@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/external-providers/frontend-provider-public-config.shared.js

@@ -1,8 +1,8 @@
 /**
  * How an APPLICATION supplies a frontend provider's public configuration — the
  * keys a picker needs that only the application can know (a Drive `appId`, a
- * OneDrive `clientId`) — and the two guards that keep that channel from
- * carrying anything else.
+ * OneDrive `clientId`) — and the gates that keep that channel from carrying
+ * anything else.
  *
  * ## The gap this closes
  *
@@ -17,29 +17,63 @@
  * `providerConfigurations[providerRef][frontend_sdk]`. One authority for
  * "what an application configured for this provider", read by both sides.
  *
- * ## Two guards, because `publicConfig` is served to every browser
+ * ## The gates, because `publicConfig` is served to every browser
  *
  * 1. **Only DECLARED keys cross.** A provider module declares the keys it reads
  *    (`publicConfigSchema` — see `defineFrontendPublicConfigSchema` below, which
- *    is what makes those keys READABLE without running the schema). A key the
- *    module never declared is refused with the provider and key named, at the
- *    two places the overlay runs: `wildo config sync` and the backend's
- *    fallback projection. A misspelled `apiId` therefore fails where it was
- *    typed, instead of silently contributing nothing and leaving a picker that
- *    reports "no appId" at the moment a user opens it.
- *
- * 2. **A secret never crosses.** A frontend provider owns no secrets by
- *    construction (`secretsContractShape: []`), so the only way one reaches a
- *    browser is an author typing the BACKEND module's secret into the frontend
- *    bag. The overlay refuses any key whose name matches a slug or an
- *    environment-variable name from the same vendor's backend secrets
- *    contract — `GOOGLE_OAUTH2_CLIENT_SECRET` cannot be typed into the bag that
- *    every visitor downloads.
- *
- * Both guards are decisions about NAMES, so they run wherever the names are
- * known and need no schema execution. Value VALIDATION (is `appId` a string?)
- * is the schema's job and runs where the schema is: at hydration (FE-8) and, on
- * the backend fallback, before serving.
+ *    is what makes those keys READABLE without running the schema), and a
+ *    module with no readable list is refused outright. Every key an entry would
+ *    serve — authored by the module, mapped onto its contribution, or supplied
+ *    by the application — is held to that list wherever an entry is PRODUCED
+ *    (`wildo config sync`, the backend's fallback projection) and again wherever
+ *    a ready-made one is READ and served (the backend's `/application-config`,
+ *    the website and documentation build loader). A misspelled `apiId` therefore
+ *    fails where it was typed, instead of silently contributing nothing and
+ *    leaving a picker that reports "no appId" at the moment a user opens it.
+ *
+ * 2. **A secret VALUE never crosses.** Every served string is compared against
+ *    the producer's secret values — the environment's whole `secrets.json` at
+ *    sync, the registered providers' confidential slots on the backend — and a
+ *    match refuses, whatever the key is called (#1705).
+ *
+ * 3. **A secret NAME is refused early.** A key spelled like a slug or an
+ *    environment-variable name from the same vendor's backend secrets contract
+ *    (`GOOGLE_OAUTH2_CLIENT_SECRET`) is refused with that explanation before the
+ *    key-list check would call it merely undeclared. It is the clearer message,
+ *    not the gate: a browser-only vendor has no backend names to match.
+ *
+ * Value VALIDATION (is `appId` a string?) is the schema's job and runs where the
+ * schema is: at hydration (FE-8) and, on the backend fallback, before serving.
+ *
+ * ## Why names were never enough, and what closes it (#1705)
+ *
+ * The name gate draws its forbidden names from the same vendor's BACKEND contract, so a
+ * browser-only vendor (reCAPTCHA, Algolia) had an EMPTY forbidden set: its secret
+ * key under `siteKey`, or an Algolia admin key under `apiKey`, passed every name
+ * check. And the declared-key gate switched itself off for a module with no introspectable
+ * schema — 8 of the 13 engine modules — admitting any key at all. A guard that
+ * matches how a key is SPELLED looks like a control and decides almost nothing.
+ *
+ * Three changes turn it into one:
+ *
+ * - **A schema is mandatory.** `declaredKeys: undefined` is now a refusal
+ *   (`SCHEMA_NOT_INTROSPECTABLE`) rather than "cannot enforce here", and the key check
+ *   runs over the WHOLE served bag — the module's authored keys and any key an
+ *   application mapped onto its contribution — not only over what
+ *   `providerConfigurations` supplied.
+ * - **Values are compared, not shapes.** {@link assertNoSecretValueInFrontendProviders}
+ *   compares every string in every served `publicConfig` against the secret
+ *   VALUES the producer holds: `wildo config sync` against the environment's
+ *   `secrets.json`, the backend against its providers' confidential slots. It
+ *   asks "is this one of OUR secrets", which no name or shape rule can answer,
+ *   and it names the key and the slot, never the value. Gitleaks answers the
+ *   other question ("does this look like a secret") on committed files; the two
+ *   do not overlap.
+ * - **What is secret comes from a declaration.** A provider secret slot is
+ *   confidential unless its contract marks it `holdsBrowserPublicValue` (a
+ *   vendor key designed to ship to browsers, such as PostHog's project key) or
+ *   `holdsDeploymentHost`; framework-managed material is confidential by its
+ *   registry's `secretKeys`. Nothing is inferred from a key's name.
  *
  * ## Why the overlay is a pure function in this package
  *
@@ -68,6 +102,7 @@
  */
 // semantic-literal-boundary: browser-safe wire value of ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK, pinned by test (#607)
 export const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY = 'frontend_sdk';
+/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */
 /** Why an application-supplied public-config bag was refused. */
 export var FrontendProviderPublicConfigRefusal;
 (function (FrontendProviderPublicConfigRefusal) {
@@ -77,7 +112,19 @@ export var FrontendProviderPublicConfigRefusal;
     FrontendProviderPublicConfigRefusal["SECRET_KEY"] = "SECRET_KEY";
     /** The supplied bag is not a plain object — a string, an array, `null`. */
     FrontendProviderPublicConfigRefusal["NOT_AN_OBJECT"] = "NOT_AN_OBJECT";
+    /**
+     * The module declares no `publicConfigSchema` whose keys can be read without running it
+     * (#1705). Nothing can then say which keys it takes, so nothing it is handed can be held to a
+     * list — and "admit everything" is the answer that reaches a browser.
+     */
+    FrontendProviderPublicConfigRefusal["SCHEMA_NOT_INTROSPECTABLE"] = "SCHEMA_NOT_INTROSPECTABLE";
+    /**
+     * A served value equals, or contains, one of the producer's SECRET VALUES (#1705) — whatever the
+     * key is called and whichever vendor the secret belongs to. Never negotiable.
+     */
+    FrontendProviderPublicConfigRefusal["SECRET_VALUE"] = "SECRET_VALUE";
 })(FrontendProviderPublicConfigRefusal || (FrontendProviderPublicConfigRefusal = {}));
+/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */
 export class FrontendProviderPublicConfigError extends Error {
     providerRef;
     refusal;
@@ -92,23 +139,26 @@ export class FrontendProviderPublicConfigError extends Error {
 }
 /**
  * Merges what the application supplied over what the module authored, refusing
- * the two classes of key that must never reach a browser.
+ * the classes of key that must never reach a browser.
  *
  * Supplied values WIN over authored ones for the same key: the module's value is
  * a default, and an application that names a key means it. Absent `supplied`
- * returns the authored bag untouched — an application that configured nothing
- * is the ordinary case, not a refusal.
+ * returns the authored bag unchanged — an application that configured nothing
+ * is the ordinary case, not a refusal — but it is still HELD to the declared
+ * keys: `authored` is what the served entry carries, which includes any key an
+ * application mapped onto the contribution in its own `provider-contributions`.
+ *
+ * Call it for EVERY entry a producer serves, supplied or not; a producer that
+ * skips it when nothing was supplied skips the schema and key checks too.
  */
 export function overlayFrontendProviderPublicConfig(input) {
     const { providerRef, authored, supplied, declaredKeys, forbiddenKeys } = input;
-    if (supplied === undefined)
-        return authored;
-    if (typeof supplied !== 'object' || supplied === null || Array.isArray(supplied)) {
+    if (supplied !== undefined && (typeof supplied !== 'object' || supplied === null || Array.isArray(supplied))) {
         throw new FrontendProviderPublicConfigError(providerRef, FrontendProviderPublicConfigRefusal.NOT_AN_OBJECT, [], `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} must be an object of public `
             + `keys, got ${Array.isArray(supplied) ? 'an array' : typeof supplied}.`);
     }
-    const suppliedKeys = Object.keys(supplied);
-    // Guard 2 runs FIRST and unconditionally: a secret is refused even when the
+    const suppliedKeys = supplied === undefined ? [] : Object.keys(supplied);
+    // The secret-NAME gate (3) runs FIRST and unconditionally: a secret is refused even when the
     // module has no introspectable schema, because that is not the module's call.
     const secretKeys = suppliedKeys.filter((key) => forbiddenKeys.has(key));
     if (secretKeys.length > 0) {
@@ -117,18 +167,172 @@ export function overlayFrontendProviderPublicConfig(input) {
             + 'served to every browser; a secret belongs in the deployment environment under its `envVarName`, and '
             + 'nowhere else.');
     }
-    if (declaredKeys !== undefined) {
-        const declared = new Set(declaredKeys);
-        const undeclared = suppliedKeys.filter((key) => !declared.has(key));
-        if (undeclared.length > 0) {
-            throw new FrontendProviderPublicConfigError(providerRef, FrontendProviderPublicConfigRefusal.UNDECLARED_KEY, undeclared, `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} names ${undeclared.map((key) => `"${key}"`).join(', ')}, `
-                + `which the "${providerRef}" frontend provider does not declare. It declares: `
-                + `${declaredKeys.length > 0 ? declaredKeys.map((key) => `"${key}"`).join(', ') : '(nothing)'}. `
-                + 'A key the provider never reads would be served to every browser and used by nothing.');
+    // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a frontend provider with no readable key list serves nothing to a browser
+    if (declaredKeys === undefined) {
+        throw new FrontendProviderPublicConfigError(providerRef, FrontendProviderPublicConfigRefusal.SCHEMA_NOT_INTROSPECTABLE, [], `The "${providerRef}" frontend provider declares no publicConfigSchema whose keys can be read, so nothing can `
+            + 'say which public keys it takes and none can be served to a browser. Declare one with '
+            + '`defineFrontendPublicConfigSchema` (or a Zod object) listing every key its publicConfig carries.');
+    }
+    const merged = supplied === undefined
+        ? authored
+        : { ...(authored ?? {}), ...supplied };
+    // The declared-key gate (1) over the WHOLE served bag (#1705), not only over what `providerConfigurations`
+    // supplied: a key a module authored, or an application mapped onto its contribution, reaches the
+    // browser exactly as a supplied one does.
+    const declared = new Set(declaredKeys);
+    const undeclared = Object.keys(merged ?? {}).filter((key) => !declared.has(key));
+    if (undeclared.length > 0) {
+        const suppliedSet = new Set(suppliedKeys);
+        const fromSupplied = undeclared.every((key) => suppliedSet.has(key));
+        const where = fromSupplied
+            ? `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY}`
+            : `The "${providerRef}" provider's publicConfig (authored by its module or mapped in provider-contributions)`;
+        throw new FrontendProviderPublicConfigError(providerRef, FrontendProviderPublicConfigRefusal.UNDECLARED_KEY, undeclared, `${where} names ${undeclared.map((key) => `"${key}"`).join(', ')}, `
+            + `which the "${providerRef}" frontend provider does not declare. It declares: `
+            + `${declaredKeys.length > 0 ? declaredKeys.map((key) => `"${key}"`).join(', ') : '(nothing)'}. `
+            + 'A key the provider never reads would be served to every browser and used by nothing.');
+    }
+    return merged;
+}
+/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */
+/**
+ * The shortest secret a served value is searched INSIDE, not only compared to.
+ *
+ * Containment catches a secret embedded in a larger public value — a URL carrying
+ * `?key=<secret>`, a `https://user:<secret>@host` endpoint — which exact equality would miss.
+ * Below this length a secret (a six-character default password, a short database name held in a
+ * credential slot) could occur by coincidence inside an ordinary public value such as a host name,
+ * and refusing a correct configuration on that coincidence would teach operators to route around
+ * the check. Shorter secrets are still compared EXACTLY.
+ */
+export const FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH = 16;
+/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */
+/**
+ * Every place a served value can carry text, as text: string leaves, the decimal form of numbers
+ * and bigints (a numeric secret typed into a `number`-kind key is served just the same), and the
+ * KEYS of nested objects (a map keyed by a secret serves the secret). Booleans and `null` carry
+ * nothing. A key found this way is reported at `<path>{key}` so the refusal can still say where.
+ */
+function collectStringLeaves(value, path, into) {
+    if (typeof value === 'string') {
+        into.push({ path, value });
+        return;
+    }
+    if ((typeof value === 'number' && Number.isFinite(value)) || typeof value === 'bigint') {
+        into.push({ path, value: String(value) });
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => collectStringLeaves(item, `${path}[${index}]`, into));
+        return;
+    }
+    if (typeof value === 'object' && value !== null) {
+        for (const [key, item] of Object.entries(value)) {
+            const childPath = path.length > 0 ? `${path}.${key}` : key;
+            // A top-level key is the provider's own declared key name, held to its list by the key gate;
+            // a NESTED key is data an author chose, and is screened like a value.
+            if (path.length > 0)
+                into.push({ path: `${path}{key}`, value: key });
+            collectStringLeaves(item, childPath, into);
+        }
+    }
+}
+/**
+ * Every place a served `publicConfig` carries one of the producer's secret values (#1705).
+ *
+ * Pure, and total over the strings it is given: every string leaf of every provider's bag —
+ * nested objects and arrays included — against every non-blank secret. A match is EXACT equality
+ * (after trimming both sides), or CONTAINMENT for a secret at least
+ * {@link FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH} long.
+ *
+ * Deliberately blind to key names and to which vendor a secret belongs: the defect it closes is a
+ * secret under an innocent key, or one vendor's secret served under another vendor's ref.
+ *
+ * What it does NOT see: an ENCODED secret (URL- or base64-encoded, split across keys, hashed). It
+ * asks "is this one of our values", verbatim; recognising transformed forms would need a guess at
+ * every encoding an author might apply, and each guess would be a new false-positive source. The
+ * committed-file scanner (gitleaks) and review are the backstops for that.
+ */
+export function findSecretValuesInFrontendProviders(providers, secrets) {
+    const comparable = secrets
+        .map((secret) => ({ slot: secret.slot, value: secret.value.trim() }))
+        .filter((secret) => secret.value.length > 0);
+    if (comparable.length === 0)
+        return [];
+    const matches = [];
+    for (const [providerRef, entry] of Object.entries(providers)) {
+        const leaves = [];
+        collectStringLeaves(entry.publicConfig ?? {}, '', leaves);
+        for (const leaf of leaves) {
+            const candidate = leaf.value.trim();
+            if (candidate.length === 0)
+                continue;
+            for (const secret of comparable) {
+                const hit = candidate === secret.value
+                    || (secret.value.length >= FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH && candidate.includes(secret.value));
+                if (hit)
+                    matches.push({ providerRef, key: leaf.path, slot: secret.slot });
+            }
+        }
+    }
+    return matches;
+}
+/**
+ * Refuses to serve a set of frontend providers when any served value is one of the producer's
+ * secrets (#1705). Called by BOTH producers of a served bootstrap — `wildo config sync` before it
+ * writes any artifact, and the backend before it answers `/application-config` — so the two cannot
+ * disagree about what may reach a browser.
+ *
+ * `producer` names who is refusing and where its secrets came from, for the message.
+ */
+export function assertNoSecretValueInFrontendProviders(input) {
+    // assurance-control: WILDO.DATA.CONFIDENTIALITY — a secret value never reaches a browser under any public key
+    const matches = findSecretValuesInFrontendProviders(input.providers, input.secrets);
+    if (matches.length === 0)
+        return;
+    throw new FrontendProviderPublicConfigError(matches[0].providerRef, FrontendProviderPublicConfigRefusal.SECRET_VALUE, matches.map((match) => `${match.providerRef}.${match.key}`), `${input.producer} refused to serve frontend provider configuration: `
+        + matches.map((match) => `publicConfig "${match.key}" of provider "${match.providerRef}" carries the secret held in ${match.slot}`).join('; ')
+        + '. A frontend provider\'s public configuration is served to every browser. Replace the value with the vendor\'s '
+        + 'PUBLIC key (a publishable, site or search-only key), and if that secret has already been committed or served, '
+        + 'rotate it.');
+}
+/**
+ * Refuses a READY-MADE block of frontend providers whose entries do not carry their key list, or
+ * serve a key outside it (#1705).
+ *
+ * The overlay holds an entry to its declared keys at the moment it is PRODUCED. A block that is only
+ * READ — the generated bootstrap the backend serves on `/application-config`, the frontend-services
+ * artifact the website and documentation builds bake into their pages — was produced earlier, by
+ * whichever `wildo config sync` wrote it. One written before a schema was mandatory carries entries
+ * with no `publicConfigKeys` and was never held to any list, and nothing downstream would notice: the
+ * reader parses the entry (the field stays optional on the wire precisely so it CAN be read and
+ * refused with a message) and serves it. So every site that serves a ready-made block asks the same
+ * question the producer asked, through the same function, and a stale artifact is refused with the
+ * remedy — regenerate it — instead of being served.
+ *
+ * `producer` names who is refusing and what it read, for the message.
+ */
+export function assertFrontendProvidersServeOnlyDeclaredKeys(input) {
+    for (const [providerRef, entry] of Object.entries(input.providers)) {
+        try {
+            // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a served frontend provider entry with no key list, or a key outside it, is not served
+            overlayFrontendProviderPublicConfig({
+                providerRef,
+                authored: entry.publicConfig,
+                supplied: undefined,
+                declaredKeys: entry.publicConfigKeys,
+                forbiddenKeys: new Set(),
+            });
+        }
+        catch (error) {
+            if (!(error instanceof FrontendProviderPublicConfigError))
+                throw error;
+            throw new FrontendProviderPublicConfigError(error.providerRef, error.refusal, error.keys, `${input.producer} refused to serve frontend provider configuration it was handed: ${error.message} `
+                + 'The configuration was most likely generated before this check existed — regenerate it with `wildo config sync`.');
         }
     }
-    return { ...(authored ?? {}), ...supplied };
 }
+/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */
 /**
  * The value kinds a public-config key may declare. Scalars only, on purpose: a
  * public key is an identifier or a flag, and a structured value here is a
@@ -197,9 +401,10 @@ export function defineFrontendPublicConfigSchema(keys) {
  * Two shapes are recognised, and the order matters: a schema built by
  * `defineFrontendPublicConfigSchema` states its keys outright; a Zod object
  * exposes them as `shape`. Anything else — a hand-written Standard Schema, a
- * library without introspection — yields `undefined`, which the overlay reads
- * as "cannot enforce here" rather than as "declares nothing". That distinction
- * is load-bearing: an empty list refuses EVERY supplied key.
+ * library without introspection — yields `undefined`, which every gate REFUSES
+ * (`SCHEMA_NOT_INTROSPECTABLE`, #1705) rather than reading as "declares nothing".
+ * That distinction is load-bearing: an empty list is a readable answer and
+ * refuses EVERY key, while `undefined` means no key list exists at all.
  */
 export function readDeclaredPublicConfigKeys(schema) {
     if (typeof schema !== 'object' || schema === null)

package/dist/esm/external-providers/frontend-provider-public-config.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-public-config.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,mIAAmI;AACnI,MAAM,CAAC,MAAM,mCAAmC,GAAW,cAAc,CAAC;AAE1E,iEAAiE;AACjE,MAAM,CAAN,IAAY,mCAOX;AAPD,WAAY,mCAAmC;IAC7C,gFAAgF;IAChF,wEAAiC,CAAA;IACjC,uFAAuF;IACvF,gEAAyB,CAAA;IACzB,2EAA2E;IAC3E,sEAA+B,CAAA;AACjC,CAAC,EAPW,mCAAmC,KAAnC,mCAAmC,QAO9C;AAED,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAE/C;IACA;IACA;IAHX,YACW,WAAmB,EACnB,OAA4C,EAC5C,IAAuB,EAChC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,gBAAW,GAAX,WAAW,CAAQ;QACnB,YAAO,GAAP,OAAO,CAAqC;QAC5C,SAAI,GAAJ,IAAI,CAAmB;QAIhC,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAmBD;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CACjD,KAA+C;IAE/C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAE/E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAE5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,aAAa,EACjD,EAAE,EACF,0BAA0B,WAAW,IAAI,mCAAmC,+BAA+B;cACzG,aAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,QAAQ,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE3C,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,UAAU,EAC9C,UAAU,EACV,0BAA0B,WAAW,IAAI,mCAAmC,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACtI,6BAA6B,WAAW,oEAAoE;cAC5G,sGAAsG;cACtG,eAAe,CAClB,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,cAAc,EAClD,UAAU,EACV,0BAA0B,WAAW,IAAI,mCAAmC,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;kBACtI,cAAc,WAAW,qDAAqD;kBAC9E,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI;kBAC/F,sFAAsF,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAI,QAAoC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,kDAAiB,CAAA;IACjB,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAgCD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAA2D;IAE3D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,OAAO;QACL,YAAY;QACZ,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,OAAO;YACf,QAAQ,CAAC,KAAc;gBACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,EAAE,CAAC;gBAC7E,CAAC;gBACD,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,MAAM,GAAqD,EAAE,CAAC;gBAEpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;wBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;4BAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC9E,SAAS;oBACX,CAAC;oBACD,IAAI,OAAO,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,IAAI,CAAC,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC;gBAED,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC5D,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,SAAS,GAAG,MAAqD,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5G,OAAO,SAAS,CAAC,YAAiC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAgC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * How an APPLICATION supplies a frontend provider's public configuration — the\n * keys a picker needs that only the application can know (a Drive `appId`, a\n * OneDrive `clientId`) — and the two guards that keep that channel from\n * carrying anything else.\n *\n * ## The gap this closes\n *\n * A frontend provider's `publicConfig` was HARD-CODED on the engine's provider\n * module and projected verbatim onto the wire. The only way to set a picker's\n * `appId` was to edit engine code. The backend never had that problem: an\n * application authors `providerConfigurations[providerRef][protocolKind]` in\n * `wildo.saas.config.ts`, and SSO's public OAuth client id already travels that\n * way, keyed by the protocol (`sso_oauth2`).\n *\n * This file gives the frontend the same channel, keyed by the same vocabulary:\n * `providerConfigurations[providerRef][frontend_sdk]`. One authority for\n * \"what an application configured for this provider\", read by both sides.\n *\n * ## Two guards, because `publicConfig` is served to every browser\n *\n * 1. **Only DECLARED keys cross.** A provider module declares the keys it reads\n *    (`publicConfigSchema` — see `defineFrontendPublicConfigSchema` below, which\n *    is what makes those keys READABLE without running the schema). A key the\n *    module never declared is refused with the provider and key named, at the\n *    two places the overlay runs: `wildo config sync` and the backend's\n *    fallback projection. A misspelled `apiId` therefore fails where it was\n *    typed, instead of silently contributing nothing and leaving a picker that\n *    reports \"no appId\" at the moment a user opens it.\n *\n * 2. **A secret never crosses.** A frontend provider owns no secrets by\n *    construction (`secretsContractShape: []`), so the only way one reaches a\n *    browser is an author typing the BACKEND module's secret into the frontend\n *    bag. The overlay refuses any key whose name matches a slug or an\n *    environment-variable name from the same vendor's backend secrets\n *    contract — `GOOGLE_OAUTH2_CLIENT_SECRET` cannot be typed into the bag that\n *    every visitor downloads.\n *\n * Both guards are decisions about NAMES, so they run wherever the names are\n * known and need no schema execution. Value VALIDATION (is `appId` a string?)\n * is the schema's job and runs where the schema is: at hydration (FE-8) and, on\n * the backend fallback, before serving.\n *\n * ## Why the overlay is a pure function in this package\n *\n * It has THREE call sites that must agree — the companion walk in\n * `platform-config-lib`, the backend fallback in `saas-backend-lib`, and any\n * future producer of a `FrontendProviderEntry` — and #380 already paid once for\n * a projection that landed on one site and not another. A function both import\n * cannot be applied differently by each.\n */\n\n/**\n * The key under `providerConfigurations[providerRef]` an application uses to\n * supply a frontend provider's public configuration.\n *\n * The protocol kind's WIRE value, exactly as SSO's channel is keyed by ITS\n * protocol kind (`sso_oauth2`): the bag is per-provider, per-protocol, and a\n * frontend module speaks `FRONTEND_SDK`.\n *\n * The owning source is `ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK` in\n * `@wildo-ai/external-connectors-models`, and this literal is pinned to it by\n * `__tests__/frontend-provider-public-config.shared.test.ts`. It is written out\n * rather than imported because this file is in the\n * `@wildo-ai/saas-models/public-runtime` closure, which K-3 forbids from\n * importing that package — an import it carried from #394 P3 until #607 put the\n * whole external-connectors model tree into every browser provider bundle.\n * `BUILTIN_PROVIDER_PROTOCOL` is the same arrangement for the same boundary.\n */\n// semantic-literal-boundary: browser-safe wire value of ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK, pinned by test (#607)\nexport const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY: string = 'frontend_sdk';\n\n/** Why an application-supplied public-config bag was refused. */\nexport enum FrontendProviderPublicConfigRefusal {\n  /** A key the provider module does not declare — almost always a misspelling. */\n  UNDECLARED_KEY = 'UNDECLARED_KEY',\n  /** A key naming a secret from the same vendor's backend contract. Never negotiable. */\n  SECRET_KEY = 'SECRET_KEY',\n  /** The supplied bag is not a plain object — a string, an array, `null`. */\n  NOT_AN_OBJECT = 'NOT_AN_OBJECT',\n}\n\nexport class FrontendProviderPublicConfigError extends Error {\n  constructor(\n    readonly providerRef: string,\n    readonly refusal: FrontendProviderPublicConfigRefusal,\n    readonly keys: readonly string[],\n    message: string,\n  ) {\n    super(message);\n    this.name = 'FrontendProviderPublicConfigError';\n  }\n}\n\nexport interface OverlayFrontendProviderPublicConfigInput {\n  readonly providerRef: string;\n  /** What the provider module authored — its own defaults, e.g. `{ authProviderRef: 'google' }`. */\n  readonly authored: Readonly<Record<string, unknown>> | undefined;\n  /** What the application supplied under `providerConfigurations[providerRef][frontend_sdk]`. */\n  readonly supplied: unknown;\n  /**\n   * The keys the provider module declares it reads. `undefined` means the\n   * module declared no introspectable schema, so guard 1 cannot run HERE and\n   * hydration's validation is the gate; an empty array means the module\n   * declares it reads NOTHING, so every supplied key is refused.\n   */\n  readonly declaredKeys: readonly string[] | undefined;\n  /** Slugs and environment-variable names of the same vendor's backend secrets. */\n  readonly forbiddenKeys: ReadonlySet<string>;\n}\n\n/**\n * Merges what the application supplied over what the module authored, refusing\n * the two classes of key that must never reach a browser.\n *\n * Supplied values WIN over authored ones for the same key: the module's value is\n * a default, and an application that names a key means it. Absent `supplied`\n * returns the authored bag untouched — an application that configured nothing\n * is the ordinary case, not a refusal.\n */\nexport function overlayFrontendProviderPublicConfig(\n  input: OverlayFrontendProviderPublicConfigInput,\n): Readonly<Record<string, unknown>> | undefined {\n  const { providerRef, authored, supplied, declaredKeys, forbiddenKeys } = input;\n\n  if (supplied === undefined) return authored;\n\n  if (typeof supplied !== 'object' || supplied === null || Array.isArray(supplied)) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.NOT_AN_OBJECT,\n      [],\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} must be an object of public `\n      + `keys, got ${Array.isArray(supplied) ? 'an array' : typeof supplied}.`,\n    );\n  }\n\n  const suppliedKeys = Object.keys(supplied);\n\n  // Guard 2 runs FIRST and unconditionally: a secret is refused even when the\n  // module has no introspectable schema, because that is not the module's call.\n  const secretKeys = suppliedKeys.filter((key) => forbiddenKeys.has(key));\n  if (secretKeys.length > 0) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.SECRET_KEY,\n      secretKeys,\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} names ${secretKeys.map((key) => `\"${key}\"`).join(', ')}, `\n      + `which is a SECRET of the \"${providerRef}\" backend provider. A frontend provider's public configuration is `\n      + 'served to every browser; a secret belongs in the deployment environment under its `envVarName`, and '\n      + 'nowhere else.',\n    );\n  }\n\n  if (declaredKeys !== undefined) {\n    const declared = new Set(declaredKeys);\n    const undeclared = suppliedKeys.filter((key) => !declared.has(key));\n    if (undeclared.length > 0) {\n      throw new FrontendProviderPublicConfigError(\n        providerRef,\n        FrontendProviderPublicConfigRefusal.UNDECLARED_KEY,\n        undeclared,\n        `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} names ${undeclared.map((key) => `\"${key}\"`).join(', ')}, `\n        + `which the \"${providerRef}\" frontend provider does not declare. It declares: `\n        + `${declaredKeys.length > 0 ? declaredKeys.map((key) => `\"${key}\"`).join(', ') : '(nothing)'}. `\n        + 'A key the provider never reads would be served to every browser and used by nothing.',\n      );\n    }\n  }\n\n  return { ...(authored ?? {}), ...(supplied as Record<string, unknown>) };\n}\n\n/**\n * The value kinds a public-config key may declare. Scalars only, on purpose: a\n * public key is an identifier or a flag, and a structured value here is a\n * design smell — a provider that needs one has a capability-level shape\n * (`FrontendFilePickerPublicConfigSchema`) to declare it in.\n */\nexport enum FrontendPublicConfigValueKind {\n  STRING = 'string',\n  NUMBER = 'number',\n  BOOLEAN = 'boolean',\n}\n\nexport interface FrontendPublicConfigKeySpec {\n  readonly kind: FrontendPublicConfigValueKind;\n  /** Absent = optional. Picker keys are usually optional: a missing one is reported when the picker opens, not by dropping the provider. */\n  readonly required?: boolean;\n  /** For the person writing `wildo.saas.config.ts`. Not validated; surfaced in refusals. */\n  readonly description?: string;\n}\n\n/** A Standard Schema v1 validator that ALSO says which keys it declares. */\nexport interface FrontendPublicConfigSchema<TOutput = Readonly<Record<string, unknown>>> {\n  readonly '~standard': {\n    readonly version: 1;\n    readonly vendor: 'wildo';\n    validate(value: unknown):\n      | { readonly value: TOutput }\n      | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey> }> };\n  };\n  /**\n   * The keys this schema admits, readable without running it.\n   *\n   * This is the DATA half of the declaration, and it is why this helper exists\n   * rather than \"use Zod\": Standard Schema v1 exposes `validate` and nothing\n   * else, so a schema alone cannot tell the companion walk which keys an\n   * application may supply — and the walk runs in Node, from a projected\n   * contribution, without the module. `projectFrontendProviderContribution`\n   * mirrors this list onto the entry as `publicConfigKeys`.\n   */\n  readonly declaredKeys: readonly string[];\n}\n\n/**\n * Declares a frontend provider's public-config keys ONCE and gets both halves:\n * a strict Standard Schema v1 validator (the CODE half hydration runs) and the\n * key list (the DATA half the companion walk reads).\n *\n * Dependency-free by design. It lives here because the engine's provider modules\n * live in `@wildo-ai/external-connectors-public`, whose bare-specifier allow-list\n * holds exactly one entry — this package's `/public-runtime` — so those modules\n * can declare a schema without that package growing a validation library. An\n * application module may still use Zod (a Zod object satisfies Standard Schema\n * and its `shape` keys are read the same way).\n *\n * Strict: an unknown key is an issue, never ignored. Silently ignoring is the\n * defect FE-8 closed — a renamed key yielding `undefined` and a picker that\n * accepts more than it should with no error anywhere.\n */\nexport function defineFrontendPublicConfigSchema(\n  keys: Readonly<Record<string, FrontendPublicConfigKeySpec>>,\n): FrontendPublicConfigSchema {\n  const declaredKeys = Object.freeze(Object.keys(keys));\n\n  return {\n    declaredKeys,\n    '~standard': {\n      version: 1,\n      vendor: 'wildo',\n      validate(value: unknown) {\n        if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n          return { issues: [{ message: 'public configuration must be an object' }] };\n        }\n        const record = value as Record<string, unknown>;\n        const issues: Array<{ message: string; path?: PropertyKey[] }> = [];\n\n        for (const key of Object.keys(record)) {\n          if (!(key in keys)) issues.push({ message: 'unknown key', path: [key] });\n        }\n        for (const [key, spec] of Object.entries(keys)) {\n          const present = record[key];\n          if (present === undefined) {\n            if (spec.required === true) issues.push({ message: 'required', path: [key] });\n            continue;\n          }\n          if (typeof present !== spec.kind) {\n            issues.push({ message: `expected a ${spec.kind}, got ${typeof present}`, path: [key] });\n          }\n        }\n\n        return issues.length > 0 ? { issues } : { value: record };\n      },\n    },\n  };\n}\n\n/**\n * Reads the declared keys off a provider's `publicConfigSchema`, whatever\n * library produced it.\n *\n * Two shapes are recognised, and the order matters: a schema built by\n * `defineFrontendPublicConfigSchema` states its keys outright; a Zod object\n * exposes them as `shape`. Anything else — a hand-written Standard Schema, a\n * library without introspection — yields `undefined`, which the overlay reads\n * as \"cannot enforce here\" rather than as \"declares nothing\". That distinction\n * is load-bearing: an empty list refuses EVERY supplied key.\n */\nexport function readDeclaredPublicConfigKeys(schema: unknown): readonly string[] | undefined {\n  if (typeof schema !== 'object' || schema === null) return undefined;\n  const candidate = schema as { declaredKeys?: unknown; shape?: unknown };\n  if (Array.isArray(candidate.declaredKeys) && candidate.declaredKeys.every((key) => typeof key === 'string')) {\n    return candidate.declaredKeys as readonly string[];\n  }\n  if (typeof candidate.shape === 'object' && candidate.shape !== null) {\n    return Object.keys(candidate.shape as Record<string, unknown>);\n  }\n  return undefined;\n}\n"]}
+{"version":3,"file":"frontend-provider-public-config.shared.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,mIAAmI;AACnI,MAAM,CAAC,MAAM,mCAAmC,GAAW,cAAc,CAAC;AAE1E,gIAAgI;AAChI,iEAAiE;AACjE,MAAM,CAAN,IAAY,mCAkBX;AAlBD,WAAY,mCAAmC;IAC7C,gFAAgF;IAChF,wEAAiC,CAAA;IACjC,uFAAuF;IACvF,gEAAyB,CAAA;IACzB,2EAA2E;IAC3E,sEAA+B,CAAA;IAC/B;;;;OAIG;IACH,8FAAuD,CAAA;IACvD;;;OAGG;IACH,oEAA6B,CAAA;AAC/B,CAAC,EAlBW,mCAAmC,KAAnC,mCAAmC,QAkB9C;AACD,kFAAkF;AAElF,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAE/C;IACA;IACA;IAHX,YACW,WAAmB,EACnB,OAA4C,EAC5C,IAAuB,EAChC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,gBAAW,GAAX,WAAW,CAAQ;QACnB,YAAO,GAAP,OAAO,CAAqC;QAC5C,SAAI,GAAJ,IAAI,CAAmB;QAIhC,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAoBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mCAAmC,CACjD,KAA+C;IAE/C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAE/E,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,aAAa,EACjD,EAAE,EACF,0BAA0B,WAAW,IAAI,mCAAmC,+BAA+B;cACzG,aAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,QAAQ,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEzE,6FAA6F;IAC7F,8EAA8E;IAC9E,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,UAAU,EAC9C,UAAU,EACV,0BAA0B,WAAW,IAAI,mCAAmC,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACtI,6BAA6B,WAAW,oEAAoE;cAC5G,sGAAsG;cACtG,eAAe,CAClB,CAAC;IACJ,CAAC;IAED,4HAA4H;IAC5H,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,yBAAyB,EAC7D,EAAE,EACF,QAAQ,WAAW,4FAA4F;cAC7G,uFAAuF;cACvF,kGAAkG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS;QACnC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAI,QAAoC,EAAE,CAAC;IAEtE,2GAA2G;IAC3G,iGAAiG;IACjG,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,YAAY;YACxB,CAAC,CAAC,0BAA0B,WAAW,IAAI,mCAAmC,EAAE;YAChF,CAAC,CAAC,QAAQ,WAAW,wFAAwF,CAAC;QAChH,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,cAAc,EAClD,UAAU,EACV,GAAG,KAAK,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cAClE,cAAc,WAAW,qDAAqD;cAC9E,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI;cAC/F,sFAAsF,CACzF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAqBD,gIAAgI;AAChI;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,EAAE,CAAC;AACvE,kFAAkF;AAElF;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY,EAAE,IAA4C;IACrG,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3D,6FAA6F;YAC7F,sEAAsE;YACtE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC,CACjD,SAAkG,EAClG,OAAmD;IAEnD,MAAM,UAAU,GAAG,OAAO;SACvB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACpE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,OAAO,GAAsC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAA2C,EAAE,CAAC;QAC1D,mBAAmB,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,SAAS,KAAK,MAAM,CAAC,KAAK;uBACjC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,oDAAoD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvH,IAAI,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAItD;IACC,8GAA8G;IAC9G,MAAM,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,IAAI,iCAAiC,CACzC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EACtB,mCAAmC,CAAC,YAAY,EAChD,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,EAC3D,GAAG,KAAK,CAAC,QAAQ,qDAAqD;UACpE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,KAAK,CAAC,GAAG,kBAAkB,KAAK,CAAC,WAAW,gCAAgC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;UAC5I,iHAAiH;UACjH,gHAAgH;UAChH,YAAY,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,4CAA4C,CAAC,KAM5D;IACC,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,wIAAwI;YACxI,mCAAmC,CAAC;gBAClC,WAAW;gBACX,QAAQ,EAAE,KAAK,CAAC,YAAY;gBAC5B,QAAQ,EAAE,SAAS;gBACnB,YAAY,EAAE,KAAK,CAAC,gBAAgB;gBACpC,aAAa,EAAE,IAAI,GAAG,EAAU;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,iCAAiC,CAAC;gBAAE,MAAM,KAAK,CAAC;YACvE,MAAM,IAAI,iCAAiC,CACzC,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,IAAI,EACV,GAAG,KAAK,CAAC,QAAQ,oEAAoE,KAAK,CAAC,OAAO,GAAG;kBACnG,iHAAiH,CACpH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,gIAAgI;AAChI;;;;;GAKG;AACH,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,kDAAiB,CAAA;IACjB,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAiCD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAA2D;IAE3D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,OAAO;QACL,YAAY;QACZ,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,OAAO;YACf,QAAQ,CAAC,KAAc;gBACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,EAAE,CAAC;gBAC7E,CAAC;gBACD,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,MAAM,GAAqD,EAAE,CAAC;gBAEpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;wBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;4BAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC9E,SAAS;oBACX,CAAC;oBACD,IAAI,OAAO,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,IAAI,CAAC,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC;gBAED,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC5D,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,SAAS,GAAG,MAAqD,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5G,OAAO,SAAS,CAAC,YAAiC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAgC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * How an APPLICATION supplies a frontend provider's public configuration — the\n * keys a picker needs that only the application can know (a Drive `appId`, a\n * OneDrive `clientId`) — and the gates that keep that channel from carrying\n * anything else.\n *\n * ## The gap this closes\n *\n * A frontend provider's `publicConfig` was HARD-CODED on the engine's provider\n * module and projected verbatim onto the wire. The only way to set a picker's\n * `appId` was to edit engine code. The backend never had that problem: an\n * application authors `providerConfigurations[providerRef][protocolKind]` in\n * `wildo.saas.config.ts`, and SSO's public OAuth client id already travels that\n * way, keyed by the protocol (`sso_oauth2`).\n *\n * This file gives the frontend the same channel, keyed by the same vocabulary:\n * `providerConfigurations[providerRef][frontend_sdk]`. One authority for\n * \"what an application configured for this provider\", read by both sides.\n *\n * ## The gates, because `publicConfig` is served to every browser\n *\n * 1. **Only DECLARED keys cross.** A provider module declares the keys it reads\n *    (`publicConfigSchema` — see `defineFrontendPublicConfigSchema` below, which\n *    is what makes those keys READABLE without running the schema), and a\n *    module with no readable list is refused outright. Every key an entry would\n *    serve — authored by the module, mapped onto its contribution, or supplied\n *    by the application — is held to that list wherever an entry is PRODUCED\n *    (`wildo config sync`, the backend's fallback projection) and again wherever\n *    a ready-made one is READ and served (the backend's `/application-config`,\n *    the website and documentation build loader). A misspelled `apiId` therefore\n *    fails where it was typed, instead of silently contributing nothing and\n *    leaving a picker that reports \"no appId\" at the moment a user opens it.\n *\n * 2. **A secret VALUE never crosses.** Every served string is compared against\n *    the producer's secret values — the environment's whole `secrets.json` at\n *    sync, the registered providers' confidential slots on the backend — and a\n *    match refuses, whatever the key is called (#1705).\n *\n * 3. **A secret NAME is refused early.** A key spelled like a slug or an\n *    environment-variable name from the same vendor's backend secrets contract\n *    (`GOOGLE_OAUTH2_CLIENT_SECRET`) is refused with that explanation before the\n *    key-list check would call it merely undeclared. It is the clearer message,\n *    not the gate: a browser-only vendor has no backend names to match.\n *\n * Value VALIDATION (is `appId` a string?) is the schema's job and runs where the\n * schema is: at hydration (FE-8) and, on the backend fallback, before serving.\n *\n * ## Why names were never enough, and what closes it (#1705)\n *\n * The name gate draws its forbidden names from the same vendor's BACKEND contract, so a\n * browser-only vendor (reCAPTCHA, Algolia) had an EMPTY forbidden set: its secret\n * key under `siteKey`, or an Algolia admin key under `apiKey`, passed every name\n * check. And the declared-key gate switched itself off for a module with no introspectable\n * schema — 8 of the 13 engine modules — admitting any key at all. A guard that\n * matches how a key is SPELLED looks like a control and decides almost nothing.\n *\n * Three changes turn it into one:\n *\n * - **A schema is mandatory.** `declaredKeys: undefined` is now a refusal\n *   (`SCHEMA_NOT_INTROSPECTABLE`) rather than \"cannot enforce here\", and the key check\n *   runs over the WHOLE served bag — the module's authored keys and any key an\n *   application mapped onto its contribution — not only over what\n *   `providerConfigurations` supplied.\n * - **Values are compared, not shapes.** {@link assertNoSecretValueInFrontendProviders}\n *   compares every string in every served `publicConfig` against the secret\n *   VALUES the producer holds: `wildo config sync` against the environment's\n *   `secrets.json`, the backend against its providers' confidential slots. It\n *   asks \"is this one of OUR secrets\", which no name or shape rule can answer,\n *   and it names the key and the slot, never the value. Gitleaks answers the\n *   other question (\"does this look like a secret\") on committed files; the two\n *   do not overlap.\n * - **What is secret comes from a declaration.** A provider secret slot is\n *   confidential unless its contract marks it `holdsBrowserPublicValue` (a\n *   vendor key designed to ship to browsers, such as PostHog's project key) or\n *   `holdsDeploymentHost`; framework-managed material is confidential by its\n *   registry's `secretKeys`. Nothing is inferred from a key's name.\n *\n * ## Why the overlay is a pure function in this package\n *\n * It has THREE call sites that must agree — the companion walk in\n * `platform-config-lib`, the backend fallback in `saas-backend-lib`, and any\n * future producer of a `FrontendProviderEntry` — and #380 already paid once for\n * a projection that landed on one site and not another. A function both import\n * cannot be applied differently by each.\n */\n\n/**\n * The key under `providerConfigurations[providerRef]` an application uses to\n * supply a frontend provider's public configuration.\n *\n * The protocol kind's WIRE value, exactly as SSO's channel is keyed by ITS\n * protocol kind (`sso_oauth2`): the bag is per-provider, per-protocol, and a\n * frontend module speaks `FRONTEND_SDK`.\n *\n * The owning source is `ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK` in\n * `@wildo-ai/external-connectors-models`, and this literal is pinned to it by\n * `__tests__/frontend-provider-public-config.shared.test.ts`. It is written out\n * rather than imported because this file is in the\n * `@wildo-ai/saas-models/public-runtime` closure, which K-3 forbids from\n * importing that package — an import it carried from #394 P3 until #607 put the\n * whole external-connectors model tree into every browser provider bundle.\n * `BUILTIN_PROVIDER_PROTOCOL` is the same arrangement for the same boundary.\n */\n// semantic-literal-boundary: browser-safe wire value of ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK, pinned by test (#607)\nexport const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY: string = 'frontend_sdk';\n\n/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */\n/** Why an application-supplied public-config bag was refused. */\nexport enum FrontendProviderPublicConfigRefusal {\n  /** A key the provider module does not declare — almost always a misspelling. */\n  UNDECLARED_KEY = 'UNDECLARED_KEY',\n  /** A key naming a secret from the same vendor's backend contract. Never negotiable. */\n  SECRET_KEY = 'SECRET_KEY',\n  /** The supplied bag is not a plain object — a string, an array, `null`. */\n  NOT_AN_OBJECT = 'NOT_AN_OBJECT',\n  /**\n   * The module declares no `publicConfigSchema` whose keys can be read without running it\n   * (#1705). Nothing can then say which keys it takes, so nothing it is handed can be held to a\n   * list — and \"admit everything\" is the answer that reaches a browser.\n   */\n  SCHEMA_NOT_INTROSPECTABLE = 'SCHEMA_NOT_INTROSPECTABLE',\n  /**\n   * A served value equals, or contains, one of the producer's SECRET VALUES (#1705) — whatever the\n   * key is called and whichever vendor the secret belongs to. Never negotiable.\n   */\n  SECRET_VALUE = 'SECRET_VALUE',\n}\n/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */\n\nexport class FrontendProviderPublicConfigError extends Error {\n  constructor(\n    readonly providerRef: string,\n    readonly refusal: FrontendProviderPublicConfigRefusal,\n    readonly keys: readonly string[],\n    message: string,\n  ) {\n    super(message);\n    this.name = 'FrontendProviderPublicConfigError';\n  }\n}\n\nexport interface OverlayFrontendProviderPublicConfigInput {\n  readonly providerRef: string;\n  /** What the provider module authored — its own defaults, e.g. `{ integrationKind: 'captcha' }`. */\n  readonly authored: Readonly<Record<string, unknown>> | undefined;\n  /** What the application supplied under `providerConfigurations[providerRef][frontend_sdk]`. */\n  readonly supplied: unknown;\n  /**\n   * The keys the provider module declares it reads. `undefined` means the\n   * module declared no introspectable schema, and is REFUSED\n   * (`SCHEMA_NOT_INTROSPECTABLE`, #1705): it used to mean \"cannot enforce here\",\n   * which admitted any key for 8 of the 13 engine modules. An empty array means\n   * the module declares it reads NOTHING, so every key is refused.\n   */\n  readonly declaredKeys: readonly string[] | undefined;\n  /** Slugs and environment-variable names of the same vendor's backend secrets. */\n  readonly forbiddenKeys: ReadonlySet<string>;\n}\n\n/**\n * Merges what the application supplied over what the module authored, refusing\n * the classes of key that must never reach a browser.\n *\n * Supplied values WIN over authored ones for the same key: the module's value is\n * a default, and an application that names a key means it. Absent `supplied`\n * returns the authored bag unchanged — an application that configured nothing\n * is the ordinary case, not a refusal — but it is still HELD to the declared\n * keys: `authored` is what the served entry carries, which includes any key an\n * application mapped onto the contribution in its own `provider-contributions`.\n *\n * Call it for EVERY entry a producer serves, supplied or not; a producer that\n * skips it when nothing was supplied skips the schema and key checks too.\n */\nexport function overlayFrontendProviderPublicConfig(\n  input: OverlayFrontendProviderPublicConfigInput,\n): Readonly<Record<string, unknown>> | undefined {\n  const { providerRef, authored, supplied, declaredKeys, forbiddenKeys } = input;\n\n  if (supplied !== undefined && (typeof supplied !== 'object' || supplied === null || Array.isArray(supplied))) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.NOT_AN_OBJECT,\n      [],\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} must be an object of public `\n      + `keys, got ${Array.isArray(supplied) ? 'an array' : typeof supplied}.`,\n    );\n  }\n\n  const suppliedKeys = supplied === undefined ? [] : Object.keys(supplied);\n\n  // The secret-NAME gate (3) runs FIRST and unconditionally: a secret is refused even when the\n  // module has no introspectable schema, because that is not the module's call.\n  const secretKeys = suppliedKeys.filter((key) => forbiddenKeys.has(key));\n  if (secretKeys.length > 0) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.SECRET_KEY,\n      secretKeys,\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} names ${secretKeys.map((key) => `\"${key}\"`).join(', ')}, `\n      + `which is a SECRET of the \"${providerRef}\" backend provider. A frontend provider's public configuration is `\n      + 'served to every browser; a secret belongs in the deployment environment under its `envVarName`, and '\n      + 'nowhere else.',\n    );\n  }\n\n  // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a frontend provider with no readable key list serves nothing to a browser\n  if (declaredKeys === undefined) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.SCHEMA_NOT_INTROSPECTABLE,\n      [],\n      `The \"${providerRef}\" frontend provider declares no publicConfigSchema whose keys can be read, so nothing can `\n      + 'say which public keys it takes and none can be served to a browser. Declare one with '\n      + '`defineFrontendPublicConfigSchema` (or a Zod object) listing every key its publicConfig carries.',\n    );\n  }\n\n  const merged = supplied === undefined\n    ? authored\n    : { ...(authored ?? {}), ...(supplied as Record<string, unknown>) };\n\n  // The declared-key gate (1) over the WHOLE served bag (#1705), not only over what `providerConfigurations`\n  // supplied: a key a module authored, or an application mapped onto its contribution, reaches the\n  // browser exactly as a supplied one does.\n  const declared = new Set(declaredKeys);\n  const undeclared = Object.keys(merged ?? {}).filter((key) => !declared.has(key));\n  if (undeclared.length > 0) {\n    const suppliedSet = new Set(suppliedKeys);\n    const fromSupplied = undeclared.every((key) => suppliedSet.has(key));\n    const where = fromSupplied\n      ? `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY}`\n      : `The \"${providerRef}\" provider's publicConfig (authored by its module or mapped in provider-contributions)`;\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.UNDECLARED_KEY,\n      undeclared,\n      `${where} names ${undeclared.map((key) => `\"${key}\"`).join(', ')}, `\n      + `which the \"${providerRef}\" frontend provider does not declare. It declares: `\n      + `${declaredKeys.length > 0 ? declaredKeys.map((key) => `\"${key}\"`).join(', ') : '(nothing)'}. `\n      + 'A key the provider never reads would be served to every browser and used by nothing.',\n    );\n  }\n\n  return merged;\n}\n\n/**\n * One secret value a producer holds, with WHERE it lives.\n *\n * `slot` is what a refusal names — `secrets.json → providerEnv.STRIPE_SECRET_KEY`, or the\n * provider slot on the backend — so an operator can find it. The value itself is never printed.\n */\nexport interface FrontendPublicConfigSecretValue {\n  readonly slot: string;\n  readonly value: string;\n}\n\n/** One served public value found to be (or to contain) a secret. Names, never the value. */\nexport interface FrontendPublicConfigSecretMatch {\n  readonly providerRef: string;\n  /** Path inside that provider's `publicConfig`, e.g. `apiKey` or `origins[1]`. */\n  readonly key: string;\n  readonly slot: string;\n}\n\n/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */\n/**\n * The shortest secret a served value is searched INSIDE, not only compared to.\n *\n * Containment catches a secret embedded in a larger public value — a URL carrying\n * `?key=<secret>`, a `https://user:<secret>@host` endpoint — which exact equality would miss.\n * Below this length a secret (a six-character default password, a short database name held in a\n * credential slot) could occur by coincidence inside an ordinary public value such as a host name,\n * and refusing a correct configuration on that coincidence would teach operators to route around\n * the check. Shorter secrets are still compared EXACTLY.\n */\nexport const FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH = 16;\n/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */\n\n/**\n * Every place a served value can carry text, as text: string leaves, the decimal form of numbers\n * and bigints (a numeric secret typed into a `number`-kind key is served just the same), and the\n * KEYS of nested objects (a map keyed by a secret serves the secret). Booleans and `null` carry\n * nothing. A key found this way is reported at `<path>{key}` so the refusal can still say where.\n */\nfunction collectStringLeaves(value: unknown, path: string, into: Array<{ path: string; value: string }>): void {\n  if (typeof value === 'string') {\n    into.push({ path, value });\n    return;\n  }\n  if ((typeof value === 'number' && Number.isFinite(value)) || typeof value === 'bigint') {\n    into.push({ path, value: String(value) });\n    return;\n  }\n  if (Array.isArray(value)) {\n    value.forEach((item, index) => collectStringLeaves(item, `${path}[${index}]`, into));\n    return;\n  }\n  if (typeof value === 'object' && value !== null) {\n    for (const [key, item] of Object.entries(value)) {\n      const childPath = path.length > 0 ? `${path}.${key}` : key;\n      // A top-level key is the provider's own declared key name, held to its list by the key gate;\n      // a NESTED key is data an author chose, and is screened like a value.\n      if (path.length > 0) into.push({ path: `${path}{key}`, value: key });\n      collectStringLeaves(item, childPath, into);\n    }\n  }\n}\n\n/**\n * Every place a served `publicConfig` carries one of the producer's secret values (#1705).\n *\n * Pure, and total over the strings it is given: every string leaf of every provider's bag —\n * nested objects and arrays included — against every non-blank secret. A match is EXACT equality\n * (after trimming both sides), or CONTAINMENT for a secret at least\n * {@link FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH} long.\n *\n * Deliberately blind to key names and to which vendor a secret belongs: the defect it closes is a\n * secret under an innocent key, or one vendor's secret served under another vendor's ref.\n *\n * What it does NOT see: an ENCODED secret (URL- or base64-encoded, split across keys, hashed). It\n * asks \"is this one of our values\", verbatim; recognising transformed forms would need a guess at\n * every encoding an author might apply, and each guess would be a new false-positive source. The\n * committed-file scanner (gitleaks) and review are the backstops for that.\n */\nexport function findSecretValuesInFrontendProviders(\n  providers: Readonly<Record<string, { readonly publicConfig?: Readonly<Record<string, unknown>> }>>,\n  secrets: readonly FrontendPublicConfigSecretValue[],\n): FrontendPublicConfigSecretMatch[] {\n  const comparable = secrets\n    .map((secret) => ({ slot: secret.slot, value: secret.value.trim() }))\n    .filter((secret) => secret.value.length > 0);\n  if (comparable.length === 0) return [];\n\n  const matches: FrontendPublicConfigSecretMatch[] = [];\n  for (const [providerRef, entry] of Object.entries(providers)) {\n    const leaves: Array<{ path: string; value: string }> = [];\n    collectStringLeaves(entry.publicConfig ?? {}, '', leaves);\n    for (const leaf of leaves) {\n      const candidate = leaf.value.trim();\n      if (candidate.length === 0) continue;\n      for (const secret of comparable) {\n        const hit = candidate === secret.value\n          || (secret.value.length >= FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH && candidate.includes(secret.value));\n        if (hit) matches.push({ providerRef, key: leaf.path, slot: secret.slot });\n      }\n    }\n  }\n  return matches;\n}\n\n/**\n * Refuses to serve a set of frontend providers when any served value is one of the producer's\n * secrets (#1705). Called by BOTH producers of a served bootstrap — `wildo config sync` before it\n * writes any artifact, and the backend before it answers `/application-config` — so the two cannot\n * disagree about what may reach a browser.\n *\n * `producer` names who is refusing and where its secrets came from, for the message.\n */\nexport function assertNoSecretValueInFrontendProviders(input: {\n  readonly producer: string;\n  readonly providers: Readonly<Record<string, { readonly publicConfig?: Readonly<Record<string, unknown>> }>>;\n  readonly secrets: readonly FrontendPublicConfigSecretValue[];\n}): void {\n  // assurance-control: WILDO.DATA.CONFIDENTIALITY — a secret value never reaches a browser under any public key\n  const matches = findSecretValuesInFrontendProviders(input.providers, input.secrets);\n  if (matches.length === 0) return;\n  throw new FrontendProviderPublicConfigError(\n    matches[0].providerRef,\n    FrontendProviderPublicConfigRefusal.SECRET_VALUE,\n    matches.map((match) => `${match.providerRef}.${match.key}`),\n    `${input.producer} refused to serve frontend provider configuration: `\n    + matches.map((match) => `publicConfig \"${match.key}\" of provider \"${match.providerRef}\" carries the secret held in ${match.slot}`).join('; ')\n    + '. A frontend provider\\'s public configuration is served to every browser. Replace the value with the vendor\\'s '\n    + 'PUBLIC key (a publishable, site or search-only key), and if that secret has already been committed or served, '\n    + 'rotate it.',\n  );\n}\n\n/**\n * Refuses a READY-MADE block of frontend providers whose entries do not carry their key list, or\n * serve a key outside it (#1705).\n *\n * The overlay holds an entry to its declared keys at the moment it is PRODUCED. A block that is only\n * READ — the generated bootstrap the backend serves on `/application-config`, the frontend-services\n * artifact the website and documentation builds bake into their pages — was produced earlier, by\n * whichever `wildo config sync` wrote it. One written before a schema was mandatory carries entries\n * with no `publicConfigKeys` and was never held to any list, and nothing downstream would notice: the\n * reader parses the entry (the field stays optional on the wire precisely so it CAN be read and\n * refused with a message) and serves it. So every site that serves a ready-made block asks the same\n * question the producer asked, through the same function, and a stale artifact is refused with the\n * remedy — regenerate it — instead of being served.\n *\n * `producer` names who is refusing and what it read, for the message.\n */\nexport function assertFrontendProvidersServeOnlyDeclaredKeys(input: {\n  readonly producer: string;\n  readonly providers: Readonly<Record<string, {\n    readonly publicConfig?: Readonly<Record<string, unknown>>;\n    readonly publicConfigKeys?: readonly string[];\n  }>>;\n}): void {\n  for (const [providerRef, entry] of Object.entries(input.providers)) {\n    try {\n      // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a served frontend provider entry with no key list, or a key outside it, is not served\n      overlayFrontendProviderPublicConfig({\n        providerRef,\n        authored: entry.publicConfig,\n        supplied: undefined,\n        declaredKeys: entry.publicConfigKeys,\n        forbiddenKeys: new Set<string>(),\n      });\n    } catch (error) {\n      if (!(error instanceof FrontendProviderPublicConfigError)) throw error;\n      throw new FrontendProviderPublicConfigError(\n        error.providerRef,\n        error.refusal,\n        error.keys,\n        `${input.producer} refused to serve frontend provider configuration it was handed: ${error.message} `\n        + 'The configuration was most likely generated before this check existed — regenerate it with `wildo config sync`.',\n      );\n    }\n  }\n}\n\n/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */\n/**\n * The value kinds a public-config key may declare. Scalars only, on purpose: a\n * public key is an identifier or a flag, and a structured value here is a\n * design smell — a provider that needs one has a capability-level shape\n * (`FrontendFilePickerPublicConfigSchema`) to declare it in.\n */\nexport enum FrontendPublicConfigValueKind {\n  STRING = 'string',\n  NUMBER = 'number',\n  BOOLEAN = 'boolean',\n}\n\nexport interface FrontendPublicConfigKeySpec {\n  readonly kind: FrontendPublicConfigValueKind;\n  /** Absent = optional. Picker keys are usually optional: a missing one is reported when the picker opens, not by dropping the provider. */\n  readonly required?: boolean;\n  /** For the person writing `wildo.saas.config.ts`. Not validated; surfaced in refusals. */\n  readonly description?: string;\n}\n/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */\n\n/** A Standard Schema v1 validator that ALSO says which keys it declares. */\nexport interface FrontendPublicConfigSchema<TOutput = Readonly<Record<string, unknown>>> {\n  readonly '~standard': {\n    readonly version: 1;\n    readonly vendor: 'wildo';\n    validate(value: unknown):\n      | { readonly value: TOutput }\n      | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey> }> };\n  };\n  /**\n   * The keys this schema admits, readable without running it.\n   *\n   * This is the DATA half of the declaration, and it is why this helper exists\n   * rather than \"use Zod\": Standard Schema v1 exposes `validate` and nothing\n   * else, so a schema alone cannot tell the companion walk which keys an\n   * application may supply — and the walk runs in Node, from a projected\n   * contribution, without the module. `projectFrontendProviderContribution`\n   * mirrors this list onto the entry as `publicConfigKeys`.\n   */\n  readonly declaredKeys: readonly string[];\n}\n\n/**\n * Declares a frontend provider's public-config keys ONCE and gets both halves:\n * a strict Standard Schema v1 validator (the CODE half hydration runs) and the\n * key list (the DATA half the companion walk reads).\n *\n * Dependency-free by design. It lives here because the engine's provider modules\n * live in `@wildo-ai/external-connectors-public`, whose bare-specifier allow-list\n * holds exactly one entry — this package's `/public-runtime` — so those modules\n * can declare a schema without that package growing a validation library. An\n * application module may still use Zod (a Zod object satisfies Standard Schema\n * and its `shape` keys are read the same way).\n *\n * Strict: an unknown key is an issue, never ignored. Silently ignoring is the\n * defect FE-8 closed — a renamed key yielding `undefined` and a picker that\n * accepts more than it should with no error anywhere.\n */\nexport function defineFrontendPublicConfigSchema(\n  keys: Readonly<Record<string, FrontendPublicConfigKeySpec>>,\n): FrontendPublicConfigSchema {\n  const declaredKeys = Object.freeze(Object.keys(keys));\n\n  return {\n    declaredKeys,\n    '~standard': {\n      version: 1,\n      vendor: 'wildo',\n      validate(value: unknown) {\n        if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n          return { issues: [{ message: 'public configuration must be an object' }] };\n        }\n        const record = value as Record<string, unknown>;\n        const issues: Array<{ message: string; path?: PropertyKey[] }> = [];\n\n        for (const key of Object.keys(record)) {\n          if (!(key in keys)) issues.push({ message: 'unknown key', path: [key] });\n        }\n        for (const [key, spec] of Object.entries(keys)) {\n          const present = record[key];\n          if (present === undefined) {\n            if (spec.required === true) issues.push({ message: 'required', path: [key] });\n            continue;\n          }\n          if (typeof present !== spec.kind) {\n            issues.push({ message: `expected a ${spec.kind}, got ${typeof present}`, path: [key] });\n          }\n        }\n\n        return issues.length > 0 ? { issues } : { value: record };\n      },\n    },\n  };\n}\n\n/**\n * Reads the declared keys off a provider's `publicConfigSchema`, whatever\n * library produced it.\n *\n * Two shapes are recognised, and the order matters: a schema built by\n * `defineFrontendPublicConfigSchema` states its keys outright; a Zod object\n * exposes them as `shape`. Anything else — a hand-written Standard Schema, a\n * library without introspection — yields `undefined`, which every gate REFUSES\n * (`SCHEMA_NOT_INTROSPECTABLE`, #1705) rather than reading as \"declares nothing\".\n * That distinction is load-bearing: an empty list is a readable answer and\n * refuses EVERY key, while `undefined` means no key list exists at all.\n */\nexport function readDeclaredPublicConfigKeys(schema: unknown): readonly string[] | undefined {\n  if (typeof schema !== 'object' || schema === null) return undefined;\n  const candidate = schema as { declaredKeys?: unknown; shape?: unknown };\n  if (Array.isArray(candidate.declaredKeys) && candidate.declaredKeys.every((key) => typeof key === 'string')) {\n    return candidate.declaredKeys as readonly string[];\n  }\n  if (typeof candidate.shape === 'object' && candidate.shape !== null) {\n    return Object.keys(candidate.shape as Record<string, unknown>);\n  }\n  return undefined;\n}\n"]}

package/dist/esm/external-providers/model-cost-accounting-config.shared.schemas.d.ts

@@ -0,0 +1,53 @@
+/**
+ * # `modelCostAccounting`: how an application prices its model calls and closes its cost periods (#1598)
+ *
+ * A backend-authored configuration section. It is NOT on the shared (frontend-visible) configuration: the
+ * rates an application registers are its negotiated acquisition costs, which is the firm's internal margin
+ * data.
+ *
+ * - `providerUsagePricingAuthorities` — the application's price list. Registered by the application because
+ *   rates are negotiated; the engine ships no catalogue (it would be wrong for every contract and go stale).
+ *   A duplicate `pricingAuthorityRef@pricingAuthorityVersion` is refused when the configuration is parsed,
+ *   which is at startup.
+ * - `periodCloseGraceDays` — how long after a calendar month ends the period-close batch waits before
+ *   writing that month's aggregates, so late rows (retries, a drain backlog) land first. Startup refuses a
+ *   declared `OPERATIONAL_LOGS` period shorter than one month plus this grace: the close reads detail rows,
+ *   and would otherwise read rows the retention sweep had already deleted.
+ */
+import { z } from 'zod';
+/** Default grace after a month ends before its cost aggregates are closed. */
+export declare const MODEL_COST_PERIOD_CLOSE_DEFAULT_GRACE_DAYS = 3;
+/** Default schedule of the period-close batch: daily at 02:17 UTC (it closes every period whose grace has passed). */
+export declare const MODEL_COST_PERIOD_CLOSE_DEFAULT_CRON = "17 2 * * *";
+/** @wildo_source:part:start saas.models.model-cost-accounting-config facet:layer:shared facet:family:config facet:audience:app-developer */
+export declare const ModelCostAccountingConfigSchema: z.ZodObject<{
+    providerUsagePricingAuthorities: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        pricingAuthorityRef: z.ZodString;
+        pricingAuthorityVersion: z.ZodNumber;
+        providerRef: z.ZodString;
+        model: z.ZodString;
+        currency: z.ZodString;
+        unitsDenominator: z.ZodNumber;
+        roundingMode: z.ZodLiteral<import("./provider-usage-pricing.shared.schemas").ProviderUsagePricingRoundingMode>;
+        rates: z.ZodArray<z.ZodObject<{
+            category: z.ZodEnum<typeof import("./provider-usage-pricing.shared.schemas").ProviderUsagePricingCategory>;
+            amountMinorNumerator: z.ZodNumber;
+        }, z.core.$strict>>;
+        usageTierRules: z.ZodArray<z.ZodObject<{
+            kind: z.ZodLiteral<import("./provider-usage-pricing.shared.schemas").ProviderUsagePricingTierRuleKind>;
+            inputTokenThresholdExclusive: z.ZodNumber;
+            inputRateMultiplierBasisPoints: z.ZodNumber;
+            outputRateMultiplierBasisPoints: z.ZodNumber;
+        }, z.core.$strict>>;
+        effectiveFrom: z.ZodISODateTime;
+        sourceRef: z.ZodString;
+        sourceVersion: z.ZodString;
+    }, z.core.$strict>>>;
+    periodCloseGraceDays: z.ZodDefault<z.ZodNumber>;
+    periodCloseCronSchedule: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type ModelCostAccountingConfig = z.infer<typeof ModelCostAccountingConfigSchema>;
+export type ModelCostAccountingConfigInput = z.input<typeof ModelCostAccountingConfigSchema>;
+/** @wildo_source:part:end saas.models.model-cost-accounting-config */
+//# sourceMappingURL=model-cost-accounting-config.shared.schemas.d.ts.map

package/dist/esm/external-providers/model-cost-accounting-config.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-cost-accounting-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/model-cost-accounting-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,8EAA8E;AAC9E,eAAO,MAAM,0CAA0C,IAAI,CAAC;AAC5D,sHAAsH;AACtH,eAAO,MAAM,oCAAoC,eAAe,CAAC;AAEjE,4IAA4I;AAC5I,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAC7F,sEAAsE"}

package/dist/esm/external-providers/model-cost-accounting-config.shared.schemas.js

@@ -0,0 +1,41 @@
+/**
+ * # `modelCostAccounting`: how an application prices its model calls and closes its cost periods (#1598)
+ *
+ * A backend-authored configuration section. It is NOT on the shared (frontend-visible) configuration: the
+ * rates an application registers are its negotiated acquisition costs, which is the firm's internal margin
+ * data.
+ *
+ * - `providerUsagePricingAuthorities` — the application's price list. Registered by the application because
+ *   rates are negotiated; the engine ships no catalogue (it would be wrong for every contract and go stale).
+ *   A duplicate `pricingAuthorityRef@pricingAuthorityVersion` is refused when the configuration is parsed,
+ *   which is at startup.
+ * - `periodCloseGraceDays` — how long after a calendar month ends the period-close batch waits before
+ *   writing that month's aggregates, so late rows (retries, a drain backlog) land first. Startup refuses a
+ *   declared `OPERATIONAL_LOGS` period shorter than one month plus this grace: the close reads detail rows,
+ *   and would otherwise read rows the retention sweep had already deleted.
+ */
+import { z } from 'zod';
+import { ProviderUsagePricingAuthoritySchema } from './provider-usage-pricing.shared.schemas.js';
+import { assertUniqueProviderUsagePricingAuthorities } from './provider-usage-cost.shared.js';
+/** Default grace after a month ends before its cost aggregates are closed. */
+export const MODEL_COST_PERIOD_CLOSE_DEFAULT_GRACE_DAYS = 3;
+/** Default schedule of the period-close batch: daily at 02:17 UTC (it closes every period whose grace has passed). */
+export const MODEL_COST_PERIOD_CLOSE_DEFAULT_CRON = '17 2 * * *';
+/** @wildo_source:part:start saas.models.model-cost-accounting-config facet:layer:shared facet:family:config facet:audience:app-developer */
+export const ModelCostAccountingConfigSchema = z.object({
+    /** The application's registered model prices. Absent or empty: every call is recorded UNPRICED. */
+    providerUsagePricingAuthorities: z.array(ProviderUsagePricingAuthoritySchema).default([]),
+    /** Days after a calendar month (UTC) ends before its cost aggregates are written. 0–27. */
+    periodCloseGraceDays: z.number().int().min(0).max(27).default(MODEL_COST_PERIOD_CLOSE_DEFAULT_GRACE_DAYS),
+    /** Cron schedule of the period-close batch. */
+    periodCloseCronSchedule: z.string().min(1).default(MODEL_COST_PERIOD_CLOSE_DEFAULT_CRON),
+}).superRefine((config, context) => {
+    try {
+        assertUniqueProviderUsagePricingAuthorities(config.providerUsagePricingAuthorities);
+    }
+    catch (error) {
+        context.addIssue({ code: 'custom', path: ['providerUsagePricingAuthorities'], message: error instanceof Error ? error.message : String(error) });
+    }
+});
+/** @wildo_source:part:end saas.models.model-cost-accounting-config */
+//# sourceMappingURL=model-cost-accounting-config.shared.schemas.js.map

package/dist/esm/external-providers/model-cost-accounting-config.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-cost-accounting-config.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/model-cost-accounting-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mCAAmC,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,EAAE,2CAA2C,EAAE,MAAM,8BAA8B,CAAC;AAE3F,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC;AAC5D,sHAAsH;AACtH,MAAM,CAAC,MAAM,oCAAoC,GAAG,YAAY,CAAC;AAEjE,4IAA4I;AAC5I,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,mGAAmG;IACnG,+BAA+B,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzF,2FAA2F;IAC3F,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,0CAA0C,CAAC;IACzG,+CAA+C;IAC/C,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC;CACzF,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,2CAA2C,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,iCAAiC,CAAC,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,sEAAsE","sourcesContent":["/**\n * # `modelCostAccounting`: how an application prices its model calls and closes its cost periods (#1598)\n *\n * A backend-authored configuration section. It is NOT on the shared (frontend-visible) configuration: the\n * rates an application registers are its negotiated acquisition costs, which is the firm's internal margin\n * data.\n *\n * - `providerUsagePricingAuthorities` — the application's price list. Registered by the application because\n *   rates are negotiated; the engine ships no catalogue (it would be wrong for every contract and go stale).\n *   A duplicate `pricingAuthorityRef@pricingAuthorityVersion` is refused when the configuration is parsed,\n *   which is at startup.\n * - `periodCloseGraceDays` — how long after a calendar month ends the period-close batch waits before\n *   writing that month's aggregates, so late rows (retries, a drain backlog) land first. Startup refuses a\n *   declared `OPERATIONAL_LOGS` period shorter than one month plus this grace: the close reads detail rows,\n *   and would otherwise read rows the retention sweep had already deleted.\n */\nimport { z } from 'zod';\n\nimport { ProviderUsagePricingAuthoritySchema } from './provider-usage-pricing.shared.schemas';\nimport { assertUniqueProviderUsagePricingAuthorities } from './provider-usage-cost.shared';\n\n/** Default grace after a month ends before its cost aggregates are closed. */\nexport const MODEL_COST_PERIOD_CLOSE_DEFAULT_GRACE_DAYS = 3;\n/** Default schedule of the period-close batch: daily at 02:17 UTC (it closes every period whose grace has passed). */\nexport const MODEL_COST_PERIOD_CLOSE_DEFAULT_CRON = '17 2 * * *';\n\n/** @wildo_source:part:start saas.models.model-cost-accounting-config facet:layer:shared facet:family:config facet:audience:app-developer */\nexport const ModelCostAccountingConfigSchema = z.object({\n  /** The application's registered model prices. Absent or empty: every call is recorded UNPRICED. */\n  providerUsagePricingAuthorities: z.array(ProviderUsagePricingAuthoritySchema).default([]),\n  /** Days after a calendar month (UTC) ends before its cost aggregates are written. 0–27. */\n  periodCloseGraceDays: z.number().int().min(0).max(27).default(MODEL_COST_PERIOD_CLOSE_DEFAULT_GRACE_DAYS),\n  /** Cron schedule of the period-close batch. */\n  periodCloseCronSchedule: z.string().min(1).default(MODEL_COST_PERIOD_CLOSE_DEFAULT_CRON),\n}).superRefine((config, context) => {\n  try {\n    assertUniqueProviderUsagePricingAuthorities(config.providerUsagePricingAuthorities);\n  } catch (error) {\n    context.addIssue({ code: 'custom', path: ['providerUsagePricingAuthorities'], message: error instanceof Error ? error.message : String(error) });\n  }\n});\nexport type ModelCostAccountingConfig = z.infer<typeof ModelCostAccountingConfigSchema>;\nexport type ModelCostAccountingConfigInput = z.input<typeof ModelCostAccountingConfigSchema>;\n/** @wildo_source:part:end saas.models.model-cost-accounting-config */\n"]}