\n   */\n  vendorLegalEntityName: z.string().trim().min(1).optional(),\n  /** Where the vendor publishes its own list of sub-processors. A suggestion for the register entry's `subprocessors`. */\n  subprocessorListUrl: z.url({ protocol: /^https$/ }).optional(),\n  /**\n   * Where the vendor offers its data processing agreement — its AVAILABILITY. Whether THIS operator signed one\n   * is the operator's fact and lives on its register entry (#1709), never here.\n   */\n  dataProcessingAgreementUrl: z.url({ protocol: /^https$/ }).optional(),\n  /** Where each stated fact was read, and when. See {@link ProviderComplianceFactEvidenceSchema}. */\n  evidence: z.array(ProviderComplianceFactEvidenceSchema).min(1).optional(),\n  /**\n   * What the VENDOR keeps about a data subject, and whether an erasure can reach it (#1710) — the D6 stance\n   * vocabulary: `NO_SUBJECT_DATA`, or `EXTERNAL_ERASURE_OPERATION` when an erasure effect reaches this vendor.\n   *\n   * Optional, and absent means UNDECLARED: a subject erasure then reports this vendor UNMEASURED — incomplete, never\n   * a silent pass. Declare it only with a source: `NO_SUBJECT_DATA` is a claim about the vendor's product that a\n   * reviewer must be able to check, and it closes the erasure question for every application using the provider.\n   */\n  subjectErasure: ProviderSubjectErasureDeclarationSchema.optional(),\n}).superRefine((profile, context) => {\n  /*\n   * A VENDOR_HOSTED provider that offers no region cannot support a transfer statement, and the\n   * whole point of carrying regions is that a transfer statement becomes derivable. Refused at the\n   * schema so the gap surfaces where the provider module is authored, rather than as an\n   * unexplainable hole in a produced notice months later.\n   *\n   * The SELF_HOSTED-only case is exempt above: its region is wherever the operator runs it.\n   */\n  if (profile.deploymentModels.includes(ProviderDeploymentModel.VENDOR_HOSTED) && profile.processingRegions.length === 0) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegions'],\n      message: 'a VENDOR_HOSTED provider must declare at least one processing region — without one, no transfer statement about it can be derived',\n    });\n  }\n  /*\n   * Evidence may cite only a fact the profile STATES. A source cited for a sub-processor list the profile does\n   * not carry is a citation of nothing, and would make the staleness report date a fact that is not there.\n   */\n  const stated = statedProviderComplianceFacts(profile);\n  (profile.evidence ?? []).forEach((entry, index) => {\n    for (const fact of entry.facts) {\n      if (!stated.has(fact)) {\n        context.addIssue({ code: 'custom', path: ['evidence', index, 'facts'], message: `evidence cites ${fact}, which this profile does not state` });\n      }\n    }\n  });\n});\nexport type EstablishedProviderComplianceProfile = z.infer<typeof EstablishedProviderComplianceProfileSchema>;\n\n/**\n * A provider whose compliance facts nobody has established (#1708). A provider carries this until its facts are\n * researched — for a registry provider, into its module's own profile in `providers-registry/<ref>/` (the archived\n * catalogue's vendors kept theirs in `_code_archive/providers/catalogue-record/`) — and a reader reports it as a gap\n * to fill.\n */\nexport const UndeterminedProviderComplianceProfileSchema = z.strictObject({\n  determination: z.literal(ProviderComplianceDetermination.UNDETERMINED),\n  /** Why the facts are not established, and where the operator establishes them instead. */\n  reason: z.string().trim().min(1),\n});\nexport type UndeterminedProviderComplianceProfile = z.infer<typeof UndeterminedProviderComplianceProfileSchema>;\n\n/**\n * What a provider declares about who runs it and where it processes: ESTABLISHED facts, or UNDETERMINED.\n *\n * A provider that declares NO profile at all is a third state, and a different gap: its author said nothing.\n * Every reader keeps the three apart — UNDETERMINED names research owed, absence names a module to fix.\n */\nexport const ProviderComplianceProfileSchema = z.union([EstablishedProviderComplianceProfileSchema, UndeterminedProviderComplianceProfileSchema]);\nexport type ProviderComplianceProfile = z.infer<typeof ProviderComplianceProfileSchema>;\n\n/** The facts an established profile states — the population its evidence may cite and a staleness report dates. */\nexport function statedProviderComplianceFacts(\n  profile: Pick<EstablishedProviderComplianceProfile, 'vendorLegalEntityName' | 'subprocessorListUrl' | 'dataProcessingAgreementUrl'>,\n): ReadonlySet<ProviderComplianceFact> {\n  const stated = new Set<ProviderComplianceFact>([ProviderComplianceFact.DEPLOYMENT_MODELS, ProviderComplianceFact.PROCESSING_REGIONS]);\n  if (profile.vendorLegalEntityName !== undefined) stated.add(ProviderComplianceFact.VENDOR_LEGAL_ENTITY);\n  if (profile.subprocessorListUrl !== undefined) stated.add(ProviderComplianceFact.SUBPROCESSOR_LIST);\n  if (profile.dataProcessingAgreementUrl !== undefined) stated.add(ProviderComplianceFact.DATA_PROCESSING_AGREEMENT);\n  return stated;\n}\n\n/** The established profile, or `null` for an UNDETERMINED one or none. The one narrowing every reader uses. */\nexport function establishedProviderComplianceProfile(\n  profile: ProviderComplianceProfile | null | undefined,\n): EstablishedProviderComplianceProfile | null {\n  if (profile === null || profile === undefined) return null;\n  return profile.determination === ProviderComplianceDetermination.UNDETERMINED ? null : profile;\n}\n\n/**\n * The oldest `verifiedAt` across an established profile's evidence, or `null` when it cites none (UNDATED).\n *\n * The OLDEST, because a profile is only as current as its most stale fact: a fresh region list beside a legal\n * entity read two years ago is a profile whose entity may be wrong.\n */\nexport function oldestProviderComplianceEvidenceDate(profile: EstablishedProviderComplianceProfile): string | null {\n  const dates = (profile.evidence ?? []).map((entry) => entry.verifiedAt).sort();\n  return dates[0] ?? null;\n}\n\n/**\n * True when this provider can only ever be run by the operator, so it is never a third-party recipient.\n * An UNDETERMINED profile answers `false`: nobody established it, so it is not established as operator-run.\n */\nexport function providerIsAlwaysSelfHosted(profile: ProviderComplianceProfile): boolean {\n  const established = establishedProviderComplianceProfile(profile);\n  return established !== null && established.deploymentModels.every((model) => model === ProviderDeploymentModel.SELF_HOSTED);\n}\n\n/**\n * True when the operator must CHOOSE, because the provider supports both.\n *\n * A register entry for such a provider cannot be derived from the provider module alone — the\n * application's configuration decides whether it is a recipient at all. An UNDETERMINED profile answers\n * `false`: what it offers is unknown, which is a research gap rather than a known choice.\n */\nexport function providerDeploymentModelIsAnOperatorChoice(profile: ProviderComplianceProfile): boolean {\n  const established = establishedProviderComplianceProfile(profile);\n  return established !== null && established.deploymentModels.length > 1;\n}\n\n/** @wildo_source:part:start saas.models.providers.compliance-choice facet:layer:shared facet:audience:app-developer */\n/**\n * The application's CHOICE among what a provider offers — one entry per configured provider.\n *\n * The provider declares possibilities ({@link ProviderComplianceProfileSchema}); this is where an\n * operator says which of them applies to their deployment. Keeping the two apart is the whole point\n * of the layering: a vendor's regions change when it opens a data centre, an operator's choice\n * changes when they migrate, and collapsing them would make one edit look like the other.\n *\n * Not carried inside `providerConfigurations`, which is an opaque `Record<string, unknown>` bag for a\n * provider's own runtime profile. A compliance answer must not live somewhere nothing can read it\n * without knowing the provider.\n */\nexport const ApplicationProviderComplianceChoiceSchema = z.strictObject({\n  /**\n   * Who runs this provider in THIS deployment.\n   *\n   * Required even when the provider supports only one model. The redundancy is deliberate: whether\n   * personal data leaves the operator's control is the single most consequential fact a notice states\n   * about a provider, and reading it out of a framework default rather than an operator's declaration\n   * is how a wrong one goes unnoticed.\n   */\n  deploymentModel: z.enum(ProviderDeploymentModel),\n  /**\n   * Which region this provider processes in, chosen from what the provider declares possible.\n   *\n   * NOT validated here, and NOT validated at boot either. This schema cannot see the provider\n   * registry, and refusing an unlisted region would make a vendor's new data centre an application\n   * build failure, so the intended posture is warn-do-not-block: a region outside the provider's\n   * declared list is APP-ASSERTED and reported, never refused.\n   *\n   * WIRED since 2026-09-10 (issue #308). `appAssertedProcessingRegions` below computes exactly that\n   * set, and the companion's compliance-primary-facts section reports it per provider, naming both the\n   * configured value and what the provider declares — because a divergence is either a typo or a stale\n   * provider module, and those are opposite work. It took this long only because of a DATA PATH: the\n   * vendor's region list lives on the backend provider module and the renderer reads provider\n   * SPECIFICATIONS, so the helper could not be called until `complianceProfile` was mirrored onto the\n   * specification contract. Any future report must call this helper rather than re-derive the\n   * comparison.\n   */\n  processingRegion: z.string().trim().min(1).optional(),\n  /**\n   * The processing PURPOSES sending data to this recipient serves, by the `purposeRef` of a lawful basis in\n   * `operatorComplianceIdentity.lawfulBases` (#1709). Keyed like every choice: a provider ref, or a\n   * `systemsOfRecord.<name>` instance.\n   *\n   * Here, on the operator's compliance statement about the recipient, and deliberately NOT on the runtime provider\n   * selection (`providers.scopes.<scope>.providers.<ref>`): a purpose is a compliance fact no runtime reads, and the\n   * selection schema has four strict copies (config, backend app-config, runtime artifact, lockfile) that would each\n   * refuse a key the others admit. Absent means no purpose is linked, which the recipients report names as such;\n   * a ref naming no declared purpose is reported as a broken link, never refused.\n   */\n  purposeRefs: z.array(LawfulBasisPurposeRefSchema).min(1).optional(),\n  /**\n   * The operator ACKNOWLEDGES that erasure does not reach this recipient (#1710) — the D6 stance\n   * CONTROLLER_ACKNOWLEDGED_NON_ERASURE for a provider. An erasure then reports ACKNOWLEDGED_NON_ERASURE for it,\n   * which is still incomplete: the data stays live at the vendor. The controller's decision, which is why it lives\n   * here on the operator's statement and never on the provider's profile.\n   */\n  subjectErasureAcknowledgement: ProviderSubjectErasureAcknowledgementSchema.optional(),\n}).superRefine((choice, context) => {\n  /*\n   * The pairing, in both directions.\n   *\n   * A VENDOR_HOSTED choice with no region leaves the notice unable to state where the data goes,\n   * which is the question this whole layer exists to answer. A SELF_HOSTED choice WITH one is the\n   * fiction the provider layer already refuses: the operator runs it, so its region is wherever they\n   * run it, and a value here would be a guess presented as a configuration.\n   */\n  if (choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED && choice.processingRegion === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a VENDOR_HOSTED provider must be configured with the region it processes in — without one, no notice can state where this data goes',\n    });\n  }\n  if (choice.deploymentModel === ProviderDeploymentModel.SELF_HOSTED && choice.processingRegion !== undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a SELF_HOSTED provider runs wherever the operator runs it, so a processing region here is a guess presented as configuration — drop it',\n    });\n  }\n});\nexport type ApplicationProviderComplianceChoice = z.infer<typeof ApplicationProviderComplianceChoiceSchema>;\n\n/** Per configured provider ref, the operator's compliance choice. */\nexport const ApplicationProviderComplianceChoicesSchema = z.record(\n  z.string().trim().min(1),\n  ApplicationProviderComplianceChoiceSchema,\n);\nexport type ApplicationProviderComplianceChoices = z.infer<typeof ApplicationProviderComplianceChoicesSchema>;\n\n/**\n * How an operator's compliance CHOICE for one provider stands against what the provider DECLARES possible (#1708).\n *\n * Five answers, because they are five different pieces of work and a reader must not round one into another:\n * a region the vendor does not list is a typo or a stale profile; a deployment model it does not offer is a\n * configuration error; an UNDETERMINED profile is research owed; no profile at all is a module that states\n * nothing. Reported, never refused — the choice schema's own rule.\n */\nexport enum ProviderComplianceChoiceAssessment {\n  /** The chosen deployment model is offered, and a vendor-hosted choice names a region the provider lists. */\n  WITHIN_DECLARED_POSSIBILITIES = 'WITHIN_DECLARED_POSSIBILITIES',\n  /** The provider does not offer the deployment model the operator chose. */\n  DEPLOYMENT_MODEL_NOT_OFFERED = 'DEPLOYMENT_MODEL_NOT_OFFERED',\n  /** A vendor-hosted choice names a region the provider does not list — APP-ASSERTED. */\n  REGION_NOT_OFFERED = 'REGION_NOT_OFFERED',\n  /** The provider's profile is UNDETERMINED, so the choice cannot be checked against anything. */\n  PROFILE_UNDETERMINED = 'PROFILE_UNDETERMINED',\n  /** The provider declares no compliance profile at all. */\n  NO_PROFILE = 'NO_PROFILE',\n}\n\n/** One choice, assessed. */\nexport interface ProviderComplianceChoiceAssessmentEntry {\n  readonly providerRef: string;\n  readonly choice: ApplicationProviderComplianceChoice;\n  readonly assessment: ProviderComplianceChoiceAssessment;\n  /** What the provider offers, when established — so a report can name both sides of a divergence. */\n  readonly offered: { readonly deploymentModels: readonly ProviderDeploymentModel[]; readonly processingRegions: readonly string[] } | null;\n}\n\n/** Assess ONE choice against the provider's profile. See {@link ProviderComplianceChoiceAssessment}. */\nexport function assessProviderComplianceChoice(\n  choice: ApplicationProviderComplianceChoice,\n  profile: ProviderComplianceProfile | null | undefined,\n): ProviderComplianceChoiceAssessment {\n  if (profile === null || profile === undefined) return ProviderComplianceChoiceAssessment.NO_PROFILE;\n  const established = establishedProviderComplianceProfile(profile);\n  if (established === null) return ProviderComplianceChoiceAssessment.PROFILE_UNDETERMINED;\n  if (!established.deploymentModels.includes(choice.deploymentModel)) return ProviderComplianceChoiceAssessment.DEPLOYMENT_MODEL_NOT_OFFERED;\n  // A self-hosted choice names no region (the choice schema refuses one), so only a vendor-hosted one is compared.\n  if (choice.processingRegion !== undefined && !established.processingRegions.includes(choice.processingRegion)) {\n    return ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED;\n  }\n  return ProviderComplianceChoiceAssessment.WITHIN_DECLARED_POSSIBILITIES;\n}\n\n/**\n * Every choice assessed against the profiles the application's providers declare, sorted by provider ref.\n *\n * `profilesByProviderRef` maps a ref to what its package declares; a ref absent from it declares nothing\n * ({@link ProviderComplianceChoiceAssessment.NO_PROFILE}). The one comparison the brief, the recipient population\n * and the evidence collector all make — never re-derived beside it.\n *\n * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING — each operator choice of a processor's deployment and\n * region is checked against what the processor declares possible, and an unresearched processor is named.\n */\nexport function assessProviderComplianceChoices(params: {\n  readonly choices: ApplicationProviderComplianceChoices;\n  readonly profilesByProviderRef: Readonly<Record<string, ProviderComplianceProfile>>;\n}): readonly ProviderComplianceChoiceAssessmentEntry[] {\n  return Object.entries(params.choices)\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([providerRef, choice]) => {\n      const established = establishedProviderComplianceProfile(params.profilesByProviderRef[providerRef]);\n      return {\n        providerRef,\n        choice,\n        assessment: assessProviderComplianceChoice(choice, params.profilesByProviderRef[providerRef]),\n        offered: established === null ? null : { deploymentModels: established.deploymentModels, processingRegions: established.processingRegions },\n      };\n    });\n}\n\n/**\n * Regions an application asserts that the provider does not declare.\n *\n * Reported, never refused — a vendor opening a data centre must not become a build failure, and an\n * operator who genuinely knows better than a stale framework list should be able to say so. What the\n * framework owes is that the divergence is VISIBLE, which is the same trade the personal-data\n * declaration report makes.\n *\n * The {@link ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED} slice of {@link assessProviderComplianceChoices};\n * an UNDETERMINED profile or none is a different gap and is not reported here.\n */\nexport function appAssertedProcessingRegions(params: {\n  readonly choices: ApplicationProviderComplianceChoices;\n  readonly profilesByProviderRef: Readonly<Record<string, ProviderComplianceProfile>>;\n}): ReadonlyArray<{ readonly providerRef: string; readonly region: string }> {\n  return assessProviderComplianceChoices(params)\n    .filter((entry) => entry.assessment === ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED && entry.choice.processingRegion !== undefined)\n    .map((entry) => ({ providerRef: entry.providerRef, region: entry.choice.processingRegion! }));\n}\n/** @wildo_source:part:end saas.models.providers.compliance-choice */\n\n/**\n * One provider a FRONTEND service serves, beside the compliance profile its facet module declares.\n *\n * `complianceProfile: null` is an answer, not an omission: the module's author stated nothing, so\n * whether that browser vendor is a third-party recipient is NOT ESTABLISHED. A reader must report\n * it; skipping it would make the least-documented browser vendor the one a notice never names.\n */\nexport interface ServedFrontendProviderCompliance {\n  /** The frontend service declaration key (`app`, `website`, `docs`, …) the provider is served on. */\n  readonly serviceKey: string;\n  /** The provider ref as the application selects it under that service's provider scope. */\n  readonly providerRef: string;\n  readonly complianceProfile: ProviderComplianceProfile | null;\n}\n\n/**\n * Every provider the application's frontend services SERVE, with the profile its facet declares\n * (#1743) — the browser half of a recipient population.\n *\n * ## The join point\n *\n * The input is `frontendProviderBootstraps` from the application's generated frontend-services\n * runtime artifact (`.wildo-saas/generated/providers/frontend-services.runtime-providers.generated.json`,\n * written by `wildo config sync`), i.e. a `Record<serviceKey, { providers: Record<ref, entry> }>`.\n * Each entry is a `FrontendProviderEntry`, and since #1743 it carries the facet module's\n * `complianceProfile`. That record is the right population on its own: materialized per service,\n * for exactly the providers the service is configured to serve, and readable as JSON without\n * loading a provider package.\n *\n * Typed STRUCTURALLY rather than as `FrontendProvidersBlock`, so this module does not import the\n * frontend-entry module that imports it, and so a caller holding raw parsed JSON can pass it.\n *\n * ## What it does NOT decide\n *\n * Whether a browser vendor is the operator's sub-processor or the person's own vendor. A browser SDK\n * the application keys with its OWN public key (an error-monitoring DSN, an analytics project key, a\n * captcha site key, a search app id) is engaged by the operator; a file picker opening a person's own\n * Drive under THEIR vendor account is not. That classification belongs to the recipient population\n * (#1707), which reads this list rather than re-walking the artifact.\n *\n * The same ref served on two services appears twice, deliberately — a per-service record is what\n * lets a reader say WHICH surface loads the vendor, and the two facets of one vendor may declare\n * different profiles. Sorted by service, then provider, so the output is deterministic.\n */\nexport function listServedFrontendProviderCompliance(\n  bootstraps:\n    | Readonly<Record<string, { readonly providers?: Readonly<Record<string, { readonly complianceProfile?: ProviderComplianceProfile }>> }>>\n    | undefined,\n): readonly ServedFrontendProviderCompliance[] {\n  const served: ServedFrontendProviderCompliance[] = [];\n  for (const [serviceKey, block] of Object.entries(bootstraps ?? {})) {\n    for (const [providerRef, entry] of Object.entries(block?.providers ?? {})) {\n      served.push({ serviceKey, providerRef, complianceProfile: entry?.complianceProfile ?? null });\n    }\n  }\n  return served.sort((left, right) =>\n    left.serviceKey.localeCompare(right.serviceKey) || left.providerRef.localeCompare(right.providerRef));\n}\n\n/**\n * The configured providers that are THIRD-PARTY RECIPIENTS — vendor-hosted, and therefore processors.\n *\n * A self-hosted provider is excluded by construction rather than by a filter a caller must remember:\n * no data leaves the operator, so it is not a recipient and must never be enumerated as one.\n */\nexport function vendorHostedProviderRefs(choices: ApplicationProviderComplianceChoices): readonly string[] {\n  return Object.entries(choices)\n    .filter(([, choice]) => choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED)\n    .map(([providerRef]) => providerRef)\n    .sort();\n}\n"]}

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.d.ts

@@ -8,8 +8,12 @@
  * facet module types that declare a component — which reads as the right place
  * until you follow what depends on what:
  *
- *   - a component lives in its own package (`@wildo-ai/providers-frontend-<vendor>`,
- *     issue #394) because it carries React, which the connectors package must not;
+ *   - a component lives outside the connectors package because it carries React,
+ *     which the connectors package must not: in the engine's facet library
+ *     (`presets-components`), or in a provider's own frontend facet package
+ *     (`<scope>/provider-<ref>-frontend`, a registry provider's `frontend/`
+ *     facet as an install leaves it — #2019; until then the archived catalogue
+ *     carried hand-authored facets under a per-vendor subpath, #1700);
  *   - that package needs this contract to type its component;
  *   - the connectors package needs to RESOLVE that package, because it reaches the
  *     component by a bare dynamic import.

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-component-contract.shared.types.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IACA,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,gBAAgB,CAAC;IAClE,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GACC;IACA,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,qBAAqB,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACC;IACA,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,oBAAoB,CAAC;IACtE,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,qBAAqB,EAAE,GAAG,IAAI,CAAC;IAC7D,sDAAsD;IACtD,QAAQ,IAAI,IAAI,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC7B"}
+{"version":3,"file":"provider-frontend-component-contract.shared.types.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IACA,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,gBAAgB,CAAC;IAClE,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GACC;IACA,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,qBAAqB,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACC;IACA,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,oBAAoB,CAAC;IACtE,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,qBAAqB,EAAE,GAAG,IAAI,CAAC;IAC7D,sDAAsD;IACtD,QAAQ,IAAI,IAAI,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC7B"}

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.js

@@ -8,8 +8,12 @@
  * facet module types that declare a component — which reads as the right place
  * until you follow what depends on what:
  *
- *   - a component lives in its own package (`@wildo-ai/providers-frontend-<vendor>`,
- *     issue #394) because it carries React, which the connectors package must not;
+ *   - a component lives outside the connectors package because it carries React,
+ *     which the connectors package must not: in the engine's facet library
+ *     (`presets-components`), or in a provider's own frontend facet package
+ *     (`<scope>/provider-<ref>-frontend`, a registry provider's `frontend/`
+ *     facet as an install leaves it — #2019; until then the archived catalogue
+ *     carried hand-authored facets under a per-vendor subpath, #1700);
  *   - that package needs this contract to type its component;
  *   - the connectors package needs to RESOLVE that package, because it reaches the
  *     component by a bare dynamic import.

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-component-contract.shared.types.js","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG","sourcesContent":["/**\n * The contract between a provider's frontend COMPONENT and the framework surface\n * that mounts it.\n *\n * ## Why it lives here and not beside the module types it serves\n *\n * These types were written in `@wildo-ai/external-connectors-public`, next to the\n * facet module types that declare a component — which reads as the right place\n * until you follow what depends on what:\n *\n *   - a component lives in its own package (`@wildo-ai/providers-frontend-<vendor>`,\n *     issue #394) because it carries React, which the connectors package must not;\n *   - that package needs this contract to type its component;\n *   - the connectors package needs to RESOLVE that package, because it reaches the\n *     component by a bare dynamic import.\n *\n * With the contract in the connectors package that is a cycle *through emitted\n * declarations*: the component package's `.d.ts` references the connectors\n * package's `.d.ts`, which makes the connectors package's own `dist` an INPUT of\n * its own build. Measured, not predicted — `tsc` refuses with `TS5055 Cannot\n * write file … because it would overwrite input file`, once per emitted\n * declaration.\n *\n * So the contract belongs BELOW both, and `saas-models` is where \"below both\"\n * already is.\n *\n * ## Why function-valued types are allowed in this package\n *\n * The sibling `provider-frontend-surface.shared.schemas.ts` states that\n * everything in it is the DATA half, and that nothing function-valued may join\n * it. That rule is about VALUES crossing a JSON channel — a projected `activate`\n * would be dropped by `JSON.stringify` with no error anywhere. A TYPE crosses\n * nothing. `onSelect` here is a compile-time obligation on two parties, and it\n * never appears in a wire record.\n *\n * `File` is a DOM type, which this package already uses\n * (`files.shared.utils.ts`), so nothing new is required of its lib.\n */\n\nimport type { ProviderFrontendSelectionDelivery } from './provider-frontend-surface.shared.schemas';\n\n/**\n * What a provider's file picker hands back for ONE chosen file.\n *\n * The three arms are the three answers to issue #383, and the union exists\n * because the decision was **per vendor**: a picker for a credentialed vendor and\n * a picker for a vendor with a browser-safe public token genuinely cannot return\n * the same thing, and both must ship.\n *\n * `kind` is not a runtime choice. Each arm corresponds to exactly one\n * `ProviderFrontendSelectionDelivery`, the provider DECLARES which one it emits,\n * and the framework refuses a selection whose `kind` contradicts that\n * declaration. Without the refusal the union would be the hedge the decision\n * rejected — a contract that says \"one of these three, we will find out at\n * runtime\" is not one an application's file field can be written against.\n */\nexport type ProviderFileSelection =\n  | {\n    /** @see ProviderFrontendSelectionDelivery.REMOTE_REFERENCE */\n    readonly kind: ProviderFrontendSelectionDelivery.REMOTE_REFERENCE;\n    /** Opaque to everything in the browser. Only the application backend can resolve it. */\n    readonly externalId: string;\n    /** What to show the user before the backend has resolved anything. */\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE;\n    readonly file: File;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL;\n    /** Fetchable by the browser. Its origin must be admitted by the surface's composed CSP. */\n    readonly url: string;\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  };\n\n/**\n * The constraints a framework file field imposes on a picker.\n *\n * Resolved by the framework — schema metadata first, then the provider's own\n * `publicConfig` through the capability's named schema — so a picker never\n * re-reads either. `maxSize` is BYTES; a provider stating megabytes in its public\n * config (`maxFileSizeMb`) is converted before it reaches here.\n *\n * ## Why the field names are these and not clearer ones\n *\n * They are the framework file field's OWN names:\n * `resolveFormFieldFileProviderConstraints` in `@wildo-ai/saas-frontend-lib`\n * produces exactly this shape and its `ResolvedFormFieldFileProviderConstraints`\n * is an alias of this type, so there is one source rather than two spellings of\n * one contract.\n *\n * That is not tidiness. The first draft called the size cap `maxSizeBytes` while\n * the resolver called it `maxSize` — both BYTES, both optional — and TypeScript\n * accepts the assignment: the weak-type check is satisfied by the two names that\n * DO match, so wiring the resolver into a picker would have compiled and silently\n * dropped the size cap. A picker would then accept files the field rejects, and\n * the user finds out after choosing one.\n */\nexport interface ProviderFilePickerConstraints {\n  /**\n   * A MUTABLE array, deliberately: `@wildo-ai/zod-decorators`' MIME helpers\n   * (`isMimeTypeAllowed`, `buildAcceptAttribute`) take `string[]`, and this\n   * type's whole reason for existing is to BE the framework file field's own\n   * shape rather than a second one. A `readonly string[]` here would be a better\n   * type in isolation and would force a cast at every one of those call sites,\n   * which is how the drift this type prevents starts again.\n   */\n  allowedMimeTypes?: string[];\n  /** BYTES, not megabytes. */\n  maxSize?: number;\n  maxFiles?: number;\n}\n\n/**\n * The props every `FRONTEND_FILE_PICKER` component receives.\n *\n * `onSelect` takes an ARRAY even for a single-file field. A picker that supports\n * multi-select otherwise needs a second callback or a hidden convention, and a\n * field that allows one file can reject a second selection with a message instead\n * of silently keeping whichever arrived first — which is what a single-value\n * callback forces it to do.\n */\nexport interface ProviderFilePickerProps {\n  /** The provider's own `ref`, so a picker can label what it renders without being told twice. */\n  readonly providerRef: string;\n  /**\n   * The provider's public configuration, already validated against the module's\n   * `publicConfigSchema` when it declares one. A picker never re-coerces it.\n   */\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n  readonly constraints: ProviderFilePickerConstraints;\n  /**\n   * An access token for THIS provider, on behalf of the current user, when the\n   * application has one.\n   *\n   * Optional, and its absence is a real state rather than a defect: a picker that\n   * authenticates through its own vendor popup (OneDrive's does) needs nothing\n   * here, and an application that has not connected a user's account to this\n   * provider has nothing to give. A picker that does need one must call this and\n   * report through `onError` when it is absent — never fall back to a token from\n   * `publicConfig`, which is served to every browser.\n   *\n   * Supplying it is the account-connection surface's job (issue #333), which does\n   * not exist yet; until it does, the framework passes nothing and a picker that\n   * requires a token says so. The prop is declared now so that the dependency is\n   * VISIBLE in the contract rather than discovered by whoever writes the second\n   * picker.\n   */\n  getAccessToken?(): Promise<string | undefined>;\n  /**\n   * Called with everything the user chose. May be called once with several files;\n   * must not be called after `onCancel`.\n   */\n  onSelect(selections: readonly ProviderFileSelection[]): void;\n  /** The user dismissed the picker without choosing. */\n  onCancel(): void;\n  /**\n   * The picker could not run — the vendor SDK failed to load, a grant was\n   * refused, the vendor returned an error. Reported rather than thrown: a throw\n   * inside a picker's own event handler does not reach a React error boundary, so\n   * it would be a surface that silently stops responding.\n   */\n  onError(error: Error): void;\n}\n"]}
+{"version":3,"file":"provider-frontend-component-contract.shared.types.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG","sourcesContent":["/**\n * The contract between a provider's frontend COMPONENT and the framework surface\n * that mounts it.\n *\n * ## Why it lives here and not beside the module types it serves\n *\n * These types were written in `@wildo-ai/external-connectors-public`, next to the\n * facet module types that declare a component — which reads as the right place\n * until you follow what depends on what:\n *\n *   - a component lives outside the connectors package because it carries React,\n *     which the connectors package must not: in the engine's facet library\n *     (`presets-components`), or in a provider's own frontend facet package\n *     (`<scope>/provider-<ref>-frontend`, a registry provider's `frontend/`\n *     facet as an install leaves it — #2019; until then the archived catalogue\n *     carried hand-authored facets under a per-vendor subpath, #1700);\n *   - that package needs this contract to type its component;\n *   - the connectors package needs to RESOLVE that package, because it reaches the\n *     component by a bare dynamic import.\n *\n * With the contract in the connectors package that is a cycle *through emitted\n * declarations*: the component package's `.d.ts` references the connectors\n * package's `.d.ts`, which makes the connectors package's own `dist` an INPUT of\n * its own build. Measured, not predicted — `tsc` refuses with `TS5055 Cannot\n * write file … because it would overwrite input file`, once per emitted\n * declaration.\n *\n * So the contract belongs BELOW both, and `saas-models` is where \"below both\"\n * already is.\n *\n * ## Why function-valued types are allowed in this package\n *\n * The sibling `provider-frontend-surface.shared.schemas.ts` states that\n * everything in it is the DATA half, and that nothing function-valued may join\n * it. That rule is about VALUES crossing a JSON channel — a projected `activate`\n * would be dropped by `JSON.stringify` with no error anywhere. A TYPE crosses\n * nothing. `onSelect` here is a compile-time obligation on two parties, and it\n * never appears in a wire record.\n *\n * `File` is a DOM type, which this package already uses\n * (`files.shared.utils.ts`), so nothing new is required of its lib.\n */\n\nimport type { ProviderFrontendSelectionDelivery } from './provider-frontend-surface.shared.schemas';\n\n/**\n * What a provider's file picker hands back for ONE chosen file.\n *\n * The three arms are the three answers to issue #383, and the union exists\n * because the decision was **per vendor**: a picker for a credentialed vendor and\n * a picker for a vendor with a browser-safe public token genuinely cannot return\n * the same thing, and both must ship.\n *\n * `kind` is not a runtime choice. Each arm corresponds to exactly one\n * `ProviderFrontendSelectionDelivery`, the provider DECLARES which one it emits,\n * and the framework refuses a selection whose `kind` contradicts that\n * declaration. Without the refusal the union would be the hedge the decision\n * rejected — a contract that says \"one of these three, we will find out at\n * runtime\" is not one an application's file field can be written against.\n */\nexport type ProviderFileSelection =\n  | {\n    /** @see ProviderFrontendSelectionDelivery.REMOTE_REFERENCE */\n    readonly kind: ProviderFrontendSelectionDelivery.REMOTE_REFERENCE;\n    /** Opaque to everything in the browser. Only the application backend can resolve it. */\n    readonly externalId: string;\n    /** What to show the user before the backend has resolved anything. */\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE;\n    readonly file: File;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL;\n    /** Fetchable by the browser. Its origin must be admitted by the surface's composed CSP. */\n    readonly url: string;\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  };\n\n/**\n * The constraints a framework file field imposes on a picker.\n *\n * Resolved by the framework — schema metadata first, then the provider's own\n * `publicConfig` through the capability's named schema — so a picker never\n * re-reads either. `maxSize` is BYTES; a provider stating megabytes in its public\n * config (`maxFileSizeMb`) is converted before it reaches here.\n *\n * ## Why the field names are these and not clearer ones\n *\n * They are the framework file field's OWN names:\n * `resolveFormFieldFileProviderConstraints` in `@wildo-ai/saas-frontend-lib`\n * produces exactly this shape and its `ResolvedFormFieldFileProviderConstraints`\n * is an alias of this type, so there is one source rather than two spellings of\n * one contract.\n *\n * That is not tidiness. The first draft called the size cap `maxSizeBytes` while\n * the resolver called it `maxSize` — both BYTES, both optional — and TypeScript\n * accepts the assignment: the weak-type check is satisfied by the two names that\n * DO match, so wiring the resolver into a picker would have compiled and silently\n * dropped the size cap. A picker would then accept files the field rejects, and\n * the user finds out after choosing one.\n */\nexport interface ProviderFilePickerConstraints {\n  /**\n   * A MUTABLE array, deliberately: `@wildo-ai/zod-decorators`' MIME helpers\n   * (`isMimeTypeAllowed`, `buildAcceptAttribute`) take `string[]`, and this\n   * type's whole reason for existing is to BE the framework file field's own\n   * shape rather than a second one. A `readonly string[]` here would be a better\n   * type in isolation and would force a cast at every one of those call sites,\n   * which is how the drift this type prevents starts again.\n   */\n  allowedMimeTypes?: string[];\n  /** BYTES, not megabytes. */\n  maxSize?: number;\n  maxFiles?: number;\n}\n\n/**\n * The props every `FRONTEND_FILE_PICKER` component receives.\n *\n * `onSelect` takes an ARRAY even for a single-file field. A picker that supports\n * multi-select otherwise needs a second callback or a hidden convention, and a\n * field that allows one file can reject a second selection with a message instead\n * of silently keeping whichever arrived first — which is what a single-value\n * callback forces it to do.\n */\nexport interface ProviderFilePickerProps {\n  /** The provider's own `ref`, so a picker can label what it renders without being told twice. */\n  readonly providerRef: string;\n  /**\n   * The provider's public configuration, already validated against the module's\n   * `publicConfigSchema` when it declares one. A picker never re-coerces it.\n   */\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n  readonly constraints: ProviderFilePickerConstraints;\n  /**\n   * An access token for THIS provider, on behalf of the current user, when the\n   * application has one.\n   *\n   * Optional, and its absence is a real state rather than a defect: a picker that\n   * authenticates through its own vendor popup (OneDrive's does) needs nothing\n   * here, and an application that has not connected a user's account to this\n   * provider has nothing to give. A picker that does need one must call this and\n   * report through `onError` when it is absent — never fall back to a token from\n   * `publicConfig`, which is served to every browser.\n   *\n   * Supplying it is the account-connection surface's job (issue #333), which does\n   * not exist yet; until it does, the framework passes nothing and a picker that\n   * requires a token says so. The prop is declared now so that the dependency is\n   * VISIBLE in the contract rather than discovered by whoever writes the second\n   * picker.\n   */\n  getAccessToken?(): Promise<string | undefined>;\n  /**\n   * Called with everything the user chose. May be called once with several files;\n   * must not be called after `onCancel`.\n   */\n  onSelect(selections: readonly ProviderFileSelection[]): void;\n  /** The user dismissed the picker without choosing. */\n  onCancel(): void;\n  /**\n   * The picker could not run — the vendor SDK failed to load, a grant was\n   * refused, the vendor returned an error. Reported rather than thrown: a throw\n   * inside a picker's own event handler does not reach a React error boundary, so\n   * it would be a surface that silently stops responding.\n   */\n  onError(error: Error): void;\n}\n"]}