@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.d.ts

@@ -77,8 +77,26 @@ export declare enum ProviderFrontendCspOriginBucket {
     FRAME = "frameOrigins",
     IMG = "imgOrigins",
     STYLE = "styleOrigins",
-    FONT = "fontOrigins"
+    FONT = "fontOrigins",
+    /**
+     * Origins a provider starts a Web Worker, Shared Worker or service worker from (`worker-src`) — a map
+     * SDK's tile decoder, a session-replay compressor. Frequently `blob:`, which a provider may name here
+     * as a scheme source (#1702).
+     */
+    WORKER = "workerOrigins",
+    /** Origins a provider plays audio or video from (`media-src`) — an embed with sound, a video player (#1702). */
+    MEDIA = "mediaOrigins"
 }
+/**
+ * Every bucket, in declaration order — the ONE list a consumer iterates when it has to visit each
+ * bucket of a footprint (the hydration staleness join, the CLI's derived-origin resolution).
+ *
+ * Derived from the enum rather than written out, because a hand-kept list of buckets is how a new one
+ * gets authored, serialized and then silently dropped by the one consumer that did not learn about it:
+ * the CLI's derived-origin resolver re-listed the six buckets by hand until #1702, so a seventh would
+ * have been erased there for any provider that also derives an origin.
+ */
+export declare const PROVIDER_FRONTEND_CSP_ORIGIN_BUCKETS: readonly ProviderFrontendCspOriginBucket[];
 /**
  * An origin the framework must READ OUT OF the provider's own public config,
  * because the provider cannot know it.
@@ -117,6 +135,10 @@ export declare const ProviderFrontendCspFootprintSchema: z.ZodObject<{
     styleOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
     /** Origins the provider loads web fonts from (`font-src`). */
     fontOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    /** Origins the provider starts workers from (`worker-src`), `blob:` included. See `ProviderFrontendCspOriginBucket.WORKER`. */
+    workerOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    /** Origins the provider plays audio or video from (`media-src`). */
+    mediaOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
     /**
      * Origins the framework reads out of this provider's own `publicConfig`,
      * for the endpoints a provider cannot know in advance. See
@@ -295,6 +317,93 @@ export declare enum ProviderFrontendSelectionDelivery {
      */
     BROWSER_READABLE_URL = "BROWSER_READABLE_URL"
 }
+/**
+ * Whether an address-lookup component hands back the VENDOR'S identifier for the place it matched (#1702,
+ * narrowed by #561 D3).
+ *
+ * ## Why this is DECLARED, per component
+ *
+ * The structured address a lookup returns is the application's own data: the person typed it, the
+ * vendor only helped spell it. The vendor's place identifier is different — it is the vendor's key, and
+ * vendors disagree on whether it may be kept (Google allows it indefinitely, Mapbox does not promise it is
+ * stable, Loqate's public documentation says nothing). So a component declares once, statically, whether
+ * it returns one, and the framework holds every selection to it — the #383 rule for `selectionDelivery`,
+ * applied here. A runtime flag on each selection was the rejected alternative: it would let the component
+ * decide per selection, which is not a decision a component can own.
+ *
+ * ## Why there is no "storable" member (#561 D3)
+ *
+ * The framework NEVER stores a vendor place id, whatever the vendor allows. It travels only inside one
+ * lookup session, from the suggestion to the retrieval, and what is saved is the address the person
+ * confirmed. A `STORABLE` member existed from #1702 until #561 and nothing read it: a declaration that
+ * permits storage while nothing can store is a claim nothing checks, and a later reader would take it as a
+ * licence. Rejected with it: a `placeRef` slot on `AddressValue`, which would mix vendor data into
+ * application data under a retention that differs per vendor.
+ *
+ * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — "Place ID
+ * caching exception": the place ID "is exempt from the caching restrictions". Fetched 2026-09-29. The Mapbox
+ * and Loqate readings are #561's 2026-09-14 research, summarised rather than quoted.
+ */
+export declare enum ProviderAddressLookupPlaceIdRetention {
+    /** The component returns no place id. A selection carrying one contradicts the declaration and is refused. */
+    NONE = "NONE",
+    /**
+     * A place id may be returned for the current interaction (re-querying the vendor for the same place),
+     * and is never stored: the field keeps only the address.
+     */
+    TRANSIENT = "TRANSIENT"
+}
+/** @wildo_source:part:start saas.models.provider-address-lookup-declaration facet:layer:shared facet:family:provider facet:audience:app-developer */
+/**
+ * How a `FRONTEND_ADDRESS_LOOKUP` component reaches its vendor, and what the vendor's terms require of the
+ * page (#561) — the DATA half a reviewer reads, and the half the framework's host ENFORCES.
+ *
+ * ## Why the lookup names backend OPERATIONS rather than a vendor URL (#561 D2)
+ *
+ * The vendor is never called from the page. Each suggestion and the final retrieval run through the
+ * application backend's provider-operation door (`POST /provider-operations/:providerRef/:operationId`),
+ * which spends the application's own credential, admits the operation by `providers.browserOperations`,
+ * throttles each caller, and records a `PROVIDER_OPERATION_CALL` row that carries no typed input. So the
+ * page holds no vendor key and needs no vendor origin in its CSP, and every vendor is reached one way.
+ * Google recommends exactly this for its web services: "Using a secure proxy server provides a solid source
+ * for interacting with a Google Maps Platform web service endpoint from a client-side application without
+ * exposing your API key".
+ * spec-cite: https://developers.google.com/maps/api-security-best-practices — "Proxy server", fetched 2026-09-29.
+ *
+ * The host hands the component two functions, `suggest` and `retrieve`, bound to the two operation ids
+ * declared here, so a reviewer reading the manifest sees which backend operations the application must open to
+ * browsers. What BOUNDS a component is the door, not this declaration: a component is code and could call the
+ * browser door itself, and the door runs only the operations the application listed in `providers.browserOperations`.
+ *
+ * ## Why the session token and the attribution are declared rather than left to the component (#561 D4)
+ *
+ * Both are vendor TERMS, and a term a component may forget is not held. The host generates one UUIDv4 per
+ * lookup session and writes it into the input field named by `sessionTokenInput` on every suggestion and on
+ * the retrieval, then starts a new session after a retrieval or when the lookup is abandoned — the vendor
+ * bills per session, and a missing or reused token bills every keystroke. The host renders
+ * `attributionMark` beside the lookup whenever it is mounted.
+ */
+export declare const ProviderAddressLookupDeclarationSchema: z.ZodObject<{
+    /** The backend operation of the SAME provider ref that turns typed text into suggestions. */
+    suggestOperationId: z.ZodString;
+    /** The backend operation of the same ref that turns one chosen suggestion into a structured address. */
+    retrieveOperationId: z.ZodString;
+    /**
+     * The operation INPUT field the vendor reads its session token from, when the vendor bills by session.
+     * Absent: the vendor takes none, and the host sends none.
+     */
+    sessionTokenInput: z.ZodOptional<z.ZodString>;
+    /**
+     * The attribution the vendor requires beside its suggestions, VERBATIM — a trademark, never translated
+     * (Google: "the text Google Maps is acceptable" where its logo does not fit). The host renders it inside a
+     * sentence from the application's own labels.
+     * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — attribution without a
+     * Google map, fetched 2026-09-29.
+     */
+    attributionMark: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ProviderAddressLookupDeclaration = z.infer<typeof ProviderAddressLookupDeclarationSchema>;
+/** @wildo_source:part:end saas.models.provider-address-lookup-declaration */
 /**
  * The DATA half of one component a provider contributes — everything about it
  * that a reviewer, the CLI or a build step can read without running a browser.
@@ -315,16 +424,50 @@ export declare const ProviderFrontendComponentDescriptorSchema: z.ZodObject<{
      * back a token, and there is no delivery question to answer about a string.
      */
     selectionDelivery: z.ZodOptional<z.ZodEnum<typeof ProviderFrontendSelectionDelivery>>;
+    /**
+     * For a `FRONTEND_ADDRESS_LOOKUP` component: whether it hands back the vendor's own identifier for
+     * the place it matched (#1702). It is never stored either way (#561 D3). See
+     * {@link ProviderAddressLookupPlaceIdRetention}. Absent means the component returns no place id — the
+     * safe reading, since the vendor identifier is the one part of a lookup vendor terms restrict.
+     */
+    placeIdRetention: z.ZodOptional<z.ZodEnum<typeof ProviderAddressLookupPlaceIdRetention>>;
+    /**
+     * For a `FRONTEND_ADDRESS_LOOKUP` component: the backend operations it runs through the provider-operation
+     * door, and the vendor terms the host enforces (#561). See {@link ProviderAddressLookupDeclarationSchema}.
+     * Absent on an address lookup, the framework's host does not offer it: a lookup with no declared
+     * operations has no way to reach its vendor that the framework admits.
+     */
+    addressLookup: z.ZodOptional<z.ZodObject<{
+        /** The backend operation of the SAME provider ref that turns typed text into suggestions. */
+        suggestOperationId: z.ZodString;
+        /** The backend operation of the same ref that turns one chosen suggestion into a structured address. */
+        retrieveOperationId: z.ZodString;
+        /**
+         * The operation INPUT field the vendor reads its session token from, when the vendor bills by session.
+         * Absent: the vendor takes none, and the host sends none.
+         */
+        sessionTokenInput: z.ZodOptional<z.ZodString>;
+        /**
+         * The attribution the vendor requires beside its suggestions, VERBATIM — a trademark, never translated
+         * (Google: "the text Google Maps is acceptable" where its logo does not fit). The host renders it inside a
+         * sentence from the application's own labels.
+         * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — attribution without a
+         * Google map, fetched 2026-09-29.
+         */
+        attributionMark: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFrontendComponentDescriptorSchema>;
 /**
  * A provider's component descriptors, keyed by the CAPABILITY each fills.
  *
- * The key is a capability token rather than a member of a closed enum because
- * `ProviderCapability` is OPEN — an application extends it by module
- * augmentation — so a `z.enum` here would refuse an application's own
- * capability. The registry that consumes this makes the same choice for the same
- * reason.
+ * The key is validated as a non-empty string, not as a `ProviderCapability`
+ * member. The reason this gave until 2026-09-12 — that `ProviderCapability` is
+ * OPEN through module augmentation, so a `z.enum` would refuse an application's
+ * own capability — stopped being true with #502: the vocabulary is the closed
+ * built-in set. A member-checked key is now possible and has NOT been adopted;
+ * until it is, an unknown capability key parses here and simply never matches a
+ * surface that asks for a real one.
  */
 export declare const ProviderFrontendComponentDescriptorsSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     /**
@@ -333,6 +476,38 @@ export declare const ProviderFrontendComponentDescriptorsSchema: z.ZodRecord<z.Z
      * back a token, and there is no delivery question to answer about a string.
      */
     selectionDelivery: z.ZodOptional<z.ZodEnum<typeof ProviderFrontendSelectionDelivery>>;
+    /**
+     * For a `FRONTEND_ADDRESS_LOOKUP` component: whether it hands back the vendor's own identifier for
+     * the place it matched (#1702). It is never stored either way (#561 D3). See
+     * {@link ProviderAddressLookupPlaceIdRetention}. Absent means the component returns no place id — the
+     * safe reading, since the vendor identifier is the one part of a lookup vendor terms restrict.
+     */
+    placeIdRetention: z.ZodOptional<z.ZodEnum<typeof ProviderAddressLookupPlaceIdRetention>>;
+    /**
+     * For a `FRONTEND_ADDRESS_LOOKUP` component: the backend operations it runs through the provider-operation
+     * door, and the vendor terms the host enforces (#561). See {@link ProviderAddressLookupDeclarationSchema}.
+     * Absent on an address lookup, the framework's host does not offer it: a lookup with no declared
+     * operations has no way to reach its vendor that the framework admits.
+     */
+    addressLookup: z.ZodOptional<z.ZodObject<{
+        /** The backend operation of the SAME provider ref that turns typed text into suggestions. */
+        suggestOperationId: z.ZodString;
+        /** The backend operation of the same ref that turns one chosen suggestion into a structured address. */
+        retrieveOperationId: z.ZodString;
+        /**
+         * The operation INPUT field the vendor reads its session token from, when the vendor bills by session.
+         * Absent: the vendor takes none, and the host sends none.
+         */
+        sessionTokenInput: z.ZodOptional<z.ZodString>;
+        /**
+         * The attribution the vendor requires beside its suggestions, VERBATIM — a trademark, never translated
+         * (Google: "the text Google Maps is acceptable" where its logo does not fit). The host renders it inside a
+         * sentence from the application's own labels.
+         * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — attribution without a
+         * Google map, fetched 2026-09-29.
+         */
+        attributionMark: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strict>>;
 export type ProviderFrontendComponentDescriptors = z.infer<typeof ProviderFrontendComponentDescriptorsSchema>;
 //# sourceMappingURL=provider-frontend-surface.shared.schemas.d.ts.map

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-surface.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,MAAM,kBAAkB;IACxB,OAAO,mBAAmB;IAC1B,KAAK,iBAAiB;IACtB,GAAG,eAAe;IAClB,KAAK,iBAAiB;IACtB,IAAI,gBAAgB;CACrB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC;IACjD,kEAAkE;;;kBAGlE,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,kCAAkC;IAC7C,uEAAuE;;IAEvE,gGAAgG;;IAEhG,gGAAgG;;IAEhG,oEAAoE;;IAEpE,iEAAiE;;IAEjE,8DAA8D;;IAE9D;;;;OAIG;;QAvBH,kEAAkE;;;;kBAyBlE,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAEzG;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,uCAAuC,GACnD,4BAA4B,CAE9B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mCAAmC;IAC9C,kEAAkE;;IAElE;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,oBAAY,iCAAiC;IAC3C,gIAAgI;IAChI,SAAS,cAAc;IACvB,kHAAkH;IAClH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uCAAuC;IAEhD,sFAAsF;;IAEtF,mDAAmD;;;;;kBAgBnD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,gBAAgB,qBAAqB;IACrC;;;;;;OAMG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G;;;;;;;;GAQG;AACH,eAAO,MAAM,0CAA0C;IAlBrD;;;;OAIG;;mBAiBJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}
+{"version":3,"file":"provider-frontend-surface.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,MAAM,kBAAkB;IACxB,OAAO,mBAAmB;IAC1B,KAAK,iBAAiB;IACtB,GAAG,eAAe;IAClB,KAAK,iBAAiB;IACtB,IAAI,gBAAgB;IACpB;;;;OAIG;IACH,MAAM,kBAAkB;IACxB,gHAAgH;IAChH,KAAK,iBAAiB;CACvB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,EAAE,SAAS,+BAA+B,EAE1F,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC;IACjD,kEAAkE;;;kBAGlE,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,kCAAkC;IAC7C,uEAAuE;;IAEvE,gGAAgG;;IAEhG,gGAAgG;;IAEhG,oEAAoE;;IAEpE,iEAAiE;;IAEjE,8DAA8D;;IAE9D,+HAA+H;;IAE/H,oEAAoE;;IAEpE;;;;OAIG;;QA3BH,kEAAkE;;;;kBA6BlE,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAEzG;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,uCAAuC,GACnD,4BAA4B,CAE9B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mCAAmC;IAC9C,kEAAkE;;IAElE;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,oBAAY,iCAAiC;IAC3C,gIAAgI;IAChI,SAAS,cAAc;IACvB,kHAAkH;IAClH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uCAAuC;IAEhD,sFAAsF;;IAEtF,mDAAmD;;;;;kBAgBnD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,gBAAgB,qBAAqB;IACrC;;;;;;OAMG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,oBAAY,qCAAqC;IAC/C,8GAA8G;IAC9G,IAAI,SAAS;IACb;;;OAGG;IACH,SAAS,cAAc;CACxB;AAED,qJAAqJ;AACrJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,sCAAsC;IACjD,6FAA6F;;IAE7F,wGAAwG;;IAExG;;;OAGG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AACtG,6EAA6E;AAE7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;OAIG;;IAEH;;;;;OAKG;;IAEH;;;;;OAKG;;QArDH,6FAA6F;;QAE7F,wGAAwG;;QAExG;;;WAGG;;QAEH;;;;;;WAMG;;;kBAwCH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0CAA0C;IAlCrD;;;;OAIG;;IAEH;;;;;OAKG;;IAEH;;;;;OAKG;;QArDH,6FAA6F;;QAE7F,wGAAwG;;QAExG;;;WAGG;;QAEH;;;;;;WAMG;;;mBAyDJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.js

@@ -79,7 +79,25 @@ export var ProviderFrontendCspOriginBucket;
     ProviderFrontendCspOriginBucket["IMG"] = "imgOrigins";
     ProviderFrontendCspOriginBucket["STYLE"] = "styleOrigins";
     ProviderFrontendCspOriginBucket["FONT"] = "fontOrigins";
+    /**
+     * Origins a provider starts a Web Worker, Shared Worker or service worker from (`worker-src`) — a map
+     * SDK's tile decoder, a session-replay compressor. Frequently `blob:`, which a provider may name here
+     * as a scheme source (#1702).
+     */
+    ProviderFrontendCspOriginBucket["WORKER"] = "workerOrigins";
+    /** Origins a provider plays audio or video from (`media-src`) — an embed with sound, a video player (#1702). */
+    ProviderFrontendCspOriginBucket["MEDIA"] = "mediaOrigins";
 })(ProviderFrontendCspOriginBucket || (ProviderFrontendCspOriginBucket = {}));
+/**
+ * Every bucket, in declaration order — the ONE list a consumer iterates when it has to visit each
+ * bucket of a footprint (the hydration staleness join, the CLI's derived-origin resolution).
+ *
+ * Derived from the enum rather than written out, because a hand-kept list of buckets is how a new one
+ * gets authored, serialized and then silently dropped by the one consumer that did not learn about it:
+ * the CLI's derived-origin resolver re-listed the six buckets by hand until #1702, so a seventh would
+ * have been erased there for any provider that also derives an origin.
+ */
+export const PROVIDER_FRONTEND_CSP_ORIGIN_BUCKETS = Object.freeze(Object.values(ProviderFrontendCspOriginBucket));
 /**
  * An origin the framework must READ OUT OF the provider's own public config,
  * because the provider cannot know it.
@@ -117,6 +135,10 @@ export const ProviderFrontendCspFootprintSchema = z.strictObject({
     styleOrigins: z.array(z.string().min(1)).default([]),
     /** Origins the provider loads web fonts from (`font-src`). */
     fontOrigins: z.array(z.string().min(1)).default([]),
+    /** Origins the provider starts workers from (`worker-src`), `blob:` included. See `ProviderFrontendCspOriginBucket.WORKER`. */
+    workerOrigins: z.array(z.string().min(1)).default([]),
+    /** Origins the provider plays audio or video from (`media-src`). */
+    mediaOrigins: z.array(z.string().min(1)).default([]),
     /**
      * Origins the framework reads out of this provider's own `publicConfig`,
      * for the endpoints a provider cannot know in advance. See
@@ -282,6 +304,93 @@ export var ProviderFrontendSelectionDelivery;
      */
     ProviderFrontendSelectionDelivery["BROWSER_READABLE_URL"] = "BROWSER_READABLE_URL";
 })(ProviderFrontendSelectionDelivery || (ProviderFrontendSelectionDelivery = {}));
+/**
+ * Whether an address-lookup component hands back the VENDOR'S identifier for the place it matched (#1702,
+ * narrowed by #561 D3).
+ *
+ * ## Why this is DECLARED, per component
+ *
+ * The structured address a lookup returns is the application's own data: the person typed it, the
+ * vendor only helped spell it. The vendor's place identifier is different — it is the vendor's key, and
+ * vendors disagree on whether it may be kept (Google allows it indefinitely, Mapbox does not promise it is
+ * stable, Loqate's public documentation says nothing). So a component declares once, statically, whether
+ * it returns one, and the framework holds every selection to it — the #383 rule for `selectionDelivery`,
+ * applied here. A runtime flag on each selection was the rejected alternative: it would let the component
+ * decide per selection, which is not a decision a component can own.
+ *
+ * ## Why there is no "storable" member (#561 D3)
+ *
+ * The framework NEVER stores a vendor place id, whatever the vendor allows. It travels only inside one
+ * lookup session, from the suggestion to the retrieval, and what is saved is the address the person
+ * confirmed. A `STORABLE` member existed from #1702 until #561 and nothing read it: a declaration that
+ * permits storage while nothing can store is a claim nothing checks, and a later reader would take it as a
+ * licence. Rejected with it: a `placeRef` slot on `AddressValue`, which would mix vendor data into
+ * application data under a retention that differs per vendor.
+ *
+ * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — "Place ID
+ * caching exception": the place ID "is exempt from the caching restrictions". Fetched 2026-09-29. The Mapbox
+ * and Loqate readings are #561's 2026-09-14 research, summarised rather than quoted.
+ */
+export var ProviderAddressLookupPlaceIdRetention;
+(function (ProviderAddressLookupPlaceIdRetention) {
+    /** The component returns no place id. A selection carrying one contradicts the declaration and is refused. */
+    ProviderAddressLookupPlaceIdRetention["NONE"] = "NONE";
+    /**
+     * A place id may be returned for the current interaction (re-querying the vendor for the same place),
+     * and is never stored: the field keeps only the address.
+     */
+    ProviderAddressLookupPlaceIdRetention["TRANSIENT"] = "TRANSIENT";
+})(ProviderAddressLookupPlaceIdRetention || (ProviderAddressLookupPlaceIdRetention = {}));
+/** @wildo_source:part:start saas.models.provider-address-lookup-declaration facet:layer:shared facet:family:provider facet:audience:app-developer */
+/**
+ * How a `FRONTEND_ADDRESS_LOOKUP` component reaches its vendor, and what the vendor's terms require of the
+ * page (#561) — the DATA half a reviewer reads, and the half the framework's host ENFORCES.
+ *
+ * ## Why the lookup names backend OPERATIONS rather than a vendor URL (#561 D2)
+ *
+ * The vendor is never called from the page. Each suggestion and the final retrieval run through the
+ * application backend's provider-operation door (`POST /provider-operations/:providerRef/:operationId`),
+ * which spends the application's own credential, admits the operation by `providers.browserOperations`,
+ * throttles each caller, and records a `PROVIDER_OPERATION_CALL` row that carries no typed input. So the
+ * page holds no vendor key and needs no vendor origin in its CSP, and every vendor is reached one way.
+ * Google recommends exactly this for its web services: "Using a secure proxy server provides a solid source
+ * for interacting with a Google Maps Platform web service endpoint from a client-side application without
+ * exposing your API key".
+ * spec-cite: https://developers.google.com/maps/api-security-best-practices — "Proxy server", fetched 2026-09-29.
+ *
+ * The host hands the component two functions, `suggest` and `retrieve`, bound to the two operation ids
+ * declared here, so a reviewer reading the manifest sees which backend operations the application must open to
+ * browsers. What BOUNDS a component is the door, not this declaration: a component is code and could call the
+ * browser door itself, and the door runs only the operations the application listed in `providers.browserOperations`.
+ *
+ * ## Why the session token and the attribution are declared rather than left to the component (#561 D4)
+ *
+ * Both are vendor TERMS, and a term a component may forget is not held. The host generates one UUIDv4 per
+ * lookup session and writes it into the input field named by `sessionTokenInput` on every suggestion and on
+ * the retrieval, then starts a new session after a retrieval or when the lookup is abandoned — the vendor
+ * bills per session, and a missing or reused token bills every keystroke. The host renders
+ * `attributionMark` beside the lookup whenever it is mounted.
+ */
+export const ProviderAddressLookupDeclarationSchema = z.strictObject({
+    /** The backend operation of the SAME provider ref that turns typed text into suggestions. */
+    suggestOperationId: z.string().trim().min(1),
+    /** The backend operation of the same ref that turns one chosen suggestion into a structured address. */
+    retrieveOperationId: z.string().trim().min(1),
+    /**
+     * The operation INPUT field the vendor reads its session token from, when the vendor bills by session.
+     * Absent: the vendor takes none, and the host sends none.
+     */
+    sessionTokenInput: z.string().trim().min(1).optional(),
+    /**
+     * The attribution the vendor requires beside its suggestions, VERBATIM — a trademark, never translated
+     * (Google: "the text Google Maps is acceptable" where its logo does not fit). The host renders it inside a
+     * sentence from the application's own labels.
+     * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — attribution without a
+     * Google map, fetched 2026-09-29.
+     */
+    attributionMark: z.string().trim().min(1).optional(),
+});
+/** @wildo_source:part:end saas.models.provider-address-lookup-declaration */
 /**
  * The DATA half of one component a provider contributes — everything about it
  * that a reviewer, the CLI or a build step can read without running a browser.
@@ -302,15 +411,31 @@ export const ProviderFrontendComponentDescriptorSchema = z.strictObject({
      * back a token, and there is no delivery question to answer about a string.
      */
     selectionDelivery: z.enum(ProviderFrontendSelectionDelivery).optional(),
+    /**
+     * For a `FRONTEND_ADDRESS_LOOKUP` component: whether it hands back the vendor's own identifier for
+     * the place it matched (#1702). It is never stored either way (#561 D3). See
+     * {@link ProviderAddressLookupPlaceIdRetention}. Absent means the component returns no place id — the
+     * safe reading, since the vendor identifier is the one part of a lookup vendor terms restrict.
+     */
+    placeIdRetention: z.enum(ProviderAddressLookupPlaceIdRetention).optional(),
+    /**
+     * For a `FRONTEND_ADDRESS_LOOKUP` component: the backend operations it runs through the provider-operation
+     * door, and the vendor terms the host enforces (#561). See {@link ProviderAddressLookupDeclarationSchema}.
+     * Absent on an address lookup, the framework's host does not offer it: a lookup with no declared
+     * operations has no way to reach its vendor that the framework admits.
+     */
+    addressLookup: ProviderAddressLookupDeclarationSchema.optional(),
 });
 /**
  * A provider's component descriptors, keyed by the CAPABILITY each fills.
  *
- * The key is a capability token rather than a member of a closed enum because
- * `ProviderCapability` is OPEN — an application extends it by module
- * augmentation — so a `z.enum` here would refuse an application's own
- * capability. The registry that consumes this makes the same choice for the same
- * reason.
+ * The key is validated as a non-empty string, not as a `ProviderCapability`
+ * member. The reason this gave until 2026-09-12 — that `ProviderCapability` is
+ * OPEN through module augmentation, so a `z.enum` would refuse an application's
+ * own capability — stopped being true with #502: the vocabulary is the closed
+ * built-in set. A member-checked key is now possible and has NOT been adopted;
+ * until it is, an unknown capability key parses here and simply never matches a
+ * surface that asks for a real one.
  */
 export const ProviderFrontendComponentDescriptorsSchema = z.record(z.string().min(1), ProviderFrontendComponentDescriptorSchema);
 /**
@@ -327,6 +452,8 @@ const _everyBucketNamesAFootprintField = {
     [ProviderFrontendCspOriginBucket.IMG]: 'imgOrigins',
     [ProviderFrontendCspOriginBucket.STYLE]: 'styleOrigins',
     [ProviderFrontendCspOriginBucket.FONT]: 'fontOrigins',
+    [ProviderFrontendCspOriginBucket.WORKER]: 'workerOrigins',
+    [ProviderFrontendCspOriginBucket.MEDIA]: 'mediaOrigins',
 };
 void _everyBucketNamesAFootprintField;
 //# sourceMappingURL=provider-frontend-surface.shared.schemas.js.map

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-surface.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,2DAAwB,CAAA;IACxB,6DAA0B,CAAA;IAC1B,yDAAsB,CAAA;IACtB,qDAAkB,CAAA;IAClB,yDAAsB,CAAA;IACtB,uDAAoB,CAAA;AACtB,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,8DAA8D;IAC9D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAyBH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAoD;IAEpD,OAAO,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,kEAAkE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,gIAAgI;IAChI,4DAAuB,CAAA;IACvB,kHAAkH;IAClH,wEAAmC,CAAA;AACrC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,mDAAmD;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACjE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mGAAmG;kBACjG,+EAA+E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,iCAuBX;AAvBD,WAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,0EAAqC,CAAA;IACrC;;;;;;OAMG;IACH,oFAA+C,CAAA;IAC/C;;;;;OAKG;IACH,kFAA6C,CAAA;AAC/C,CAAC,EAvBW,iCAAiC,KAAjC,iCAAiC,QAuB5C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,gCAAgC,GAGlC;IACF,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,gBAAgB;IAC3D,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,GAAG,CAAC,EAAE,YAAY;IACnD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,aAAa;CACtD,CAAC;AACF,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * Frontend-surface atoms a provider declares: what it needs the page to be\n * ALLOWED to reach (its CSP footprint), which vendor SDK package it loads, and\n * which third-party `<script>` tags it asks the surface to add.\n *\n * ## Why these are DATA and live here\n *\n * A frontend provider reaches its surface through TWO channels, and only one of\n * them can carry code:\n *\n *   - the **DATA** channel — `FrontendProviderEntry`, projected by the backend\n *     into `/application-config` and materialized into the generated\n *     frontend-services artifact. It is JSON end to end, so nothing\n *     function-valued survives it (it used to be cast to a module type anyway,\n *     which is the defect this split closes);\n *   - the **CODE** channel — the provider package's own facet barrel, imported\n *     by the bundle through the generated `frontend-providers.generated.ts`.\n *\n * Everything in this file is the DATA half. It is what the CLI, the CSP\n * composer and the bundle-isolation policy need to SEE without executing any\n * frontend module — and the CLI genuinely cannot execute one: it is a Node\n * process and these modules are browser-bound. The executable half (`sdk.activate`,\n * `publicConfigSchema`) lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this boundary.\n *\n * Added by slice S4a of epic #337 (issue #332).\n */\n\nimport { z } from 'zod';\n\n/**\n * The origins a provider needs the composed Content-Security-Policy to admit,\n * grouped by WHAT THE PROVIDER IS REACHING rather than by CSP directive name.\n *\n * ## Why semantic buckets and not directive names\n *\n * `CSP_DIRECTIVE_NAMES` is a closed vocabulary that already has one named\n * runtime source, in `@wildo-ai/platform-config-lib`. That package DEPENDS on\n * this one, so this file cannot reference it, and re-declaring the list here\n * would create a second source for one vocabulary — precisely what the\n * one-named-source rule exists to prevent, and the way the two copies would\n * drift the first time a directive is added.\n *\n * Keying on intent instead is also the better contract. A provider author knows\n * \"my SDK is fetched from `https://js.stripe.com` and it calls back to\n * `https://api.stripe.com`\"; which directive grades which fetch is framework\n * knowledge, and it lives in exactly one place — the bucket-to-directive\n * mapping in `platform-config-lib`'s `csp-emit.ts`.\n *\n * ## Why it is STRICT while the entry that carries it is loose\n *\n * The entry is a WIRE record read by a possibly-older consumer, so it tolerates\n * unknown keys (see `frontend-provider-entry.shared.schemas.ts`). This footprint\n * is AUTHORED, by a provider package, and validated where it is authored — so a\n * misspelled bucket must fail loudly rather than contribute nothing. That\n * distinction matters more here than anywhere else in the frontend surface:\n * CSP is enforced in production and report-only in development, so a bucket that\n * silently contributes nothing is invisible until the provider breaks in\n * production only.\n *\n * Adding a bucket is not a one-sided producer change either — a new bucket is\n * useless until `csp-emit.ts` maps it to a directive — so strictness costs no\n * version-skew tolerance that was ever available.\n *\n * Every field defaults to `[]`: a provider that declares a footprint at all is\n * making a complete statement about the buckets it did not name.\n */\n/**\n * Which bucket an origin lands in, as a value a provider can name.\n *\n * The bucket names are already the footprint's field names; this enum is what\n * lets a provider REFER to one — a derived origin has to say where it goes, and\n * a bare string there would be a second, unexplained spelling of a closed\n * vocabulary. A compile-time check below pins the two together.\n */\nexport enum ProviderFrontendCspOriginBucket {\n  SCRIPT = 'scriptOrigins',\n  CONNECT = 'connectOrigins',\n  FRAME = 'frameOrigins',\n  IMG = 'imgOrigins',\n  STYLE = 'styleOrigins',\n  FONT = 'fontOrigins',\n}\n\n/**\n * An origin the framework must READ OUT OF the provider's own public config,\n * because the provider cannot know it.\n *\n * The case that forced this: an error-monitoring provider sends to the host\n * inside its DSN, and a product-analytics provider to whatever `apiHost` the\n * application configured — including a self-hosted one. Both are per\n * APPLICATION, and often per ENVIRONMENT, so no static list on the provider\n * module can contain them. Without this the application would have to author\n * the same host twice — once as the provider's config and once in its CSP — and\n * the copy that drifts fails in production only, because development is\n * report-only.\n *\n * Resolution is data, not code: the CLI takes `publicConfig[publicConfigKey]`,\n * reads its URL origin, and adds it to `bucket`. An absent key contributes\n * nothing (the provider simply is not configured for that service); a key that\n * is present and is NOT a URL fails the sync loudly, because silently dropping\n * it is the exact failure this exists to prevent.\n */\nexport const ProviderFrontendCspDerivedOriginSchema = z.strictObject({\n  /** Key in this provider's `publicConfig` whose value is a URL. */\n  publicConfigKey: z.string().min(1),\n  bucket: z.enum(ProviderFrontendCspOriginBucket),\n});\nexport type ProviderFrontendCspDerivedOrigin = z.infer<typeof ProviderFrontendCspDerivedOriginSchema>;\n\nexport const ProviderFrontendCspFootprintSchema = z.strictObject({\n  /** Origins the surface loads executable script from (`script-src`). */\n  scriptOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider's code opens fetch / XHR / WebSocket connections to (`connect-src`). */\n  connectOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider embeds in an iframe — a picker, a checkout, a meeting (`frame-src`). */\n  frameOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads images or pixels from (`img-src`). */\n  imgOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads stylesheets from (`style-src`). */\n  styleOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads web fonts from (`font-src`). */\n  fontOrigins: z.array(z.string().min(1)).default([]),\n  /**\n   * Origins the framework reads out of this provider's own `publicConfig`,\n   * for the endpoints a provider cannot know in advance. See\n   * {@link ProviderFrontendCspDerivedOriginSchema}.\n   */\n  derivedOrigins: z.array(ProviderFrontendCspDerivedOriginSchema).default([]),\n});\nexport type ProviderFrontendCspFootprint = z.infer<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * The footprint as a provider AUTHORS it: name only the buckets you reach.\n *\n * Authoring and the wire are deliberately different shapes, and the asymmetry\n * is the point.\n *\n *   - **Authoring is partial.** A provider that only loads a script should write\n *     `{ scriptOrigins: ['https://js.acme.com'] }`, not that plus four empty\n *     arrays. Four empty arrays are noise at exactly the place the declaration\n *     should be readable, and noise is what stops a reviewer noticing the one\n *     line that grants an origin.\n *   - **The wire is total.** Every bucket is present by the time the footprint\n *     reaches an entry, so the CSP composer never branches on absence and the\n *     staleness comparison between a served footprint and its module's has two\n *     comparable shapes rather than a partial and a total that differ in every\n *     bucket nobody named.\n *\n * Derived as `z.input` rather than written as a `Partial<…>`, so it cannot drift\n * from the schema: adding a bucket makes it optional here automatically.\n */\nexport type ProviderFrontendCspFootprintDeclaration = z.input<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * Fills in the buckets a declaration did not name.\n *\n * The ONE place that normalization happens, used by the projection that builds\n * an entry and by the hydration join that compares one against a module. Two\n * copies would eventually disagree about whether an unnamed bucket is `[]` or\n * absent, and the join reads that difference as a stale artifact — a false\n * alarm on the diagnostic whose whole job is to be believed.\n */\nexport function normalizeProviderFrontendCspFootprint(\n  declaration: ProviderFrontendCspFootprintDeclaration,\n): ProviderFrontendCspFootprint {\n  return ProviderFrontendCspFootprintSchema.parse(declaration);\n}\n\n/**\n * The DATA half of a provider's `sdk` declaration: WHICH npm package carries the\n * vendor SDK, and at which range.\n *\n * The CODE half — the dynamic import and the vendor's initialization call — is\n * `ProviderFrontendSdk.activate` on the facet module type, and is deliberately\n * absent here: a function cannot cross a JSON channel, and a channel that\n * silently drops one is worse than a channel that never carried it.\n *\n * The descriptor is not decoration. It is what the bundle-isolation policy reads\n * to decide whether a bare specifier a provider package imports was DECLARED,\n * what an application's dependency alignment needs in order to install the SDK\n * as an optional peer, and what a human reads when asking why a bundle grew.\n *\n * Who authors it, since the epic's bulk-integration model was reversed on\n * 2026-09-06: a FIRST-CLASS provider package or an application's own provider\n * module. The scraper-mapper that fills the catalogue emits identity, auth, a\n * secrets contract and an operation catalogue on the `rest` arm — a\n * backend-only package — so a scraped provider has no frontend facet to carry\n * this. That is a narrowing of the population, not of the contract: the pickers\n * and embeds this surface exists for were always the hand-authored kind.\n */\nexport const ProviderFrontendSdkDescriptorSchema = z.strictObject({\n  /** npm package name of the vendor SDK, e.g. `@sentry/browser`. */\n  packageName: z.string().min(1),\n  /**\n   * Semver range the provider was built against. Optional because a provider\n   * that pins its SDK as a direct dependency has already said so in its own\n   * manifest; stating it here as well would be a second copy of that pin.\n   */\n  versionRange: z.string().min(1).optional(),\n});\nexport type ProviderFrontendSdkDescriptor = z.infer<typeof ProviderFrontendSdkDescriptorSchema>;\n\n/**\n * `crossorigin` attribute values for a provider-declared `<script>`.\n *\n * A closed vocabulary with a named runtime source rather than a bare literal\n * union, so each member can carry why it exists — and there are exactly two\n * reasons to pick one over the other.\n */\nexport enum ProviderFrontendScriptCrossOrigin {\n  /** No credentials are sent; the response must carry `Access-Control-Allow-Origin`. The right choice for a public CDN script. */\n  ANONYMOUS = 'anonymous',\n  /** Cookies and TLS client certificates are sent. Only for a vendor that authenticates the script fetch itself. */\n  USE_CREDENTIALS = 'use-credentials',\n}\n\n/**\n * A third-party `<script>` a provider asks its surface to add — the case a\n * dynamic `import()` cannot serve, because the vendor ships a global-installing\n * tag rather than an npm module (reCAPTCHA, most tag managers, several chat\n * widgets).\n *\n * `integrity` is Subresource Integrity. It is optional because a vendor that\n * versionless-serves a mutable URL (again, reCAPTCHA) cannot publish a stable\n * hash — but when it IS given the surface must also send `crossorigin`, or the\n * browser refuses the integrity check outright. That coupling is enforced below\n * rather than left to each surface to remember.\n */\nexport const ProviderFrontendScriptDeclarationSchema = z\n  .strictObject({\n    /** Absolute URL of the script. Its origin must also appear in `csp.scriptOrigins`. */\n    src: z.string().min(1),\n    /** Subresource-integrity hash, e.g. `sha384-…`. */\n    integrity: z.string().min(1).optional(),\n    crossOrigin: z.enum(ProviderFrontendScriptCrossOrigin).optional(),\n    async: z.boolean().optional(),\n    defer: z.boolean().optional(),\n  })\n  .superRefine((declaration, context) => {\n    if (declaration.integrity !== undefined && declaration.crossOrigin === undefined) {\n      context.addIssue({\n        code: 'custom',\n        path: ['crossOrigin'],\n        message:\n          'A script declaring `integrity` must also declare `crossOrigin`; without it the browser skips the '\n          + 'integrity check for a cross-origin script, so the hash would protect nothing.',\n      });\n    }\n  });\nexport type ProviderFrontendScriptDeclaration = z.infer<typeof ProviderFrontendScriptDeclarationSchema>;\n\n/**\n * WHAT a provider's component hands back, when what it hands back is a thing\n * rather than a value.\n *\n * ## The question this answers, and why it is a DECLARATION\n *\n * An application's objective is that it calls third-party APIs directly from\n * custom frontend components. On the backend that is unambiguous. In a browser\n * it is not, because a tenant credential must never get there — so a picker for\n * a credentialed vendor and a picker for a vendor with a browser-safe public\n * token cannot hand back the same thing, and the framework surface that\n * receives a selection has to know which before it mounts anything.\n *\n * Settled 2026-09-07 (issue #383, recorded as Q5 of the provider-architecture\n * plan): **per vendor, DECLARED.** Both shapes are real and both ship; which one\n * a provider emits is a static fact about that provider, stated here and\n * visible on the DATA channel without executing a line of its code.\n *\n * The word doing the work is *declared*. A discriminated union alone would let a\n * provider decide at runtime, which is the shape the decision explicitly\n * rejected — so the framework REFUSES a selection whose discriminant contradicts\n * this field. Without that refusal the declaration is decoration, and a reviewer\n * reading a provider's manifest would be reading a wish.\n *\n * ## Why a single value and not a set\n *\n * A provider that genuinely could emit either — Google's Picker hands back both\n * a file id and a URL, and which is usable depends on the granted OAuth scope —\n * was the argument for `selectionDelivery: [...]`. Rejected: an array puts the\n * choice back at runtime, which is the half of the decision that carries all the\n * weight. A vendor whose two modes are both wanted contributes two components,\n * and the chooser then shows them as what they are — two different things a user\n * can pick between — rather than one component whose behaviour a reader cannot\n * predict.\n *\n * ## What it means for CSP\n *\n * `REMOTE_REFERENCE` does NOT imply a provider needs no `connectOrigins`: a\n * picker still talks to its vendor to RENDER, even when the bytes it selects are\n * fetched later by the backend. So this field does not gate the CSP buckets, and\n * a guard inferring otherwise would break every real picker. What it does gate\n * is where the SELECTED OBJECT travels.\n */\nexport enum ProviderFrontendSelectionDelivery {\n  /**\n   * An opaque handle only the application backend can resolve — a Drive file id,\n   * a DAM asset key. The browser never holds the bytes and never authenticates\n   * to the vendor for them; the framework routes the reference to the\n   * application's executor door, which holds the tenant credential.\n   */\n  REMOTE_REFERENCE = 'REMOTE_REFERENCE',\n  /**\n   * Bytes the browser already holds, as a `File`. Available only to a vendor\n   * whose picker runs on a browser-safe grant — a publishable key, a\n   * user-consented OAuth token, a picker's own scoped grant — so nothing\n   * tenant-secret is involved. The framework uploads it exactly as it uploads a\n   * file chosen from disk.\n   */\n  BROWSER_READABLE_FILE = 'BROWSER_READABLE_FILE',\n  /**\n   * A URL the browser may fetch, under the same browser-safe-grant condition as\n   * `BROWSER_READABLE_FILE`. Distinct from it because the framework must fetch\n   * before it can upload, and that fetch is a network call the composed CSP has\n   * to admit — a difference the surface cannot discover from a `File`.\n   */\n  BROWSER_READABLE_URL = 'BROWSER_READABLE_URL',\n}\n\n/**\n * The DATA half of one component a provider contributes — everything about it\n * that a reviewer, the CLI or a build step can read without running a browser.\n *\n * The loader is the CODE half and stays on the facet module in\n * `@wildo-ai/external-connectors-public`, exactly as `sdk.activate` does. What\n * crosses the wire is the fact that a component EXISTS for this capability, plus\n * the contract it commits to.\n *\n * Strict, and for the same reason the CSP footprint is: this is AUTHORED by a\n * provider package rather than received from an older producer, so a misspelled\n * key must fail where it is written instead of contributing nothing.\n */\nexport const ProviderFrontendComponentDescriptorSchema = z.strictObject({\n  /**\n   * What a selection from this component contains. Absent for a capability whose\n   * component returns a plain value rather than a thing — a captcha widget hands\n   * back a token, and there is no delivery question to answer about a string.\n   */\n  selectionDelivery: z.enum(ProviderFrontendSelectionDelivery).optional(),\n});\nexport type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFrontendComponentDescriptorSchema>;\n\n/**\n * A provider's component descriptors, keyed by the CAPABILITY each fills.\n *\n * The key is a capability token rather than a member of a closed enum because\n * `ProviderCapability` is OPEN — an application extends it by module\n * augmentation — so a `z.enum` here would refuse an application's own\n * capability. The registry that consumes this makes the same choice for the same\n * reason.\n */\nexport const ProviderFrontendComponentDescriptorsSchema = z.record(\n  z.string().min(1),\n  ProviderFrontendComponentDescriptorSchema,\n);\nexport type ProviderFrontendComponentDescriptors = z.infer<typeof ProviderFrontendComponentDescriptorsSchema>;\n\n/**\n * Pins every bucket member to a real field of the footprint.\n *\n * A member whose value is not a footprint key would be authorable, would parse,\n * and would contribute nothing — in production only, because CSP is report-only\n * in development. This makes it a compile error instead.\n */\nconst _everyBucketNamesAFootprintField: Record<\n  ProviderFrontendCspOriginBucket,\n  keyof Omit<ProviderFrontendCspFootprint, 'derivedOrigins'>\n> = {\n  [ProviderFrontendCspOriginBucket.SCRIPT]: 'scriptOrigins',\n  [ProviderFrontendCspOriginBucket.CONNECT]: 'connectOrigins',\n  [ProviderFrontendCspOriginBucket.FRAME]: 'frameOrigins',\n  [ProviderFrontendCspOriginBucket.IMG]: 'imgOrigins',\n  [ProviderFrontendCspOriginBucket.STYLE]: 'styleOrigins',\n  [ProviderFrontendCspOriginBucket.FONT]: 'fontOrigins',\n};\nvoid _everyBucketNamesAFootprintField;\n"]}
+{"version":3,"file":"provider-frontend-surface.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAeX;AAfD,WAAY,+BAA+B;IACzC,2DAAwB,CAAA;IACxB,6DAA0B,CAAA;IAC1B,yDAAsB,CAAA;IACtB,qDAAkB,CAAA;IAClB,yDAAsB,CAAA;IACtB,uDAAoB,CAAA;IACpB;;;;OAIG;IACH,2DAAwB,CAAA;IACxB,gHAAgH;IAChH,yDAAsB,CAAA;AACxB,CAAC,EAfW,+BAA+B,KAA/B,+BAA+B,QAe1C;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,MAAM,CAAC,MAAM,CAC3G,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,8DAA8D;IAC9D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,+HAA+H;IAC/H,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAyBH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAoD;IAEpD,OAAO,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,kEAAkE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,gIAAgI;IAChI,4DAAuB,CAAA;IACvB,kHAAkH;IAClH,wEAAmC,CAAA;AACrC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,mDAAmD;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACjE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mGAAmG;kBACjG,+EAA+E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,iCAuBX;AAvBD,WAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,0EAAqC,CAAA;IACrC;;;;;;OAMG;IACH,oFAA+C,CAAA;IAC/C;;;;;OAKG;IACH,kFAA6C,CAAA;AAC/C,CAAC,EAvBW,iCAAiC,KAAjC,iCAAiC,QAuB5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAN,IAAY,qCAQX;AARD,WAAY,qCAAqC;IAC/C,8GAA8G;IAC9G,sDAAa,CAAA;IACb;;;OAGG;IACH,gEAAuB,CAAA;AACzB,CAAC,EARW,qCAAqC,KAArC,qCAAqC,QAQhD;AAED,qJAAqJ;AACrJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,6FAA6F;IAC7F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,wGAAwG;IACxG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,6EAA6E;AAE7E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACvE;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;IAC1E;;;;;OAKG;IACH,aAAa,EAAE,sCAAsC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,gCAAgC,GAGlC;IACF,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,gBAAgB;IAC3D,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,GAAG,CAAC,EAAE,YAAY;IACnD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,aAAa;IACrD,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;CACxD,CAAC;AACF,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * Frontend-surface atoms a provider declares: what it needs the page to be\n * ALLOWED to reach (its CSP footprint), which vendor SDK package it loads, and\n * which third-party `<script>` tags it asks the surface to add.\n *\n * ## Why these are DATA and live here\n *\n * A frontend provider reaches its surface through TWO channels, and only one of\n * them can carry code:\n *\n *   - the **DATA** channel — `FrontendProviderEntry`, projected by the backend\n *     into `/application-config` and materialized into the generated\n *     frontend-services artifact. It is JSON end to end, so nothing\n *     function-valued survives it (it used to be cast to a module type anyway,\n *     which is the defect this split closes);\n *   - the **CODE** channel — the provider package's own facet barrel, imported\n *     by the bundle through the generated `frontend-providers.generated.ts`.\n *\n * Everything in this file is the DATA half. It is what the CLI, the CSP\n * composer and the bundle-isolation policy need to SEE without executing any\n * frontend module — and the CLI genuinely cannot execute one: it is a Node\n * process and these modules are browser-bound. The executable half (`sdk.activate`,\n * `publicConfigSchema`) lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this boundary.\n *\n * Added by slice S4a of epic #337 (issue #332).\n */\n\nimport { z } from 'zod';\n\n/**\n * The origins a provider needs the composed Content-Security-Policy to admit,\n * grouped by WHAT THE PROVIDER IS REACHING rather than by CSP directive name.\n *\n * ## Why semantic buckets and not directive names\n *\n * `CSP_DIRECTIVE_NAMES` is a closed vocabulary that already has one named\n * runtime source, in `@wildo-ai/platform-config-lib`. That package DEPENDS on\n * this one, so this file cannot reference it, and re-declaring the list here\n * would create a second source for one vocabulary — precisely what the\n * one-named-source rule exists to prevent, and the way the two copies would\n * drift the first time a directive is added.\n *\n * Keying on intent instead is also the better contract. A provider author knows\n * \"my SDK is fetched from `https://js.stripe.com` and it calls back to\n * `https://api.stripe.com`\"; which directive grades which fetch is framework\n * knowledge, and it lives in exactly one place — the bucket-to-directive\n * mapping in `platform-config-lib`'s `csp-emit.ts`.\n *\n * ## Why it is STRICT while the entry that carries it is loose\n *\n * The entry is a WIRE record read by a possibly-older consumer, so it tolerates\n * unknown keys (see `frontend-provider-entry.shared.schemas.ts`). This footprint\n * is AUTHORED, by a provider package, and validated where it is authored — so a\n * misspelled bucket must fail loudly rather than contribute nothing. That\n * distinction matters more here than anywhere else in the frontend surface:\n * CSP is enforced in production and report-only in development, so a bucket that\n * silently contributes nothing is invisible until the provider breaks in\n * production only.\n *\n * Adding a bucket is not a one-sided producer change either — a new bucket is\n * useless until `csp-emit.ts` maps it to a directive — so strictness costs no\n * version-skew tolerance that was ever available.\n *\n * Every field defaults to `[]`: a provider that declares a footprint at all is\n * making a complete statement about the buckets it did not name.\n */\n/**\n * Which bucket an origin lands in, as a value a provider can name.\n *\n * The bucket names are already the footprint's field names; this enum is what\n * lets a provider REFER to one — a derived origin has to say where it goes, and\n * a bare string there would be a second, unexplained spelling of a closed\n * vocabulary. A compile-time check below pins the two together.\n */\nexport enum ProviderFrontendCspOriginBucket {\n  SCRIPT = 'scriptOrigins',\n  CONNECT = 'connectOrigins',\n  FRAME = 'frameOrigins',\n  IMG = 'imgOrigins',\n  STYLE = 'styleOrigins',\n  FONT = 'fontOrigins',\n  /**\n   * Origins a provider starts a Web Worker, Shared Worker or service worker from (`worker-src`) — a map\n   * SDK's tile decoder, a session-replay compressor. Frequently `blob:`, which a provider may name here\n   * as a scheme source (#1702).\n   */\n  WORKER = 'workerOrigins',\n  /** Origins a provider plays audio or video from (`media-src`) — an embed with sound, a video player (#1702). */\n  MEDIA = 'mediaOrigins',\n}\n\n/**\n * Every bucket, in declaration order — the ONE list a consumer iterates when it has to visit each\n * bucket of a footprint (the hydration staleness join, the CLI's derived-origin resolution).\n *\n * Derived from the enum rather than written out, because a hand-kept list of buckets is how a new one\n * gets authored, serialized and then silently dropped by the one consumer that did not learn about it:\n * the CLI's derived-origin resolver re-listed the six buckets by hand until #1702, so a seventh would\n * have been erased there for any provider that also derives an origin.\n */\nexport const PROVIDER_FRONTEND_CSP_ORIGIN_BUCKETS: readonly ProviderFrontendCspOriginBucket[] = Object.freeze(\n  Object.values(ProviderFrontendCspOriginBucket),\n);\n\n/**\n * An origin the framework must READ OUT OF the provider's own public config,\n * because the provider cannot know it.\n *\n * The case that forced this: an error-monitoring provider sends to the host\n * inside its DSN, and a product-analytics provider to whatever `apiHost` the\n * application configured — including a self-hosted one. Both are per\n * APPLICATION, and often per ENVIRONMENT, so no static list on the provider\n * module can contain them. Without this the application would have to author\n * the same host twice — once as the provider's config and once in its CSP — and\n * the copy that drifts fails in production only, because development is\n * report-only.\n *\n * Resolution is data, not code: the CLI takes `publicConfig[publicConfigKey]`,\n * reads its URL origin, and adds it to `bucket`. An absent key contributes\n * nothing (the provider simply is not configured for that service); a key that\n * is present and is NOT a URL fails the sync loudly, because silently dropping\n * it is the exact failure this exists to prevent.\n */\nexport const ProviderFrontendCspDerivedOriginSchema = z.strictObject({\n  /** Key in this provider's `publicConfig` whose value is a URL. */\n  publicConfigKey: z.string().min(1),\n  bucket: z.enum(ProviderFrontendCspOriginBucket),\n});\nexport type ProviderFrontendCspDerivedOrigin = z.infer<typeof ProviderFrontendCspDerivedOriginSchema>;\n\nexport const ProviderFrontendCspFootprintSchema = z.strictObject({\n  /** Origins the surface loads executable script from (`script-src`). */\n  scriptOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider's code opens fetch / XHR / WebSocket connections to (`connect-src`). */\n  connectOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider embeds in an iframe — a picker, a checkout, a meeting (`frame-src`). */\n  frameOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads images or pixels from (`img-src`). */\n  imgOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads stylesheets from (`style-src`). */\n  styleOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads web fonts from (`font-src`). */\n  fontOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider starts workers from (`worker-src`), `blob:` included. See `ProviderFrontendCspOriginBucket.WORKER`. */\n  workerOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider plays audio or video from (`media-src`). */\n  mediaOrigins: z.array(z.string().min(1)).default([]),\n  /**\n   * Origins the framework reads out of this provider's own `publicConfig`,\n   * for the endpoints a provider cannot know in advance. See\n   * {@link ProviderFrontendCspDerivedOriginSchema}.\n   */\n  derivedOrigins: z.array(ProviderFrontendCspDerivedOriginSchema).default([]),\n});\nexport type ProviderFrontendCspFootprint = z.infer<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * The footprint as a provider AUTHORS it: name only the buckets you reach.\n *\n * Authoring and the wire are deliberately different shapes, and the asymmetry\n * is the point.\n *\n *   - **Authoring is partial.** A provider that only loads a script should write\n *     `{ scriptOrigins: ['https://js.acme.com'] }`, not that plus four empty\n *     arrays. Four empty arrays are noise at exactly the place the declaration\n *     should be readable, and noise is what stops a reviewer noticing the one\n *     line that grants an origin.\n *   - **The wire is total.** Every bucket is present by the time the footprint\n *     reaches an entry, so the CSP composer never branches on absence and the\n *     staleness comparison between a served footprint and its module's has two\n *     comparable shapes rather than a partial and a total that differ in every\n *     bucket nobody named.\n *\n * Derived as `z.input` rather than written as a `Partial<…>`, so it cannot drift\n * from the schema: adding a bucket makes it optional here automatically.\n */\nexport type ProviderFrontendCspFootprintDeclaration = z.input<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * Fills in the buckets a declaration did not name.\n *\n * The ONE place that normalization happens, used by the projection that builds\n * an entry and by the hydration join that compares one against a module. Two\n * copies would eventually disagree about whether an unnamed bucket is `[]` or\n * absent, and the join reads that difference as a stale artifact — a false\n * alarm on the diagnostic whose whole job is to be believed.\n */\nexport function normalizeProviderFrontendCspFootprint(\n  declaration: ProviderFrontendCspFootprintDeclaration,\n): ProviderFrontendCspFootprint {\n  return ProviderFrontendCspFootprintSchema.parse(declaration);\n}\n\n/**\n * The DATA half of a provider's `sdk` declaration: WHICH npm package carries the\n * vendor SDK, and at which range.\n *\n * The CODE half — the dynamic import and the vendor's initialization call — is\n * `ProviderFrontendSdk.activate` on the facet module type, and is deliberately\n * absent here: a function cannot cross a JSON channel, and a channel that\n * silently drops one is worse than a channel that never carried it.\n *\n * The descriptor is not decoration. It is what the bundle-isolation policy reads\n * to decide whether a bare specifier a provider package imports was DECLARED,\n * what an application's dependency alignment needs in order to install the SDK\n * as an optional peer, and what a human reads when asking why a bundle grew.\n *\n * Who authors it, since the epic's bulk-integration model was reversed on\n * 2026-09-06: a FIRST-CLASS provider package or an application's own provider\n * module. The scraper-mapper that fills the catalogue emits identity, auth, a\n * secrets contract and an operation catalogue on the `rest` arm — a\n * backend-only package — so a scraped provider has no frontend facet to carry\n * this. That is a narrowing of the population, not of the contract: the pickers\n * and embeds this surface exists for were always the hand-authored kind.\n */\nexport const ProviderFrontendSdkDescriptorSchema = z.strictObject({\n  /** npm package name of the vendor SDK, e.g. `@sentry/browser`. */\n  packageName: z.string().min(1),\n  /**\n   * Semver range the provider was built against. Optional because a provider\n   * that pins its SDK as a direct dependency has already said so in its own\n   * manifest; stating it here as well would be a second copy of that pin.\n   */\n  versionRange: z.string().min(1).optional(),\n});\nexport type ProviderFrontendSdkDescriptor = z.infer<typeof ProviderFrontendSdkDescriptorSchema>;\n\n/**\n * `crossorigin` attribute values for a provider-declared `<script>`.\n *\n * A closed vocabulary with a named runtime source rather than a bare literal\n * union, so each member can carry why it exists — and there are exactly two\n * reasons to pick one over the other.\n */\nexport enum ProviderFrontendScriptCrossOrigin {\n  /** No credentials are sent; the response must carry `Access-Control-Allow-Origin`. The right choice for a public CDN script. */\n  ANONYMOUS = 'anonymous',\n  /** Cookies and TLS client certificates are sent. Only for a vendor that authenticates the script fetch itself. */\n  USE_CREDENTIALS = 'use-credentials',\n}\n\n/**\n * A third-party `<script>` a provider asks its surface to add — the case a\n * dynamic `import()` cannot serve, because the vendor ships a global-installing\n * tag rather than an npm module (reCAPTCHA, most tag managers, several chat\n * widgets).\n *\n * `integrity` is Subresource Integrity. It is optional because a vendor that\n * versionless-serves a mutable URL (again, reCAPTCHA) cannot publish a stable\n * hash — but when it IS given the surface must also send `crossorigin`, or the\n * browser refuses the integrity check outright. That coupling is enforced below\n * rather than left to each surface to remember.\n */\nexport const ProviderFrontendScriptDeclarationSchema = z\n  .strictObject({\n    /** Absolute URL of the script. Its origin must also appear in `csp.scriptOrigins`. */\n    src: z.string().min(1),\n    /** Subresource-integrity hash, e.g. `sha384-…`. */\n    integrity: z.string().min(1).optional(),\n    crossOrigin: z.enum(ProviderFrontendScriptCrossOrigin).optional(),\n    async: z.boolean().optional(),\n    defer: z.boolean().optional(),\n  })\n  .superRefine((declaration, context) => {\n    if (declaration.integrity !== undefined && declaration.crossOrigin === undefined) {\n      context.addIssue({\n        code: 'custom',\n        path: ['crossOrigin'],\n        message:\n          'A script declaring `integrity` must also declare `crossOrigin`; without it the browser skips the '\n          + 'integrity check for a cross-origin script, so the hash would protect nothing.',\n      });\n    }\n  });\nexport type ProviderFrontendScriptDeclaration = z.infer<typeof ProviderFrontendScriptDeclarationSchema>;\n\n/**\n * WHAT a provider's component hands back, when what it hands back is a thing\n * rather than a value.\n *\n * ## The question this answers, and why it is a DECLARATION\n *\n * An application's objective is that it calls third-party APIs directly from\n * custom frontend components. On the backend that is unambiguous. In a browser\n * it is not, because a tenant credential must never get there — so a picker for\n * a credentialed vendor and a picker for a vendor with a browser-safe public\n * token cannot hand back the same thing, and the framework surface that\n * receives a selection has to know which before it mounts anything.\n *\n * Settled 2026-09-07 (issue #383, recorded as Q5 of the provider-architecture\n * plan): **per vendor, DECLARED.** Both shapes are real and both ship; which one\n * a provider emits is a static fact about that provider, stated here and\n * visible on the DATA channel without executing a line of its code.\n *\n * The word doing the work is *declared*. A discriminated union alone would let a\n * provider decide at runtime, which is the shape the decision explicitly\n * rejected — so the framework REFUSES a selection whose discriminant contradicts\n * this field. Without that refusal the declaration is decoration, and a reviewer\n * reading a provider's manifest would be reading a wish.\n *\n * ## Why a single value and not a set\n *\n * A provider that genuinely could emit either — Google's Picker hands back both\n * a file id and a URL, and which is usable depends on the granted OAuth scope —\n * was the argument for `selectionDelivery: [...]`. Rejected: an array puts the\n * choice back at runtime, which is the half of the decision that carries all the\n * weight. A vendor whose two modes are both wanted contributes two components,\n * and the chooser then shows them as what they are — two different things a user\n * can pick between — rather than one component whose behaviour a reader cannot\n * predict.\n *\n * ## What it means for CSP\n *\n * `REMOTE_REFERENCE` does NOT imply a provider needs no `connectOrigins`: a\n * picker still talks to its vendor to RENDER, even when the bytes it selects are\n * fetched later by the backend. So this field does not gate the CSP buckets, and\n * a guard inferring otherwise would break every real picker. What it does gate\n * is where the SELECTED OBJECT travels.\n */\nexport enum ProviderFrontendSelectionDelivery {\n  /**\n   * An opaque handle only the application backend can resolve — a Drive file id,\n   * a DAM asset key. The browser never holds the bytes and never authenticates\n   * to the vendor for them; the framework routes the reference to the\n   * application's executor door, which holds the tenant credential.\n   */\n  REMOTE_REFERENCE = 'REMOTE_REFERENCE',\n  /**\n   * Bytes the browser already holds, as a `File`. Available only to a vendor\n   * whose picker runs on a browser-safe grant — a publishable key, a\n   * user-consented OAuth token, a picker's own scoped grant — so nothing\n   * tenant-secret is involved. The framework uploads it exactly as it uploads a\n   * file chosen from disk.\n   */\n  BROWSER_READABLE_FILE = 'BROWSER_READABLE_FILE',\n  /**\n   * A URL the browser may fetch, under the same browser-safe-grant condition as\n   * `BROWSER_READABLE_FILE`. Distinct from it because the framework must fetch\n   * before it can upload, and that fetch is a network call the composed CSP has\n   * to admit — a difference the surface cannot discover from a `File`.\n   */\n  BROWSER_READABLE_URL = 'BROWSER_READABLE_URL',\n}\n\n/**\n * Whether an address-lookup component hands back the VENDOR'S identifier for the place it matched (#1702,\n * narrowed by #561 D3).\n *\n * ## Why this is DECLARED, per component\n *\n * The structured address a lookup returns is the application's own data: the person typed it, the\n * vendor only helped spell it. The vendor's place identifier is different — it is the vendor's key, and\n * vendors disagree on whether it may be kept (Google allows it indefinitely, Mapbox does not promise it is\n * stable, Loqate's public documentation says nothing). So a component declares once, statically, whether\n * it returns one, and the framework holds every selection to it — the #383 rule for `selectionDelivery`,\n * applied here. A runtime flag on each selection was the rejected alternative: it would let the component\n * decide per selection, which is not a decision a component can own.\n *\n * ## Why there is no \"storable\" member (#561 D3)\n *\n * The framework NEVER stores a vendor place id, whatever the vendor allows. It travels only inside one\n * lookup session, from the suggestion to the retrieval, and what is saved is the address the person\n * confirmed. A `STORABLE` member existed from #1702 until #561 and nothing read it: a declaration that\n * permits storage while nothing can store is a claim nothing checks, and a later reader would take it as a\n * licence. Rejected with it: a `placeRef` slot on `AddressValue`, which would mix vendor data into\n * application data under a retention that differs per vendor.\n *\n * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — \"Place ID\n * caching exception\": the place ID \"is exempt from the caching restrictions\". Fetched 2026-09-29. The Mapbox\n * and Loqate readings are #561's 2026-09-14 research, summarised rather than quoted.\n */\nexport enum ProviderAddressLookupPlaceIdRetention {\n  /** The component returns no place id. A selection carrying one contradicts the declaration and is refused. */\n  NONE = 'NONE',\n  /**\n   * A place id may be returned for the current interaction (re-querying the vendor for the same place),\n   * and is never stored: the field keeps only the address.\n   */\n  TRANSIENT = 'TRANSIENT',\n}\n\n/** @wildo_source:part:start saas.models.provider-address-lookup-declaration facet:layer:shared facet:family:provider facet:audience:app-developer */\n/**\n * How a `FRONTEND_ADDRESS_LOOKUP` component reaches its vendor, and what the vendor's terms require of the\n * page (#561) — the DATA half a reviewer reads, and the half the framework's host ENFORCES.\n *\n * ## Why the lookup names backend OPERATIONS rather than a vendor URL (#561 D2)\n *\n * The vendor is never called from the page. Each suggestion and the final retrieval run through the\n * application backend's provider-operation door (`POST /provider-operations/:providerRef/:operationId`),\n * which spends the application's own credential, admits the operation by `providers.browserOperations`,\n * throttles each caller, and records a `PROVIDER_OPERATION_CALL` row that carries no typed input. So the\n * page holds no vendor key and needs no vendor origin in its CSP, and every vendor is reached one way.\n * Google recommends exactly this for its web services: \"Using a secure proxy server provides a solid source\n * for interacting with a Google Maps Platform web service endpoint from a client-side application without\n * exposing your API key\".\n * spec-cite: https://developers.google.com/maps/api-security-best-practices — \"Proxy server\", fetched 2026-09-29.\n *\n * The host hands the component two functions, `suggest` and `retrieve`, bound to the two operation ids\n * declared here, so a reviewer reading the manifest sees which backend operations the application must open to\n * browsers. What BOUNDS a component is the door, not this declaration: a component is code and could call the\n * browser door itself, and the door runs only the operations the application listed in `providers.browserOperations`.\n *\n * ## Why the session token and the attribution are declared rather than left to the component (#561 D4)\n *\n * Both are vendor TERMS, and a term a component may forget is not held. The host generates one UUIDv4 per\n * lookup session and writes it into the input field named by `sessionTokenInput` on every suggestion and on\n * the retrieval, then starts a new session after a retrieval or when the lookup is abandoned — the vendor\n * bills per session, and a missing or reused token bills every keystroke. The host renders\n * `attributionMark` beside the lookup whenever it is mounted.\n */\nexport const ProviderAddressLookupDeclarationSchema = z.strictObject({\n  /** The backend operation of the SAME provider ref that turns typed text into suggestions. */\n  suggestOperationId: z.string().trim().min(1),\n  /** The backend operation of the same ref that turns one chosen suggestion into a structured address. */\n  retrieveOperationId: z.string().trim().min(1),\n  /**\n   * The operation INPUT field the vendor reads its session token from, when the vendor bills by session.\n   * Absent: the vendor takes none, and the host sends none.\n   */\n  sessionTokenInput: z.string().trim().min(1).optional(),\n  /**\n   * The attribution the vendor requires beside its suggestions, VERBATIM — a trademark, never translated\n   * (Google: \"the text Google Maps is acceptable\" where its logo does not fit). The host renders it inside a\n   * sentence from the application's own labels.\n   * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — attribution without a\n   * Google map, fetched 2026-09-29.\n   */\n  attributionMark: z.string().trim().min(1).optional(),\n});\nexport type ProviderAddressLookupDeclaration = z.infer<typeof ProviderAddressLookupDeclarationSchema>;\n/** @wildo_source:part:end saas.models.provider-address-lookup-declaration */\n\n/**\n * The DATA half of one component a provider contributes — everything about it\n * that a reviewer, the CLI or a build step can read without running a browser.\n *\n * The loader is the CODE half and stays on the facet module in\n * `@wildo-ai/external-connectors-public`, exactly as `sdk.activate` does. What\n * crosses the wire is the fact that a component EXISTS for this capability, plus\n * the contract it commits to.\n *\n * Strict, and for the same reason the CSP footprint is: this is AUTHORED by a\n * provider package rather than received from an older producer, so a misspelled\n * key must fail where it is written instead of contributing nothing.\n */\nexport const ProviderFrontendComponentDescriptorSchema = z.strictObject({\n  /**\n   * What a selection from this component contains. Absent for a capability whose\n   * component returns a plain value rather than a thing — a captcha widget hands\n   * back a token, and there is no delivery question to answer about a string.\n   */\n  selectionDelivery: z.enum(ProviderFrontendSelectionDelivery).optional(),\n  /**\n   * For a `FRONTEND_ADDRESS_LOOKUP` component: whether it hands back the vendor's own identifier for\n   * the place it matched (#1702). It is never stored either way (#561 D3). See\n   * {@link ProviderAddressLookupPlaceIdRetention}. Absent means the component returns no place id — the\n   * safe reading, since the vendor identifier is the one part of a lookup vendor terms restrict.\n   */\n  placeIdRetention: z.enum(ProviderAddressLookupPlaceIdRetention).optional(),\n  /**\n   * For a `FRONTEND_ADDRESS_LOOKUP` component: the backend operations it runs through the provider-operation\n   * door, and the vendor terms the host enforces (#561). See {@link ProviderAddressLookupDeclarationSchema}.\n   * Absent on an address lookup, the framework's host does not offer it: a lookup with no declared\n   * operations has no way to reach its vendor that the framework admits.\n   */\n  addressLookup: ProviderAddressLookupDeclarationSchema.optional(),\n});\nexport type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFrontendComponentDescriptorSchema>;\n\n/**\n * A provider's component descriptors, keyed by the CAPABILITY each fills.\n *\n * The key is validated as a non-empty string, not as a `ProviderCapability`\n * member. The reason this gave until 2026-09-12 — that `ProviderCapability` is\n * OPEN through module augmentation, so a `z.enum` would refuse an application's\n * own capability — stopped being true with #502: the vocabulary is the closed\n * built-in set. A member-checked key is now possible and has NOT been adopted;\n * until it is, an unknown capability key parses here and simply never matches a\n * surface that asks for a real one.\n */\nexport const ProviderFrontendComponentDescriptorsSchema = z.record(\n  z.string().min(1),\n  ProviderFrontendComponentDescriptorSchema,\n);\nexport type ProviderFrontendComponentDescriptors = z.infer<typeof ProviderFrontendComponentDescriptorsSchema>;\n\n/**\n * Pins every bucket member to a real field of the footprint.\n *\n * A member whose value is not a footprint key would be authorable, would parse,\n * and would contribute nothing — in production only, because CSP is report-only\n * in development. This makes it a compile error instead.\n */\nconst _everyBucketNamesAFootprintField: Record<\n  ProviderFrontendCspOriginBucket,\n  keyof Omit<ProviderFrontendCspFootprint, 'derivedOrigins'>\n> = {\n  [ProviderFrontendCspOriginBucket.SCRIPT]: 'scriptOrigins',\n  [ProviderFrontendCspOriginBucket.CONNECT]: 'connectOrigins',\n  [ProviderFrontendCspOriginBucket.FRAME]: 'frameOrigins',\n  [ProviderFrontendCspOriginBucket.IMG]: 'imgOrigins',\n  [ProviderFrontendCspOriginBucket.STYLE]: 'styleOrigins',\n  [ProviderFrontendCspOriginBucket.FONT]: 'fontOrigins',\n  [ProviderFrontendCspOriginBucket.WORKER]: 'workerOrigins',\n  [ProviderFrontendCspOriginBucket.MEDIA]: 'mediaOrigins',\n};\nvoid _everyBucketNamesAFootprintField;\n"]}

package/dist/esm/external-providers/provider-metadata.shared.schemas.d.ts

@@ -97,8 +97,11 @@ export declare enum ProviderOriginKind {
  * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.
  *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response
  *   shaping stays Wildo's.
- * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the
- *   same output shape. Authoritative where it exists, since it is the vendor's own description.
+ * - `OPENAPI_DOCUMENT` — a vendor's OpenAPI document, read as an ORACLE rather than as a catalogue:
+ *   it never decides WHICH operations exist, and answers questions about the operations the two
+ *   catalogues chose — the response shape, and the names of path holes a catalogue could only name
+ *   by position (#1572). Consulted on every full batch, from a public corpus or from a URL a
+ *   provider decision pins.
  */
 export declare enum ProviderCatalogueSource {
     ACTIVEPIECES = "ACTIVEPIECES",

package/dist/esm/external-providers/provider-metadata.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED,iDAAiD;AACjD,oBAAY,kBAAkB;IAC5B,yDAAyD;IACzD,MAAM,WAAW;IACjB,yEAAyE;IACzE,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,uBAAuB;IACjC,YAAY,iBAAiB;IAC7B,GAAG,QAAQ;IACX,gBAAgB,qBAAqB;CACtC;AAED,eAAO,MAAM,iCAAiC;;;;iBAa5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAa7B,CAAC;AACL,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEnF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,EAAE,cAAmE,CAAC;AAEzG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBA2CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAW3F"}
+{"version":3,"file":"provider-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED,iDAAiD;AACjD,oBAAY,kBAAkB;IAC5B,yDAAyD;IACzD,MAAM,WAAW;IACjB,yEAAyE;IACzE,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,uBAAuB;IACjC,YAAY,iBAAiB;IAC7B,GAAG,QAAQ;IACX,gBAAgB,qBAAqB;CACtC;AAED,eAAO,MAAM,iCAAiC;;;;iBAa5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAa7B,CAAC;AACL,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEnF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,EAAE,cAAmE,CAAC;AAEzG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBA2CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAW3F"}

package/dist/esm/external-providers/provider-metadata.shared.schemas.js

@@ -101,8 +101,11 @@ export var ProviderOriginKind;
  * - `SIM` — Sim's tool modules, whose request declaration carries URL and headers the same way.
  *   Their `transformResponse` / `postProcess` are functions and are deliberately not read; response
  *   shaping stays Wildo's.
- * - `OPENAPI_DOCUMENT` — a vendor-published OpenAPI document, the second mapper input feeding the
- *   same output shape. Authoritative where it exists, since it is the vendor's own description.
+ * - `OPENAPI_DOCUMENT` — a vendor's OpenAPI document, read as an ORACLE rather than as a catalogue:
+ *   it never decides WHICH operations exist, and answers questions about the operations the two
+ *   catalogues chose — the response shape, and the names of path holes a catalogue could only name
+ *   by position (#1572). Consulted on every full batch, from a public corpus or from a URL a
+ *   provider decision pins.
  */
 export var ProviderCatalogueSource;
 (function (ProviderCatalogueSource) {