@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.d.ts

@@ -30,6 +30,8 @@ export declare const FrontendAppBootstrapPayloadSchema: z.ZodObject<{
                 imgOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
                 styleOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
                 fontOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                workerOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                mediaOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
                 derivedOrigins: z.ZodDefault<z.ZodArray<z.ZodObject<{
                     publicConfigKey: z.ZodString;
                     bucket: z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendCspOriginBucket>;
@@ -48,6 +50,13 @@ export declare const FrontendAppBootstrapPayloadSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
+                placeIdRetention: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderAddressLookupPlaceIdRetention>>;
+                addressLookup: z.ZodOptional<z.ZodObject<{
+                    suggestOperationId: z.ZodString;
+                    retrieveOperationId: z.ZodString;
+                    sessionTokenInput: z.ZodOptional<z.ZodString>;
+                    attributionMark: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
             fileStorage: z.ZodOptional<z.ZodEnum<{
@@ -57,6 +66,29 @@ export declare const FrontendAppBootstrapPayloadSchema: z.ZodObject<{
                 readonly GOOGLE_DRIVE: "google_drive";
                 readonly DROPBOX: "dropbox";
             }>>;
+            complianceProfile: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                determination: z.ZodOptional<z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.ESTABLISHED>>;
+                deploymentModels: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderDeploymentModel>>;
+                processingRegions: z.ZodArray<z.ZodString>;
+                vendorLegalEntityName: z.ZodOptional<z.ZodString>;
+                subprocessorListUrl: z.ZodOptional<z.ZodURL>;
+                dataProcessingAgreementUrl: z.ZodOptional<z.ZodURL>;
+                evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    facts: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderComplianceFact>>;
+                    source: z.ZodURL;
+                    verifiedAt: z.ZodISODate;
+                }, z.core.$strict>>>;
+                subjectErasure: z.ZodOptional<z.ZodObject<{
+                    stance: z.ZodEnum<{
+                        readonly NO_SUBJECT_DATA: import("..").HttpApiErasureStance.NO_SUBJECT_DATA;
+                        readonly EXTERNAL_ERASURE_OPERATION: import("..").HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION;
+                    }>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>, z.ZodObject<{
+                determination: z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.UNDETERMINED>;
+                reason: z.ZodString;
+            }, z.core.$strict>]>>;
+            consentPurposes: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$loose>>>;
     }, z.core.$strip>;
 }, z.core.$strip>;
@@ -230,7 +262,39 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
             defaultOwnerRole: z.ZodDefault<z.ZodString>;
         }, z.core.$strip>>;
         ownsApplication: z.ZodOptional<z.ZodLiteral<true>>;
+        servesAsProvider: z.ZodOptional<z.ZodObject<{
+            clientOrganizationTypes: z.ZodArray<z.ZodString>;
+            providerRoles: z.ZodArray<z.ZodString>;
+            defaultProviderRole: z.ZodString;
+        }, z.core.$strip>>;
+        acceptsServiceProviders: z.ZodOptional<z.ZodObject<{
+            defaultExpertAdmissionPolicy: z.ZodOptional<z.ZodEnum<typeof import("..").ServiceProviderExpertAdmissionPolicy>>;
+            securityCriticalCapabilityMaxDays: z.ZodOptional<z.ZodNumber>;
+            expertApprovalDeadlines: z.ZodOptional<z.ZodObject<{
+                lapseAfter: z.ZodOptional<z.ZodString>;
+                claim: z.ZodOptional<z.ZodObject<{
+                    at: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                        fractionOfLapse: z.ZodNumber;
+                    }, z.core.$strip>]>;
+                    basis: z.ZodOptional<z.ZodEnum<typeof import("..").ReviewClockBasis>>;
+                    warnBefore: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+                decision: z.ZodOptional<z.ZodObject<{
+                    at: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                        fractionOfLapse: z.ZodNumber;
+                    }, z.core.$strip>]>;
+                    basis: z.ZodOptional<z.ZodEnum<typeof import("..").ReviewClockBasis>>;
+                    warnBefore: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+                rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    stage: z.ZodEnum<typeof import("..").ReviewDeadlineStage>;
+                    action: z.ZodEnum<typeof import("..").ReviewEscalationActionKind>;
+                }, z.core.$strip>>>;
+                pauseStates: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>>;
+    organizationRoles: z.ZodOptional<z.ZodArray<z.ZodString>>;
     compliance: z.ZodObject<{
         userProfileVisibility: z.ZodDefault<z.ZodEnum<typeof import("..").UserProfileVisibility>>;
         organizationProfileVisibility: z.ZodDefault<z.ZodEnum<typeof import("..").OrganizationProfileVisibility>>;
@@ -329,6 +393,27 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
             gatedProcessing: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         capabilityDeclaredConsentPurposes: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").ConsentPurpose>>>;
+        dataRetention: z.ZodOptional<z.ZodRecord<z.ZodEnum<typeof import("..").DataRetentionClass> & z.core.$partial, z.ZodObject<{
+            retentionDays: z.ZodNumber;
+            rationale: z.ZodString;
+        }, z.core.$strict>>>;
+        subjectDataRecipients: z.ZodOptional<z.ZodObject<{
+            recipients: z.ZodArray<z.ZodObject<{
+                ref: z.ZodString;
+                legalEntityName: z.ZodNullable<z.ZodString>;
+                processingRegions: z.ZodArray<z.ZodString>;
+                reach: z.ZodEnum<typeof import("..").SubjectDataRecipientReach>;
+                categories: z.ZodArray<z.ZodEnum<typeof import("..").PersonalDataCategory>>;
+                categoriesNotDerivable: z.ZodArray<z.ZodEnum<typeof import("..").RecipientCategoriesNotDerivableReason>>;
+                categoriesAreAFloor: z.ZodBoolean;
+                derivedFrom: z.ZodArray<z.ZodString>;
+                erasureStance: z.ZodNullable<z.ZodEnum<typeof import("..").HttpApiErasureStance>>;
+            }, z.core.$strict>>;
+            roleAllocations: z.ZodArray<z.ZodObject<{
+                role: z.ZodEnum<typeof import("..").OperatorProcessingRole>;
+                resourceTypes: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
     }, z.core.$strip>;
     billing: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -347,6 +432,31 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
             enabled: z.ZodDefault<z.ZodBoolean>;
             defaultInitialBalance: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
+        referrals: z.ZodDefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            referrerReward: z.ZodOptional<z.ZodObject<{
+                credits: z.ZodOptional<z.ZodNumber>;
+                creditPoolKey: z.ZodOptional<z.ZodString>;
+                featureKey: z.ZodOptional<z.ZodString>;
+                durationDays: z.ZodOptional<z.ZodNumber>;
+                percentOff: z.ZodOptional<z.ZodNumber>;
+                discountDuration: z.ZodOptional<z.ZodEnum<typeof import("..").PromotionDuration>>;
+                discountDurationInMonths: z.ZodOptional<z.ZodNumber>;
+                type: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").ReferrerRewardType>>;
+            }, z.core.$strip>>;
+            referredReward: z.ZodOptional<z.ZodObject<{
+                trialExtensionDays: z.ZodOptional<z.ZodNumber>;
+                credits: z.ZodOptional<z.ZodNumber>;
+                creditPoolKey: z.ZodOptional<z.ZodString>;
+                featureKey: z.ZodOptional<z.ZodString>;
+                durationDays: z.ZodOptional<z.ZodNumber>;
+                percentOff: z.ZodOptional<z.ZodNumber>;
+                discountDuration: z.ZodOptional<z.ZodEnum<typeof import("..").PromotionDuration>>;
+                discountDurationInMonths: z.ZodOptional<z.ZodNumber>;
+                type: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof import("..").ReferredRewardType>>;
+            }, z.core.$strip>>;
+            codeValidityDays: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
         defaultBehaviorPolicy: z.ZodDefault<z.ZodObject<{
             defaultTrialDays: z.ZodDefault<z.ZodNumber>;
             paymentGracePeriodDays: z.ZodDefault<z.ZodNumber>;
@@ -444,10 +554,19 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
         dormancyCronSchedule: z.ZodDefault<z.ZodString>;
     }, z.core.$strip>>;
     tenantTeardown: z.ZodOptional<z.ZodObject<{
-        retentionWindowDays: z.ZodDefault<z.ZodNumber>;
+        retentionWindowDays: z.ZodOptional<z.ZodNumber>;
         purgeCronSchedule: z.ZodDefault<z.ZodString>;
         purgeBatchSize: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
+    reviewCalendar: z.ZodOptional<z.ZodObject<{
+        timeZone: z.ZodString;
+        workingDays: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof import("..").CalendarWeekday>>>;
+        workingHours: z.ZodDefault<z.ZodObject<{
+            start: z.ZodString;
+            end: z.ZodString;
+        }, z.core.$strip>>;
+        holidays: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
     dataSeeding: z.ZodOptional<z.ZodObject<{
         scheduledRerunCronSchedule: z.ZodDefault<z.ZodString>;
         runRetentionDays: z.ZodDefault<z.ZodNumber>;
@@ -486,6 +605,8 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
                 imgOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
                 styleOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
                 fontOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                workerOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                mediaOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
                 derivedOrigins: z.ZodDefault<z.ZodArray<z.ZodObject<{
                     publicConfigKey: z.ZodString;
                     bucket: z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendCspOriginBucket>;
@@ -504,6 +625,13 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
             }, z.core.$strict>>>;
             components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
+                placeIdRetention: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderAddressLookupPlaceIdRetention>>;
+                addressLookup: z.ZodOptional<z.ZodObject<{
+                    suggestOperationId: z.ZodString;
+                    retrieveOperationId: z.ZodString;
+                    sessionTokenInput: z.ZodOptional<z.ZodString>;
+                    attributionMark: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
             }, z.core.$strict>>>;
             publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
             fileStorage: z.ZodOptional<z.ZodEnum<{
@@ -513,6 +641,29 @@ export declare const AppConfiguration_FrontendBootstrapResponse_Schema: z.ZodObj
                 readonly GOOGLE_DRIVE: "google_drive";
                 readonly DROPBOX: "dropbox";
             }>>;
+            complianceProfile: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                determination: z.ZodOptional<z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.ESTABLISHED>>;
+                deploymentModels: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderDeploymentModel>>;
+                processingRegions: z.ZodArray<z.ZodString>;
+                vendorLegalEntityName: z.ZodOptional<z.ZodString>;
+                subprocessorListUrl: z.ZodOptional<z.ZodURL>;
+                dataProcessingAgreementUrl: z.ZodOptional<z.ZodURL>;
+                evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    facts: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderComplianceFact>>;
+                    source: z.ZodURL;
+                    verifiedAt: z.ZodISODate;
+                }, z.core.$strict>>>;
+                subjectErasure: z.ZodOptional<z.ZodObject<{
+                    stance: z.ZodEnum<{
+                        readonly NO_SUBJECT_DATA: import("..").HttpApiErasureStance.NO_SUBJECT_DATA;
+                        readonly EXTERNAL_ERASURE_OPERATION: import("..").HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION;
+                    }>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>, z.ZodObject<{
+                determination: z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.UNDETERMINED>;
+                reason: z.ZodString;
+            }, z.core.$strict>]>>;
+            consentPurposes: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$loose>>>;
     }, z.core.$strip>;
 }, z.core.$strip>;

package/dist/esm/external-providers/frontend-bootstrap.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-bootstrap.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1D,CAAC;AACL,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC9D,OAAO,iDAAiD,CACzD,CAAC"}
+{"version":3,"file":"frontend-bootstrap.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-bootstrap.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,0CAA0C,CAAC;AAGlD,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iDAAiD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1D,CAAC;AACL,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC9D,OAAO,iDAAiD,CACzD,CAAC"}

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.d.ts

@@ -125,9 +125,10 @@ export declare function partitionFrontendCapabilityPublicConfig(input: {
  * declares, UNION what the capabilities it claims own.
  *
  * `undefined` in, `undefined` out — and that is load-bearing. A provider with no
- * introspectable schema cannot be held to a key list at all, and widening
- * `undefined` to the capability keys would turn "cannot enforce here" into
- * "declares exactly these", refusing every vendor key such a provider reads.
+ * introspectable schema has no key list, which every gate refuses
+ * (`SCHEMA_NOT_INTROSPECTABLE`, #1705); widening `undefined` to the capability
+ * keys would instead turn that refusal into "declares exactly these" and hide
+ * the missing schema behind a plausible list.
  *
  * It lives beside the capability map rather than beside
  * `readDeclaredPublicConfigKeys`, because that module is deliberately

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-public-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC;IAC/C;;;;;;;;;OASG;;IAKH;;;;;;OAMG;;IAEH,mFAAmF;;iBAEnF,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAE1F,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAClD,SAAS,MAAM,EAAE,CASnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CAAC,KAAK,EAAE;IAC7D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1D,GAAG;IACF,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAA;KAAE,CAAC,CAAC;CACrG,CA0BA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9D,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAGhC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kCAAkC,CAChD,YAAY,SAAS;IACnB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,EACD,KAAK,EAAE;IACP,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACtE,GAAG,YAAY,CAcf"}
+{"version":3,"file":"frontend-capability-public-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC;IAC/C;;;;;;;;;OASG;;IAKH;;;;;;OAMG;;IAEH,mFAAmF;;iBAEnF,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAE1F,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,kCAAkC,CAChD,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAClD,SAAS,MAAM,EAAE,CASnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CAAC,KAAK,EAAE;IAC7D,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC1D,GAAG;IACF,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAA;KAAE,CAAC,CAAC;CACrG,CA0BA;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE;IACxD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC9D,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAGhC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kCAAkC,CAChD,YAAY,SAAS;IACnB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,EACD,KAAK,EAAE;IACP,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CACtE,GAAG,YAAY,CAcf"}

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.js

@@ -155,9 +155,10 @@ export function partitionFrontendCapabilityPublicConfig(input) {
  * declares, UNION what the capabilities it claims own.
  *
  * `undefined` in, `undefined` out — and that is load-bearing. A provider with no
- * introspectable schema cannot be held to a key list at all, and widening
- * `undefined` to the capability keys would turn "cannot enforce here" into
- * "declares exactly these", refusing every vendor key such a provider reads.
+ * introspectable schema has no key list, which every gate refuses
+ * (`SCHEMA_NOT_INTROSPECTABLE`, #1705); widening `undefined` to the capability
+ * keys would instead turn that refusal into "declares exactly these" and hide
+ * the missing schema behind a plausible list.
  *
  * It lives beside the capability map rather than beside
  * `readDeclaredPublicConfigKeys`, because that module is deliberately

package/dist/esm/external-providers/frontend-capability-public-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-public-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,WAAW,CAAC;IAChE;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0C,MAAM,CAAC,MAAM,CAAC;IAC5G,oBAAoB,EAAE,oCAAoC;CAC3D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,kCAAkC,CAChD,oBAAmD;IAEnD,IAAI,oBAAoB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uCAAuC,CAAC,KAGvD;IAKC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACtF,MAAM,gBAAgB,GAA4B,EAAE,CAAC;IACrD,MAAM,cAAc,GAA4B,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAA6D,EAAE,CAAC;IAC5E,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,8EAA8E;QAC9E,8EAA8E;QAC9E,iCAAiC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CACxE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,OAAO;YAAE,SAAS;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,GAAG,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kCAAkC,CAMhD,KAID;IACC,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACxF,wEAAwE;IACxE,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC;IAEzC,OAAO;QACL,GAAG,KAAK,CAAC,IAAI;QACb,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,iBAAiB;QAC3E,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;QAC9F,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;KACrG,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The public-config shape a BUILT-IN frontend capability expects, as a named\n * schema rather than a convention.\n *\n * ## Why the capability owns this and not each provider\n *\n * `publicConfig` is `Record<string, unknown>`, so every consuming site was\n * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter\n * for strings, a Mb-to-bytes multiplication — and a renamed key produced\n * `undefined` and a silently wrong picker rather than an error. The keys were a\n * convention nobody had written down, which is the whole defect: three ad-hoc\n * readers agreeing by luck.\n *\n * What a FILE PICKER's constraints mean is framework knowledge — the framework\n * is what applies them to its own file fields — so the shape belongs to the\n * CAPABILITY. A provider is free to carry its own keys beside these (a client\n * id, an app key); it is not free to invent a different spelling of the ones\n * the framework reads, and now it cannot.\n *\n * A provider declaring `publicConfigSchema` should EXTEND the schema for the\n * capability it claims, so hydration validates the framework's fields and its\n * own in one pass.\n */\n\nimport { z } from 'zod';\n\n/**\n * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.\n *\n * Every field is optional: a provider that constrains nothing is legitimate,\n * and the field's own Zod file metadata always wins anyway — a provider only\n * fills the gaps the schema left open.\n *\n * LOOSE, because a provider's own keys live in the same object and must survive\n * a parse that is only looking for these.\n */\nexport const FrontendFilePickerPublicConfigSchema = z.looseObject({\n  /**\n   * MIME types the picker can return.\n   *\n   * An EMPTY list is normalized to absent, and that is behaviour rather than\n   * decoration: the framework turns this into an `accept=` attribute, and an\n   * empty `accept=\"\"` does not mean \"anything\" — it means the file dialog\n   * offers nothing. A provider that declares no types is unconstrained, so the\n   * normalization happens here, once, instead of at each reader that would have\n   * to remember it.\n   */\n  acceptedMimeTypes: z\n    .array(z.string().min(1))\n    .optional()\n    .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),\n  /**\n   * Largest file the picker will hand back, in MEGABYTES.\n   *\n   * The unit is in the name because the framework's own constraint is in BYTES\n   * and the conversion is the kind of thing that is wrong by a factor of 1024²\n   * exactly once, silently, in production.\n   */\n  maxFileSizeMb: z.number().positive().optional(),\n  /** How many files one selection may return. Applies only to a `multiple` field. */\n  maxSelectionCount: z.number().int().positive().optional(),\n});\nexport type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;\n\n/**\n * Every built-in capability that owns public-config keys, and the schema that\n * owns them.\n *\n * A MAP rather than a list of keys, so the keys are derived from the schema that\n * validates them and the two cannot disagree. Adding a capability's shape here\n * is the ONE edit that makes its keys admissible everywhere — the admission,\n * the refusal message and the validation all read this map.\n *\n * A capability absent from this map owns no public-config keys, which is the\n * common case and needs no entry.\n */\nexport const FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS: Readonly<Record<string, z.ZodObject>> = Object.freeze({\n  FRONTEND_FILE_PICKER: FrontendFilePickerPublicConfigSchema,\n});\n\n/**\n * The public-config keys a provider admits BY VIRTUE OF the capabilities it\n * claims, beside whatever its own `publicConfigSchema` declares.\n *\n * ## Why this exists — measured 2026-09-18 (#380)\n *\n * `FrontendFilePickerPublicConfigSchema` declares the constraint vocabulary the\n * FRAMEWORK reads off a picker (`acceptedMimeTypes`, `maxFileSizeMb`,\n * `maxSelectionCount`), and `resolveFormFieldFileProviderConstraints` reads it.\n * Three separate gates refused it, because each asked only what the PROVIDER\n * declares:\n *\n * - the config overlay THREW `UNDECLARED_KEY` — *\"a key the provider never reads\n *   would be served to every browser and used by nothing\"*, which is false here:\n *   the framework reads it, for that provider, because it claims the capability;\n * - hydration answered `unknown key` and set the provider's code to `undefined`,\n *   so declaring a size limit DELETED the picker;\n * - and the resolver then found nothing, because nothing had been allowed through.\n *\n * All three engine pickers declare a `publicConfigSchema` (`appId`, `clientId`,\n * `appKey`), so the capability's whole vocabulary was unusable on every one of\n * them. It worked only on an application-authored picker that declares NO\n * schema, where the first gate is skipped — which is why the dogfood never saw it.\n *\n * The capability schema's own docstring asked a provider to *\"EXTEND the schema\n * for the capability it claims\"*, and no affordance to do that existed. This is\n * the affordance, DERIVED instead: a provider claiming `FRONTEND_FILE_PICKER`\n * admits the file-picker keys with no edit to the provider, so a capability\n * shape added tomorrow reaches every provider claiming it and none that does not.\n */\nexport function frontendCapabilityPublicConfigKeys(\n  providerCapabilities: readonly string[] | undefined,\n): readonly string[] {\n  if (providerCapabilities === undefined) return [];\n  const keys = new Set<string>();\n  for (const capability of providerCapabilities) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    for (const key of Object.keys(schema.shape)) keys.add(key);\n  }\n  return [...keys];\n}\n\n/**\n * Splits a public-config bag into the half the CAPABILITIES own and the half the\n * provider's own schema must answer for, validating the first here.\n *\n * Returning the two halves rather than one merged bag is what lets a caller run\n * the provider's schema over exactly the keys it declared — a strict provider\n * schema would otherwise refuse the capability's keys, which is the defect this\n * whole mechanism exists to remove.\n */\nexport function partitionFrontendCapabilityPublicConfig(input: {\n  readonly providerCapabilities: readonly string[] | undefined;\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n}): {\n  readonly capabilityConfig: Readonly<Record<string, unknown>>;\n  readonly providerConfig: Readonly<Record<string, unknown>>;\n  readonly issues: ReadonlyArray<{ readonly message: string; readonly path: readonly PropertyKey[] }>;\n} {\n  const owned = new Set(frontendCapabilityPublicConfigKeys(input.providerCapabilities));\n  const capabilityConfig: Record<string, unknown> = {};\n  const providerConfig: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input.publicConfig)) {\n    (owned.has(key) ? capabilityConfig : providerConfig)[key] = value;\n  }\n\n  const issues: Array<{ message: string; path: readonly PropertyKey[] }> = [];\n  for (const capability of input.providerCapabilities ?? []) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    // Only the keys this capability owns: a loose schema would otherwise re-admit\n    // the provider's own keys and report nothing about them, which is correct but\n    // makes the partition pointless.\n    const subject = Object.fromEntries(\n      Object.entries(capabilityConfig).filter(([key]) => key in schema.shape),\n    );\n    const parsed = schema.safeParse(subject);\n    if (parsed.success) continue;\n    for (const issue of parsed.error.issues) {\n      issues.push({ message: issue.message, path: issue.path });\n    }\n  }\n\n  return { capabilityConfig, providerConfig, issues };\n}\n\n/**\n * The full set of public-config keys a provider admits: what its own schema\n * declares, UNION what the capabilities it claims own.\n *\n * `undefined` in, `undefined` out — and that is load-bearing. A provider with no\n * introspectable schema cannot be held to a key list at all, and widening\n * `undefined` to the capability keys would turn \"cannot enforce here\" into\n * \"declares exactly these\", refusing every vendor key such a provider reads.\n *\n * It lives beside the capability map rather than beside\n * `readDeclaredPublicConfigKeys`, because that module is deliberately\n * dependency-free so a provider module can declare a schema without pulling a\n * validation library in.\n */\nexport function admissibleFrontendPublicConfigKeys(input: {\n  readonly declaredKeys: readonly string[] | undefined;\n  readonly providerCapabilities: readonly string[] | undefined;\n}): readonly string[] | undefined {\n  if (input.declaredKeys === undefined) return undefined;\n  return [...new Set([...input.declaredKeys, ...frontendCapabilityPublicConfigKeys(input.providerCapabilities)])];\n}\n\n/**\n * Lays ONE provider's declared picker limits under the field's own, for that\n * provider's picker and no other.\n *\n * ## Why this is per-provider and not resolved once (#380)\n *\n * The field used to resolve its picker constraints from the FIRST provider the\n * registry returned for `FRONTEND_FILE_PICKER`, and pass that single object to\n * whichever picker the person then chose — so a Drive limit governed a Dropbox\n * pick, and which provider won depended on registry order. `ProviderFilePickerHost`\n * was built so \"a framework that picked one would be making a product decision in\n * a lookup table\"; the constraints were still making exactly that decision, one\n * layer up, and it became reachable the moment a third picker shipped.\n *\n * It also reached the field's OWN native upload, which is wrong at any number of\n * providers: a vendor's picker limit says nothing about a local file going to the\n * field's own storage.\n *\n * Precedence is unchanged and is the part that must not move: the field's Zod\n * metadata ALWAYS wins, and a provider only fills the gaps the schema left open.\n * `maxSelectionCount` applies only to a `multiple` field — a single-file field\n * never inherits a selection count.\n */\nexport function layerProviderFilePickerConstraints<\n  TConstraints extends {\n    readonly allowedMimeTypes?: readonly string[];\n    readonly maxSize?: number;\n    readonly maxFiles?: number;\n  },\n>(input: {\n  readonly base: TConstraints;\n  readonly multiple: boolean;\n  readonly publicConfig: Readonly<Record<string, unknown>> | undefined;\n}): TConstraints {\n  const parsed = FrontendFilePickerPublicConfigSchema.safeParse(input.publicConfig ?? {});\n  // A provider whose own values are wrong contributes NOTHING rather than\n  // nonsense — the same choice the three hand readers this replaced could not\n  // make, because a bad value was indistinguishable from an absent one.\n  const declared = parsed.success ? parsed.data : {};\n  const maxSizeMb = declared.maxFileSizeMb;\n\n  return {\n    ...input.base,\n    allowedMimeTypes: input.base.allowedMimeTypes ?? declared.acceptedMimeTypes,\n    maxSize: input.base.maxSize ?? (maxSizeMb === undefined ? undefined : maxSizeMb * 1024 * 1024),\n    maxFiles: input.multiple ? (input.base.maxFiles ?? declared.maxSelectionCount) : input.base.maxFiles,\n  };\n}\n"]}
+{"version":3,"file":"frontend-capability-public-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-public-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,WAAW,CAAC;IAChE;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,QAAQ,EAAE;SACV,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,mFAAmF;IACnF,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAGH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0C,MAAM,CAAC,MAAM,CAAC;IAC5G,oBAAoB,EAAE,oCAAoC;CAC3D,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,kCAAkC,CAChD,oBAAmD;IAEnD,IAAI,oBAAoB,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uCAAuC,CAAC,KAGvD;IAKC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACtF,MAAM,gBAAgB,GAA4B,EAAE,CAAC;IACrD,MAAM,cAAc,GAA4B,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAA6D,EAAE,CAAC;IAC5E,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,oBAAoB,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,yCAAyC,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,8EAA8E;QAC9E,8EAA8E;QAC9E,iCAAiC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CACxE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,OAAO;YAAE,SAAS;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kCAAkC,CAAC,KAGlD;IACC,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,GAAG,kCAAkC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;AAClH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kCAAkC,CAMhD,KAID;IACC,MAAM,MAAM,GAAG,oCAAoC,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACxF,wEAAwE;IACxE,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,aAAa,CAAC;IAEzC,OAAO;QACL,GAAG,KAAK,CAAC,IAAI;QACb,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,QAAQ,CAAC,iBAAiB;QAC3E,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC;QAC9F,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;KACrG,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The public-config shape a BUILT-IN frontend capability expects, as a named\n * schema rather than a convention.\n *\n * ## Why the capability owns this and not each provider\n *\n * `publicConfig` is `Record<string, unknown>`, so every consuming site was\n * reading it by hand — `typeof x === 'number' ? x : undefined`, an array filter\n * for strings, a Mb-to-bytes multiplication — and a renamed key produced\n * `undefined` and a silently wrong picker rather than an error. The keys were a\n * convention nobody had written down, which is the whole defect: three ad-hoc\n * readers agreeing by luck.\n *\n * What a FILE PICKER's constraints mean is framework knowledge — the framework\n * is what applies them to its own file fields — so the shape belongs to the\n * CAPABILITY. A provider is free to carry its own keys beside these (a client\n * id, an app key); it is not free to invent a different spelling of the ones\n * the framework reads, and now it cannot.\n *\n * A provider declaring `publicConfigSchema` should EXTEND the schema for the\n * capability it claims, so hydration validates the framework's fields and its\n * own in one pass.\n */\n\nimport { z } from 'zod';\n\n/**\n * Constraints a `FRONTEND_FILE_PICKER` provider may contribute.\n *\n * Every field is optional: a provider that constrains nothing is legitimate,\n * and the field's own Zod file metadata always wins anyway — a provider only\n * fills the gaps the schema left open.\n *\n * LOOSE, because a provider's own keys live in the same object and must survive\n * a parse that is only looking for these.\n */\nexport const FrontendFilePickerPublicConfigSchema = z.looseObject({\n  /**\n   * MIME types the picker can return.\n   *\n   * An EMPTY list is normalized to absent, and that is behaviour rather than\n   * decoration: the framework turns this into an `accept=` attribute, and an\n   * empty `accept=\"\"` does not mean \"anything\" — it means the file dialog\n   * offers nothing. A provider that declares no types is unconstrained, so the\n   * normalization happens here, once, instead of at each reader that would have\n   * to remember it.\n   */\n  acceptedMimeTypes: z\n    .array(z.string().min(1))\n    .optional()\n    .transform((types) => (types !== undefined && types.length > 0 ? types : undefined)),\n  /**\n   * Largest file the picker will hand back, in MEGABYTES.\n   *\n   * The unit is in the name because the framework's own constraint is in BYTES\n   * and the conversion is the kind of thing that is wrong by a factor of 1024²\n   * exactly once, silently, in production.\n   */\n  maxFileSizeMb: z.number().positive().optional(),\n  /** How many files one selection may return. Applies only to a `multiple` field. */\n  maxSelectionCount: z.number().int().positive().optional(),\n});\nexport type FrontendFilePickerPublicConfig = z.infer<typeof FrontendFilePickerPublicConfigSchema>;\n\n/**\n * Every built-in capability that owns public-config keys, and the schema that\n * owns them.\n *\n * A MAP rather than a list of keys, so the keys are derived from the schema that\n * validates them and the two cannot disagree. Adding a capability's shape here\n * is the ONE edit that makes its keys admissible everywhere — the admission,\n * the refusal message and the validation all read this map.\n *\n * A capability absent from this map owns no public-config keys, which is the\n * common case and needs no entry.\n */\nexport const FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS: Readonly<Record<string, z.ZodObject>> = Object.freeze({\n  FRONTEND_FILE_PICKER: FrontendFilePickerPublicConfigSchema,\n});\n\n/**\n * The public-config keys a provider admits BY VIRTUE OF the capabilities it\n * claims, beside whatever its own `publicConfigSchema` declares.\n *\n * ## Why this exists — measured 2026-09-18 (#380)\n *\n * `FrontendFilePickerPublicConfigSchema` declares the constraint vocabulary the\n * FRAMEWORK reads off a picker (`acceptedMimeTypes`, `maxFileSizeMb`,\n * `maxSelectionCount`), and `resolveFormFieldFileProviderConstraints` reads it.\n * Three separate gates refused it, because each asked only what the PROVIDER\n * declares:\n *\n * - the config overlay THREW `UNDECLARED_KEY` — *\"a key the provider never reads\n *   would be served to every browser and used by nothing\"*, which is false here:\n *   the framework reads it, for that provider, because it claims the capability;\n * - hydration answered `unknown key` and set the provider's code to `undefined`,\n *   so declaring a size limit DELETED the picker;\n * - and the resolver then found nothing, because nothing had been allowed through.\n *\n * All three engine pickers declare a `publicConfigSchema` (`appId`, `clientId`,\n * `appKey`), so the capability's whole vocabulary was unusable on every one of\n * them. It worked only on an application-authored picker that declares NO\n * schema, where the first gate is skipped — which is why the dogfood never saw it.\n *\n * The capability schema's own docstring asked a provider to *\"EXTEND the schema\n * for the capability it claims\"*, and no affordance to do that existed. This is\n * the affordance, DERIVED instead: a provider claiming `FRONTEND_FILE_PICKER`\n * admits the file-picker keys with no edit to the provider, so a capability\n * shape added tomorrow reaches every provider claiming it and none that does not.\n */\nexport function frontendCapabilityPublicConfigKeys(\n  providerCapabilities: readonly string[] | undefined,\n): readonly string[] {\n  if (providerCapabilities === undefined) return [];\n  const keys = new Set<string>();\n  for (const capability of providerCapabilities) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    for (const key of Object.keys(schema.shape)) keys.add(key);\n  }\n  return [...keys];\n}\n\n/**\n * Splits a public-config bag into the half the CAPABILITIES own and the half the\n * provider's own schema must answer for, validating the first here.\n *\n * Returning the two halves rather than one merged bag is what lets a caller run\n * the provider's schema over exactly the keys it declared — a strict provider\n * schema would otherwise refuse the capability's keys, which is the defect this\n * whole mechanism exists to remove.\n */\nexport function partitionFrontendCapabilityPublicConfig(input: {\n  readonly providerCapabilities: readonly string[] | undefined;\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n}): {\n  readonly capabilityConfig: Readonly<Record<string, unknown>>;\n  readonly providerConfig: Readonly<Record<string, unknown>>;\n  readonly issues: ReadonlyArray<{ readonly message: string; readonly path: readonly PropertyKey[] }>;\n} {\n  const owned = new Set(frontendCapabilityPublicConfigKeys(input.providerCapabilities));\n  const capabilityConfig: Record<string, unknown> = {};\n  const providerConfig: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input.publicConfig)) {\n    (owned.has(key) ? capabilityConfig : providerConfig)[key] = value;\n  }\n\n  const issues: Array<{ message: string; path: readonly PropertyKey[] }> = [];\n  for (const capability of input.providerCapabilities ?? []) {\n    const schema = FRONTEND_CAPABILITY_PUBLIC_CONFIG_SCHEMAS[capability];\n    if (schema === undefined) continue;\n    // Only the keys this capability owns: a loose schema would otherwise re-admit\n    // the provider's own keys and report nothing about them, which is correct but\n    // makes the partition pointless.\n    const subject = Object.fromEntries(\n      Object.entries(capabilityConfig).filter(([key]) => key in schema.shape),\n    );\n    const parsed = schema.safeParse(subject);\n    if (parsed.success) continue;\n    for (const issue of parsed.error.issues) {\n      issues.push({ message: issue.message, path: issue.path });\n    }\n  }\n\n  return { capabilityConfig, providerConfig, issues };\n}\n\n/**\n * The full set of public-config keys a provider admits: what its own schema\n * declares, UNION what the capabilities it claims own.\n *\n * `undefined` in, `undefined` out — and that is load-bearing. A provider with no\n * introspectable schema has no key list, which every gate refuses\n * (`SCHEMA_NOT_INTROSPECTABLE`, #1705); widening `undefined` to the capability\n * keys would instead turn that refusal into \"declares exactly these\" and hide\n * the missing schema behind a plausible list.\n *\n * It lives beside the capability map rather than beside\n * `readDeclaredPublicConfigKeys`, because that module is deliberately\n * dependency-free so a provider module can declare a schema without pulling a\n * validation library in.\n */\nexport function admissibleFrontendPublicConfigKeys(input: {\n  readonly declaredKeys: readonly string[] | undefined;\n  readonly providerCapabilities: readonly string[] | undefined;\n}): readonly string[] | undefined {\n  if (input.declaredKeys === undefined) return undefined;\n  return [...new Set([...input.declaredKeys, ...frontendCapabilityPublicConfigKeys(input.providerCapabilities)])];\n}\n\n/**\n * Lays ONE provider's declared picker limits under the field's own, for that\n * provider's picker and no other.\n *\n * ## Why this is per-provider and not resolved once (#380)\n *\n * The field used to resolve its picker constraints from the FIRST provider the\n * registry returned for `FRONTEND_FILE_PICKER`, and pass that single object to\n * whichever picker the person then chose — so a Drive limit governed a Dropbox\n * pick, and which provider won depended on registry order. `ProviderFilePickerHost`\n * was built so \"a framework that picked one would be making a product decision in\n * a lookup table\"; the constraints were still making exactly that decision, one\n * layer up, and it became reachable the moment a third picker shipped.\n *\n * It also reached the field's OWN native upload, which is wrong at any number of\n * providers: a vendor's picker limit says nothing about a local file going to the\n * field's own storage.\n *\n * Precedence is unchanged and is the part that must not move: the field's Zod\n * metadata ALWAYS wins, and a provider only fills the gaps the schema left open.\n * `maxSelectionCount` applies only to a `multiple` field — a single-file field\n * never inherits a selection count.\n */\nexport function layerProviderFilePickerConstraints<\n  TConstraints extends {\n    readonly allowedMimeTypes?: readonly string[];\n    readonly maxSize?: number;\n    readonly maxFiles?: number;\n  },\n>(input: {\n  readonly base: TConstraints;\n  readonly multiple: boolean;\n  readonly publicConfig: Readonly<Record<string, unknown>> | undefined;\n}): TConstraints {\n  const parsed = FrontendFilePickerPublicConfigSchema.safeParse(input.publicConfig ?? {});\n  // A provider whose own values are wrong contributes NOTHING rather than\n  // nonsense — the same choice the three hand readers this replaced could not\n  // make, because a bad value was indistinguishable from an absent one.\n  const declared = parsed.success ? parsed.data : {};\n  const maxSizeMb = declared.maxFileSizeMb;\n\n  return {\n    ...input.base,\n    allowedMimeTypes: input.base.allowedMimeTypes ?? declared.acceptedMimeTypes,\n    maxSize: input.base.maxSize ?? (maxSizeMb === undefined ? undefined : maxSizeMb * 1024 * 1024),\n    maxFiles: input.multiple ? (input.base.maxFiles ?? declared.maxSelectionCount) : input.base.maxFiles,\n  };\n}\n"]}

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.d.ts

@@ -94,4 +94,49 @@ export interface FrontendErrorMonitoringSink {
  * reported diagnostic rather than a `TypeError` thrown while handling a crash.
  */
 export declare function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink;
+/**
+ * One product-analytics event, as the framework hands it to a vendor (#1704).
+ *
+ * The same shape `AnalyticsContext.track()` has always taken — a name and flat properties — so the
+ * framework's own auto-instrumentation and an application's custom `track()` reach a vendor unchanged.
+ */
+export interface FrontendProductAnalyticsEvent {
+    readonly name: string;
+    readonly properties?: Readonly<Record<string, unknown>>;
+}
+/**
+ * What the framework calls on a `FRONTEND_PRODUCT_ANALYTICS` provider's activated handle (#1704).
+ *
+ * The application's analytics used to reach a vendor through a second registry inside
+ * `AnalyticsContext`, with its own consent gate. A vendor now arrives as a provider module, is started
+ * by the consent-based activation consumer once the person grants `ConsentPurpose.ANALYTICS`, and
+ * stopped by its `deactivate` on withdrawal or sign-out; `AnalyticsContext` only DISPATCHES to the
+ * sinks that are currently active. So there is one consent gate and one CSP footprint for a vendor.
+ *
+ * Synchronous and returning nothing, for the reason `FrontendErrorMonitoringSink` gives: a vendor
+ * queues and flushes on its own schedule, and tracking must never become something a surface awaits.
+ */
+export interface FrontendProductAnalyticsSink {
+    track(event: FrontendProductAnalyticsEvent): void;
+    page(path: string, properties?: Readonly<Record<string, unknown>>): void;
+    /** The signed-in person, by the framework's own opaque id — never an email or a name. */
+    identify(identity: {
+        readonly userId: string;
+        readonly organizationId?: string;
+    }): void;
+    /** Forget the identified person (sign-out) without stopping the provider. */
+    reset(): void;
+}
+/** Whether an activated SDK handle can receive product-analytics events — checked at the seam, like the crash sink. */
+export declare function isFrontendProductAnalyticsSink(handle: unknown): handle is FrontendProductAnalyticsSink;
+/**
+ * What the framework calls on a `FRONTEND_CAPTCHA` provider's activated handle (#1735): mint a token for
+ * one action, which the same vendor's backend part verifies. Returns `undefined` when the vendor could not
+ * produce one; the form then answers the engine's proof of work instead.
+ */
+export interface FrontendCaptchaSink {
+    execute(action: string): Promise<string | undefined>;
+}
+/** Whether an activated SDK handle can mint captcha tokens — checked at the seam, like the other sinks. */
+export declare function isFrontendCaptchaSink(handle: unknown): handle is FrontendCaptchaSink;
 //# sourceMappingURL=frontend-capability-runtime.shared.types.d.ts.map

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-runtime.shared.types.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAMpG"}
+{"version":3,"file":"frontend-capability-runtime.shared.types.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,2BAA2B,CAMpG;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,KAAK,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAClD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACzE,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACxF,6EAA6E;IAC7E,KAAK,IAAI,IAAI,CAAC;CACf;AAED,uHAAuH;AACvH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,4BAA4B,CAOtG;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACtD;AAED,2GAA2G;AAC3G,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,mBAAmB,CAEpF"}

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.js

@@ -38,4 +38,18 @@ export function isFrontendErrorMonitoringSink(handle) {
         && handle !== null
         && typeof handle.reportCrash === 'function');
 }
+/** Whether an activated SDK handle can receive product-analytics events — checked at the seam, like the crash sink. */
+export function isFrontendProductAnalyticsSink(handle) {
+    if (typeof handle !== 'object' || handle === null)
+        return false;
+    const candidate = handle;
+    return typeof candidate.track === 'function'
+        && typeof candidate.page === 'function'
+        && typeof candidate.identify === 'function'
+        && typeof candidate.reset === 'function';
+}
+/** Whether an activated SDK handle can mint captcha tokens — checked at the seam, like the other sinks. */
+export function isFrontendCaptchaSink(handle) {
+    return typeof handle === 'object' && handle !== null && typeof handle.execute === 'function';
+}
 //# sourceMappingURL=frontend-capability-runtime.shared.types.js.map

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-runtime.shared.types.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;WACvB,MAAM,KAAK,IAAI;WACf,OAAQ,MAAsC,CAAC,WAAW,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The RUNTIME contract a built-in frontend capability expects of whichever\n * provider fills it — the code-half sibling of\n * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.\n *\n * ## Why the capability owns the shape, and not the framework's call site\n *\n * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider\n * package must not know any vendor's type, and \"a consumer that needs one narrows\n * it at the point where it also knows which provider it asked for.\"\n *\n * That reasoning holds for a picker, where the surface really did ask for Drive.\n * It inverts for an OBSERVABILITY capability: the framework reports a crash without\n * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted\n * collector is listening. Narrowing at the call site would mean a `switch` over\n * vendors inside the engine, which is precisely what the capability model exists to\n * prevent.\n *\n * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,\n * and the framework calls one method it owns the definition of.\n *\n * ## Bundle-safe by construction\n *\n * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from\n * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take\n * a handful of atoms without the decorator-bound schema graph.\n */\n\n/**\n * One crash, as the framework describes it to whichever provider is listening.\n *\n * ## What is in it, and why that is the whole list\n *\n * `name`, `message`, `stack` and `componentStack` are exactly what\n * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught\n * crash. Nothing new is collected to fill this shape; what changes is only that the\n * report can now leave the browser.\n *\n * **`message` is sent as authored, and that is a decision rather than an oversight.**\n * It is the field most likely to carry user content — `new Error(\\`Invalid value:\n * ${input}\\`)` — and it is also the field without which a crash report is close to\n * useless. Every mainstream crash reporter sends the exception message and scrubs by\n * KEY rather than by free-text inspection, because a scrubber over prose either\n * destroys the diagnostic or gives false assurance. An application that cannot accept\n * that should not declare `FRONTEND_ERROR_MONITORING`.\n *\n * ## What is deliberately NOT in it\n *\n * No user identity, no session or organisation id, no request or form payload, and no\n * resource content. A crash report is a diagnostic about CODE; attributing it to a\n * PERSON is a separate decision an application would have to take deliberately, and\n * there is no field here through which it could happen by accident.\n */\nexport interface FrontendCrashReport {\n  /** The error's class name — `TypeError`, `WildoFrontendError`. */\n  readonly name: string;\n  /** The error's own message, unmodified. See the note above before changing this. */\n  readonly message: string;\n  /** The JavaScript stack, when the runtime produced one. */\n  readonly stack?: string;\n  /**\n   * React's component stack for a crash a boundary caught. Component NAMES only —\n   * no props, no state — so it says which screen broke without saying what was on it.\n   */\n  readonly componentStack?: string;\n  /**\n   * Framework classification, flattened to strings at this boundary.\n   *\n   * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,\n   * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must\n   * not pull in, and every mainstream vendor models exactly this as string tags. The\n   * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one\n   * named runtime source and only its serialization is local to this contract.\n   */\n  readonly tags?: Readonly<Record<string, string>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated\n * handle.\n *\n * Synchronous and returning nothing, deliberately. Reporting a crash must never\n * become something a crashing surface has to await or handle: a vendor SDK queues and\n * flushes on its own schedule, and a rejected promise here would be a second error\n * raised from inside the first one's handler.\n */\nexport interface FrontendErrorMonitoringSink {\n  reportCrash(report: FrontendCrashReport): void;\n}\n\n/**\n * Whether an activated SDK handle can receive crash reports.\n *\n * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor\n * namespace that does not implement this contract — a mistake no type can catch,\n * because `handle` is `unknown` by design. Checked at the seam so the failure is a\n * reported diagnostic rather than a `TypeError` thrown while handling a crash.\n */\nexport function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink {\n  return (\n    typeof handle === 'object'\n    && handle !== null\n    && typeof (handle as FrontendErrorMonitoringSink).reportCrash === 'function'\n  );\n}\n"]}
+{"version":3,"file":"frontend-capability-runtime.shared.types.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;WACvB,MAAM,KAAK,IAAI;WACf,OAAQ,MAAsC,CAAC,WAAW,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC;AAkCD,uHAAuH;AACvH,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,SAAS,GAAG,MAAsE,CAAC;IACzF,OAAO,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU;WACvC,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;WACpC,OAAO,SAAS,CAAC,QAAQ,KAAK,UAAU;WACxC,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,CAAC;AAC7C,CAAC;AAWD,2GAA2G;AAC3G,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAQ,MAA8B,CAAC,OAAO,KAAK,UAAU,CAAC;AACxH,CAAC","sourcesContent":["/**\n * The RUNTIME contract a built-in frontend capability expects of whichever\n * provider fills it — the code-half sibling of\n * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.\n *\n * ## Why the capability owns the shape, and not the framework's call site\n *\n * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider\n * package must not know any vendor's type, and \"a consumer that needs one narrows\n * it at the point where it also knows which provider it asked for.\"\n *\n * That reasoning holds for a picker, where the surface really did ask for Drive.\n * It inverts for an OBSERVABILITY capability: the framework reports a crash without\n * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted\n * collector is listening. Narrowing at the call site would mean a `switch` over\n * vendors inside the engine, which is precisely what the capability model exists to\n * prevent.\n *\n * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,\n * and the framework calls one method it owns the definition of.\n *\n * ## Bundle-safe by construction\n *\n * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from\n * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take\n * a handful of atoms without the decorator-bound schema graph.\n */\n\n/**\n * One crash, as the framework describes it to whichever provider is listening.\n *\n * ## What is in it, and why that is the whole list\n *\n * `name`, `message`, `stack` and `componentStack` are exactly what\n * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught\n * crash. Nothing new is collected to fill this shape; what changes is only that the\n * report can now leave the browser.\n *\n * **`message` is sent as authored, and that is a decision rather than an oversight.**\n * It is the field most likely to carry user content — `new Error(\\`Invalid value:\n * ${input}\\`)` — and it is also the field without which a crash report is close to\n * useless. Every mainstream crash reporter sends the exception message and scrubs by\n * KEY rather than by free-text inspection, because a scrubber over prose either\n * destroys the diagnostic or gives false assurance. An application that cannot accept\n * that should not declare `FRONTEND_ERROR_MONITORING`.\n *\n * ## What is deliberately NOT in it\n *\n * No user identity, no session or organisation id, no request or form payload, and no\n * resource content. A crash report is a diagnostic about CODE; attributing it to a\n * PERSON is a separate decision an application would have to take deliberately, and\n * there is no field here through which it could happen by accident.\n */\nexport interface FrontendCrashReport {\n  /** The error's class name — `TypeError`, `WildoFrontendError`. */\n  readonly name: string;\n  /** The error's own message, unmodified. See the note above before changing this. */\n  readonly message: string;\n  /** The JavaScript stack, when the runtime produced one. */\n  readonly stack?: string;\n  /**\n   * React's component stack for a crash a boundary caught. Component NAMES only —\n   * no props, no state — so it says which screen broke without saying what was on it.\n   */\n  readonly componentStack?: string;\n  /**\n   * Framework classification, flattened to strings at this boundary.\n   *\n   * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,\n   * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must\n   * not pull in, and every mainstream vendor models exactly this as string tags. The\n   * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one\n   * named runtime source and only its serialization is local to this contract.\n   */\n  readonly tags?: Readonly<Record<string, string>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated\n * handle.\n *\n * Synchronous and returning nothing, deliberately. Reporting a crash must never\n * become something a crashing surface has to await or handle: a vendor SDK queues and\n * flushes on its own schedule, and a rejected promise here would be a second error\n * raised from inside the first one's handler.\n */\nexport interface FrontendErrorMonitoringSink {\n  reportCrash(report: FrontendCrashReport): void;\n}\n\n/**\n * Whether an activated SDK handle can receive crash reports.\n *\n * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor\n * namespace that does not implement this contract — a mistake no type can catch,\n * because `handle` is `unknown` by design. Checked at the seam so the failure is a\n * reported diagnostic rather than a `TypeError` thrown while handling a crash.\n */\nexport function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink {\n  return (\n    typeof handle === 'object'\n    && handle !== null\n    && typeof (handle as FrontendErrorMonitoringSink).reportCrash === 'function'\n  );\n}\n\n/**\n * One product-analytics event, as the framework hands it to a vendor (#1704).\n *\n * The same shape `AnalyticsContext.track()` has always taken — a name and flat properties — so the\n * framework's own auto-instrumentation and an application's custom `track()` reach a vendor unchanged.\n */\nexport interface FrontendProductAnalyticsEvent {\n  readonly name: string;\n  readonly properties?: Readonly<Record<string, unknown>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_PRODUCT_ANALYTICS` provider's activated handle (#1704).\n *\n * The application's analytics used to reach a vendor through a second registry inside\n * `AnalyticsContext`, with its own consent gate. A vendor now arrives as a provider module, is started\n * by the consent-based activation consumer once the person grants `ConsentPurpose.ANALYTICS`, and\n * stopped by its `deactivate` on withdrawal or sign-out; `AnalyticsContext` only DISPATCHES to the\n * sinks that are currently active. So there is one consent gate and one CSP footprint for a vendor.\n *\n * Synchronous and returning nothing, for the reason `FrontendErrorMonitoringSink` gives: a vendor\n * queues and flushes on its own schedule, and tracking must never become something a surface awaits.\n */\nexport interface FrontendProductAnalyticsSink {\n  track(event: FrontendProductAnalyticsEvent): void;\n  page(path: string, properties?: Readonly<Record<string, unknown>>): void;\n  /** The signed-in person, by the framework's own opaque id — never an email or a name. */\n  identify(identity: { readonly userId: string; readonly organizationId?: string }): void;\n  /** Forget the identified person (sign-out) without stopping the provider. */\n  reset(): void;\n}\n\n/** Whether an activated SDK handle can receive product-analytics events — checked at the seam, like the crash sink. */\nexport function isFrontendProductAnalyticsSink(handle: unknown): handle is FrontendProductAnalyticsSink {\n  if (typeof handle !== 'object' || handle === null) return false;\n  const candidate = handle as Partial<Record<keyof FrontendProductAnalyticsSink, unknown>>;\n  return typeof candidate.track === 'function'\n    && typeof candidate.page === 'function'\n    && typeof candidate.identify === 'function'\n    && typeof candidate.reset === 'function';\n}\n\n/**\n * What the framework calls on a `FRONTEND_CAPTCHA` provider's activated handle (#1735): mint a token for\n * one action, which the same vendor's backend part verifies. Returns `undefined` when the vendor could not\n * produce one; the form then answers the engine's proof of work instead.\n */\nexport interface FrontendCaptchaSink {\n  execute(action: string): Promise<string | undefined>;\n}\n\n/** Whether an activated SDK handle can mint captcha tokens — checked at the seam, like the other sinks. */\nexport function isFrontendCaptchaSink(handle: unknown): handle is FrontendCaptchaSink {\n  return typeof handle === 'object' && handle !== null && typeof (handle as FrontendCaptchaSink).execute === 'function';\n}\n\n"]}