@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.d.ts

@@ -107,6 +107,8 @@ export declare const FrontendProviderEntrySchema: z.ZodObject<{
         imgOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
         styleOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
         fontOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        workerOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        mediaOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
         derivedOrigins: z.ZodDefault<z.ZodArray<z.ZodObject<{
             publicConfigKey: z.ZodString;
             bucket: z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendCspOriginBucket>;
@@ -142,14 +144,22 @@ export declare const FrontendProviderEntrySchema: z.ZodObject<{
      */
     components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
+        placeIdRetention: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderAddressLookupPlaceIdRetention>>;
+        addressLookup: z.ZodOptional<z.ZodObject<{
+            suggestOperationId: z.ZodString;
+            retrieveOperationId: z.ZodString;
+            sessionTokenInput: z.ZodOptional<z.ZodString>;
+            attributionMark: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>>;
     /**
      * The public-config keys the provider module DECLARES it reads — the DATA
      * half of its `publicConfigSchema`, mirrored here so the companion walk can
      * refuse an application-supplied key the module never declared, without
      * executing the module (#394 P3). Absent when the module's schema is not
-     * introspectable, which the overlay reads as "cannot enforce here", never as
-     * "declares nothing".
+     * introspectable, which the overlay REFUSES (`SCHEMA_NOT_INTROSPECTABLE`, #1705)
+     * — never read as "declares nothing". Optional on the wire only so an entry an
+     * older producer wrote still parses and is refused with a message.
      */
     publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
     /**
@@ -177,6 +187,88 @@ export declare const FrontendProviderEntrySchema: z.ZodObject<{
         readonly GOOGLE_DRIVE: "google_drive";
         readonly DROPBOX: "dropbox";
     }>>;
+    /**
+     * The vendor's deployment model, processing regions and legal entity, as the facet module
+     * declares them (#1743) — the primitives a processor register, a recipients fact and a regional
+     * report are derived from.
+     *
+     * ## Why it rides HERE, and why the browser gets it too
+     *
+     * A frontend provider executes in the DATA SUBJECT'S BROWSER and talks to its vendor directly, so
+     * it is exactly the kind of recipient a privacy notice must name (#345). The module has carried
+     * this profile since #345, and every projection built the entry field by field and left it
+     * behind — so reCAPTCHA, Sentry and the Drive/OneDrive/Dropbox pickers stated their
+     * entity and regions in source and no compliance reader could see any of them.
+     *
+     * This entry is the one record that is materialized PER APPLICATION, PER SERVICE, for exactly the
+     * providers that service SERVES (`frontendProviderBootstraps` in the generated frontend-services
+     * artifact). That is the population a recipient derivation needs — the browser vendors this
+     * application actually runs, not every module the engine ships — and a reader gets it by parsing a
+     * generated JSON file on disk rather than by loading provider packages. A field on the
+     * contribution beside `identity` was the alternative and was rejected for that reason: the
+     * contribution is never materialized per service, so a reader would have to re-run discovery.
+     *
+     * It is therefore also served on `/application-config`. That costs a few public facts (a vendor's
+     * name and the regions it offers, which the application's own privacy notice publishes anyway)
+     * and it keeps the two producing sites — the companion projection and the backend fallback —
+     * identical, so what a compliance reader sees never depends on whether a sync ran.
+     *
+     * Not a second authority for backend providers. A provider SPECIFICATION restates its BACKEND
+     * module's profile (and is reconciled against it); this restates the FRONTEND facet's. Registering
+     * specifications for browser-only vendors was the other option and was rejected: a specification
+     * describes a backend module — protocols, secrets contract, engine slots — and a browser-only
+     * vendor has none of them.
+     *
+     * Absent means the module's author stated nothing, which a reader must report as NOT ESTABLISHED
+     * rather than skip — `listServedFrontendProviderCompliance` (beside the profile schema) returns `null` for exactly that.
+     */
+    complianceProfile: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        determination: z.ZodOptional<z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.ESTABLISHED>>;
+        deploymentModels: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderDeploymentModel>>;
+        processingRegions: z.ZodArray<z.ZodString>;
+        vendorLegalEntityName: z.ZodOptional<z.ZodString>;
+        subprocessorListUrl: z.ZodOptional<z.ZodURL>;
+        dataProcessingAgreementUrl: z.ZodOptional<z.ZodURL>;
+        evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            facts: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderComplianceFact>>;
+            source: z.ZodURL;
+            verifiedAt: z.ZodISODate;
+        }, z.core.$strict>>>;
+        subjectErasure: z.ZodOptional<z.ZodObject<{
+            stance: z.ZodEnum<{
+                readonly NO_SUBJECT_DATA: import("..").HttpApiErasureStance.NO_SUBJECT_DATA;
+                readonly EXTERNAL_ERASURE_OPERATION: import("..").HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION;
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>, z.ZodObject<{
+        determination: z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.UNDETERMINED>;
+        reason: z.ZodString;
+    }, z.core.$strict>]>>;
+    /**
+     * Consent purposes this PROVIDER rests on beyond its capabilities' floor (#1702) — the facet module's
+     * own `consentPurposes`, as data.
+     *
+     * ## Why it has to ride here
+     *
+     * The consent decision is taken in the browser on the HYDRATED module, whose `providerCapabilities`
+     * come from this entry, so a vendor-level purpose the entry did not carry would reach no gate at all:
+     * a provider whose vendor needs more than its capability's floor (Google reCAPTCHA, which the CNIL held
+     * is not exempt as a security measure because it also serves Google's own purposes — Délibération
+     * SAN-2023-003) would start on the floor alone. Carried by BOTH producing sites — the companion
+     * projection and the backend fallback — for the reason every field above is.
+     *
+     * ADDITIVE ONLY. It is unioned with the capabilities' floor by `consentPurposesRequiredByProvider`,
+     * so an entry can never lower what a capability requires; and hydration unions it with the CODE
+     * module's own declaration, so a stale entry cannot lower what the bundled module requires either.
+     * Absent and `[]` mean the same thing: nothing beyond the floor.
+     *
+     * Strings on the wire, like `providerCapabilities`, and for the same version-skew reason: a member an
+     * older reader does not know must not fail the parse of the whole provider block. The projection
+     * refuses an unknown member where it is authored, and the browser's consent decision FAILS CLOSED on
+     * one it meets (`isProviderPermittedByConsent`) — so an unknown purpose withholds its provider rather
+     * than being dropped, which on an additive field would lower the floor.
+     */
+    consentPurposes: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$loose>;
 export type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;
 export declare const FrontendProvidersBlockSchema: z.ZodObject<{
@@ -213,6 +305,8 @@ export declare const FrontendProvidersBlockSchema: z.ZodObject<{
             imgOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
             styleOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
             fontOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            workerOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            mediaOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
             derivedOrigins: z.ZodDefault<z.ZodArray<z.ZodObject<{
                 publicConfigKey: z.ZodString;
                 bucket: z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendCspOriginBucket>;
@@ -248,14 +342,22 @@ export declare const FrontendProvidersBlockSchema: z.ZodObject<{
          */
         components: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             selectionDelivery: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderFrontendSelectionDelivery>>;
+            placeIdRetention: z.ZodOptional<z.ZodEnum<typeof import("./provider-frontend-surface.shared.schemas").ProviderAddressLookupPlaceIdRetention>>;
+            addressLookup: z.ZodOptional<z.ZodObject<{
+                suggestOperationId: z.ZodString;
+                retrieveOperationId: z.ZodString;
+                sessionTokenInput: z.ZodOptional<z.ZodString>;
+                attributionMark: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>>;
         /**
          * The public-config keys the provider module DECLARES it reads — the DATA
          * half of its `publicConfigSchema`, mirrored here so the companion walk can
          * refuse an application-supplied key the module never declared, without
          * executing the module (#394 P3). Absent when the module's schema is not
-         * introspectable, which the overlay reads as "cannot enforce here", never as
-         * "declares nothing".
+         * introspectable, which the overlay REFUSES (`SCHEMA_NOT_INTROSPECTABLE`, #1705)
+         * — never read as "declares nothing". Optional on the wire only so an entry an
+         * older producer wrote still parses and is refused with a message.
          */
         publicConfigKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
         /**
@@ -283,6 +385,88 @@ export declare const FrontendProvidersBlockSchema: z.ZodObject<{
             readonly GOOGLE_DRIVE: "google_drive";
             readonly DROPBOX: "dropbox";
         }>>;
+        /**
+         * The vendor's deployment model, processing regions and legal entity, as the facet module
+         * declares them (#1743) — the primitives a processor register, a recipients fact and a regional
+         * report are derived from.
+         *
+         * ## Why it rides HERE, and why the browser gets it too
+         *
+         * A frontend provider executes in the DATA SUBJECT'S BROWSER and talks to its vendor directly, so
+         * it is exactly the kind of recipient a privacy notice must name (#345). The module has carried
+         * this profile since #345, and every projection built the entry field by field and left it
+         * behind — so reCAPTCHA, Sentry and the Drive/OneDrive/Dropbox pickers stated their
+         * entity and regions in source and no compliance reader could see any of them.
+         *
+         * This entry is the one record that is materialized PER APPLICATION, PER SERVICE, for exactly the
+         * providers that service SERVES (`frontendProviderBootstraps` in the generated frontend-services
+         * artifact). That is the population a recipient derivation needs — the browser vendors this
+         * application actually runs, not every module the engine ships — and a reader gets it by parsing a
+         * generated JSON file on disk rather than by loading provider packages. A field on the
+         * contribution beside `identity` was the alternative and was rejected for that reason: the
+         * contribution is never materialized per service, so a reader would have to re-run discovery.
+         *
+         * It is therefore also served on `/application-config`. That costs a few public facts (a vendor's
+         * name and the regions it offers, which the application's own privacy notice publishes anyway)
+         * and it keeps the two producing sites — the companion projection and the backend fallback —
+         * identical, so what a compliance reader sees never depends on whether a sync ran.
+         *
+         * Not a second authority for backend providers. A provider SPECIFICATION restates its BACKEND
+         * module's profile (and is reconciled against it); this restates the FRONTEND facet's. Registering
+         * specifications for browser-only vendors was the other option and was rejected: a specification
+         * describes a backend module — protocols, secrets contract, engine slots — and a browser-only
+         * vendor has none of them.
+         *
+         * Absent means the module's author stated nothing, which a reader must report as NOT ESTABLISHED
+         * rather than skip — `listServedFrontendProviderCompliance` (beside the profile schema) returns `null` for exactly that.
+         */
+        complianceProfile: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            determination: z.ZodOptional<z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.ESTABLISHED>>;
+            deploymentModels: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderDeploymentModel>>;
+            processingRegions: z.ZodArray<z.ZodString>;
+            vendorLegalEntityName: z.ZodOptional<z.ZodString>;
+            subprocessorListUrl: z.ZodOptional<z.ZodURL>;
+            dataProcessingAgreementUrl: z.ZodOptional<z.ZodURL>;
+            evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                facts: z.ZodArray<z.ZodEnum<typeof import("./provider-compliance-profile.shared.schemas").ProviderComplianceFact>>;
+                source: z.ZodURL;
+                verifiedAt: z.ZodISODate;
+            }, z.core.$strict>>>;
+            subjectErasure: z.ZodOptional<z.ZodObject<{
+                stance: z.ZodEnum<{
+                    readonly NO_SUBJECT_DATA: import("..").HttpApiErasureStance.NO_SUBJECT_DATA;
+                    readonly EXTERNAL_ERASURE_OPERATION: import("..").HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION;
+                }>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>, z.ZodObject<{
+            determination: z.ZodLiteral<import("./provider-compliance-profile.shared.schemas").ProviderComplianceDetermination.UNDETERMINED>;
+            reason: z.ZodString;
+        }, z.core.$strict>]>>;
+        /**
+         * Consent purposes this PROVIDER rests on beyond its capabilities' floor (#1702) — the facet module's
+         * own `consentPurposes`, as data.
+         *
+         * ## Why it has to ride here
+         *
+         * The consent decision is taken in the browser on the HYDRATED module, whose `providerCapabilities`
+         * come from this entry, so a vendor-level purpose the entry did not carry would reach no gate at all:
+         * a provider whose vendor needs more than its capability's floor (Google reCAPTCHA, which the CNIL held
+         * is not exempt as a security measure because it also serves Google's own purposes — Délibération
+         * SAN-2023-003) would start on the floor alone. Carried by BOTH producing sites — the companion
+         * projection and the backend fallback — for the reason every field above is.
+         *
+         * ADDITIVE ONLY. It is unioned with the capabilities' floor by `consentPurposesRequiredByProvider`,
+         * so an entry can never lower what a capability requires; and hydration unions it with the CODE
+         * module's own declaration, so a stale entry cannot lower what the bundled module requires either.
+         * Absent and `[]` mean the same thing: nothing beyond the floor.
+         *
+         * Strings on the wire, like `providerCapabilities`, and for the same version-skew reason: a member an
+         * older reader does not know must not fail the parse of the whole provider block. The projection
+         * refuses an unknown member where it is authored, and the browser's consent decision FAILS CLOSED on
+         * one it meets (`isProviderPermittedByConsent`) — so an unknown purpose withholds its provider rather
+         * than being dropped, which on an additive field would lower the floor.
+         */
+        consentPurposes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$loose>>>;
 }, z.core.$strip>;
 export type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-entry.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAoBH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEjG;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;IAKtC;;;;OAIG;;;;;;;;;;;;;IAEH;;;;;OAKG;;;;;IAEH,0EAA0E;;;;;;;;IAE1E;;;;;;;;;OASG;;;;IAEH;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;;OAiBG;;;;;;;;iBAEH,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;QAzDvC;;;;WAIG;;;;;;;;;;;;;QAEH;;;;;WAKG;;;;;QAEH,0EAA0E;;;;;;;;QAE1E;;;;;;;;;WASG;;;;QAEH;;;;;;;WAOG;;QAEH;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;;iBAOH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"frontend-provider-entry.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAwBH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEjG;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;IAKtC;;;;OAIG;;;;;;;;;;;;;;;IAEH;;;;;OAKG;;;;;IAEH,0EAA0E;;;;;;;;IAE1E;;;;;;;;;OASG;;;;;;;;;;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;;;;;;;;OAiBG;;;;;;;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;;;;;;;;;;;;;;;;;;;;;;;IAEH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;;iBAEH,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;QAvHvC;;;;WAIG;;;;;;;;;;;;;;;QAEH;;;;;WAKG;;;;;QAEH,0EAA0E;;;;;;;;QAE1E;;;;;;;;;WASG;;;;;;;;;;;QAEH;;;;;;;;WAQG;;QAEH;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;QAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCG;;;;;;;;;;;;;;;;;;;;;;;QAEH;;;;;;;;;;;;;;;;;;;;;;;WAuBG;;;iBAOH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { ProviderComplianceProfileSchema } from './provider-compliance-profile.shared.schemas.js';
 import { ProviderMetadataSchema } from './provider-metadata.shared.schemas.js';
 import { ProviderFrontendComponentDescriptorsSchema, ProviderFrontendCspFootprintSchema, ProviderFrontendScriptDeclarationSchema, ProviderFrontendSdkDescriptorSchema, } from './provider-frontend-surface.shared.schemas.js';
 /**
@@ -38,19 +39,23 @@ import { ProviderFrontendComponentDescriptorsSchema, ProviderFrontendCspFootprin
  *
  * A member is SERVED when `FileStorageRouterBackendService` registers an `IFileStorageProvider` for
  * it; that map is the one runtime answer, and this comment is a dated reading of it rather than a
- * second authority. Measured 2026-09-17: `WILDO_MANAGED`, `LOCAL_DIRECTORY` and `GOOGLE_DRIVE` are
- * served; `ONEDRIVE` and `DROPBOX` are declarable and ship no provider.
+ * second authority. The engine serves `WILDO_MANAGED`, `LOCAL_DIRECTORY` and `GOOGLE_DRIVE` itself;
+ * since #1674 any other member is served when a loaded provider module CONTRIBUTES an adapter for it
+ * (`fileStorageAdapters`, `ProviderFileStorageAdapter`). A provider serves a member of this closed
+ * vocabulary; it never adds one. Measured 2026-09-29: the engine's own `microsoft-onedrive` (since #2017) contributes
+ * `ONEDRIVE` (a person's own OneDrive through Microsoft Graph, commercial cloud only); nothing contributes
+ * `DROPBOX`.
  *
  * Declaring an unserved member is not silently ignored — the router refuses and now says WHICH of the
  * two problems it is, because "not implemented" and "implemented but not configured" have different
  * remedies and the old single message sent an operator looking for environment variables that cannot
  * exist.
  *
- * The unserved members are NOT removed here, deliberately. `ONEDRIVE` is the subject of #570, whose
- * open question is exactly whether to build the governed path, keep the current picker, or drop it —
- * deleting the member would answer that by default and from the wrong place. Re-measure before
- * quoting this paragraph; the count was "three of five" when #460 was filed and Drive has landed
- * since.
+ * An unserved member is NOT removed here, deliberately: a member a package may yet serve is part of the
+ * closed vocabulary, and deleting it would decide from the wrong place that nothing ever will. (`ONEDRIVE`
+ * STORING is served since #1674; the governed OneDrive PICK path of #570 is separate and still unbuilt.)
+ * Re-measure before quoting this paragraph; the count was "three of five" when #460 was filed, and Drive and
+ * OneDrive have landed since.
  */
 export const FileStorageAccepted = {
     WILDO_MANAGED: 'wildo_managed',
@@ -130,8 +135,9 @@ export const FrontendProviderEntrySchema = z.looseObject({
      * half of its `publicConfigSchema`, mirrored here so the companion walk can
      * refuse an application-supplied key the module never declared, without
      * executing the module (#394 P3). Absent when the module's schema is not
-     * introspectable, which the overlay reads as "cannot enforce here", never as
-     * "declares nothing".
+     * introspectable, which the overlay REFUSES (`SCHEMA_NOT_INTROSPECTABLE`, #1705)
+     * — never read as "declares nothing". Optional on the wire only so an entry an
+     * older producer wrote still parses and is refused with a message.
      */
     publicConfigKeys: z.array(z.string().min(1)).optional(),
     /**
@@ -153,6 +159,67 @@ export const FrontendProviderEntrySchema = z.looseObject({
      * provider back as its `connectedProviderRef`; a pin holds the two ends equal.
      */
     fileStorage: z.enum(FileStorageAccepted).optional(),
+    /**
+     * The vendor's deployment model, processing regions and legal entity, as the facet module
+     * declares them (#1743) — the primitives a processor register, a recipients fact and a regional
+     * report are derived from.
+     *
+     * ## Why it rides HERE, and why the browser gets it too
+     *
+     * A frontend provider executes in the DATA SUBJECT'S BROWSER and talks to its vendor directly, so
+     * it is exactly the kind of recipient a privacy notice must name (#345). The module has carried
+     * this profile since #345, and every projection built the entry field by field and left it
+     * behind — so reCAPTCHA, Sentry and the Drive/OneDrive/Dropbox pickers stated their
+     * entity and regions in source and no compliance reader could see any of them.
+     *
+     * This entry is the one record that is materialized PER APPLICATION, PER SERVICE, for exactly the
+     * providers that service SERVES (`frontendProviderBootstraps` in the generated frontend-services
+     * artifact). That is the population a recipient derivation needs — the browser vendors this
+     * application actually runs, not every module the engine ships — and a reader gets it by parsing a
+     * generated JSON file on disk rather than by loading provider packages. A field on the
+     * contribution beside `identity` was the alternative and was rejected for that reason: the
+     * contribution is never materialized per service, so a reader would have to re-run discovery.
+     *
+     * It is therefore also served on `/application-config`. That costs a few public facts (a vendor's
+     * name and the regions it offers, which the application's own privacy notice publishes anyway)
+     * and it keeps the two producing sites — the companion projection and the backend fallback —
+     * identical, so what a compliance reader sees never depends on whether a sync ran.
+     *
+     * Not a second authority for backend providers. A provider SPECIFICATION restates its BACKEND
+     * module's profile (and is reconciled against it); this restates the FRONTEND facet's. Registering
+     * specifications for browser-only vendors was the other option and was rejected: a specification
+     * describes a backend module — protocols, secrets contract, engine slots — and a browser-only
+     * vendor has none of them.
+     *
+     * Absent means the module's author stated nothing, which a reader must report as NOT ESTABLISHED
+     * rather than skip — `listServedFrontendProviderCompliance` (beside the profile schema) returns `null` for exactly that.
+     */
+    complianceProfile: ProviderComplianceProfileSchema.optional(),
+    /**
+     * Consent purposes this PROVIDER rests on beyond its capabilities' floor (#1702) — the facet module's
+     * own `consentPurposes`, as data.
+     *
+     * ## Why it has to ride here
+     *
+     * The consent decision is taken in the browser on the HYDRATED module, whose `providerCapabilities`
+     * come from this entry, so a vendor-level purpose the entry did not carry would reach no gate at all:
+     * a provider whose vendor needs more than its capability's floor (Google reCAPTCHA, which the CNIL held
+     * is not exempt as a security measure because it also serves Google's own purposes — Délibération
+     * SAN-2023-003) would start on the floor alone. Carried by BOTH producing sites — the companion
+     * projection and the backend fallback — for the reason every field above is.
+     *
+     * ADDITIVE ONLY. It is unioned with the capabilities' floor by `consentPurposesRequiredByProvider`,
+     * so an entry can never lower what a capability requires; and hydration unions it with the CODE
+     * module's own declaration, so a stale entry cannot lower what the bundled module requires either.
+     * Absent and `[]` mean the same thing: nothing beyond the floor.
+     *
+     * Strings on the wire, like `providerCapabilities`, and for the same version-skew reason: a member an
+     * older reader does not know must not fail the parse of the whole provider block. The projection
+     * refuses an unknown member where it is authored, and the browser's consent decision FAILS CLOSED on
+     * one it meets (`isProviderPermittedByConsent`) — so an unknown purpose withholds its provider rather
+     * than being dropped, which on an additive field would lower the floor.
+     */
+    consentPurposes: z.array(z.string().min(1)).optional(),
 });
 export const FrontendProvidersBlockSchema = z.object({
     providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-entry.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;CACV,CAAC;AAGX;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACvD,QAAQ,EAAE,sBAAsB;IAChC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,GAAG,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACnD,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,QAAQ,EAAE;IACpE;;;;;;;;;OASG;IACH,UAAU,EAAE,0CAA0C,CAAC,QAAQ,EAAE;IACjE;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { ProviderMetadataSchema } from './provider-metadata.shared.schemas';\nimport {\n  ProviderFrontendComponentDescriptorsSchema,\n  ProviderFrontendCspFootprintSchema,\n  ProviderFrontendScriptDeclarationSchema,\n  ProviderFrontendSdkDescriptorSchema,\n} from './provider-frontend-surface.shared.schemas';\n\n/**\n * The `z_file` storage vocabulary, as a BROWSER-SAFE declaration of the values\n * `FileStorageAccepted` in `@wildo-ai/zod-decorators` owns.\n *\n * ## Why this is not an import of that enum\n *\n * This file sits in the `@wildo-ai/saas-models/public-runtime` closure, which\n * browser-bound provider modules load. Importing ANYTHING from\n * `@wildo-ai/zod-decorators` puts that package's root barrel into the bundle,\n * and that barrel mutates Zod's prototypes as an import side effect\n * (`ensureZodDecoratorsLoaded(z)`) — the reason K-3 forbids it, and what\n * `public-runtime.boundary.test.ts` measures. A re-export of the enum (the\n * previous shape, #394 P5) is an import all the same (#607).\n *\n * ## Why a literal union, and why it stays compatible\n *\n * The owning enum is the ONE runtime source of the vocabulary; this is the\n * browser door's spelling of it, pinned member-for-member (keys AND values, at\n * type level and at runtime) by `__tests__/file-storage-accepted.drift.test.ts`\n * — the same arrangement `BUILTIN_PROVIDER_PROTOCOL` has with the engine's\n * protocol enum, for the same boundary.\n *\n * It is `as const` rather than a second `enum` on purpose: two enums are\n * NOMINALLY distinct, so the field side (`z_file({ storageAccepted })`, the\n * owning enum) could not be compared with the provider side (this). A string\n * enum IS assignable to the literal union of its values, so the owning enum\n * flows into every slot typed with this vocabulary, and\n * `FileStorageAccepted.GOOGLE_DRIVE` reads identically at an authoring site.\n * The reverse is not true: a value typed here does not flow into a slot typed\n * with the owning enum — that direction does not occur today, and the compiler\n * reports it if it ever does.\n */\n/*\n * ## NOT every member is served, and the rule is what to trust (#460)\n *\n * A member is SERVED when `FileStorageRouterBackendService` registers an `IFileStorageProvider` for\n * it; that map is the one runtime answer, and this comment is a dated reading of it rather than a\n * second authority. Measured 2026-09-17: `WILDO_MANAGED`, `LOCAL_DIRECTORY` and `GOOGLE_DRIVE` are\n * served; `ONEDRIVE` and `DROPBOX` are declarable and ship no provider.\n *\n * Declaring an unserved member is not silently ignored — the router refuses and now says WHICH of the\n * two problems it is, because \"not implemented\" and \"implemented but not configured\" have different\n * remedies and the old single message sent an operator looking for environment variables that cannot\n * exist.\n *\n * The unserved members are NOT removed here, deliberately. `ONEDRIVE` is the subject of #570, whose\n * open question is exactly whether to build the governed path, keep the current picker, or drop it —\n * deleting the member would answer that by default and from the wrong place. Re-measure before\n * quoting this paragraph; the count was \"three of five\" when #460 was filed and Drive has landed\n * since.\n */\nexport const FileStorageAccepted = {\n  WILDO_MANAGED: 'wildo_managed',\n  LOCAL_DIRECTORY: 'local_directory',\n  ONEDRIVE: 'onedrive',\n  GOOGLE_DRIVE: 'google_drive',\n  DROPBOX: 'dropbox',\n} as const;\nexport type FileStorageAccepted = (typeof FileStorageAccepted)[keyof typeof FileStorageAccepted];\n\n/**\n * Bundle-safe frontend provider atoms shared by every browser-bound runtime.\n *\n * This file intentionally stops at the provider-entry/block level so\n * `@wildo-ai/saas-models/public-runtime` can expose the types without pulling\n * the heavier application-config bootstrap contract into browser bundles.\n */\n\n/**\n * One provider as it crosses the DATA channel: authored on a facet module,\n * projected into a companion contribution, materialized into the generated\n * frontend-services artifact, served on `/application-config`, and parsed by the\n * app, the website and the technical doc.\n *\n * ## Why this is a LOOSE object\n *\n * It is a WIRE RECORD produced by one package version and read by another, and a\n * strict object silently STRIPS what a newer producer added — which is how a\n * provider's CSP footprint would vanish between the CLI that wrote it and the\n * runtime that needs it, leaving a policy that is correct in development\n * (report-only) and wrong in production (enforcing). #328 made\n * `ProviderCompanionContributionSchema` loose for exactly this reason, one file\n * over; the entry rides INSIDE that contribution, so leaving it strict left the\n * hole one layer down. Required fields stay required; unknown keys are kept\n * rather than dropped, so a re-emitting consumer cannot silently discard what it\n * did not understand.\n *\n * ## What may and may not be added here\n *\n * Only things a JSON channel can carry. A function-valued field would be\n * stripped by `JSON.stringify` with no error anywhere — the provider would look\n * declared and do nothing. Executable provider surface (`sdk.activate`,\n * `publicConfigSchema`, and, from S4b, `components`) belongs on the facet module\n * types in `@wildo-ai/external-connectors-public`, which reach a bundle through\n * the generated `frontend-providers.generated.ts` CODE channel instead.\n */\nexport const FrontendProviderEntrySchema = z.looseObject({\n  metadata: ProviderMetadataSchema,\n  providerCapabilities: z.array(z.string().min(1)),\n  protocols: z.array(z.string().min(1)),\n  publicConfig: z.record(z.string(), z.unknown()).optional(),\n  /**\n   * Origins this provider needs the composed CSP of its service to admit.\n   * Consumed by `resolveCspPolicy`'s provider layer; absent means the provider\n   * reaches nothing beyond the surface's own origin.\n   */\n  csp: ProviderFrontendCspFootprintSchema.optional(),\n  /**\n   * The vendor SDK package this provider loads on demand — the DATA half only.\n   * Its presence tells a surface that the provider HAS executable code to\n   * activate, which is the difference between \"declared\" and \"live\" once the\n   * CODE channel is consulted.\n   */\n  sdk: ProviderFrontendSdkDescriptorSchema.optional(),\n  /** Third-party `<script>` tags the surface must add for this provider. */\n  scripts: z.array(ProviderFrontendScriptDeclarationSchema).optional(),\n  /**\n   * The components this provider contributes, by capability — the DATA half\n   * only, exactly as `sdk` is. It says a component EXISTS and what contract it\n   * commits to; the loader stays on the CODE channel, because a function does\n   * not survive `JSON.stringify` and a field that vanishes silently is worse\n   * than a field that was never declared.\n   *\n   * A surface reads this to know a chooser is worth rendering, and to know what\n   * a selection will contain, BEFORE it downloads any provider's component.\n   */\n  components: ProviderFrontendComponentDescriptorsSchema.optional(),\n  /**\n   * The public-config keys the provider module DECLARES it reads — the DATA\n   * half of its `publicConfigSchema`, mirrored here so the companion walk can\n   * refuse an application-supplied key the module never declared, without\n   * executing the module (#394 P3). Absent when the module's schema is not\n   * introspectable, which the overlay reads as \"cannot enforce here\", never as\n   * \"declares nothing\".\n   */\n  publicConfigKeys: z.array(z.string().min(1)).optional(),\n  /**\n   * The `z_file` storage this provider's file picker is the FRONT DOOR of — the\n   * join key between the provider vocabulary (`google-drive`) and the z_file\n   * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).\n   *\n   * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the\n   * vendor, so the FILES row it produces is stored in THAT storage, and a field\n   * may only receive it when its `storageAccepted` names that storage. The\n   * chooser therefore offers such a picker only to a field that accepts the\n   * storage, and the backend refuses the link otherwise — both read this\n   * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no\n   * storage: its bytes are ingested into whatever the field's own storage is,\n   * and it is offered to every field.\n   *\n   * DATA half only, like `components`: the backend storage provider that\n   * SERVES the storage is CODE, keyed by the same enum member and naming this\n   * provider back as its `connectedProviderRef`; a pin holds the two ends equal.\n   */\n  fileStorage: z.enum(FileStorageAccepted).optional(),\n});\nexport type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;\n\nexport const FrontendProvidersBlockSchema = z.object({\n  providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),\n});\nexport type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;\n"]}
+{"version":3,"file":"frontend-provider-entry.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,+BAA+B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;CACV,CAAC;AAGX;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACvD,QAAQ,EAAE,sBAAsB;IAChC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,GAAG,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACnD,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,QAAQ,EAAE;IACpE;;;;;;;;;OASG;IACH,UAAU,EAAE,0CAA0C,CAAC,QAAQ,EAAE;IACjE;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,iBAAiB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAC7D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { ProviderComplianceProfileSchema } from './provider-compliance-profile.shared.schemas';\nimport { ProviderMetadataSchema } from './provider-metadata.shared.schemas';\nimport {\n  ProviderFrontendComponentDescriptorsSchema,\n  ProviderFrontendCspFootprintSchema,\n  ProviderFrontendScriptDeclarationSchema,\n  ProviderFrontendSdkDescriptorSchema,\n} from './provider-frontend-surface.shared.schemas';\n\n/**\n * The `z_file` storage vocabulary, as a BROWSER-SAFE declaration of the values\n * `FileStorageAccepted` in `@wildo-ai/zod-decorators` owns.\n *\n * ## Why this is not an import of that enum\n *\n * This file sits in the `@wildo-ai/saas-models/public-runtime` closure, which\n * browser-bound provider modules load. Importing ANYTHING from\n * `@wildo-ai/zod-decorators` puts that package's root barrel into the bundle,\n * and that barrel mutates Zod's prototypes as an import side effect\n * (`ensureZodDecoratorsLoaded(z)`) — the reason K-3 forbids it, and what\n * `public-runtime.boundary.test.ts` measures. A re-export of the enum (the\n * previous shape, #394 P5) is an import all the same (#607).\n *\n * ## Why a literal union, and why it stays compatible\n *\n * The owning enum is the ONE runtime source of the vocabulary; this is the\n * browser door's spelling of it, pinned member-for-member (keys AND values, at\n * type level and at runtime) by `__tests__/file-storage-accepted.drift.test.ts`\n * — the same arrangement `BUILTIN_PROVIDER_PROTOCOL` has with the engine's\n * protocol enum, for the same boundary.\n *\n * It is `as const` rather than a second `enum` on purpose: two enums are\n * NOMINALLY distinct, so the field side (`z_file({ storageAccepted })`, the\n * owning enum) could not be compared with the provider side (this). A string\n * enum IS assignable to the literal union of its values, so the owning enum\n * flows into every slot typed with this vocabulary, and\n * `FileStorageAccepted.GOOGLE_DRIVE` reads identically at an authoring site.\n * The reverse is not true: a value typed here does not flow into a slot typed\n * with the owning enum — that direction does not occur today, and the compiler\n * reports it if it ever does.\n */\n/*\n * ## NOT every member is served, and the rule is what to trust (#460)\n *\n * A member is SERVED when `FileStorageRouterBackendService` registers an `IFileStorageProvider` for\n * it; that map is the one runtime answer, and this comment is a dated reading of it rather than a\n * second authority. The engine serves `WILDO_MANAGED`, `LOCAL_DIRECTORY` and `GOOGLE_DRIVE` itself;\n * since #1674 any other member is served when a loaded provider module CONTRIBUTES an adapter for it\n * (`fileStorageAdapters`, `ProviderFileStorageAdapter`). A provider serves a member of this closed\n * vocabulary; it never adds one. Measured 2026-09-29: the engine's own `microsoft-onedrive` (since #2017) contributes\n * `ONEDRIVE` (a person's own OneDrive through Microsoft Graph, commercial cloud only); nothing contributes\n * `DROPBOX`.\n *\n * Declaring an unserved member is not silently ignored — the router refuses and now says WHICH of the\n * two problems it is, because \"not implemented\" and \"implemented but not configured\" have different\n * remedies and the old single message sent an operator looking for environment variables that cannot\n * exist.\n *\n * An unserved member is NOT removed here, deliberately: a member a package may yet serve is part of the\n * closed vocabulary, and deleting it would decide from the wrong place that nothing ever will. (`ONEDRIVE`\n * STORING is served since #1674; the governed OneDrive PICK path of #570 is separate and still unbuilt.)\n * Re-measure before quoting this paragraph; the count was \"three of five\" when #460 was filed, and Drive and\n * OneDrive have landed since.\n */\nexport const FileStorageAccepted = {\n  WILDO_MANAGED: 'wildo_managed',\n  LOCAL_DIRECTORY: 'local_directory',\n  ONEDRIVE: 'onedrive',\n  GOOGLE_DRIVE: 'google_drive',\n  DROPBOX: 'dropbox',\n} as const;\nexport type FileStorageAccepted = (typeof FileStorageAccepted)[keyof typeof FileStorageAccepted];\n\n/**\n * Bundle-safe frontend provider atoms shared by every browser-bound runtime.\n *\n * This file intentionally stops at the provider-entry/block level so\n * `@wildo-ai/saas-models/public-runtime` can expose the types without pulling\n * the heavier application-config bootstrap contract into browser bundles.\n */\n\n/**\n * One provider as it crosses the DATA channel: authored on a facet module,\n * projected into a companion contribution, materialized into the generated\n * frontend-services artifact, served on `/application-config`, and parsed by the\n * app, the website and the technical doc.\n *\n * ## Why this is a LOOSE object\n *\n * It is a WIRE RECORD produced by one package version and read by another, and a\n * strict object silently STRIPS what a newer producer added — which is how a\n * provider's CSP footprint would vanish between the CLI that wrote it and the\n * runtime that needs it, leaving a policy that is correct in development\n * (report-only) and wrong in production (enforcing). #328 made\n * `ProviderCompanionContributionSchema` loose for exactly this reason, one file\n * over; the entry rides INSIDE that contribution, so leaving it strict left the\n * hole one layer down. Required fields stay required; unknown keys are kept\n * rather than dropped, so a re-emitting consumer cannot silently discard what it\n * did not understand.\n *\n * ## What may and may not be added here\n *\n * Only things a JSON channel can carry. A function-valued field would be\n * stripped by `JSON.stringify` with no error anywhere — the provider would look\n * declared and do nothing. Executable provider surface (`sdk.activate`,\n * `publicConfigSchema`, and, from S4b, `components`) belongs on the facet module\n * types in `@wildo-ai/external-connectors-public`, which reach a bundle through\n * the generated `frontend-providers.generated.ts` CODE channel instead.\n */\nexport const FrontendProviderEntrySchema = z.looseObject({\n  metadata: ProviderMetadataSchema,\n  providerCapabilities: z.array(z.string().min(1)),\n  protocols: z.array(z.string().min(1)),\n  publicConfig: z.record(z.string(), z.unknown()).optional(),\n  /**\n   * Origins this provider needs the composed CSP of its service to admit.\n   * Consumed by `resolveCspPolicy`'s provider layer; absent means the provider\n   * reaches nothing beyond the surface's own origin.\n   */\n  csp: ProviderFrontendCspFootprintSchema.optional(),\n  /**\n   * The vendor SDK package this provider loads on demand — the DATA half only.\n   * Its presence tells a surface that the provider HAS executable code to\n   * activate, which is the difference between \"declared\" and \"live\" once the\n   * CODE channel is consulted.\n   */\n  sdk: ProviderFrontendSdkDescriptorSchema.optional(),\n  /** Third-party `<script>` tags the surface must add for this provider. */\n  scripts: z.array(ProviderFrontendScriptDeclarationSchema).optional(),\n  /**\n   * The components this provider contributes, by capability — the DATA half\n   * only, exactly as `sdk` is. It says a component EXISTS and what contract it\n   * commits to; the loader stays on the CODE channel, because a function does\n   * not survive `JSON.stringify` and a field that vanishes silently is worse\n   * than a field that was never declared.\n   *\n   * A surface reads this to know a chooser is worth rendering, and to know what\n   * a selection will contain, BEFORE it downloads any provider's component.\n   */\n  components: ProviderFrontendComponentDescriptorsSchema.optional(),\n  /**\n   * The public-config keys the provider module DECLARES it reads — the DATA\n   * half of its `publicConfigSchema`, mirrored here so the companion walk can\n   * refuse an application-supplied key the module never declared, without\n   * executing the module (#394 P3). Absent when the module's schema is not\n   * introspectable, which the overlay REFUSES (`SCHEMA_NOT_INTROSPECTABLE`, #1705)\n   * — never read as \"declares nothing\". Optional on the wire only so an entry an\n   * older producer wrote still parses and is refused with a message.\n   */\n  publicConfigKeys: z.array(z.string().min(1)).optional(),\n  /**\n   * The `z_file` storage this provider's file picker is the FRONT DOOR of — the\n   * join key between the provider vocabulary (`google-drive`) and the z_file\n   * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).\n   *\n   * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the\n   * vendor, so the FILES row it produces is stored in THAT storage, and a field\n   * may only receive it when its `storageAccepted` names that storage. The\n   * chooser therefore offers such a picker only to a field that accepts the\n   * storage, and the backend refuses the link otherwise — both read this\n   * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no\n   * storage: its bytes are ingested into whatever the field's own storage is,\n   * and it is offered to every field.\n   *\n   * DATA half only, like `components`: the backend storage provider that\n   * SERVES the storage is CODE, keyed by the same enum member and naming this\n   * provider back as its `connectedProviderRef`; a pin holds the two ends equal.\n   */\n  fileStorage: z.enum(FileStorageAccepted).optional(),\n  /**\n   * The vendor's deployment model, processing regions and legal entity, as the facet module\n   * declares them (#1743) — the primitives a processor register, a recipients fact and a regional\n   * report are derived from.\n   *\n   * ## Why it rides HERE, and why the browser gets it too\n   *\n   * A frontend provider executes in the DATA SUBJECT'S BROWSER and talks to its vendor directly, so\n   * it is exactly the kind of recipient a privacy notice must name (#345). The module has carried\n   * this profile since #345, and every projection built the entry field by field and left it\n   * behind — so reCAPTCHA, Sentry and the Drive/OneDrive/Dropbox pickers stated their\n   * entity and regions in source and no compliance reader could see any of them.\n   *\n   * This entry is the one record that is materialized PER APPLICATION, PER SERVICE, for exactly the\n   * providers that service SERVES (`frontendProviderBootstraps` in the generated frontend-services\n   * artifact). That is the population a recipient derivation needs — the browser vendors this\n   * application actually runs, not every module the engine ships — and a reader gets it by parsing a\n   * generated JSON file on disk rather than by loading provider packages. A field on the\n   * contribution beside `identity` was the alternative and was rejected for that reason: the\n   * contribution is never materialized per service, so a reader would have to re-run discovery.\n   *\n   * It is therefore also served on `/application-config`. That costs a few public facts (a vendor's\n   * name and the regions it offers, which the application's own privacy notice publishes anyway)\n   * and it keeps the two producing sites — the companion projection and the backend fallback —\n   * identical, so what a compliance reader sees never depends on whether a sync ran.\n   *\n   * Not a second authority for backend providers. A provider SPECIFICATION restates its BACKEND\n   * module's profile (and is reconciled against it); this restates the FRONTEND facet's. Registering\n   * specifications for browser-only vendors was the other option and was rejected: a specification\n   * describes a backend module — protocols, secrets contract, engine slots — and a browser-only\n   * vendor has none of them.\n   *\n   * Absent means the module's author stated nothing, which a reader must report as NOT ESTABLISHED\n   * rather than skip — `listServedFrontendProviderCompliance` (beside the profile schema) returns `null` for exactly that.\n   */\n  complianceProfile: ProviderComplianceProfileSchema.optional(),\n  /**\n   * Consent purposes this PROVIDER rests on beyond its capabilities' floor (#1702) — the facet module's\n   * own `consentPurposes`, as data.\n   *\n   * ## Why it has to ride here\n   *\n   * The consent decision is taken in the browser on the HYDRATED module, whose `providerCapabilities`\n   * come from this entry, so a vendor-level purpose the entry did not carry would reach no gate at all:\n   * a provider whose vendor needs more than its capability's floor (Google reCAPTCHA, which the CNIL held\n   * is not exempt as a security measure because it also serves Google's own purposes — Délibération\n   * SAN-2023-003) would start on the floor alone. Carried by BOTH producing sites — the companion\n   * projection and the backend fallback — for the reason every field above is.\n   *\n   * ADDITIVE ONLY. It is unioned with the capabilities' floor by `consentPurposesRequiredByProvider`,\n   * so an entry can never lower what a capability requires; and hydration unions it with the CODE\n   * module's own declaration, so a stale entry cannot lower what the bundled module requires either.\n   * Absent and `[]` mean the same thing: nothing beyond the floor.\n   *\n   * Strings on the wire, like `providerCapabilities`, and for the same version-skew reason: a member an\n   * older reader does not know must not fail the parse of the whole provider block. The projection\n   * refuses an unknown member where it is authored, and the browser's consent decision FAILS CLOSED on\n   * one it meets (`isProviderPermittedByConsent`) — so an unknown purpose withholds its provider rather\n   * than being dropped, which on an additive field would lower the floor.\n   */\n  consentPurposes: z.array(z.string().min(1)).optional(),\n});\nexport type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;\n\nexport const FrontendProvidersBlockSchema = z.object({\n  providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),\n});\nexport type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;\n"]}