@wildo-ai/saas-models 1.1.6 → 1.1.7

package/dist/esm/external-providers/frontend-capability-runtime.shared.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-capability-runtime.shared.types.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;WACvB,MAAM,KAAK,IAAI;WACf,OAAQ,MAAsC,CAAC,WAAW,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC;AAkCD,uHAAuH;AACvH,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,SAAS,GAAG,MAAsE,CAAC;IACzF,OAAO,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU;WACvC,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;WACpC,OAAO,SAAS,CAAC,QAAQ,KAAK,UAAU;WACxC,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,CAAC;AAC7C,CAAC;AAWD,2GAA2G;AAC3G,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAQ,MAA8B,CAAC,OAAO,KAAK,UAAU,CAAC;AACxH,CAAC","sourcesContent":["/**\n * The RUNTIME contract a built-in frontend capability expects of whichever\n * provider fills it — the code-half sibling of\n * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.\n *\n * ## Why the capability owns the shape, and not the framework's call site\n *\n * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider\n * package must not know any vendor's type, and \"a consumer that needs one narrows\n * it at the point where it also knows which provider it asked for.\"\n *\n * That reasoning holds for a picker, where the surface really did ask for Drive.\n * It inverts for an OBSERVABILITY capability: the framework reports a crash without\n * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted\n * collector is listening. Narrowing at the call site would mean a `switch` over\n * vendors inside the engine, which is precisely what the capability model exists to\n * prevent.\n *\n * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,\n * and the framework calls one method it owns the definition of.\n *\n * ## Bundle-safe by construction\n *\n * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from\n * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take\n * a handful of atoms without the decorator-bound schema graph.\n */\n\n/**\n * One crash, as the framework describes it to whichever provider is listening.\n *\n * ## What is in it, and why that is the whole list\n *\n * `name`, `message`, `stack` and `componentStack` are exactly what\n * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught\n * crash. Nothing new is collected to fill this shape; what changes is only that the\n * report can now leave the browser.\n *\n * **`message` is sent as authored, and that is a decision rather than an oversight.**\n * It is the field most likely to carry user content — `new Error(\\`Invalid value:\n * ${input}\\`)` — and it is also the field without which a crash report is close to\n * useless. Every mainstream crash reporter sends the exception message and scrubs by\n * KEY rather than by free-text inspection, because a scrubber over prose either\n * destroys the diagnostic or gives false assurance. An application that cannot accept\n * that should not declare `FRONTEND_ERROR_MONITORING`.\n *\n * ## What is deliberately NOT in it\n *\n * No user identity, no session or organisation id, no request or form payload, and no\n * resource content. A crash report is a diagnostic about CODE; attributing it to a\n * PERSON is a separate decision an application would have to take deliberately, and\n * there is no field here through which it could happen by accident.\n */\nexport interface FrontendCrashReport {\n  /** The error's class name — `TypeError`, `WildoFrontendError`. */\n  readonly name: string;\n  /** The error's own message, unmodified. See the note above before changing this. */\n  readonly message: string;\n  /** The JavaScript stack, when the runtime produced one. */\n  readonly stack?: string;\n  /**\n   * React's component stack for a crash a boundary caught. Component NAMES only —\n   * no props, no state — so it says which screen broke without saying what was on it.\n   */\n  readonly componentStack?: string;\n  /**\n   * Framework classification, flattened to strings at this boundary.\n   *\n   * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,\n   * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must\n   * not pull in, and every mainstream vendor models exactly this as string tags. The\n   * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one\n   * named runtime source and only its serialization is local to this contract.\n   */\n  readonly tags?: Readonly<Record<string, string>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated\n * handle.\n *\n * Synchronous and returning nothing, deliberately. Reporting a crash must never\n * become something a crashing surface has to await or handle: a vendor SDK queues and\n * flushes on its own schedule, and a rejected promise here would be a second error\n * raised from inside the first one's handler.\n */\nexport interface FrontendErrorMonitoringSink {\n  reportCrash(report: FrontendCrashReport): void;\n}\n\n/**\n * Whether an activated SDK handle can receive crash reports.\n *\n * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor\n * namespace that does not implement this contract — a mistake no type can catch,\n * because `handle` is `unknown` by design. Checked at the seam so the failure is a\n * reported diagnostic rather than a `TypeError` thrown while handling a crash.\n */\nexport function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink {\n  return (\n    typeof handle === 'object'\n    && handle !== null\n    && typeof (handle as FrontendErrorMonitoringSink).reportCrash === 'function'\n  );\n}\n\n/**\n * One product-analytics event, as the framework hands it to a vendor (#1704).\n *\n * The same shape `AnalyticsContext.track()` has always taken — a name and flat properties — so the\n * framework's own auto-instrumentation and an application's custom `track()` reach a vendor unchanged.\n */\nexport interface FrontendProductAnalyticsEvent {\n  readonly name: string;\n  readonly properties?: Readonly<Record<string, unknown>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_PRODUCT_ANALYTICS` provider's activated handle (#1704).\n *\n * The application's analytics used to reach a vendor through a second registry inside\n * `AnalyticsContext`, with its own consent gate. A vendor now arrives as a provider module, is started\n * by the consent-based activation consumer once the person grants `ConsentPurpose.ANALYTICS`, and\n * stopped by its `deactivate` on withdrawal or sign-out; `AnalyticsContext` only DISPATCHES to the\n * sinks that are currently active. So there is one consent gate and one CSP footprint for a vendor.\n *\n * Synchronous and returning nothing, for the reason `FrontendErrorMonitoringSink` gives: a vendor\n * queues and flushes on its own schedule, and tracking must never become something a surface awaits.\n */\nexport interface FrontendProductAnalyticsSink {\n  track(event: FrontendProductAnalyticsEvent): void;\n  page(path: string, properties?: Readonly<Record<string, unknown>>): void;\n  /** The signed-in person, by the framework's own opaque id — never an email or a name. */\n  identify(identity: { readonly userId: string; readonly organizationId?: string }): void;\n  /** Forget the identified person (sign-out) without stopping the provider. */\n  reset(): void;\n}\n\n/** Whether an activated SDK handle can receive product-analytics events — checked at the seam, like the crash sink. */\nexport function isFrontendProductAnalyticsSink(handle: unknown): handle is FrontendProductAnalyticsSink {\n  if (typeof handle !== 'object' || handle === null) return false;\n  const candidate = handle as Partial<Record<keyof FrontendProductAnalyticsSink, unknown>>;\n  return typeof candidate.track === 'function'\n    && typeof candidate.page === 'function'\n    && typeof candidate.identify === 'function'\n    && typeof candidate.reset === 'function';\n}\n\n/**\n * What the framework calls on a `FRONTEND_CAPTCHA` provider's activated handle (#1735): mint a token for\n * one action, which the same vendor's backend part verifies. Returns `undefined` when the vendor could not\n * produce one; the form then answers the engine's proof of work instead.\n */\nexport interface FrontendCaptchaSink {\n  execute(action: string): Promise<string | undefined>;\n}\n\n/** Whether an activated SDK handle can mint captcha tokens — checked at the seam, like the other sinks. */\nexport function isFrontendCaptchaSink(handle: unknown): handle is FrontendCaptchaSink {\n  return typeof handle === 'object' && handle !== null && typeof (handle as FrontendCaptchaSink).execute === 'function';\n}\n\n"]}
+{"version":3,"file":"frontend-capability-runtime.shared.types.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-capability-runtime.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgEH;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAe;IAC3D,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;WACvB,MAAM,KAAK,IAAI;WACf,OAAQ,MAAsC,CAAC,WAAW,KAAK,UAAU,CAC7E,CAAC;AACJ,CAAC;AAkCD,uHAAuH;AACvH,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,SAAS,GAAG,MAAsE,CAAC;IACzF,OAAO,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU;WACvC,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU;WACpC,OAAO,SAAS,CAAC,QAAQ,KAAK,UAAU;WACxC,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,CAAC;AAC7C,CAAC;AAWD,2GAA2G;AAC3G,MAAM,UAAU,qBAAqB,CAAC,MAAe;IACnD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAQ,MAA8B,CAAC,OAAO,KAAK,UAAU,CAAC;AACxH,CAAC","sourcesContent":["/**\n * The RUNTIME contract a built-in frontend capability expects of whichever\n * provider fills it — the code-half sibling of\n * `frontend-capability-public-config.shared.schemas.ts`, which owns the data half.\n *\n * ## Why the capability owns the shape, and not the framework's call site\n *\n * `ProviderFrontendSdkActivation.handle` is `unknown` on purpose: the provider\n * package must not know any vendor's type, and \"a consumer that needs one narrows\n * it at the point where it also knows which provider it asked for.\"\n *\n * That reasoning holds for a picker, where the surface really did ask for Drive.\n * It inverts for an OBSERVABILITY capability: the framework reports a crash without\n * knowing — and without wanting to know — whether Sentry, Rollbar or a self-hosted\n * collector is listening. Narrowing at the call site would mean a `switch` over\n * vendors inside the engine, which is precisely what the capability model exists to\n * prevent.\n *\n * So the CAPABILITY declares the interface, the PROVIDER adapts its vendor to it,\n * and the framework calls one method it owns the definition of.\n *\n * ## Bundle-safe by construction\n *\n * Pure types. No Zod, no decorators, no imports at all — this seam is reachable from\n * `@wildo-ai/saas-models/public-runtime`, which exists so a browser bundle can take\n * a handful of atoms without the decorator-bound schema graph.\n */\n\n/**\n * One crash, as the framework describes it to whichever provider is listening.\n *\n * ## What is in it, and why that is the whole list\n *\n * `name`, `message`, `stack` and `componentStack` are exactly what\n * `ErrorsBuilderFrontendService.buildReactError` already assembles on every caught\n * crash. Nothing new is collected to fill this shape; what changes is only that the\n * report can now leave the browser.\n *\n * **`message` is sent as authored, and that is a decision rather than an oversight.**\n * It is the field most likely to carry user content — `new Error(\\`Invalid value:\n * ${input}\\`)` — and it is also the field without which a crash report is close to\n * useless. Every mainstream crash reporter sends the exception message and scrubs by\n * KEY rather than by free-text inspection, because a scrubber over prose either\n * destroys the diagnostic or gives false assurance. An application that cannot accept\n * that should not declare `FRONTEND_ERROR_MONITORING`.\n *\n * ## What is deliberately NOT in it\n *\n * No user identity, no session or organisation id, no request or form payload, and no\n * resource content. A crash report is a diagnostic about CODE; attributing it to a\n * PERSON is a separate decision an application would have to take deliberately, and\n * there is no field here through which it could happen by accident.\n */\nexport interface FrontendCrashReport {\n  /** The error's class name — `TypeError`, `WildoFrontendError`. */\n  readonly name: string;\n  /** The error's own message, unmodified. See the note above before changing this. */\n  readonly message: string;\n  /** The JavaScript stack, when the runtime produced one. */\n  readonly stack?: string;\n  /**\n   * React's component stack for a crash a boundary caught. Component NAMES only —\n   * no props, no state — so it says which screen broke without saying what was on it.\n   */\n  readonly componentStack?: string;\n  /**\n   * Framework classification, flattened to strings at this boundary.\n   *\n   * String-valued on purpose: the closed vocabularies it carries (`ErrorType`,\n   * `ErrorSeverity`) live in the heavy schema graph that this bundle-safe seam must\n   * not pull in, and every mainstream vendor models exactly this as string tags. The\n   * BRIDGE reads the real enums and stringifies here, so the vocabulary still has one\n   * named runtime source and only its serialization is local to this contract.\n   */\n  readonly tags?: Readonly<Record<string, string>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_ERROR_MONITORING` provider's activated\n * handle.\n *\n * Synchronous and returning nothing, deliberately. Reporting a crash must never\n * become something a crashing surface has to await or handle: a vendor SDK queues and\n * flushes on its own schedule, and a rejected promise here would be a second error\n * raised from inside the first one's handler.\n */\nexport interface FrontendErrorMonitoringSink {\n  reportCrash(report: FrontendCrashReport): void;\n}\n\n/**\n * Whether an activated SDK handle can receive crash reports.\n *\n * A provider may declare `FRONTEND_ERROR_MONITORING` and return a bare vendor\n * namespace that does not implement this contract — a mistake no type can catch,\n * because `handle` is `unknown` by design. Checked at the seam so the failure is a\n * reported diagnostic rather than a `TypeError` thrown while handling a crash.\n */\nexport function isFrontendErrorMonitoringSink(handle: unknown): handle is FrontendErrorMonitoringSink {\n  return (\n    typeof handle === 'object'\n    && handle !== null\n    && typeof (handle as FrontendErrorMonitoringSink).reportCrash === 'function'\n  );\n}\n\n/**\n * One product-analytics event, as the framework hands it to a vendor (#1704).\n *\n * The same shape `AnalyticsContext.track()` has always taken — a name and flat properties — so the\n * framework's own auto-instrumentation and an application's custom `track()` reach a vendor unchanged.\n */\nexport interface FrontendProductAnalyticsEvent {\n  readonly name: string;\n  readonly properties?: Readonly<Record<string, unknown>>;\n}\n\n/**\n * What the framework calls on a `FRONTEND_PRODUCT_ANALYTICS` provider's activated handle (#1704).\n *\n * The application's analytics used to reach a vendor through a second registry inside\n * `AnalyticsContext`, with its own consent gate. A vendor now arrives as a provider module, is started\n * by the consent-based activation consumer once the person grants `ConsentPurpose.ANALYTICS`, and\n * stopped by its `deactivate` on withdrawal or sign-out; `AnalyticsContext` only DISPATCHES to the\n * sinks that are currently active. So there is one consent gate and one CSP footprint for a vendor.\n *\n * Synchronous and returning nothing, for the reason `FrontendErrorMonitoringSink` gives: a vendor\n * queues and flushes on its own schedule, and tracking must never become something a surface awaits.\n */\nexport interface FrontendProductAnalyticsSink {\n  track(event: FrontendProductAnalyticsEvent): void;\n  page(path: string, properties?: Readonly<Record<string, unknown>>): void;\n  /** The signed-in person, by the framework's own opaque id — never an email or a name. */\n  identify(identity: { readonly userId: string; readonly organizationId?: string }): void;\n  /** Forget the identified person (sign-out) without stopping the provider. */\n  reset(): void;\n}\n\n/** Whether an activated SDK handle can receive product-analytics events — checked at the seam, like the crash sink. */\nexport function isFrontendProductAnalyticsSink(handle: unknown): handle is FrontendProductAnalyticsSink {\n  if (typeof handle !== 'object' || handle === null) return false;\n  const candidate = handle as Partial<Record<keyof FrontendProductAnalyticsSink, unknown>>;\n  return typeof candidate.track === 'function'\n    && typeof candidate.page === 'function'\n    && typeof candidate.identify === 'function'\n    && typeof candidate.reset === 'function';\n}\n\n/**\n * What the framework calls on a `FRONTEND_CAPTCHA` provider's activated handle (#1735): mint a token for\n * one action, which the same vendor's backend part verifies. Returns `undefined` when the vendor could not\n * produce one; the form then answers the engine's proof of work instead.\n */\nexport interface FrontendCaptchaSink {\n  execute(action: string): Promise<string | undefined>;\n}\n\n/** Whether an activated SDK handle can mint captcha tokens — checked at the seam, like the other sinks. */\nexport function isFrontendCaptchaSink(handle: unknown): handle is FrontendCaptchaSink {\n  return typeof handle === 'object' && handle !== null && typeof (handle as FrontendCaptchaSink).execute === 'function';\n}\n\n"]}

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-entry.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAwBH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEjG;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;IAKtC;;;;OAIG;;;;;;;;;;;;;;;IAEH;;;;;OAKG;;;;;IAEH,0EAA0E;;;;;;;;IAE1E;;;;;;;;;OASG;;;;;;;;;;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;;;;;;;;OAiBG;;;;;;;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;;;;;;;;;;;;;;;;;;;;;;;IAEH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;;iBAEH,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;QAvHvC;;;;WAIG;;;;;;;;;;;;;;;QAEH;;;;;WAKG;;;;;QAEH,0EAA0E;;;;;;;;QAE1E;;;;;;;;;WASG;;;;;;;;;;;QAEH;;;;;;;;WAQG;;QAEH;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;QAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCG;;;;;;;;;;;;;;;;;;;;;;;QAEH;;;;;;;;;;;;;;;;;;;;;;;WAuBG;;;iBAOH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}
+{"version":3,"file":"frontend-provider-entry.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAwBH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEjG;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;IAKtC;;;;OAIG;;;;;;;;;;;;;;;IAEH;;;;;OAKG;;;;;IAEH,0EAA0E;;;;;;;;IAE1E;;;;;;;;;OASG;;;;;;;;;;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;;;;;;;;OAiBG;;;;;;;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;;;;;;;;;;;;;;;;;;;;;;;IAEH;;;;;;;;;;;;;;;;;;;;;;;OAuBG;;iBAEH,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;QAvHvC;;;;WAIG;;;;;;;;;;;;;;;QAEH;;;;;WAKG;;;;;QAEH,0EAA0E;;;;;;;;QAE1E;;;;;;;;;WASG;;;;;;;;;;;QAEH;;;;;;;;WAQG;;QAEH;;;;;;;;;;;;;;;;;WAiBG;;;;;;;;QAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAkCG;;;;;;;;;;;;;;;;;;;;;;;QAEH;;;;;;;;;;;;;;;;;;;;;;;WAuBG;;;iBAOH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/esm/external-providers/frontend-provider-entry.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-entry.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,+BAA+B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;CACV,CAAC;AAGX;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACvD,QAAQ,EAAE,sBAAsB;IAChC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,GAAG,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACnD,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,QAAQ,EAAE;IACpE;;;;;;;;;OASG;IACH,UAAU,EAAE,0CAA0C,CAAC,QAAQ,EAAE;IACjE;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,iBAAiB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAC7D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { ProviderComplianceProfileSchema } from './provider-compliance-profile.shared.schemas';\nimport { ProviderMetadataSchema } from './provider-metadata.shared.schemas';\nimport {\n  ProviderFrontendComponentDescriptorsSchema,\n  ProviderFrontendCspFootprintSchema,\n  ProviderFrontendScriptDeclarationSchema,\n  ProviderFrontendSdkDescriptorSchema,\n} from './provider-frontend-surface.shared.schemas';\n\n/**\n * The `z_file` storage vocabulary, as a BROWSER-SAFE declaration of the values\n * `FileStorageAccepted` in `@wildo-ai/zod-decorators` owns.\n *\n * ## Why this is not an import of that enum\n *\n * This file sits in the `@wildo-ai/saas-models/public-runtime` closure, which\n * browser-bound provider modules load. Importing ANYTHING from\n * `@wildo-ai/zod-decorators` puts that package's root barrel into the bundle,\n * and that barrel mutates Zod's prototypes as an import side effect\n * (`ensureZodDecoratorsLoaded(z)`) — the reason K-3 forbids it, and what\n * `public-runtime.boundary.test.ts` measures. A re-export of the enum (the\n * previous shape, #394 P5) is an import all the same (#607).\n *\n * ## Why a literal union, and why it stays compatible\n *\n * The owning enum is the ONE runtime source of the vocabulary; this is the\n * browser door's spelling of it, pinned member-for-member (keys AND values, at\n * type level and at runtime) by `__tests__/file-storage-accepted.drift.test.ts`\n * — the same arrangement `BUILTIN_PROVIDER_PROTOCOL` has with the engine's\n * protocol enum, for the same boundary.\n *\n * It is `as const` rather than a second `enum` on purpose: two enums are\n * NOMINALLY distinct, so the field side (`z_file({ storageAccepted })`, the\n * owning enum) could not be compared with the provider side (this). A string\n * enum IS assignable to the literal union of its values, so the owning enum\n * flows into every slot typed with this vocabulary, and\n * `FileStorageAccepted.GOOGLE_DRIVE` reads identically at an authoring site.\n * The reverse is not true: a value typed here does not flow into a slot typed\n * with the owning enum — that direction does not occur today, and the compiler\n * reports it if it ever does.\n */\n/*\n * ## NOT every member is served, and the rule is what to trust (#460)\n *\n * A member is SERVED when `FileStorageRouterBackendService` registers an `IFileStorageProvider` for\n * it; that map is the one runtime answer, and this comment is a dated reading of it rather than a\n * second authority. The engine serves `WILDO_MANAGED`, `LOCAL_DIRECTORY` and `GOOGLE_DRIVE` itself;\n * since #1674 any other member is served when a loaded provider module CONTRIBUTES an adapter for it\n * (`fileStorageAdapters`, `ProviderFileStorageAdapter`). A provider serves a member of this closed\n * vocabulary; it never adds one. Measured 2026-09-29: the engine's own `microsoft-onedrive` (since #2017) contributes\n * `ONEDRIVE` (a person's own OneDrive through Microsoft Graph, commercial cloud only); nothing contributes\n * `DROPBOX`.\n *\n * Declaring an unserved member is not silently ignored — the router refuses and now says WHICH of the\n * two problems it is, because \"not implemented\" and \"implemented but not configured\" have different\n * remedies and the old single message sent an operator looking for environment variables that cannot\n * exist.\n *\n * An unserved member is NOT removed here, deliberately: a member a package may yet serve is part of the\n * closed vocabulary, and deleting it would decide from the wrong place that nothing ever will. (`ONEDRIVE`\n * STORING is served since #1674; the governed OneDrive PICK path of #570 is separate and still unbuilt.)\n * Re-measure before quoting this paragraph; the count was \"three of five\" when #460 was filed, and Drive and\n * OneDrive have landed since.\n */\nexport const FileStorageAccepted = {\n  WILDO_MANAGED: 'wildo_managed',\n  LOCAL_DIRECTORY: 'local_directory',\n  ONEDRIVE: 'onedrive',\n  GOOGLE_DRIVE: 'google_drive',\n  DROPBOX: 'dropbox',\n} as const;\nexport type FileStorageAccepted = (typeof FileStorageAccepted)[keyof typeof FileStorageAccepted];\n\n/**\n * Bundle-safe frontend provider atoms shared by every browser-bound runtime.\n *\n * This file intentionally stops at the provider-entry/block level so\n * `@wildo-ai/saas-models/public-runtime` can expose the types without pulling\n * the heavier application-config bootstrap contract into browser bundles.\n */\n\n/**\n * One provider as it crosses the DATA channel: authored on a facet module,\n * projected into a companion contribution, materialized into the generated\n * frontend-services artifact, served on `/application-config`, and parsed by the\n * app, the website and the technical doc.\n *\n * ## Why this is a LOOSE object\n *\n * It is a WIRE RECORD produced by one package version and read by another, and a\n * strict object silently STRIPS what a newer producer added — which is how a\n * provider's CSP footprint would vanish between the CLI that wrote it and the\n * runtime that needs it, leaving a policy that is correct in development\n * (report-only) and wrong in production (enforcing). #328 made\n * `ProviderCompanionContributionSchema` loose for exactly this reason, one file\n * over; the entry rides INSIDE that contribution, so leaving it strict left the\n * hole one layer down. Required fields stay required; unknown keys are kept\n * rather than dropped, so a re-emitting consumer cannot silently discard what it\n * did not understand.\n *\n * ## What may and may not be added here\n *\n * Only things a JSON channel can carry. A function-valued field would be\n * stripped by `JSON.stringify` with no error anywhere — the provider would look\n * declared and do nothing. Executable provider surface (`sdk.activate`,\n * `publicConfigSchema`, and, from S4b, `components`) belongs on the facet module\n * types in `@wildo-ai/external-connectors-public`, which reach a bundle through\n * the generated `frontend-providers.generated.ts` CODE channel instead.\n */\nexport const FrontendProviderEntrySchema = z.looseObject({\n  metadata: ProviderMetadataSchema,\n  providerCapabilities: z.array(z.string().min(1)),\n  protocols: z.array(z.string().min(1)),\n  publicConfig: z.record(z.string(), z.unknown()).optional(),\n  /**\n   * Origins this provider needs the composed CSP of its service to admit.\n   * Consumed by `resolveCspPolicy`'s provider layer; absent means the provider\n   * reaches nothing beyond the surface's own origin.\n   */\n  csp: ProviderFrontendCspFootprintSchema.optional(),\n  /**\n   * The vendor SDK package this provider loads on demand — the DATA half only.\n   * Its presence tells a surface that the provider HAS executable code to\n   * activate, which is the difference between \"declared\" and \"live\" once the\n   * CODE channel is consulted.\n   */\n  sdk: ProviderFrontendSdkDescriptorSchema.optional(),\n  /** Third-party `<script>` tags the surface must add for this provider. */\n  scripts: z.array(ProviderFrontendScriptDeclarationSchema).optional(),\n  /**\n   * The components this provider contributes, by capability — the DATA half\n   * only, exactly as `sdk` is. It says a component EXISTS and what contract it\n   * commits to; the loader stays on the CODE channel, because a function does\n   * not survive `JSON.stringify` and a field that vanishes silently is worse\n   * than a field that was never declared.\n   *\n   * A surface reads this to know a chooser is worth rendering, and to know what\n   * a selection will contain, BEFORE it downloads any provider's component.\n   */\n  components: ProviderFrontendComponentDescriptorsSchema.optional(),\n  /**\n   * The public-config keys the provider module DECLARES it reads — the DATA\n   * half of its `publicConfigSchema`, mirrored here so the companion walk can\n   * refuse an application-supplied key the module never declared, without\n   * executing the module (#394 P3). Absent when the module's schema is not\n   * introspectable, which the overlay REFUSES (`SCHEMA_NOT_INTROSPECTABLE`, #1705)\n   * — never read as \"declares nothing\". Optional on the wire only so an entry an\n   * older producer wrote still parses and is refused with a message.\n   */\n  publicConfigKeys: z.array(z.string().min(1)).optional(),\n  /**\n   * The `z_file` storage this provider's file picker is the FRONT DOOR of — the\n   * join key between the provider vocabulary (`google-drive`) and the z_file\n   * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).\n   *\n   * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the\n   * vendor, so the FILES row it produces is stored in THAT storage, and a field\n   * may only receive it when its `storageAccepted` names that storage. The\n   * chooser therefore offers such a picker only to a field that accepts the\n   * storage, and the backend refuses the link otherwise — both read this\n   * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no\n   * storage: its bytes are ingested into whatever the field's own storage is,\n   * and it is offered to every field.\n   *\n   * DATA half only, like `components`: the backend storage provider that\n   * SERVES the storage is CODE, keyed by the same enum member and naming this\n   * provider back as its `connectedProviderRef`; a pin holds the two ends equal.\n   */\n  fileStorage: z.enum(FileStorageAccepted).optional(),\n  /**\n   * The vendor's deployment model, processing regions and legal entity, as the facet module\n   * declares them (#1743) — the primitives a processor register, a recipients fact and a regional\n   * report are derived from.\n   *\n   * ## Why it rides HERE, and why the browser gets it too\n   *\n   * A frontend provider executes in the DATA SUBJECT'S BROWSER and talks to its vendor directly, so\n   * it is exactly the kind of recipient a privacy notice must name (#345). The module has carried\n   * this profile since #345, and every projection built the entry field by field and left it\n   * behind — so reCAPTCHA, Sentry and the Drive/OneDrive/Dropbox pickers stated their\n   * entity and regions in source and no compliance reader could see any of them.\n   *\n   * This entry is the one record that is materialized PER APPLICATION, PER SERVICE, for exactly the\n   * providers that service SERVES (`frontendProviderBootstraps` in the generated frontend-services\n   * artifact). That is the population a recipient derivation needs — the browser vendors this\n   * application actually runs, not every module the engine ships — and a reader gets it by parsing a\n   * generated JSON file on disk rather than by loading provider packages. A field on the\n   * contribution beside `identity` was the alternative and was rejected for that reason: the\n   * contribution is never materialized per service, so a reader would have to re-run discovery.\n   *\n   * It is therefore also served on `/application-config`. That costs a few public facts (a vendor's\n   * name and the regions it offers, which the application's own privacy notice publishes anyway)\n   * and it keeps the two producing sites — the companion projection and the backend fallback —\n   * identical, so what a compliance reader sees never depends on whether a sync ran.\n   *\n   * Not a second authority for backend providers. A provider SPECIFICATION restates its BACKEND\n   * module's profile (and is reconciled against it); this restates the FRONTEND facet's. Registering\n   * specifications for browser-only vendors was the other option and was rejected: a specification\n   * describes a backend module — protocols, secrets contract, engine slots — and a browser-only\n   * vendor has none of them.\n   *\n   * Absent means the module's author stated nothing, which a reader must report as NOT ESTABLISHED\n   * rather than skip — `listServedFrontendProviderCompliance` (beside the profile schema) returns `null` for exactly that.\n   */\n  complianceProfile: ProviderComplianceProfileSchema.optional(),\n  /**\n   * Consent purposes this PROVIDER rests on beyond its capabilities' floor (#1702) — the facet module's\n   * own `consentPurposes`, as data.\n   *\n   * ## Why it has to ride here\n   *\n   * The consent decision is taken in the browser on the HYDRATED module, whose `providerCapabilities`\n   * come from this entry, so a vendor-level purpose the entry did not carry would reach no gate at all:\n   * a provider whose vendor needs more than its capability's floor (Google reCAPTCHA, which the CNIL held\n   * is not exempt as a security measure because it also serves Google's own purposes — Délibération\n   * SAN-2023-003) would start on the floor alone. Carried by BOTH producing sites — the companion\n   * projection and the backend fallback — for the reason every field above is.\n   *\n   * ADDITIVE ONLY. It is unioned with the capabilities' floor by `consentPurposesRequiredByProvider`,\n   * so an entry can never lower what a capability requires; and hydration unions it with the CODE\n   * module's own declaration, so a stale entry cannot lower what the bundled module requires either.\n   * Absent and `[]` mean the same thing: nothing beyond the floor.\n   *\n   * Strings on the wire, like `providerCapabilities`, and for the same version-skew reason: a member an\n   * older reader does not know must not fail the parse of the whole provider block. The projection\n   * refuses an unknown member where it is authored, and the browser's consent decision FAILS CLOSED on\n   * one it meets (`isProviderPermittedByConsent`) — so an unknown purpose withholds its provider rather\n   * than being dropped, which on an additive field would lower the floor.\n   */\n  consentPurposes: z.array(z.string().min(1)).optional(),\n});\nexport type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;\n\nexport const FrontendProvidersBlockSchema = z.object({\n  providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),\n});\nexport type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;\n"]}
+{"version":3,"file":"frontend-provider-entry.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-entry.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,+BAA+B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EACL,0CAA0C,EAC1C,kCAAkC,EAClC,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;CACV,CAAC;AAGX;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC;IACvD,QAAQ,EAAE,sBAAsB;IAChC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,GAAG,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAClD;;;;;OAKG;IACH,GAAG,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACnD,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,QAAQ,EAAE;IACpE;;;;;;;;;OASG;IACH,UAAU,EAAE,0CAA0C,CAAC,QAAQ,EAAE;IACjE;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD;;;;;;;;;;;;;;;;;OAiBG;IACH,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IACnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,iBAAiB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAC7D;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAChF,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\nimport { ProviderComplianceProfileSchema } from './provider-compliance-profile.shared.schemas';\nimport { ProviderMetadataSchema } from './provider-metadata.shared.schemas';\nimport {\n  ProviderFrontendComponentDescriptorsSchema,\n  ProviderFrontendCspFootprintSchema,\n  ProviderFrontendScriptDeclarationSchema,\n  ProviderFrontendSdkDescriptorSchema,\n} from './provider-frontend-surface.shared.schemas';\n\n/**\n * The `z_file` storage vocabulary, as a BROWSER-SAFE declaration of the values\n * `FileStorageAccepted` in `@wildo-ai/zod-decorators` owns.\n *\n * ## Why this is not an import of that enum\n *\n * This file sits in the `@wildo-ai/saas-models/public-runtime` closure, which\n * browser-bound provider modules load. Importing ANYTHING from\n * `@wildo-ai/zod-decorators` puts that package's root barrel into the bundle,\n * and that barrel mutates Zod's prototypes as an import side effect\n * (`ensureZodDecoratorsLoaded(z)`) — the reason K-3 forbids it, and what\n * `public-runtime.boundary.test.ts` measures. A re-export of the enum (the\n * previous shape, #394 P5) is an import all the same (#607).\n *\n * ## Why a literal union, and why it stays compatible\n *\n * The owning enum is the ONE runtime source of the vocabulary; this is the\n * browser door's spelling of it, pinned member-for-member (keys AND values, at\n * type level and at runtime) by `__tests__/file-storage-accepted.drift.test.ts`\n * — the same arrangement `BUILTIN_PROVIDER_PROTOCOL` has with the engine's\n * protocol enum, for the same boundary.\n *\n * It is `as const` rather than a second `enum` on purpose: two enums are\n * NOMINALLY distinct, so the field side (`z_file({ storageAccepted })`, the\n * owning enum) could not be compared with the provider side (this). A string\n * enum IS assignable to the literal union of its values, so the owning enum\n * flows into every slot typed with this vocabulary, and\n * `FileStorageAccepted.GOOGLE_DRIVE` reads identically at an authoring site.\n * The reverse is not true: a value typed here does not flow into a slot typed\n * with the owning enum — that direction does not occur today, and the compiler\n * reports it if it ever does.\n */\n/*\n * ## NOT every member is served, and the rule is what to trust (#460)\n *\n * A member is SERVED when `FileStorageRouterBackendService` registers an `IFileStorageProvider` for\n * it; that map is the one runtime answer, and this comment is a dated reading of it rather than a\n * second authority. The engine serves `WILDO_MANAGED`, `LOCAL_DIRECTORY` and `GOOGLE_DRIVE` itself;\n * since #1674 any other member is served when a loaded provider module CONTRIBUTES an adapter for it\n * (`fileStorageAdapters`, `ProviderFileStorageAdapter`). A provider serves a member of this closed\n * vocabulary; it never adds one. Measured 2026-09-29: the engine's own `microsoft-onedrive` (since #2017) contributes\n * `ONEDRIVE` (a person's own OneDrive through Microsoft Graph, commercial cloud only); nothing contributes\n * `DROPBOX`.\n *\n * Declaring an unserved member is not silently ignored — the router refuses and now says WHICH of the\n * two problems it is, because \"not implemented\" and \"implemented but not configured\" have different\n * remedies and the old single message sent an operator looking for environment variables that cannot\n * exist.\n *\n * An unserved member is NOT removed here, deliberately: a member a package may yet serve is part of the\n * closed vocabulary, and deleting it would decide from the wrong place that nothing ever will. (`ONEDRIVE`\n * STORING is served since #1674; the governed OneDrive PICK path of #570 is separate and still unbuilt.)\n * Re-measure before quoting this paragraph; the count was \"three of five\" when #460 was filed, and Drive and\n * OneDrive have landed since.\n */\nexport const FileStorageAccepted = {\n  WILDO_MANAGED: 'wildo_managed',\n  LOCAL_DIRECTORY: 'local_directory',\n  ONEDRIVE: 'onedrive',\n  GOOGLE_DRIVE: 'google_drive',\n  DROPBOX: 'dropbox',\n} as const;\nexport type FileStorageAccepted = (typeof FileStorageAccepted)[keyof typeof FileStorageAccepted];\n\n/**\n * Bundle-safe frontend provider atoms shared by every browser-bound runtime.\n *\n * This file intentionally stops at the provider-entry/block level so\n * `@wildo-ai/saas-models/public-runtime` can expose the types without pulling\n * the heavier application-config bootstrap contract into browser bundles.\n */\n\n/**\n * One provider as it crosses the DATA channel: authored on a facet module,\n * projected into a companion contribution, materialized into the generated\n * frontend-services artifact, served on `/application-config`, and parsed by the\n * app, the website and the technical doc.\n *\n * ## Why this is a LOOSE object\n *\n * It is a WIRE RECORD produced by one package version and read by another, and a\n * strict object silently STRIPS what a newer producer added — which is how a\n * provider's CSP footprint would vanish between the CLI that wrote it and the\n * runtime that needs it, leaving a policy that is correct in development\n * (report-only) and wrong in production (enforcing). #328 made\n * `ProviderCompanionContributionSchema` loose for exactly this reason, one file\n * over; the entry rides INSIDE that contribution, so leaving it strict left the\n * hole one layer down. Required fields stay required; unknown keys are kept\n * rather than dropped, so a re-emitting consumer cannot silently discard what it\n * did not understand.\n *\n * ## What may and may not be added here\n *\n * Only things a JSON channel can carry. A function-valued field would be\n * stripped by `JSON.stringify` with no error anywhere — the provider would look\n * declared and do nothing. Executable provider surface (`sdk.activate`,\n * `publicConfigSchema`, and, from S4b, `components`) belongs on the facet module\n * types in `@wildo-ai/external-connectors-public`, which reach a bundle through\n * the generated `frontend-providers.generated.ts` CODE channel instead.\n */\nexport const FrontendProviderEntrySchema = z.looseObject({\n  metadata: ProviderMetadataSchema,\n  providerCapabilities: z.array(z.string().min(1)),\n  protocols: z.array(z.string().min(1)),\n  publicConfig: z.record(z.string(), z.unknown()).optional(),\n  /**\n   * Origins this provider needs the composed CSP of its service to admit.\n   * Consumed by `resolveCspPolicy`'s provider layer; absent means the provider\n   * reaches nothing beyond the surface's own origin.\n   */\n  csp: ProviderFrontendCspFootprintSchema.optional(),\n  /**\n   * The vendor SDK package this provider loads on demand — the DATA half only.\n   * Its presence tells a surface that the provider HAS executable code to\n   * activate, which is the difference between \"declared\" and \"live\" once the\n   * CODE channel is consulted.\n   */\n  sdk: ProviderFrontendSdkDescriptorSchema.optional(),\n  /** Third-party `<script>` tags the surface must add for this provider. */\n  scripts: z.array(ProviderFrontendScriptDeclarationSchema).optional(),\n  /**\n   * The components this provider contributes, by capability — the DATA half\n   * only, exactly as `sdk` is. It says a component EXISTS and what contract it\n   * commits to; the loader stays on the CODE channel, because a function does\n   * not survive `JSON.stringify` and a field that vanishes silently is worse\n   * than a field that was never declared.\n   *\n   * A surface reads this to know a chooser is worth rendering, and to know what\n   * a selection will contain, BEFORE it downloads any provider's component.\n   */\n  components: ProviderFrontendComponentDescriptorsSchema.optional(),\n  /**\n   * The public-config keys the provider module DECLARES it reads — the DATA\n   * half of its `publicConfigSchema`, mirrored here so the companion walk can\n   * refuse an application-supplied key the module never declared, without\n   * executing the module (#394 P3). Absent when the module's schema is not\n   * introspectable, which the overlay REFUSES (`SCHEMA_NOT_INTROSPECTABLE`, #1705)\n   * — never read as \"declares nothing\". Optional on the wire only so an entry an\n   * older producer wrote still parses and is refused with a message.\n   */\n  publicConfigKeys: z.array(z.string().min(1)).optional(),\n  /**\n   * The `z_file` storage this provider's file picker is the FRONT DOOR of — the\n   * join key between the provider vocabulary (`google-drive`) and the z_file\n   * vocabulary (`FileStorageAccepted.GOOGLE_DRIVE`) (#394 P5).\n   *\n   * A picker that hands back a `REMOTE_REFERENCE` leaves the bytes at the\n   * vendor, so the FILES row it produces is stored in THAT storage, and a field\n   * may only receive it when its `storageAccepted` names that storage. The\n   * chooser therefore offers such a picker only to a field that accepts the\n   * storage, and the backend refuses the link otherwise — both read this\n   * field. A picker that delivers bytes (`BROWSER_READABLE_*`) declares no\n   * storage: its bytes are ingested into whatever the field's own storage is,\n   * and it is offered to every field.\n   *\n   * DATA half only, like `components`: the backend storage provider that\n   * SERVES the storage is CODE, keyed by the same enum member and naming this\n   * provider back as its `connectedProviderRef`; a pin holds the two ends equal.\n   */\n  fileStorage: z.enum(FileStorageAccepted).optional(),\n  /**\n   * The vendor's deployment model, processing regions and legal entity, as the facet module\n   * declares them (#1743) — the primitives a processor register, a recipients fact and a regional\n   * report are derived from.\n   *\n   * ## Why it rides HERE, and why the browser gets it too\n   *\n   * A frontend provider executes in the DATA SUBJECT'S BROWSER and talks to its vendor directly, so\n   * it is exactly the kind of recipient a privacy notice must name (#345). The module has carried\n   * this profile since #345, and every projection built the entry field by field and left it\n   * behind — so reCAPTCHA, Sentry and the Drive/OneDrive/Dropbox pickers stated their\n   * entity and regions in source and no compliance reader could see any of them.\n   *\n   * This entry is the one record that is materialized PER APPLICATION, PER SERVICE, for exactly the\n   * providers that service SERVES (`frontendProviderBootstraps` in the generated frontend-services\n   * artifact). That is the population a recipient derivation needs — the browser vendors this\n   * application actually runs, not every module the engine ships — and a reader gets it by parsing a\n   * generated JSON file on disk rather than by loading provider packages. A field on the\n   * contribution beside `identity` was the alternative and was rejected for that reason: the\n   * contribution is never materialized per service, so a reader would have to re-run discovery.\n   *\n   * It is therefore also served on `/application-config`. That costs a few public facts (a vendor's\n   * name and the regions it offers, which the application's own privacy notice publishes anyway)\n   * and it keeps the two producing sites — the companion projection and the backend fallback —\n   * identical, so what a compliance reader sees never depends on whether a sync ran.\n   *\n   * Not a second authority for backend providers. A provider SPECIFICATION restates its BACKEND\n   * module's profile (and is reconciled against it); this restates the FRONTEND facet's. Registering\n   * specifications for browser-only vendors was the other option and was rejected: a specification\n   * describes a backend module — protocols, secrets contract, engine slots — and a browser-only\n   * vendor has none of them.\n   *\n   * Absent means the module's author stated nothing, which a reader must report as NOT ESTABLISHED\n   * rather than skip — `listServedFrontendProviderCompliance` (beside the profile schema) returns `null` for exactly that.\n   */\n  complianceProfile: ProviderComplianceProfileSchema.optional(),\n  /**\n   * Consent purposes this PROVIDER rests on beyond its capabilities' floor (#1702) — the facet module's\n   * own `consentPurposes`, as data.\n   *\n   * ## Why it has to ride here\n   *\n   * The consent decision is taken in the browser on the HYDRATED module, whose `providerCapabilities`\n   * come from this entry, so a vendor-level purpose the entry did not carry would reach no gate at all:\n   * a provider whose vendor needs more than its capability's floor (Google reCAPTCHA, which the CNIL held\n   * is not exempt as a security measure because it also serves Google's own purposes — Délibération\n   * SAN-2023-003) would start on the floor alone. Carried by BOTH producing sites — the companion\n   * projection and the backend fallback — for the reason every field above is.\n   *\n   * ADDITIVE ONLY. It is unioned with the capabilities' floor by `consentPurposesRequiredByProvider`,\n   * so an entry can never lower what a capability requires; and hydration unions it with the CODE\n   * module's own declaration, so a stale entry cannot lower what the bundled module requires either.\n   * Absent and `[]` mean the same thing: nothing beyond the floor.\n   *\n   * Strings on the wire, like `providerCapabilities`, and for the same version-skew reason: a member an\n   * older reader does not know must not fail the parse of the whole provider block. The projection\n   * refuses an unknown member where it is authored, and the browser's consent decision FAILS CLOSED on\n   * one it meets (`isProviderPermittedByConsent`) — so an unknown purpose withholds its provider rather\n   * than being dropped, which on an additive field would lower the floor.\n   */\n  consentPurposes: z.array(z.string().min(1)).optional(),\n});\nexport type FrontendProviderEntry = z.infer<typeof FrontendProviderEntrySchema>;\n\nexport const FrontendProvidersBlockSchema = z.object({\n  providers: z.record(z.string().min(1), FrontendProviderEntrySchema).default({}),\n});\nexport type FrontendProvidersBlock = z.infer<typeof FrontendProvidersBlockSchema>;\n"]}

package/dist/esm/external-providers/frontend-provider-public-config.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-public-config.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,mCAAmC,EAAE,MAAuB,CAAC;AAE1E,gIAAgI;AAChI,iEAAiE;AACjE,oBAAY,mCAAmC;IAC7C,gFAAgF;IAChF,cAAc,mBAAmB;IACjC,uFAAuF;IACvF,UAAU,eAAe;IACzB,2EAA2E;IAC3E,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,YAAY,iBAAiB;CAC9B;AACD,kFAAkF;AAElF,qBAAa,iCAAkC,SAAQ,KAAK;IAExD,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,OAAO,EAAE,mCAAmC;IACrD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE;gBAFvB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mCAAmC,EAC5C,IAAI,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,wCAAwC,GAC9C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAqE/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,4FAA4F;AAC5F,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gIAAgI;AAChI;;;;;;;;;GASG;AACH,eAAO,MAAM,oDAAoD,KAAK,CAAC;AAiCvE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC,EAClG,OAAO,EAAE,SAAS,+BAA+B,EAAE,GAClD,+BAA+B,EAAE,CAqBnC;AAED;;;;;;;GAOG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IAC5G,QAAQ,CAAC,OAAO,EAAE,SAAS,+BAA+B,EAAE,CAAC;CAC9D,GAAG,IAAI,CAcP;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,4CAA4C,CAAC,KAAK,EAAE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC/C,CAAC,CAAC,CAAC;CACL,GAAG,IAAI,CAsBP;AAED,gIAAgI;AAChI;;;;;GAKG;AACH,oBAAY,6BAA6B;IACvC,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,0IAA0I;IAC1I,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AACD,kFAAkF;AAElF,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrF,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,GACnB;YAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;SAAE,GAC3B;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC;KAClH,CAAC;IACF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,GAC1D,0BAA0B,CAiC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAU3F"}
+{"version":3,"file":"frontend-provider-public-config.shared.d.ts","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,mCAAmC,EAAE,MAAuB,CAAC;AAE1E,gIAAgI;AAChI,iEAAiE;AACjE,oBAAY,mCAAmC;IAC7C,gFAAgF;IAChF,cAAc,mBAAmB;IACjC,uFAAuF;IACvF,UAAU,eAAe;IACzB,2EAA2E;IAC3E,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,yBAAyB,8BAA8B;IACvD;;;OAGG;IACH,YAAY,iBAAiB;CAC9B;AACD,kFAAkF;AAElF,qBAAa,iCAAkC,SAAQ,KAAK;IAExD,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,QAAQ,CAAC,OAAO,EAAE,mCAAmC;IACrD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE;gBAFvB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mCAAmC,EAC5C,IAAI,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,EAAE,MAAM;CAKlB;AAED,MAAM,WAAW,wCAAwC;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IACjE,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,wCAAwC,GAC9C,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAqE/C;AAED;;;;;GAKG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,4FAA4F;AAC5F,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gIAAgI;AAChI;;;;;;;;;GASG;AACH,eAAO,MAAM,oDAAoD,KAAK,CAAC;AAiCvE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC,EAClG,OAAO,EAAE,SAAS,+BAA+B,EAAE,GAClD,+BAA+B,EAAE,CAqBnC;AAED;;;;;;;GAOG;AACH,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,CAAC,CAAC,CAAC;IAC5G,QAAQ,CAAC,OAAO,EAAE,SAAS,+BAA+B,EAAE,CAAC;CAC9D,GAAG,IAAI,CAcP;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,4CAA4C,CAAC,KAAK,EAAE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC/C,CAAC,CAAC,CAAC;CACL,GAAG,IAAI,CAsBP;AAED,gIAAgI;AAChI;;;;;GAKG;AACH,oBAAY,6BAA6B;IACvC,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;IAC7C,0IAA0I;IAC1I,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AACD,kFAAkF;AAElF,4EAA4E;AAC5E,MAAM,WAAW,0BAA0B,CAAC,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrF,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACpB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,GACnB;YAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;SAAE,GAC3B;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC;KAClH,CAAC;IACF;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC,GAC1D,0BAA0B,CAiC5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAU3F"}

package/dist/esm/external-providers/frontend-provider-public-config.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"frontend-provider-public-config.shared.js","sourceRoot":"","sources":["../../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,mIAAmI;AACnI,MAAM,CAAC,MAAM,mCAAmC,GAAW,cAAc,CAAC;AAE1E,gIAAgI;AAChI,iEAAiE;AACjE,MAAM,CAAN,IAAY,mCAkBX;AAlBD,WAAY,mCAAmC;IAC7C,gFAAgF;IAChF,wEAAiC,CAAA;IACjC,uFAAuF;IACvF,gEAAyB,CAAA;IACzB,2EAA2E;IAC3E,sEAA+B,CAAA;IAC/B;;;;OAIG;IACH,8FAAuD,CAAA;IACvD;;;OAGG;IACH,oEAA6B,CAAA;AAC/B,CAAC,EAlBW,mCAAmC,KAAnC,mCAAmC,QAkB9C;AACD,kFAAkF;AAElF,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAE/C;IACA;IACA;IAHX,YACW,WAAmB,EACnB,OAA4C,EAC5C,IAAuB,EAChC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,gBAAW,GAAX,WAAW,CAAQ;QACnB,YAAO,GAAP,OAAO,CAAqC;QAC5C,SAAI,GAAJ,IAAI,CAAmB;QAIhC,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAoBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mCAAmC,CACjD,KAA+C;IAE/C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAE/E,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,aAAa,EACjD,EAAE,EACF,0BAA0B,WAAW,IAAI,mCAAmC,+BAA+B;cACzG,aAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,QAAQ,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEzE,6FAA6F;IAC7F,8EAA8E;IAC9E,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,UAAU,EAC9C,UAAU,EACV,0BAA0B,WAAW,IAAI,mCAAmC,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACtI,6BAA6B,WAAW,oEAAoE;cAC5G,sGAAsG;cACtG,eAAe,CAClB,CAAC;IACJ,CAAC;IAED,4HAA4H;IAC5H,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,yBAAyB,EAC7D,EAAE,EACF,QAAQ,WAAW,4FAA4F;cAC7G,uFAAuF;cACvF,kGAAkG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS;QACnC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAI,QAAoC,EAAE,CAAC;IAEtE,2GAA2G;IAC3G,iGAAiG;IACjG,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,YAAY;YACxB,CAAC,CAAC,0BAA0B,WAAW,IAAI,mCAAmC,EAAE;YAChF,CAAC,CAAC,QAAQ,WAAW,wFAAwF,CAAC;QAChH,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,cAAc,EAClD,UAAU,EACV,GAAG,KAAK,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cAClE,cAAc,WAAW,qDAAqD;cAC9E,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI;cAC/F,sFAAsF,CACzF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAqBD,gIAAgI;AAChI;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,EAAE,CAAC;AACvE,kFAAkF;AAElF;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY,EAAE,IAA4C;IACrG,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3D,6FAA6F;YAC7F,sEAAsE;YACtE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC,CACjD,SAAkG,EAClG,OAAmD;IAEnD,MAAM,UAAU,GAAG,OAAO;SACvB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACpE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,OAAO,GAAsC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAA2C,EAAE,CAAC;QAC1D,mBAAmB,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,SAAS,KAAK,MAAM,CAAC,KAAK;uBACjC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,oDAAoD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvH,IAAI,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAItD;IACC,8GAA8G;IAC9G,MAAM,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,IAAI,iCAAiC,CACzC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EACtB,mCAAmC,CAAC,YAAY,EAChD,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,EAC3D,GAAG,KAAK,CAAC,QAAQ,qDAAqD;UACpE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,KAAK,CAAC,GAAG,kBAAkB,KAAK,CAAC,WAAW,gCAAgC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;UAC5I,iHAAiH;UACjH,gHAAgH;UAChH,YAAY,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,4CAA4C,CAAC,KAM5D;IACC,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,wIAAwI;YACxI,mCAAmC,CAAC;gBAClC,WAAW;gBACX,QAAQ,EAAE,KAAK,CAAC,YAAY;gBAC5B,QAAQ,EAAE,SAAS;gBACnB,YAAY,EAAE,KAAK,CAAC,gBAAgB;gBACpC,aAAa,EAAE,IAAI,GAAG,EAAU;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,iCAAiC,CAAC;gBAAE,MAAM,KAAK,CAAC;YACvE,MAAM,IAAI,iCAAiC,CACzC,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,IAAI,EACV,GAAG,KAAK,CAAC,QAAQ,oEAAoE,KAAK,CAAC,OAAO,GAAG;kBACnG,iHAAiH,CACpH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,gIAAgI;AAChI;;;;;GAKG;AACH,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,kDAAiB,CAAA;IACjB,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAiCD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAA2D;IAE3D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,OAAO;QACL,YAAY;QACZ,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,OAAO;YACf,QAAQ,CAAC,KAAc;gBACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,EAAE,CAAC;gBAC7E,CAAC;gBACD,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,MAAM,GAAqD,EAAE,CAAC;gBAEpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;wBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;4BAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC9E,SAAS;oBACX,CAAC;oBACD,IAAI,OAAO,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,IAAI,CAAC,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC;gBAED,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC5D,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,SAAS,GAAG,MAAqD,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5G,OAAO,SAAS,CAAC,YAAiC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAgC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * How an APPLICATION supplies a frontend provider's public configuration — the\n * keys a picker needs that only the application can know (a Drive `appId`, a\n * OneDrive `clientId`) — and the gates that keep that channel from carrying\n * anything else.\n *\n * ## The gap this closes\n *\n * A frontend provider's `publicConfig` was HARD-CODED on the engine's provider\n * module and projected verbatim onto the wire. The only way to set a picker's\n * `appId` was to edit engine code. The backend never had that problem: an\n * application authors `providerConfigurations[providerRef][protocolKind]` in\n * `wildo.saas.config.ts`, and SSO's public OAuth client id already travels that\n * way, keyed by the protocol (`sso_oauth2`).\n *\n * This file gives the frontend the same channel, keyed by the same vocabulary:\n * `providerConfigurations[providerRef][frontend_sdk]`. One authority for\n * \"what an application configured for this provider\", read by both sides.\n *\n * ## The gates, because `publicConfig` is served to every browser\n *\n * 1. **Only DECLARED keys cross.** A provider module declares the keys it reads\n *    (`publicConfigSchema` — see `defineFrontendPublicConfigSchema` below, which\n *    is what makes those keys READABLE without running the schema), and a\n *    module with no readable list is refused outright. Every key an entry would\n *    serve — authored by the module, mapped onto its contribution, or supplied\n *    by the application — is held to that list wherever an entry is PRODUCED\n *    (`wildo config sync`, the backend's fallback projection) and again wherever\n *    a ready-made one is READ and served (the backend's `/application-config`,\n *    the website and documentation build loader). A misspelled `apiId` therefore\n *    fails where it was typed, instead of silently contributing nothing and\n *    leaving a picker that reports \"no appId\" at the moment a user opens it.\n *\n * 2. **A secret VALUE never crosses.** Every served string is compared against\n *    the producer's secret values — the environment's whole `secrets.json` at\n *    sync, the registered providers' confidential slots on the backend — and a\n *    match refuses, whatever the key is called (#1705).\n *\n * 3. **A secret NAME is refused early.** A key spelled like a slug or an\n *    environment-variable name from the same vendor's backend secrets contract\n *    (`GOOGLE_OAUTH2_CLIENT_SECRET`) is refused with that explanation before the\n *    key-list check would call it merely undeclared. It is the clearer message,\n *    not the gate: a browser-only vendor has no backend names to match.\n *\n * Value VALIDATION (is `appId` a string?) is the schema's job and runs where the\n * schema is: at hydration (FE-8) and, on the backend fallback, before serving.\n *\n * ## Why names were never enough, and what closes it (#1705)\n *\n * The name gate draws its forbidden names from the same vendor's BACKEND contract, so a\n * browser-only vendor (reCAPTCHA, Algolia) had an EMPTY forbidden set: its secret\n * key under `siteKey`, or an Algolia admin key under `apiKey`, passed every name\n * check. And the declared-key gate switched itself off for a module with no introspectable\n * schema — 8 of the 13 engine modules — admitting any key at all. A guard that\n * matches how a key is SPELLED looks like a control and decides almost nothing.\n *\n * Three changes turn it into one:\n *\n * - **A schema is mandatory.** `declaredKeys: undefined` is now a refusal\n *   (`SCHEMA_NOT_INTROSPECTABLE`) rather than \"cannot enforce here\", and the key check\n *   runs over the WHOLE served bag — the module's authored keys and any key an\n *   application mapped onto its contribution — not only over what\n *   `providerConfigurations` supplied.\n * - **Values are compared, not shapes.** {@link assertNoSecretValueInFrontendProviders}\n *   compares every string in every served `publicConfig` against the secret\n *   VALUES the producer holds: `wildo config sync` against the environment's\n *   `secrets.json`, the backend against its providers' confidential slots. It\n *   asks \"is this one of OUR secrets\", which no name or shape rule can answer,\n *   and it names the key and the slot, never the value. Gitleaks answers the\n *   other question (\"does this look like a secret\") on committed files; the two\n *   do not overlap.\n * - **What is secret comes from a declaration.** A provider secret slot is\n *   confidential unless its contract marks it `holdsBrowserPublicValue` (a\n *   vendor key designed to ship to browsers, such as PostHog's project key) or\n *   `holdsDeploymentHost`; framework-managed material is confidential by its\n *   registry's `secretKeys`. Nothing is inferred from a key's name.\n *\n * ## Why the overlay is a pure function in this package\n *\n * It has THREE call sites that must agree — the companion walk in\n * `platform-config-lib`, the backend fallback in `saas-backend-lib`, and any\n * future producer of a `FrontendProviderEntry` — and #380 already paid once for\n * a projection that landed on one site and not another. A function both import\n * cannot be applied differently by each.\n */\n\n/**\n * The key under `providerConfigurations[providerRef]` an application uses to\n * supply a frontend provider's public configuration.\n *\n * The protocol kind's WIRE value, exactly as SSO's channel is keyed by ITS\n * protocol kind (`sso_oauth2`): the bag is per-provider, per-protocol, and a\n * frontend module speaks `FRONTEND_SDK`.\n *\n * The owning source is `ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK` in\n * `@wildo-ai/external-connectors-models`, and this literal is pinned to it by\n * `__tests__/frontend-provider-public-config.shared.test.ts`. It is written out\n * rather than imported because this file is in the\n * `@wildo-ai/saas-models/public-runtime` closure, which K-3 forbids from\n * importing that package — an import it carried from #394 P3 until #607 put the\n * whole external-connectors model tree into every browser provider bundle.\n * `BUILTIN_PROVIDER_PROTOCOL` is the same arrangement for the same boundary.\n */\n// semantic-literal-boundary: browser-safe wire value of ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK, pinned by test (#607)\nexport const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY: string = 'frontend_sdk';\n\n/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */\n/** Why an application-supplied public-config bag was refused. */\nexport enum FrontendProviderPublicConfigRefusal {\n  /** A key the provider module does not declare — almost always a misspelling. */\n  UNDECLARED_KEY = 'UNDECLARED_KEY',\n  /** A key naming a secret from the same vendor's backend contract. Never negotiable. */\n  SECRET_KEY = 'SECRET_KEY',\n  /** The supplied bag is not a plain object — a string, an array, `null`. */\n  NOT_AN_OBJECT = 'NOT_AN_OBJECT',\n  /**\n   * The module declares no `publicConfigSchema` whose keys can be read without running it\n   * (#1705). Nothing can then say which keys it takes, so nothing it is handed can be held to a\n   * list — and \"admit everything\" is the answer that reaches a browser.\n   */\n  SCHEMA_NOT_INTROSPECTABLE = 'SCHEMA_NOT_INTROSPECTABLE',\n  /**\n   * A served value equals, or contains, one of the producer's SECRET VALUES (#1705) — whatever the\n   * key is called and whichever vendor the secret belongs to. Never negotiable.\n   */\n  SECRET_VALUE = 'SECRET_VALUE',\n}\n/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */\n\nexport class FrontendProviderPublicConfigError extends Error {\n  constructor(\n    readonly providerRef: string,\n    readonly refusal: FrontendProviderPublicConfigRefusal,\n    readonly keys: readonly string[],\n    message: string,\n  ) {\n    super(message);\n    this.name = 'FrontendProviderPublicConfigError';\n  }\n}\n\nexport interface OverlayFrontendProviderPublicConfigInput {\n  readonly providerRef: string;\n  /** What the provider module authored — its own defaults, e.g. `{ integrationKind: 'captcha' }`. */\n  readonly authored: Readonly<Record<string, unknown>> | undefined;\n  /** What the application supplied under `providerConfigurations[providerRef][frontend_sdk]`. */\n  readonly supplied: unknown;\n  /**\n   * The keys the provider module declares it reads. `undefined` means the\n   * module declared no introspectable schema, and is REFUSED\n   * (`SCHEMA_NOT_INTROSPECTABLE`, #1705): it used to mean \"cannot enforce here\",\n   * which admitted any key for 8 of the 13 engine modules. An empty array means\n   * the module declares it reads NOTHING, so every key is refused.\n   */\n  readonly declaredKeys: readonly string[] | undefined;\n  /** Slugs and environment-variable names of the same vendor's backend secrets. */\n  readonly forbiddenKeys: ReadonlySet<string>;\n}\n\n/**\n * Merges what the application supplied over what the module authored, refusing\n * the classes of key that must never reach a browser.\n *\n * Supplied values WIN over authored ones for the same key: the module's value is\n * a default, and an application that names a key means it. Absent `supplied`\n * returns the authored bag unchanged — an application that configured nothing\n * is the ordinary case, not a refusal — but it is still HELD to the declared\n * keys: `authored` is what the served entry carries, which includes any key an\n * application mapped onto the contribution in its own `provider-contributions`.\n *\n * Call it for EVERY entry a producer serves, supplied or not; a producer that\n * skips it when nothing was supplied skips the schema and key checks too.\n */\nexport function overlayFrontendProviderPublicConfig(\n  input: OverlayFrontendProviderPublicConfigInput,\n): Readonly<Record<string, unknown>> | undefined {\n  const { providerRef, authored, supplied, declaredKeys, forbiddenKeys } = input;\n\n  if (supplied !== undefined && (typeof supplied !== 'object' || supplied === null || Array.isArray(supplied))) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.NOT_AN_OBJECT,\n      [],\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} must be an object of public `\n      + `keys, got ${Array.isArray(supplied) ? 'an array' : typeof supplied}.`,\n    );\n  }\n\n  const suppliedKeys = supplied === undefined ? [] : Object.keys(supplied);\n\n  // The secret-NAME gate (3) runs FIRST and unconditionally: a secret is refused even when the\n  // module has no introspectable schema, because that is not the module's call.\n  const secretKeys = suppliedKeys.filter((key) => forbiddenKeys.has(key));\n  if (secretKeys.length > 0) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.SECRET_KEY,\n      secretKeys,\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} names ${secretKeys.map((key) => `\"${key}\"`).join(', ')}, `\n      + `which is a SECRET of the \"${providerRef}\" backend provider. A frontend provider's public configuration is `\n      + 'served to every browser; a secret belongs in the deployment environment under its `envVarName`, and '\n      + 'nowhere else.',\n    );\n  }\n\n  // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a frontend provider with no readable key list serves nothing to a browser\n  if (declaredKeys === undefined) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.SCHEMA_NOT_INTROSPECTABLE,\n      [],\n      `The \"${providerRef}\" frontend provider declares no publicConfigSchema whose keys can be read, so nothing can `\n      + 'say which public keys it takes and none can be served to a browser. Declare one with '\n      + '`defineFrontendPublicConfigSchema` (or a Zod object) listing every key its publicConfig carries.',\n    );\n  }\n\n  const merged = supplied === undefined\n    ? authored\n    : { ...(authored ?? {}), ...(supplied as Record<string, unknown>) };\n\n  // The declared-key gate (1) over the WHOLE served bag (#1705), not only over what `providerConfigurations`\n  // supplied: a key a module authored, or an application mapped onto its contribution, reaches the\n  // browser exactly as a supplied one does.\n  const declared = new Set(declaredKeys);\n  const undeclared = Object.keys(merged ?? {}).filter((key) => !declared.has(key));\n  if (undeclared.length > 0) {\n    const suppliedSet = new Set(suppliedKeys);\n    const fromSupplied = undeclared.every((key) => suppliedSet.has(key));\n    const where = fromSupplied\n      ? `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY}`\n      : `The \"${providerRef}\" provider's publicConfig (authored by its module or mapped in provider-contributions)`;\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.UNDECLARED_KEY,\n      undeclared,\n      `${where} names ${undeclared.map((key) => `\"${key}\"`).join(', ')}, `\n      + `which the \"${providerRef}\" frontend provider does not declare. It declares: `\n      + `${declaredKeys.length > 0 ? declaredKeys.map((key) => `\"${key}\"`).join(', ') : '(nothing)'}. `\n      + 'A key the provider never reads would be served to every browser and used by nothing.',\n    );\n  }\n\n  return merged;\n}\n\n/**\n * One secret value a producer holds, with WHERE it lives.\n *\n * `slot` is what a refusal names — `secrets.json → providerEnv.STRIPE_SECRET_KEY`, or the\n * provider slot on the backend — so an operator can find it. The value itself is never printed.\n */\nexport interface FrontendPublicConfigSecretValue {\n  readonly slot: string;\n  readonly value: string;\n}\n\n/** One served public value found to be (or to contain) a secret. Names, never the value. */\nexport interface FrontendPublicConfigSecretMatch {\n  readonly providerRef: string;\n  /** Path inside that provider's `publicConfig`, e.g. `apiKey` or `origins[1]`. */\n  readonly key: string;\n  readonly slot: string;\n}\n\n/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */\n/**\n * The shortest secret a served value is searched INSIDE, not only compared to.\n *\n * Containment catches a secret embedded in a larger public value — a URL carrying\n * `?key=<secret>`, a `https://user:<secret>@host` endpoint — which exact equality would miss.\n * Below this length a secret (a six-character default password, a short database name held in a\n * credential slot) could occur by coincidence inside an ordinary public value such as a host name,\n * and refusing a correct configuration on that coincidence would teach operators to route around\n * the check. Shorter secrets are still compared EXACTLY.\n */\nexport const FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH = 16;\n/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */\n\n/**\n * Every place a served value can carry text, as text: string leaves, the decimal form of numbers\n * and bigints (a numeric secret typed into a `number`-kind key is served just the same), and the\n * KEYS of nested objects (a map keyed by a secret serves the secret). Booleans and `null` carry\n * nothing. A key found this way is reported at `<path>{key}` so the refusal can still say where.\n */\nfunction collectStringLeaves(value: unknown, path: string, into: Array<{ path: string; value: string }>): void {\n  if (typeof value === 'string') {\n    into.push({ path, value });\n    return;\n  }\n  if ((typeof value === 'number' && Number.isFinite(value)) || typeof value === 'bigint') {\n    into.push({ path, value: String(value) });\n    return;\n  }\n  if (Array.isArray(value)) {\n    value.forEach((item, index) => collectStringLeaves(item, `${path}[${index}]`, into));\n    return;\n  }\n  if (typeof value === 'object' && value !== null) {\n    for (const [key, item] of Object.entries(value)) {\n      const childPath = path.length > 0 ? `${path}.${key}` : key;\n      // A top-level key is the provider's own declared key name, held to its list by the key gate;\n      // a NESTED key is data an author chose, and is screened like a value.\n      if (path.length > 0) into.push({ path: `${path}{key}`, value: key });\n      collectStringLeaves(item, childPath, into);\n    }\n  }\n}\n\n/**\n * Every place a served `publicConfig` carries one of the producer's secret values (#1705).\n *\n * Pure, and total over the strings it is given: every string leaf of every provider's bag —\n * nested objects and arrays included — against every non-blank secret. A match is EXACT equality\n * (after trimming both sides), or CONTAINMENT for a secret at least\n * {@link FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH} long.\n *\n * Deliberately blind to key names and to which vendor a secret belongs: the defect it closes is a\n * secret under an innocent key, or one vendor's secret served under another vendor's ref.\n *\n * What it does NOT see: an ENCODED secret (URL- or base64-encoded, split across keys, hashed). It\n * asks \"is this one of our values\", verbatim; recognising transformed forms would need a guess at\n * every encoding an author might apply, and each guess would be a new false-positive source. The\n * committed-file scanner (gitleaks) and review are the backstops for that.\n */\nexport function findSecretValuesInFrontendProviders(\n  providers: Readonly<Record<string, { readonly publicConfig?: Readonly<Record<string, unknown>> }>>,\n  secrets: readonly FrontendPublicConfigSecretValue[],\n): FrontendPublicConfigSecretMatch[] {\n  const comparable = secrets\n    .map((secret) => ({ slot: secret.slot, value: secret.value.trim() }))\n    .filter((secret) => secret.value.length > 0);\n  if (comparable.length === 0) return [];\n\n  const matches: FrontendPublicConfigSecretMatch[] = [];\n  for (const [providerRef, entry] of Object.entries(providers)) {\n    const leaves: Array<{ path: string; value: string }> = [];\n    collectStringLeaves(entry.publicConfig ?? {}, '', leaves);\n    for (const leaf of leaves) {\n      const candidate = leaf.value.trim();\n      if (candidate.length === 0) continue;\n      for (const secret of comparable) {\n        const hit = candidate === secret.value\n          || (secret.value.length >= FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH && candidate.includes(secret.value));\n        if (hit) matches.push({ providerRef, key: leaf.path, slot: secret.slot });\n      }\n    }\n  }\n  return matches;\n}\n\n/**\n * Refuses to serve a set of frontend providers when any served value is one of the producer's\n * secrets (#1705). Called by BOTH producers of a served bootstrap — `wildo config sync` before it\n * writes any artifact, and the backend before it answers `/application-config` — so the two cannot\n * disagree about what may reach a browser.\n *\n * `producer` names who is refusing and where its secrets came from, for the message.\n */\nexport function assertNoSecretValueInFrontendProviders(input: {\n  readonly producer: string;\n  readonly providers: Readonly<Record<string, { readonly publicConfig?: Readonly<Record<string, unknown>> }>>;\n  readonly secrets: readonly FrontendPublicConfigSecretValue[];\n}): void {\n  // assurance-control: WILDO.DATA.CONFIDENTIALITY — a secret value never reaches a browser under any public key\n  const matches = findSecretValuesInFrontendProviders(input.providers, input.secrets);\n  if (matches.length === 0) return;\n  throw new FrontendProviderPublicConfigError(\n    matches[0].providerRef,\n    FrontendProviderPublicConfigRefusal.SECRET_VALUE,\n    matches.map((match) => `${match.providerRef}.${match.key}`),\n    `${input.producer} refused to serve frontend provider configuration: `\n    + matches.map((match) => `publicConfig \"${match.key}\" of provider \"${match.providerRef}\" carries the secret held in ${match.slot}`).join('; ')\n    + '. A frontend provider\\'s public configuration is served to every browser. Replace the value with the vendor\\'s '\n    + 'PUBLIC key (a publishable, site or search-only key), and if that secret has already been committed or served, '\n    + 'rotate it.',\n  );\n}\n\n/**\n * Refuses a READY-MADE block of frontend providers whose entries do not carry their key list, or\n * serve a key outside it (#1705).\n *\n * The overlay holds an entry to its declared keys at the moment it is PRODUCED. A block that is only\n * READ — the generated bootstrap the backend serves on `/application-config`, the frontend-services\n * artifact the website and documentation builds bake into their pages — was produced earlier, by\n * whichever `wildo config sync` wrote it. One written before a schema was mandatory carries entries\n * with no `publicConfigKeys` and was never held to any list, and nothing downstream would notice: the\n * reader parses the entry (the field stays optional on the wire precisely so it CAN be read and\n * refused with a message) and serves it. So every site that serves a ready-made block asks the same\n * question the producer asked, through the same function, and a stale artifact is refused with the\n * remedy — regenerate it — instead of being served.\n *\n * `producer` names who is refusing and what it read, for the message.\n */\nexport function assertFrontendProvidersServeOnlyDeclaredKeys(input: {\n  readonly producer: string;\n  readonly providers: Readonly<Record<string, {\n    readonly publicConfig?: Readonly<Record<string, unknown>>;\n    readonly publicConfigKeys?: readonly string[];\n  }>>;\n}): void {\n  for (const [providerRef, entry] of Object.entries(input.providers)) {\n    try {\n      // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a served frontend provider entry with no key list, or a key outside it, is not served\n      overlayFrontendProviderPublicConfig({\n        providerRef,\n        authored: entry.publicConfig,\n        supplied: undefined,\n        declaredKeys: entry.publicConfigKeys,\n        forbiddenKeys: new Set<string>(),\n      });\n    } catch (error) {\n      if (!(error instanceof FrontendProviderPublicConfigError)) throw error;\n      throw new FrontendProviderPublicConfigError(\n        error.providerRef,\n        error.refusal,\n        error.keys,\n        `${input.producer} refused to serve frontend provider configuration it was handed: ${error.message} `\n        + 'The configuration was most likely generated before this check existed — regenerate it with `wildo config sync`.',\n      );\n    }\n  }\n}\n\n/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */\n/**\n * The value kinds a public-config key may declare. Scalars only, on purpose: a\n * public key is an identifier or a flag, and a structured value here is a\n * design smell — a provider that needs one has a capability-level shape\n * (`FrontendFilePickerPublicConfigSchema`) to declare it in.\n */\nexport enum FrontendPublicConfigValueKind {\n  STRING = 'string',\n  NUMBER = 'number',\n  BOOLEAN = 'boolean',\n}\n\nexport interface FrontendPublicConfigKeySpec {\n  readonly kind: FrontendPublicConfigValueKind;\n  /** Absent = optional. Picker keys are usually optional: a missing one is reported when the picker opens, not by dropping the provider. */\n  readonly required?: boolean;\n  /** For the person writing `wildo.saas.config.ts`. Not validated; surfaced in refusals. */\n  readonly description?: string;\n}\n/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */\n\n/** A Standard Schema v1 validator that ALSO says which keys it declares. */\nexport interface FrontendPublicConfigSchema<TOutput = Readonly<Record<string, unknown>>> {\n  readonly '~standard': {\n    readonly version: 1;\n    readonly vendor: 'wildo';\n    validate(value: unknown):\n      | { readonly value: TOutput }\n      | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey> }> };\n  };\n  /**\n   * The keys this schema admits, readable without running it.\n   *\n   * This is the DATA half of the declaration, and it is why this helper exists\n   * rather than \"use Zod\": Standard Schema v1 exposes `validate` and nothing\n   * else, so a schema alone cannot tell the companion walk which keys an\n   * application may supply — and the walk runs in Node, from a projected\n   * contribution, without the module. `projectFrontendProviderContribution`\n   * mirrors this list onto the entry as `publicConfigKeys`.\n   */\n  readonly declaredKeys: readonly string[];\n}\n\n/**\n * Declares a frontend provider's public-config keys ONCE and gets both halves:\n * a strict Standard Schema v1 validator (the CODE half hydration runs) and the\n * key list (the DATA half the companion walk reads).\n *\n * Dependency-free by design. It lives here because the engine's provider modules\n * live in `@wildo-ai/external-connectors-public`, whose bare-specifier allow-list\n * holds exactly one entry — this package's `/public-runtime` — so those modules\n * can declare a schema without that package growing a validation library. An\n * application module may still use Zod (a Zod object satisfies Standard Schema\n * and its `shape` keys are read the same way).\n *\n * Strict: an unknown key is an issue, never ignored. Silently ignoring is the\n * defect FE-8 closed — a renamed key yielding `undefined` and a picker that\n * accepts more than it should with no error anywhere.\n */\nexport function defineFrontendPublicConfigSchema(\n  keys: Readonly<Record<string, FrontendPublicConfigKeySpec>>,\n): FrontendPublicConfigSchema {\n  const declaredKeys = Object.freeze(Object.keys(keys));\n\n  return {\n    declaredKeys,\n    '~standard': {\n      version: 1,\n      vendor: 'wildo',\n      validate(value: unknown) {\n        if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n          return { issues: [{ message: 'public configuration must be an object' }] };\n        }\n        const record = value as Record<string, unknown>;\n        const issues: Array<{ message: string; path?: PropertyKey[] }> = [];\n\n        for (const key of Object.keys(record)) {\n          if (!(key in keys)) issues.push({ message: 'unknown key', path: [key] });\n        }\n        for (const [key, spec] of Object.entries(keys)) {\n          const present = record[key];\n          if (present === undefined) {\n            if (spec.required === true) issues.push({ message: 'required', path: [key] });\n            continue;\n          }\n          if (typeof present !== spec.kind) {\n            issues.push({ message: `expected a ${spec.kind}, got ${typeof present}`, path: [key] });\n          }\n        }\n\n        return issues.length > 0 ? { issues } : { value: record };\n      },\n    },\n  };\n}\n\n/**\n * Reads the declared keys off a provider's `publicConfigSchema`, whatever\n * library produced it.\n *\n * Two shapes are recognised, and the order matters: a schema built by\n * `defineFrontendPublicConfigSchema` states its keys outright; a Zod object\n * exposes them as `shape`. Anything else — a hand-written Standard Schema, a\n * library without introspection — yields `undefined`, which every gate REFUSES\n * (`SCHEMA_NOT_INTROSPECTABLE`, #1705) rather than reading as \"declares nothing\".\n * That distinction is load-bearing: an empty list is a readable answer and\n * refuses EVERY key, while `undefined` means no key list exists at all.\n */\nexport function readDeclaredPublicConfigKeys(schema: unknown): readonly string[] | undefined {\n  if (typeof schema !== 'object' || schema === null) return undefined;\n  const candidate = schema as { declaredKeys?: unknown; shape?: unknown };\n  if (Array.isArray(candidate.declaredKeys) && candidate.declaredKeys.every((key) => typeof key === 'string')) {\n    return candidate.declaredKeys as readonly string[];\n  }\n  if (typeof candidate.shape === 'object' && candidate.shape !== null) {\n    return Object.keys(candidate.shape as Record<string, unknown>);\n  }\n  return undefined;\n}\n"]}
+{"version":3,"file":"frontend-provider-public-config.shared.js","sourceRoot":"","sources":["../../../src/external-providers/frontend-provider-public-config.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,mIAAmI;AACnI,MAAM,CAAC,MAAM,mCAAmC,GAAW,cAAc,CAAC;AAE1E,gIAAgI;AAChI,iEAAiE;AACjE,MAAM,CAAN,IAAY,mCAkBX;AAlBD,WAAY,mCAAmC;IAC7C,gFAAgF;IAChF,wEAAiC,CAAA;IACjC,uFAAuF;IACvF,gEAAyB,CAAA;IACzB,2EAA2E;IAC3E,sEAA+B,CAAA;IAC/B;;;;OAIG;IACH,8FAAuD,CAAA;IACvD;;;OAGG;IACH,oEAA6B,CAAA;AAC/B,CAAC,EAlBW,mCAAmC,KAAnC,mCAAmC,QAkB9C;AACD,kFAAkF;AAElF,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAE/C;IACA;IACA;IAHX,YACW,WAAmB,EACnB,OAA4C,EAC5C,IAAuB,EAChC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,gBAAW,GAAX,WAAW,CAAQ;QACnB,YAAO,GAAP,OAAO,CAAqC;QAC5C,SAAI,GAAJ,IAAI,CAAmB;QAIhC,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AAoBD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mCAAmC,CACjD,KAA+C;IAE/C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAE/E,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,aAAa,EACjD,EAAE,EACF,0BAA0B,WAAW,IAAI,mCAAmC,+BAA+B;cACzG,aAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,QAAQ,GAAG,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEzE,6FAA6F;IAC7F,8EAA8E;IAC9E,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,UAAU,EAC9C,UAAU,EACV,0BAA0B,WAAW,IAAI,mCAAmC,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cACtI,6BAA6B,WAAW,oEAAoE;cAC5G,sGAAsG;cACtG,eAAe,CAClB,CAAC;IACJ,CAAC;IAED,4HAA4H;IAC5H,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,yBAAyB,EAC7D,EAAE,EACF,QAAQ,WAAW,4FAA4F;cAC7G,uFAAuF;cACvF,kGAAkG,CACrG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS;QACnC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAI,QAAoC,EAAE,CAAC;IAEtE,2GAA2G;IAC3G,iGAAiG;IACjG,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,YAAY;YACxB,CAAC,CAAC,0BAA0B,WAAW,IAAI,mCAAmC,EAAE;YAChF,CAAC,CAAC,QAAQ,WAAW,wFAAwF,CAAC;QAChH,MAAM,IAAI,iCAAiC,CACzC,WAAW,EACX,mCAAmC,CAAC,cAAc,EAClD,UAAU,EACV,GAAG,KAAK,UAAU,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;cAClE,cAAc,WAAW,qDAAqD;cAC9E,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI;cAC/F,sFAAsF,CACzF,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAqBD,gIAAgI;AAChI;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAAG,EAAE,CAAC;AACvE,kFAAkF;AAElF;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY,EAAE,IAA4C;IACrG,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC3D,6FAA6F;YAC7F,sEAAsE;YACtE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACrE,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC,CACjD,SAAkG,EAClG,OAAmD;IAEnD,MAAM,UAAU,GAAG,OAAO;SACvB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACpE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,OAAO,GAAsC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAA2C,EAAE,CAAC;QAC1D,mBAAmB,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,SAAS,KAAK,MAAM,CAAC,KAAK;uBACjC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,oDAAoD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvH,IAAI,GAAG;oBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sCAAsC,CAAC,KAItD;IACC,8GAA8G;IAC9G,MAAM,OAAO,GAAG,mCAAmC,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,IAAI,iCAAiC,CACzC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EACtB,mCAAmC,CAAC,YAAY,EAChD,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,EAC3D,GAAG,KAAK,CAAC,QAAQ,qDAAqD;UACpE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,KAAK,CAAC,GAAG,kBAAkB,KAAK,CAAC,WAAW,gCAAgC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;UAC5I,iHAAiH;UACjH,gHAAgH;UAChH,YAAY,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,4CAA4C,CAAC,KAM5D;IACC,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,wIAAwI;YACxI,mCAAmC,CAAC;gBAClC,WAAW;gBACX,QAAQ,EAAE,KAAK,CAAC,YAAY;gBAC5B,QAAQ,EAAE,SAAS;gBACnB,YAAY,EAAE,KAAK,CAAC,gBAAgB;gBACpC,aAAa,EAAE,IAAI,GAAG,EAAU;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,iCAAiC,CAAC;gBAAE,MAAM,KAAK,CAAC;YACvE,MAAM,IAAI,iCAAiC,CACzC,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,IAAI,EACV,GAAG,KAAK,CAAC,QAAQ,oEAAoE,KAAK,CAAC,OAAO,GAAG;kBACnG,iHAAiH,CACpH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,gIAAgI;AAChI;;;;;GAKG;AACH,MAAM,CAAN,IAAY,6BAIX;AAJD,WAAY,6BAA6B;IACvC,kDAAiB,CAAA;IACjB,kDAAiB,CAAA;IACjB,oDAAmB,CAAA;AACrB,CAAC,EAJW,6BAA6B,KAA7B,6BAA6B,QAIxC;AAiCD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAA2D;IAE3D,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,OAAO;QACL,YAAY;QACZ,WAAW,EAAE;YACX,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,OAAO;YACf,QAAQ,CAAC,KAAc;gBACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,EAAE,CAAC;gBAC7E,CAAC;gBACD,MAAM,MAAM,GAAG,KAAgC,CAAC;gBAChD,MAAM,MAAM,GAAqD,EAAE,CAAC;gBAEpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;wBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC3E,CAAC;gBACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC5B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;wBAC1B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;4BAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC9E,SAAS;oBACX,CAAC;oBACD,IAAI,OAAO,OAAO,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,IAAI,CAAC,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC1F,CAAC;gBACH,CAAC;gBAED,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC5D,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,SAAS,GAAG,MAAqD,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5G,OAAO,SAAS,CAAC,YAAiC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAgC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * How an APPLICATION supplies a frontend provider's public configuration — the\n * keys a picker needs that only the application can know (a Drive `appId`, a\n * OneDrive `clientId`) — and the gates that keep that channel from carrying\n * anything else.\n *\n * ## The gap this closes\n *\n * A frontend provider's `publicConfig` was HARD-CODED on the engine's provider\n * module and projected verbatim onto the wire. The only way to set a picker's\n * `appId` was to edit engine code. The backend never had that problem: an\n * application authors `providerConfigurations[providerRef][protocolKind]` in\n * `wildo.saas.config.ts`, and SSO's public OAuth client id already travels that\n * way, keyed by the protocol (`sso_oauth2`).\n *\n * This file gives the frontend the same channel, keyed by the same vocabulary:\n * `providerConfigurations[providerRef][frontend_sdk]`. One authority for\n * \"what an application configured for this provider\", read by both sides.\n *\n * ## The gates, because `publicConfig` is served to every browser\n *\n * 1. **Only DECLARED keys cross.** A provider module declares the keys it reads\n *    (`publicConfigSchema` — see `defineFrontendPublicConfigSchema` below, which\n *    is what makes those keys READABLE without running the schema), and a\n *    module with no readable list is refused outright. Every key an entry would\n *    serve — authored by the module, mapped onto its contribution, or supplied\n *    by the application — is held to that list wherever an entry is PRODUCED\n *    (`wildo config sync`, the backend's fallback projection) and again wherever\n *    a ready-made one is READ and served (the backend's `/application-config`,\n *    the website and documentation build loader). A misspelled `apiId` therefore\n *    fails where it was typed, instead of silently contributing nothing and\n *    leaving a picker that reports \"no appId\" at the moment a user opens it.\n *\n * 2. **A secret VALUE never crosses.** Every served string is compared against\n *    the producer's secret values — the environment's whole `secrets.json` at\n *    sync, the registered providers' confidential slots on the backend — and a\n *    match refuses, whatever the key is called (#1705).\n *\n * 3. **A secret NAME is refused early.** A key spelled like a slug or an\n *    environment-variable name from the same vendor's backend secrets contract\n *    (`GOOGLE_OAUTH2_CLIENT_SECRET`) is refused with that explanation before the\n *    key-list check would call it merely undeclared. It is the clearer message,\n *    not the gate: a browser-only vendor has no backend names to match.\n *\n * Value VALIDATION (is `appId` a string?) is the schema's job and runs where the\n * schema is: at hydration (FE-8) and, on the backend fallback, before serving.\n *\n * ## Why names were never enough, and what closes it (#1705)\n *\n * The name gate draws its forbidden names from the same vendor's BACKEND contract, so a\n * browser-only vendor (reCAPTCHA, Algolia) had an EMPTY forbidden set: its secret\n * key under `siteKey`, or an Algolia admin key under `apiKey`, passed every name\n * check. And the declared-key gate switched itself off for a module with no introspectable\n * schema — 8 of the 13 engine modules — admitting any key at all. A guard that\n * matches how a key is SPELLED looks like a control and decides almost nothing.\n *\n * Three changes turn it into one:\n *\n * - **A schema is mandatory.** `declaredKeys: undefined` is now a refusal\n *   (`SCHEMA_NOT_INTROSPECTABLE`) rather than \"cannot enforce here\", and the key check\n *   runs over the WHOLE served bag — the module's authored keys and any key an\n *   application mapped onto its contribution — not only over what\n *   `providerConfigurations` supplied.\n * - **Values are compared, not shapes.** {@link assertNoSecretValueInFrontendProviders}\n *   compares every string in every served `publicConfig` against the secret\n *   VALUES the producer holds: `wildo config sync` against the environment's\n *   `secrets.json`, the backend against its providers' confidential slots. It\n *   asks \"is this one of OUR secrets\", which no name or shape rule can answer,\n *   and it names the key and the slot, never the value. Gitleaks answers the\n *   other question (\"does this look like a secret\") on committed files; the two\n *   do not overlap.\n * - **What is secret comes from a declaration.** A provider secret slot is\n *   confidential unless its contract marks it `holdsBrowserPublicValue` (a\n *   vendor key designed to ship to browsers, such as PostHog's project key) or\n *   `holdsDeploymentHost`; framework-managed material is confidential by its\n *   registry's `secretKeys`. Nothing is inferred from a key's name.\n *\n * ## Why the overlay is a pure function in this package\n *\n * It has THREE call sites that must agree — the companion walk in\n * `platform-config-lib`, the backend fallback in `saas-backend-lib`, and any\n * future producer of a `FrontendProviderEntry` — and #380 already paid once for\n * a projection that landed on one site and not another. A function both import\n * cannot be applied differently by each.\n */\n\n/**\n * The key under `providerConfigurations[providerRef]` an application uses to\n * supply a frontend provider's public configuration.\n *\n * The protocol kind's WIRE value, exactly as SSO's channel is keyed by ITS\n * protocol kind (`sso_oauth2`): the bag is per-provider, per-protocol, and a\n * frontend module speaks `FRONTEND_SDK`.\n *\n * The owning source is `ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK` in\n * `@wildo-ai/external-connectors-models`, and this literal is pinned to it by\n * `__tests__/frontend-provider-public-config.shared.test.ts`. It is written out\n * rather than imported because this file is in the\n * `@wildo-ai/saas-models/public-runtime` closure, which K-3 forbids from\n * importing that package — an import it carried from #394 P3 until #607 put the\n * whole external-connectors model tree into every browser provider bundle.\n * `BUILTIN_PROVIDER_PROTOCOL` is the same arrangement for the same boundary.\n */\n// semantic-literal-boundary: browser-safe wire value of ExternalProvider_ExchangeProtocol_Kind.FRONTEND_SDK, pinned by test (#607)\nexport const FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY: string = 'frontend_sdk';\n\n/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */\n/** Why an application-supplied public-config bag was refused. */\nexport enum FrontendProviderPublicConfigRefusal {\n  /** A key the provider module does not declare — almost always a misspelling. */\n  UNDECLARED_KEY = 'UNDECLARED_KEY',\n  /** A key naming a secret from the same vendor's backend contract. Never negotiable. */\n  SECRET_KEY = 'SECRET_KEY',\n  /** The supplied bag is not a plain object — a string, an array, `null`. */\n  NOT_AN_OBJECT = 'NOT_AN_OBJECT',\n  /**\n   * The module declares no `publicConfigSchema` whose keys can be read without running it\n   * (#1705). Nothing can then say which keys it takes, so nothing it is handed can be held to a\n   * list — and \"admit everything\" is the answer that reaches a browser.\n   */\n  SCHEMA_NOT_INTROSPECTABLE = 'SCHEMA_NOT_INTROSPECTABLE',\n  /**\n   * A served value equals, or contains, one of the producer's SECRET VALUES (#1705) — whatever the\n   * key is called and whichever vendor the secret belongs to. Never negotiable.\n   */\n  SECRET_VALUE = 'SECRET_VALUE',\n}\n/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */\n\nexport class FrontendProviderPublicConfigError extends Error {\n  constructor(\n    readonly providerRef: string,\n    readonly refusal: FrontendProviderPublicConfigRefusal,\n    readonly keys: readonly string[],\n    message: string,\n  ) {\n    super(message);\n    this.name = 'FrontendProviderPublicConfigError';\n  }\n}\n\nexport interface OverlayFrontendProviderPublicConfigInput {\n  readonly providerRef: string;\n  /** What the provider module authored — its own defaults, e.g. `{ integrationKind: 'captcha' }`. */\n  readonly authored: Readonly<Record<string, unknown>> | undefined;\n  /** What the application supplied under `providerConfigurations[providerRef][frontend_sdk]`. */\n  readonly supplied: unknown;\n  /**\n   * The keys the provider module declares it reads. `undefined` means the\n   * module declared no introspectable schema, and is REFUSED\n   * (`SCHEMA_NOT_INTROSPECTABLE`, #1705): it used to mean \"cannot enforce here\",\n   * which admitted any key for 8 of the 13 engine modules. An empty array means\n   * the module declares it reads NOTHING, so every key is refused.\n   */\n  readonly declaredKeys: readonly string[] | undefined;\n  /** Slugs and environment-variable names of the same vendor's backend secrets. */\n  readonly forbiddenKeys: ReadonlySet<string>;\n}\n\n/**\n * Merges what the application supplied over what the module authored, refusing\n * the classes of key that must never reach a browser.\n *\n * Supplied values WIN over authored ones for the same key: the module's value is\n * a default, and an application that names a key means it. Absent `supplied`\n * returns the authored bag unchanged — an application that configured nothing\n * is the ordinary case, not a refusal — but it is still HELD to the declared\n * keys: `authored` is what the served entry carries, which includes any key an\n * application mapped onto the contribution in its own `provider-contributions`.\n *\n * Call it for EVERY entry a producer serves, supplied or not; a producer that\n * skips it when nothing was supplied skips the schema and key checks too.\n */\nexport function overlayFrontendProviderPublicConfig(\n  input: OverlayFrontendProviderPublicConfigInput,\n): Readonly<Record<string, unknown>> | undefined {\n  const { providerRef, authored, supplied, declaredKeys, forbiddenKeys } = input;\n\n  if (supplied !== undefined && (typeof supplied !== 'object' || supplied === null || Array.isArray(supplied))) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.NOT_AN_OBJECT,\n      [],\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} must be an object of public `\n      + `keys, got ${Array.isArray(supplied) ? 'an array' : typeof supplied}.`,\n    );\n  }\n\n  const suppliedKeys = supplied === undefined ? [] : Object.keys(supplied);\n\n  // The secret-NAME gate (3) runs FIRST and unconditionally: a secret is refused even when the\n  // module has no introspectable schema, because that is not the module's call.\n  const secretKeys = suppliedKeys.filter((key) => forbiddenKeys.has(key));\n  if (secretKeys.length > 0) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.SECRET_KEY,\n      secretKeys,\n      `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY} names ${secretKeys.map((key) => `\"${key}\"`).join(', ')}, `\n      + `which is a SECRET of the \"${providerRef}\" backend provider. A frontend provider's public configuration is `\n      + 'served to every browser; a secret belongs in the deployment environment under its `envVarName`, and '\n      + 'nowhere else.',\n    );\n  }\n\n  // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a frontend provider with no readable key list serves nothing to a browser\n  if (declaredKeys === undefined) {\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.SCHEMA_NOT_INTROSPECTABLE,\n      [],\n      `The \"${providerRef}\" frontend provider declares no publicConfigSchema whose keys can be read, so nothing can `\n      + 'say which public keys it takes and none can be served to a browser. Declare one with '\n      + '`defineFrontendPublicConfigSchema` (or a Zod object) listing every key its publicConfig carries.',\n    );\n  }\n\n  const merged = supplied === undefined\n    ? authored\n    : { ...(authored ?? {}), ...(supplied as Record<string, unknown>) };\n\n  // The declared-key gate (1) over the WHOLE served bag (#1705), not only over what `providerConfigurations`\n  // supplied: a key a module authored, or an application mapped onto its contribution, reaches the\n  // browser exactly as a supplied one does.\n  const declared = new Set(declaredKeys);\n  const undeclared = Object.keys(merged ?? {}).filter((key) => !declared.has(key));\n  if (undeclared.length > 0) {\n    const suppliedSet = new Set(suppliedKeys);\n    const fromSupplied = undeclared.every((key) => suppliedSet.has(key));\n    const where = fromSupplied\n      ? `providerConfigurations.${providerRef}.${FRONTEND_PROVIDER_PUBLIC_CONFIG_KEY}`\n      : `The \"${providerRef}\" provider's publicConfig (authored by its module or mapped in provider-contributions)`;\n    throw new FrontendProviderPublicConfigError(\n      providerRef,\n      FrontendProviderPublicConfigRefusal.UNDECLARED_KEY,\n      undeclared,\n      `${where} names ${undeclared.map((key) => `\"${key}\"`).join(', ')}, `\n      + `which the \"${providerRef}\" frontend provider does not declare. It declares: `\n      + `${declaredKeys.length > 0 ? declaredKeys.map((key) => `\"${key}\"`).join(', ') : '(nothing)'}. `\n      + 'A key the provider never reads would be served to every browser and used by nothing.',\n    );\n  }\n\n  return merged;\n}\n\n/**\n * One secret value a producer holds, with WHERE it lives.\n *\n * `slot` is what a refusal names — `secrets.json → providerEnv.STRIPE_SECRET_KEY`, or the\n * provider slot on the backend — so an operator can find it. The value itself is never printed.\n */\nexport interface FrontendPublicConfigSecretValue {\n  readonly slot: string;\n  readonly value: string;\n}\n\n/** One served public value found to be (or to contain) a secret. Names, never the value. */\nexport interface FrontendPublicConfigSecretMatch {\n  readonly providerRef: string;\n  /** Path inside that provider's `publicConfig`, e.g. `apiKey` or `origins[1]`. */\n  readonly key: string;\n  readonly slot: string;\n}\n\n/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */\n/**\n * The shortest secret a served value is searched INSIDE, not only compared to.\n *\n * Containment catches a secret embedded in a larger public value — a URL carrying\n * `?key=<secret>`, a `https://user:<secret>@host` endpoint — which exact equality would miss.\n * Below this length a secret (a six-character default password, a short database name held in a\n * credential slot) could occur by coincidence inside an ordinary public value such as a host name,\n * and refusing a correct configuration on that coincidence would teach operators to route around\n * the check. Shorter secrets are still compared EXACTLY.\n */\nexport const FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH = 16;\n/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */\n\n/**\n * Every place a served value can carry text, as text: string leaves, the decimal form of numbers\n * and bigints (a numeric secret typed into a `number`-kind key is served just the same), and the\n * KEYS of nested objects (a map keyed by a secret serves the secret). Booleans and `null` carry\n * nothing. A key found this way is reported at `<path>{key}` so the refusal can still say where.\n */\nfunction collectStringLeaves(value: unknown, path: string, into: Array<{ path: string; value: string }>): void {\n  if (typeof value === 'string') {\n    into.push({ path, value });\n    return;\n  }\n  if ((typeof value === 'number' && Number.isFinite(value)) || typeof value === 'bigint') {\n    into.push({ path, value: String(value) });\n    return;\n  }\n  if (Array.isArray(value)) {\n    value.forEach((item, index) => collectStringLeaves(item, `${path}[${index}]`, into));\n    return;\n  }\n  if (typeof value === 'object' && value !== null) {\n    for (const [key, item] of Object.entries(value)) {\n      const childPath = path.length > 0 ? `${path}.${key}` : key;\n      // A top-level key is the provider's own declared key name, held to its list by the key gate;\n      // a NESTED key is data an author chose, and is screened like a value.\n      if (path.length > 0) into.push({ path: `${path}{key}`, value: key });\n      collectStringLeaves(item, childPath, into);\n    }\n  }\n}\n\n/**\n * Every place a served `publicConfig` carries one of the producer's secret values (#1705).\n *\n * Pure, and total over the strings it is given: every string leaf of every provider's bag —\n * nested objects and arrays included — against every non-blank secret. A match is EXACT equality\n * (after trimming both sides), or CONTAINMENT for a secret at least\n * {@link FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH} long.\n *\n * Deliberately blind to key names and to which vendor a secret belongs: the defect it closes is a\n * secret under an innocent key, or one vendor's secret served under another vendor's ref.\n *\n * What it does NOT see: an ENCODED secret (URL- or base64-encoded, split across keys, hashed). It\n * asks \"is this one of our values\", verbatim; recognising transformed forms would need a guess at\n * every encoding an author might apply, and each guess would be a new false-positive source. The\n * committed-file scanner (gitleaks) and review are the backstops for that.\n */\nexport function findSecretValuesInFrontendProviders(\n  providers: Readonly<Record<string, { readonly publicConfig?: Readonly<Record<string, unknown>> }>>,\n  secrets: readonly FrontendPublicConfigSecretValue[],\n): FrontendPublicConfigSecretMatch[] {\n  const comparable = secrets\n    .map((secret) => ({ slot: secret.slot, value: secret.value.trim() }))\n    .filter((secret) => secret.value.length > 0);\n  if (comparable.length === 0) return [];\n\n  const matches: FrontendPublicConfigSecretMatch[] = [];\n  for (const [providerRef, entry] of Object.entries(providers)) {\n    const leaves: Array<{ path: string; value: string }> = [];\n    collectStringLeaves(entry.publicConfig ?? {}, '', leaves);\n    for (const leaf of leaves) {\n      const candidate = leaf.value.trim();\n      if (candidate.length === 0) continue;\n      for (const secret of comparable) {\n        const hit = candidate === secret.value\n          || (secret.value.length >= FRONTEND_PUBLIC_CONFIG_SECRET_CONTAINMENT_MIN_LENGTH && candidate.includes(secret.value));\n        if (hit) matches.push({ providerRef, key: leaf.path, slot: secret.slot });\n      }\n    }\n  }\n  return matches;\n}\n\n/**\n * Refuses to serve a set of frontend providers when any served value is one of the producer's\n * secrets (#1705). Called by BOTH producers of a served bootstrap — `wildo config sync` before it\n * writes any artifact, and the backend before it answers `/application-config` — so the two cannot\n * disagree about what may reach a browser.\n *\n * `producer` names who is refusing and where its secrets came from, for the message.\n */\nexport function assertNoSecretValueInFrontendProviders(input: {\n  readonly producer: string;\n  readonly providers: Readonly<Record<string, { readonly publicConfig?: Readonly<Record<string, unknown>> }>>;\n  readonly secrets: readonly FrontendPublicConfigSecretValue[];\n}): void {\n  // assurance-control: WILDO.DATA.CONFIDENTIALITY — a secret value never reaches a browser under any public key\n  const matches = findSecretValuesInFrontendProviders(input.providers, input.secrets);\n  if (matches.length === 0) return;\n  throw new FrontendProviderPublicConfigError(\n    matches[0].providerRef,\n    FrontendProviderPublicConfigRefusal.SECRET_VALUE,\n    matches.map((match) => `${match.providerRef}.${match.key}`),\n    `${input.producer} refused to serve frontend provider configuration: `\n    + matches.map((match) => `publicConfig \"${match.key}\" of provider \"${match.providerRef}\" carries the secret held in ${match.slot}`).join('; ')\n    + '. A frontend provider\\'s public configuration is served to every browser. Replace the value with the vendor\\'s '\n    + 'PUBLIC key (a publishable, site or search-only key), and if that secret has already been committed or served, '\n    + 'rotate it.',\n  );\n}\n\n/**\n * Refuses a READY-MADE block of frontend providers whose entries do not carry their key list, or\n * serve a key outside it (#1705).\n *\n * The overlay holds an entry to its declared keys at the moment it is PRODUCED. A block that is only\n * READ — the generated bootstrap the backend serves on `/application-config`, the frontend-services\n * artifact the website and documentation builds bake into their pages — was produced earlier, by\n * whichever `wildo config sync` wrote it. One written before a schema was mandatory carries entries\n * with no `publicConfigKeys` and was never held to any list, and nothing downstream would notice: the\n * reader parses the entry (the field stays optional on the wire precisely so it CAN be read and\n * refused with a message) and serves it. So every site that serves a ready-made block asks the same\n * question the producer asked, through the same function, and a stale artifact is refused with the\n * remedy — regenerate it — instead of being served.\n *\n * `producer` names who is refusing and what it read, for the message.\n */\nexport function assertFrontendProvidersServeOnlyDeclaredKeys(input: {\n  readonly producer: string;\n  readonly providers: Readonly<Record<string, {\n    readonly publicConfig?: Readonly<Record<string, unknown>>;\n    readonly publicConfigKeys?: readonly string[];\n  }>>;\n}): void {\n  for (const [providerRef, entry] of Object.entries(input.providers)) {\n    try {\n      // assurance-control: WILDO.SECURITY.FAIL_CLOSED — a served frontend provider entry with no key list, or a key outside it, is not served\n      overlayFrontendProviderPublicConfig({\n        providerRef,\n        authored: entry.publicConfig,\n        supplied: undefined,\n        declaredKeys: entry.publicConfigKeys,\n        forbiddenKeys: new Set<string>(),\n      });\n    } catch (error) {\n      if (!(error instanceof FrontendProviderPublicConfigError)) throw error;\n      throw new FrontendProviderPublicConfigError(\n        error.providerRef,\n        error.refusal,\n        error.keys,\n        `${input.producer} refused to serve frontend provider configuration it was handed: ${error.message} `\n        + 'The configuration was most likely generated before this check existed — regenerate it with `wildo config sync`.',\n      );\n    }\n  }\n}\n\n/** @wildo_source:part:start saas.models.frontend-provider-public-config-contract facet:kind:api facet:audience:app-developer */\n/**\n * The value kinds a public-config key may declare. Scalars only, on purpose: a\n * public key is an identifier or a flag, and a structured value here is a\n * design smell — a provider that needs one has a capability-level shape\n * (`FrontendFilePickerPublicConfigSchema`) to declare it in.\n */\nexport enum FrontendPublicConfigValueKind {\n  STRING = 'string',\n  NUMBER = 'number',\n  BOOLEAN = 'boolean',\n}\n\nexport interface FrontendPublicConfigKeySpec {\n  readonly kind: FrontendPublicConfigValueKind;\n  /** Absent = optional. Picker keys are usually optional: a missing one is reported when the picker opens, not by dropping the provider. */\n  readonly required?: boolean;\n  /** For the person writing `wildo.saas.config.ts`. Not validated; surfaced in refusals. */\n  readonly description?: string;\n}\n/** @wildo_source:part:end saas.models.frontend-provider-public-config-contract */\n\n/** A Standard Schema v1 validator that ALSO says which keys it declares. */\nexport interface FrontendPublicConfigSchema<TOutput = Readonly<Record<string, unknown>>> {\n  readonly '~standard': {\n    readonly version: 1;\n    readonly vendor: 'wildo';\n    validate(value: unknown):\n      | { readonly value: TOutput }\n      | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey> }> };\n  };\n  /**\n   * The keys this schema admits, readable without running it.\n   *\n   * This is the DATA half of the declaration, and it is why this helper exists\n   * rather than \"use Zod\": Standard Schema v1 exposes `validate` and nothing\n   * else, so a schema alone cannot tell the companion walk which keys an\n   * application may supply — and the walk runs in Node, from a projected\n   * contribution, without the module. `projectFrontendProviderContribution`\n   * mirrors this list onto the entry as `publicConfigKeys`.\n   */\n  readonly declaredKeys: readonly string[];\n}\n\n/**\n * Declares a frontend provider's public-config keys ONCE and gets both halves:\n * a strict Standard Schema v1 validator (the CODE half hydration runs) and the\n * key list (the DATA half the companion walk reads).\n *\n * Dependency-free by design. It lives here because the engine's provider modules\n * live in `@wildo-ai/external-connectors-public`, whose bare-specifier allow-list\n * holds exactly one entry — this package's `/public-runtime` — so those modules\n * can declare a schema without that package growing a validation library. An\n * application module may still use Zod (a Zod object satisfies Standard Schema\n * and its `shape` keys are read the same way).\n *\n * Strict: an unknown key is an issue, never ignored. Silently ignoring is the\n * defect FE-8 closed — a renamed key yielding `undefined` and a picker that\n * accepts more than it should with no error anywhere.\n */\nexport function defineFrontendPublicConfigSchema(\n  keys: Readonly<Record<string, FrontendPublicConfigKeySpec>>,\n): FrontendPublicConfigSchema {\n  const declaredKeys = Object.freeze(Object.keys(keys));\n\n  return {\n    declaredKeys,\n    '~standard': {\n      version: 1,\n      vendor: 'wildo',\n      validate(value: unknown) {\n        if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n          return { issues: [{ message: 'public configuration must be an object' }] };\n        }\n        const record = value as Record<string, unknown>;\n        const issues: Array<{ message: string; path?: PropertyKey[] }> = [];\n\n        for (const key of Object.keys(record)) {\n          if (!(key in keys)) issues.push({ message: 'unknown key', path: [key] });\n        }\n        for (const [key, spec] of Object.entries(keys)) {\n          const present = record[key];\n          if (present === undefined) {\n            if (spec.required === true) issues.push({ message: 'required', path: [key] });\n            continue;\n          }\n          if (typeof present !== spec.kind) {\n            issues.push({ message: `expected a ${spec.kind}, got ${typeof present}`, path: [key] });\n          }\n        }\n\n        return issues.length > 0 ? { issues } : { value: record };\n      },\n    },\n  };\n}\n\n/**\n * Reads the declared keys off a provider's `publicConfigSchema`, whatever\n * library produced it.\n *\n * Two shapes are recognised, and the order matters: a schema built by\n * `defineFrontendPublicConfigSchema` states its keys outright; a Zod object\n * exposes them as `shape`. Anything else — a hand-written Standard Schema, a\n * library without introspection — yields `undefined`, which every gate REFUSES\n * (`SCHEMA_NOT_INTROSPECTABLE`, #1705) rather than reading as \"declares nothing\".\n * That distinction is load-bearing: an empty list is a readable answer and\n * refuses EVERY key, while `undefined` means no key list exists at all.\n */\nexport function readDeclaredPublicConfigKeys(schema: unknown): readonly string[] | undefined {\n  if (typeof schema !== 'object' || schema === null) return undefined;\n  const candidate = schema as { declaredKeys?: unknown; shape?: unknown };\n  if (Array.isArray(candidate.declaredKeys) && candidate.declaredKeys.every((key) => typeof key === 'string')) {\n    return candidate.declaredKeys as readonly string[];\n  }\n  if (typeof candidate.shape === 'object' && candidate.shape !== null) {\n    return Object.keys(candidate.shape as Record<string, unknown>);\n  }\n  return undefined;\n}\n"]}

package/dist/esm/external-providers/model-cost-accounting-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-cost-accounting-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/model-cost-accounting-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,8EAA8E;AAC9E,eAAO,MAAM,0CAA0C,IAAI,CAAC;AAC5D,sHAAsH;AACtH,eAAO,MAAM,oCAAoC,eAAe,CAAC;AAEjE,4IAA4I;AAC5I,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAC7F,sEAAsE"}
+{"version":3,"file":"model-cost-accounting-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/model-cost-accounting-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,8EAA8E;AAC9E,eAAO,MAAM,0CAA0C,IAAI,CAAC;AAC5D,sHAAsH;AACtH,eAAO,MAAM,oCAAoC,eAAe,CAAC;AAEjE,4IAA4I;AAC5I,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAC7F,sEAAsE"}

package/dist/esm/external-providers/model-cost-accounting-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"model-cost-accounting-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/model-cost-accounting-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mCAAmC,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,EAAE,2CAA2C,EAAE,MAAM,8BAA8B,CAAC;AAE3F,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC;AAC5D,sHAAsH;AACtH,MAAM,CAAC,MAAM,oCAAoC,GAAG,YAAY,CAAC;AAEjE,4IAA4I;AAC5I,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,mGAAmG;IACnG,+BAA+B,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzF,2FAA2F;IAC3F,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,0CAA0C,CAAC;IACzG,+CAA+C;IAC/C,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC;CACzF,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,2CAA2C,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,iCAAiC,CAAC,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,sEAAsE","sourcesContent":["/**\n * # `modelCostAccounting`: how an application prices its model calls and closes its cost periods (#1598)\n *\n * A backend-authored configuration section. It is NOT on the shared (frontend-visible) configuration: the\n * rates an application registers are its negotiated acquisition costs, which is the firm's internal margin\n * data.\n *\n * - `providerUsagePricingAuthorities` — the application's price list. Registered by the application because\n *   rates are negotiated; the engine ships no catalogue (it would be wrong for every contract and go stale).\n *   A duplicate `pricingAuthorityRef@pricingAuthorityVersion` is refused when the configuration is parsed,\n *   which is at startup.\n * - `periodCloseGraceDays` — how long after a calendar month ends the period-close batch waits before\n *   writing that month's aggregates, so late rows (retries, a drain backlog) land first. Startup refuses a\n *   declared `OPERATIONAL_LOGS` period shorter than one month plus this grace: the close reads detail rows,\n *   and would otherwise read rows the retention sweep had already deleted.\n */\nimport { z } from 'zod';\n\nimport { ProviderUsagePricingAuthoritySchema } from './provider-usage-pricing.shared.schemas';\nimport { assertUniqueProviderUsagePricingAuthorities } from './provider-usage-cost.shared';\n\n/** Default grace after a month ends before its cost aggregates are closed. */\nexport const MODEL_COST_PERIOD_CLOSE_DEFAULT_GRACE_DAYS = 3;\n/** Default schedule of the period-close batch: daily at 02:17 UTC (it closes every period whose grace has passed). */\nexport const MODEL_COST_PERIOD_CLOSE_DEFAULT_CRON = '17 2 * * *';\n\n/** @wildo_source:part:start saas.models.model-cost-accounting-config facet:layer:shared facet:family:config facet:audience:app-developer */\nexport const ModelCostAccountingConfigSchema = z.object({\n  /** The application's registered model prices. Absent or empty: every call is recorded UNPRICED. */\n  providerUsagePricingAuthorities: z.array(ProviderUsagePricingAuthoritySchema).default([]),\n  /** Days after a calendar month (UTC) ends before its cost aggregates are written. 0–27. */\n  periodCloseGraceDays: z.number().int().min(0).max(27).default(MODEL_COST_PERIOD_CLOSE_DEFAULT_GRACE_DAYS),\n  /** Cron schedule of the period-close batch. */\n  periodCloseCronSchedule: z.string().min(1).default(MODEL_COST_PERIOD_CLOSE_DEFAULT_CRON),\n}).superRefine((config, context) => {\n  try {\n    assertUniqueProviderUsagePricingAuthorities(config.providerUsagePricingAuthorities);\n  } catch (error) {\n    context.addIssue({ code: 'custom', path: ['providerUsagePricingAuthorities'], message: error instanceof Error ? error.message : String(error) });\n  }\n});\nexport type ModelCostAccountingConfig = z.infer<typeof ModelCostAccountingConfigSchema>;\nexport type ModelCostAccountingConfigInput = z.input<typeof ModelCostAccountingConfigSchema>;\n/** @wildo_source:part:end saas.models.model-cost-accounting-config */\n"]}
+{"version":3,"file":"model-cost-accounting-config.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/model-cost-accounting-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mCAAmC,EAAE,MAAM,yCAAyC,CAAC;AAC9F,OAAO,EAAE,2CAA2C,EAAE,MAAM,8BAA8B,CAAC;AAE3F,8EAA8E;AAC9E,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC;AAC5D,sHAAsH;AACtH,MAAM,CAAC,MAAM,oCAAoC,GAAG,YAAY,CAAC;AAEjE,4IAA4I;AAC5I,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,mGAAmG;IACnG,+BAA+B,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzF,2FAA2F;IAC3F,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,0CAA0C,CAAC;IACzG,+CAA+C;IAC/C,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC;CACzF,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC,IAAI,CAAC;QACH,2CAA2C,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,iCAAiC,CAAC,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnJ,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,sEAAsE","sourcesContent":["/**\n * # `modelCostAccounting`: how an application prices its model calls and closes its cost periods (#1598)\n *\n * A backend-authored configuration section. It is NOT on the shared (frontend-visible) configuration: the\n * rates an application registers are its negotiated acquisition costs, which is the firm's internal margin\n * data.\n *\n * - `providerUsagePricingAuthorities` — the application's price list. Registered by the application because\n *   rates are negotiated; the engine ships no catalogue (it would be wrong for every contract and go stale).\n *   A duplicate `pricingAuthorityRef@pricingAuthorityVersion` is refused when the configuration is parsed,\n *   which is at startup.\n * - `periodCloseGraceDays` — how long after a calendar month ends the period-close batch waits before\n *   writing that month's aggregates, so late rows (retries, a drain backlog) land first. Startup refuses a\n *   declared `OPERATIONAL_LOGS` period shorter than one month plus this grace: the close reads detail rows,\n *   and would otherwise read rows the retention sweep had already deleted.\n */\nimport { z } from 'zod';\n\nimport { ProviderUsagePricingAuthoritySchema } from './provider-usage-pricing.shared.schemas';\nimport { assertUniqueProviderUsagePricingAuthorities } from './provider-usage-cost.shared';\n\n/** Default grace after a month ends before its cost aggregates are closed. */\nexport const MODEL_COST_PERIOD_CLOSE_DEFAULT_GRACE_DAYS = 3;\n/** Default schedule of the period-close batch: daily at 02:17 UTC (it closes every period whose grace has passed). */\nexport const MODEL_COST_PERIOD_CLOSE_DEFAULT_CRON = '17 2 * * *';\n\n/** @wildo_source:part:start saas.models.model-cost-accounting-config facet:layer:shared facet:family:config facet:audience:app-developer */\nexport const ModelCostAccountingConfigSchema = z.object({\n  /** The application's registered model prices. Absent or empty: every call is recorded UNPRICED. */\n  providerUsagePricingAuthorities: z.array(ProviderUsagePricingAuthoritySchema).default([]),\n  /** Days after a calendar month (UTC) ends before its cost aggregates are written. 0–27. */\n  periodCloseGraceDays: z.number().int().min(0).max(27).default(MODEL_COST_PERIOD_CLOSE_DEFAULT_GRACE_DAYS),\n  /** Cron schedule of the period-close batch. */\n  periodCloseCronSchedule: z.string().min(1).default(MODEL_COST_PERIOD_CLOSE_DEFAULT_CRON),\n}).superRefine((config, context) => {\n  try {\n    assertUniqueProviderUsagePricingAuthorities(config.providerUsagePricingAuthorities);\n  } catch (error) {\n    context.addIssue({ code: 'custom', path: ['providerUsagePricingAuthorities'], message: error instanceof Error ? error.message : String(error) });\n  }\n});\nexport type ModelCostAccountingConfig = z.infer<typeof ModelCostAccountingConfigSchema>;\nexport type ModelCostAccountingConfigInput = z.input<typeof ModelCostAccountingConfigSchema>;\n/** @wildo_source:part:end saas.models.model-cost-accounting-config */\n"]}

package/dist/esm/external-providers/provider-address-lookup-contract.shared.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-address-lookup-contract.shared.types.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-address-lookup-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,wHAAwH;AAExH;;;;;;;GAOG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,iHAAiH;IACjH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,0BAA0B;IACzC,gCAAgC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oHAAoH;IACpH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,uHAAuH;IACvH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,oCAAoC,CAAC;IAC5D,0DAA0D;IAC1D,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,yGAAyG;IACzG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,8BAA8B,GAAG,IAAI,CAAC;IAC1D,iFAAiF;IACjF,QAAQ,IAAI,IAAI,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC7B;AAED,mFAAmF;AACnF,MAAM,WAAW,oCAAoC;IACnD,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,yFAAyF;AACzF,MAAM,WAAW,+BAA+B;IAC9C,yGAAyG;IACzG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,4BAA4B;IAC3C,iBAAiB,CAAC,OAAO,EAAE;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,6GAA6G;IAC7G,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,+BAA+B,EAAE,CAAC;IAC7E,kBAAkB,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9I,kHAAkH;IAClH,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAAC;CACxD;AACD,0EAA0E"}
+{"version":3,"file":"provider-address-lookup-contract.shared.types.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-address-lookup-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,wHAAwH;AAExH;;;;;;;GAOG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,iHAAiH;IACjH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,0BAA0B;IACzC,gCAAgC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oHAAoH;IACpH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,uHAAuH;IACvH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,oCAAoC,CAAC;IAC5D,0DAA0D;IAC1D,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,yGAAyG;IACzG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,8BAA8B,GAAG,IAAI,CAAC;IAC1D,iFAAiF;IACjF,QAAQ,IAAI,IAAI,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC7B;AAED,mFAAmF;AACnF,MAAM,WAAW,oCAAoC;IACnD,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,yFAAyF;AACzF,MAAM,WAAW,+BAA+B;IAC9C,yGAAyG;IACzG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,4BAA4B;IAC3C,iBAAiB,CAAC,OAAO,EAAE;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5B,6GAA6G;IAC7G,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,+BAA+B,EAAE,CAAC;IAC7E,kBAAkB,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,+BAA+B,CAAC;QAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9I,kHAAkH;IAClH,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAAC;CACxD;AACD,0EAA0E"}

package/dist/esm/external-providers/provider-address-lookup-contract.shared.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-address-lookup-contract.shared.types.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-address-lookup-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAqIH,0EAA0E","sourcesContent":["/**\n * The contract between a `FRONTEND_ADDRESS_LOOKUP` component and the address field that mounts it\n * (#1702, consumed by #561).\n *\n * ## Why it lives here, and why NOT on `public-runtime`\n *\n * It sits beside the file-picker contract (`provider-frontend-component-contract.shared.types.ts`) for\n * the reason that file gives: a component ships in its own React-bearing package, which must be able to\n * type itself without importing the connectors package that resolves it.\n *\n * Unlike that file it is exported from the package ROOT only. The value it hands back is the framework's\n * address value, `AddressValue` from `@wildo-ai/zod-decorators`, and the `public-runtime` closure may not\n * import that package at all — not even for a type (K-3, measured by `public-runtime.boundary.test.ts`).\n * Restating the address shape here to stay inside that closure was the rejected alternative: it would be\n * a second source for the one address vocabulary #1730 exists to make single. A type-only import is\n * erased from every bundle, so a component package importing these types from the root pays nothing.\n *\n * The DATA half — whether a component returns a vendor place id (never stored, #561 D3) — is\n * `ProviderAddressLookupPlaceIdRetention` on the component descriptor, which IS on `public-runtime`.\n */\n\nimport type { AddressValue } from '@wildo-ai/zod-decorators';\n\n/** @wildo_source:part:start saas.models.provider-address-lookup-contract facet:kind:api facet:audience:app-developer */\n\n/**\n * What an address lookup hands back for ONE chosen place.\n *\n * `address` is the application's own value: the person chose it, and it is stored exactly as a typed\n * address would be. `placeId` is the VENDOR's key for the place, present only when the component's\n * declared `placeIdRetention` allows one; the framework refuses a selection that carries a place id its\n * component declared it never returns, and never stores one (#561 D3).\n */\nexport interface ProviderAddressLookupSelection {\n  readonly address: AddressValue;\n  /** The vendor's identifier for the matched place. Opaque, usable for this interaction only, and never stored. */\n  readonly placeId?: string;\n}\n\n/**\n * The props every `FRONTEND_ADDRESS_LOOKUP` component receives.\n *\n * Deliberately narrow. The component suggests and resolves; the FIELD owns the value, its validation\n * (`z_address()` with its `countriesAllowed`) and its persistence. That split is what lets an address\n * field work with no lookup at all, which is why the capability fills no engine slot.\n *\n * ## The vendor is reached through `suggest` and `retrieve`, never directly (#561 D2)\n *\n * The framework's host binds both to the operations the component's descriptor declares\n * (`addressLookup.suggestOperationId` / `retrieveOperationId`) and runs them through the application\n * backend's provider-operation door. The host also writes the vendor session token into each input when the\n * descriptor names `sessionTokenInput` (#561 D4) — a component never generates, holds or rotates one. Each\n * resolves to the operation's parsed output, and rejects with the door's error (a refusal, a throttle, a\n * vendor timeout); a component reports that through `onError` and the field stays usable by hand.\n */\nexport interface ProviderAddressLookupProps {\n  /** The provider's own `ref`. */\n  readonly providerRef: string;\n  /** The provider's public configuration, already validated against its `publicConfigSchema` when it declares one. */\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n  /**\n   * ISO 3166-1 alpha-2 codes the field accepts (`z_address({ countriesAllowed })`). A component should\n   * restrict its suggestions to them; the field still validates whatever comes back.\n   */\n  readonly countriesAllowed?: readonly string[];\n  /** The field's default country, a hint for ranking suggestions. */\n  readonly defaultCountry?: string;\n  /** The person's language (BCP 47), so suggestions and the retrieved address are spelled in it where the vendor can. */\n  readonly languageCode: string;\n  /** True while the field is disabled or read-only: the component offers no search then. */\n  readonly disabled: boolean;\n  /**\n   * The search control's form NAME. The host renders the control's visible label (from the application's\n   * labels) for the element whose id is `field-<name>` — the id every engine form control takes — so the\n   * component puts that id on its focusable control and invents no label text of its own.\n   */\n  readonly name: string;\n  /**\n   * The vendor's required attribution (#561 D4), from the descriptor's `attributionMark`, or absent when the vendor\n   * requires none. `mark` is the vendor's text, verbatim; `accessibleLabel` is a sentence from the application's\n   * labels naming it, for assistive technology.\n   *\n   * The component shows it INSIDE the container that shows its suggestions, whenever suggestions are shown — the\n   * placement Google requires (\"within the same visual container\" as the content). Render it with\n   * `ProviderAddressLookupAttribution` (`@wildo-ai/saas-frontend-lib`), which applies the vendor's text rules\n   * (untranslated, on one line, in a permitted colour); the framework's own lookup combobox does.\n   * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — text attribution rules,\n   * fetched 2026-09-29.\n   */\n  readonly attribution?: ProviderAddressLookupAttributionText;\n  /** Run the declared SUGGEST operation with this input. */\n  suggest(input: Readonly<Record<string, unknown>>): Promise<unknown>;\n  /** Run the declared RETRIEVE operation with this input. Ends the vendor session, whatever it answers. */\n  retrieve(input: Readonly<Record<string, unknown>>): Promise<unknown>;\n  /** The person chose a place. Called at most once per interaction. */\n  onSelect(selection: ProviderAddressLookupSelection): void;\n  /** The person dismissed the lookup without choosing. Ends the vendor session. */\n  onCancel(): void;\n  /**\n   * The lookup could not run — the door refused it, the vendor timed out or answered a shape the adapter\n   * cannot read. Reported rather than thrown, for the reason the file-picker contract gives: a throw inside\n   * a component's own event handler reaches no React error boundary.\n   */\n  onError(error: Error): void;\n}\n\n/** A vendor's required attribution, as the host hands it to a lookup component. */\nexport interface ProviderAddressLookupAttributionText {\n  /** The vendor's own attribution text, never translated or restyled (\"Google Maps\"). */\n  readonly mark: string;\n  /** A sentence from the application's labels that names the mark, for assistive technology. */\n  readonly accessibleLabel: string;\n}\n\n/** One suggestion, as a person reads it. Vendor text, never derived by the framework. */\nexport interface ProviderAddressLookupSuggestion {\n  /** The vendor's handle for the suggestion, passed back to `buildRetrieveInput`. Opaque; never stored. */\n  readonly id: string;\n  /** The line a person recognises the place by (the street address). */\n  readonly primaryText: string;\n  /** The line that disambiguates it (town, region, country), when the vendor gives one. */\n  readonly secondaryText?: string;\n}\n\n/**\n * Everything VENDOR-SPECIFIC about an address lookup, as four pure functions: how a query becomes the\n * suggest operation's input, how its answer becomes suggestions, how a chosen suggestion becomes the retrieve\n * operation's input, and how that answer becomes the framework's `AddressValue`.\n *\n * With it, the framework's own combobox (`ProviderAddressLookupCombobox` in `@wildo-ai/saas-frontend-lib`)\n * is a complete lookup component: the keyboard pattern, the debounce, the minimum query length, stale-answer\n * handling and the manual-entry fallback are written once rather than once per vendor. A provider whose\n * lookup needs its own UI implements `ProviderAddressLookupProps` directly instead.\n *\n * `readAddress` returns TEXT parts only: a vendor geocode is never taken (#561 D3). A stored coordinate has no\n * expiry, while a lookup's geocode is at best storable for a limited time (Google: 30 days) or not at all (Mapbox\n * Search Box) — #561's 2026-09-14 reading of both vendors' terms — and nothing runs the vendor's clock. The\n * field drops coordinates anyway.\n */\nexport interface ProviderAddressLookupAdapter {\n  buildSuggestInput(request: {\n    readonly query: string;\n    readonly countriesAllowed?: readonly string[];\n    readonly defaultCountry?: string;\n    readonly languageCode: string;\n  }): Record<string, unknown>;\n  /** Never throws on a well-formed but empty answer; returns `[]`. Throws only on an answer it cannot read. */\n  readSuggestions(output: unknown): readonly ProviderAddressLookupSuggestion[];\n  buildRetrieveInput(request: { readonly suggestion: ProviderAddressLookupSuggestion; readonly languageCode: string }): Record<string, unknown>;\n  /** `undefined` when the vendor answered with no postal address for the place (a place with no street address). */\n  readAddress(output: unknown): AddressValue | undefined;\n}\n/** @wildo_source:part:end saas.models.provider-address-lookup-contract */\n"]}
+{"version":3,"file":"provider-address-lookup-contract.shared.types.js","sourceRoot":"","sources":["../../../src/external-providers/provider-address-lookup-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAqIH,0EAA0E","sourcesContent":["/**\n * The contract between a `FRONTEND_ADDRESS_LOOKUP` component and the address field that mounts it\n * (#1702, consumed by #561).\n *\n * ## Why it lives here, and why NOT on `public-runtime`\n *\n * It sits beside the file-picker contract (`provider-frontend-component-contract.shared.types.ts`) for\n * the reason that file gives: a component ships in its own React-bearing package, which must be able to\n * type itself without importing the connectors package that resolves it.\n *\n * Unlike that file it is exported from the package ROOT only. The value it hands back is the framework's\n * address value, `AddressValue` from `@wildo-ai/zod-decorators`, and the `public-runtime` closure may not\n * import that package at all — not even for a type (K-3, measured by `public-runtime.boundary.test.ts`).\n * Restating the address shape here to stay inside that closure was the rejected alternative: it would be\n * a second source for the one address vocabulary #1730 exists to make single. A type-only import is\n * erased from every bundle, so a component package importing these types from the root pays nothing.\n *\n * The DATA half — whether a component returns a vendor place id (never stored, #561 D3) — is\n * `ProviderAddressLookupPlaceIdRetention` on the component descriptor, which IS on `public-runtime`.\n */\n\nimport type { AddressValue } from '@wildo-ai/zod-decorators';\n\n/** @wildo_source:part:start saas.models.provider-address-lookup-contract facet:kind:api facet:audience:app-developer */\n\n/**\n * What an address lookup hands back for ONE chosen place.\n *\n * `address` is the application's own value: the person chose it, and it is stored exactly as a typed\n * address would be. `placeId` is the VENDOR's key for the place, present only when the component's\n * declared `placeIdRetention` allows one; the framework refuses a selection that carries a place id its\n * component declared it never returns, and never stores one (#561 D3).\n */\nexport interface ProviderAddressLookupSelection {\n  readonly address: AddressValue;\n  /** The vendor's identifier for the matched place. Opaque, usable for this interaction only, and never stored. */\n  readonly placeId?: string;\n}\n\n/**\n * The props every `FRONTEND_ADDRESS_LOOKUP` component receives.\n *\n * Deliberately narrow. The component suggests and resolves; the FIELD owns the value, its validation\n * (`z_address()` with its `countriesAllowed`) and its persistence. That split is what lets an address\n * field work with no lookup at all, which is why the capability fills no engine slot.\n *\n * ## The vendor is reached through `suggest` and `retrieve`, never directly (#561 D2)\n *\n * The framework's host binds both to the operations the component's descriptor declares\n * (`addressLookup.suggestOperationId` / `retrieveOperationId`) and runs them through the application\n * backend's provider-operation door. The host also writes the vendor session token into each input when the\n * descriptor names `sessionTokenInput` (#561 D4) — a component never generates, holds or rotates one. Each\n * resolves to the operation's parsed output, and rejects with the door's error (a refusal, a throttle, a\n * vendor timeout); a component reports that through `onError` and the field stays usable by hand.\n */\nexport interface ProviderAddressLookupProps {\n  /** The provider's own `ref`. */\n  readonly providerRef: string;\n  /** The provider's public configuration, already validated against its `publicConfigSchema` when it declares one. */\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n  /**\n   * ISO 3166-1 alpha-2 codes the field accepts (`z_address({ countriesAllowed })`). A component should\n   * restrict its suggestions to them; the field still validates whatever comes back.\n   */\n  readonly countriesAllowed?: readonly string[];\n  /** The field's default country, a hint for ranking suggestions. */\n  readonly defaultCountry?: string;\n  /** The person's language (BCP 47), so suggestions and the retrieved address are spelled in it where the vendor can. */\n  readonly languageCode: string;\n  /** True while the field is disabled or read-only: the component offers no search then. */\n  readonly disabled: boolean;\n  /**\n   * The search control's form NAME. The host renders the control's visible label (from the application's\n   * labels) for the element whose id is `field-<name>` — the id every engine form control takes — so the\n   * component puts that id on its focusable control and invents no label text of its own.\n   */\n  readonly name: string;\n  /**\n   * The vendor's required attribution (#561 D4), from the descriptor's `attributionMark`, or absent when the vendor\n   * requires none. `mark` is the vendor's text, verbatim; `accessibleLabel` is a sentence from the application's\n   * labels naming it, for assistive technology.\n   *\n   * The component shows it INSIDE the container that shows its suggestions, whenever suggestions are shown — the\n   * placement Google requires (\"within the same visual container\" as the content). Render it with\n   * `ProviderAddressLookupAttribution` (`@wildo-ai/saas-frontend-lib`), which applies the vendor's text rules\n   * (untranslated, on one line, in a permitted colour); the framework's own lookup combobox does.\n   * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — text attribution rules,\n   * fetched 2026-09-29.\n   */\n  readonly attribution?: ProviderAddressLookupAttributionText;\n  /** Run the declared SUGGEST operation with this input. */\n  suggest(input: Readonly<Record<string, unknown>>): Promise<unknown>;\n  /** Run the declared RETRIEVE operation with this input. Ends the vendor session, whatever it answers. */\n  retrieve(input: Readonly<Record<string, unknown>>): Promise<unknown>;\n  /** The person chose a place. Called at most once per interaction. */\n  onSelect(selection: ProviderAddressLookupSelection): void;\n  /** The person dismissed the lookup without choosing. Ends the vendor session. */\n  onCancel(): void;\n  /**\n   * The lookup could not run — the door refused it, the vendor timed out or answered a shape the adapter\n   * cannot read. Reported rather than thrown, for the reason the file-picker contract gives: a throw inside\n   * a component's own event handler reaches no React error boundary.\n   */\n  onError(error: Error): void;\n}\n\n/** A vendor's required attribution, as the host hands it to a lookup component. */\nexport interface ProviderAddressLookupAttributionText {\n  /** The vendor's own attribution text, never translated or restyled (\"Google Maps\"). */\n  readonly mark: string;\n  /** A sentence from the application's labels that names the mark, for assistive technology. */\n  readonly accessibleLabel: string;\n}\n\n/** One suggestion, as a person reads it. Vendor text, never derived by the framework. */\nexport interface ProviderAddressLookupSuggestion {\n  /** The vendor's handle for the suggestion, passed back to `buildRetrieveInput`. Opaque; never stored. */\n  readonly id: string;\n  /** The line a person recognises the place by (the street address). */\n  readonly primaryText: string;\n  /** The line that disambiguates it (town, region, country), when the vendor gives one. */\n  readonly secondaryText?: string;\n}\n\n/**\n * Everything VENDOR-SPECIFIC about an address lookup, as four pure functions: how a query becomes the\n * suggest operation's input, how its answer becomes suggestions, how a chosen suggestion becomes the retrieve\n * operation's input, and how that answer becomes the framework's `AddressValue`.\n *\n * With it, the framework's own combobox (`ProviderAddressLookupCombobox` in `@wildo-ai/saas-frontend-lib`)\n * is a complete lookup component: the keyboard pattern, the debounce, the minimum query length, stale-answer\n * handling and the manual-entry fallback are written once rather than once per vendor. A provider whose\n * lookup needs its own UI implements `ProviderAddressLookupProps` directly instead.\n *\n * `readAddress` returns TEXT parts only: a vendor geocode is never taken (#561 D3). A stored coordinate has no\n * expiry, while a lookup's geocode is at best storable for a limited time (Google: 30 days) or not at all (Mapbox\n * Search Box) — #561's 2026-09-14 reading of both vendors' terms — and nothing runs the vendor's clock. The\n * field drops coordinates anyway.\n */\nexport interface ProviderAddressLookupAdapter {\n  buildSuggestInput(request: {\n    readonly query: string;\n    readonly countriesAllowed?: readonly string[];\n    readonly defaultCountry?: string;\n    readonly languageCode: string;\n  }): Record<string, unknown>;\n  /** Never throws on a well-formed but empty answer; returns `[]`. Throws only on an answer it cannot read. */\n  readSuggestions(output: unknown): readonly ProviderAddressLookupSuggestion[];\n  buildRetrieveInput(request: { readonly suggestion: ProviderAddressLookupSuggestion; readonly languageCode: string }): Record<string, unknown>;\n  /** `undefined` when the vendor answered with no postal address for the place (a place with no street address). */\n  readAddress(output: unknown): AddressValue | undefined;\n}\n/** @wildo_source:part:end saas.models.provider-address-lookup-contract */\n"]}

package/dist/esm/external-providers/provider-augmentation-opt-ins.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-augmentation-opt-ins.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-augmentation-opt-ins.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gJAAgJ;AAChJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,gCAAgC,mDAW5C,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,iEAAiE"}
+{"version":3,"file":"provider-augmentation-opt-ins.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-augmentation-opt-ins.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gJAAgJ;AAChJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,gCAAgC,mDAW5C,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,iEAAiE"}

package/dist/esm/external-providers/provider-augmentation-opt-ins.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-augmentation-opt-ins.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-augmentation-opt-ins.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gJAAgJ;AAChJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,WAAW,uCAAuC,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxB,CAAC;AACH,CAAC,CAAC,CACH,CAAC;AAEF,iEAAiE","sourcesContent":["import { z } from 'zod';\n\n/** @wildo_source:part:start saas.config.providers.augmentations facet:layer:shared facet:family:provider-config facet:audience:app-developer */\n/**\n * Which provider AUGMENTATIONS this application admits (#1672): `baseRef` → the packages allowed to add\n * operations to that provider.\n *\n * ```ts\n * providers: {\n *   scopes: { backend: { providers: { 'acme-crm': { protocols: ['REST_API'] } } } },\n *   augmentations: { 'acme-crm': ['@acme/provider-crm-chat'] },\n * }\n * ```\n *\n * The base provider must declare a `REST_API` binding, and the package must be one discovery walks: a\n * framework provider package, a provider package in the application's own scope\n * (`<application-scope>/provider-*`), or a package listed in `providers.packages`.\n *\n * ## Why an augmentation needs an opt-in at all\n *\n * An augmentation adds operations to a provider it does not own, and those operations run with the BASE\n * provider's credential — for a delegated connection, a person's own grant. Admitting one is therefore a\n * trust decision about third-party code spending a grant, of the same kind as `connections`, and it is the\n * application's to make. Installing a package decides nothing: a package that is a dependency and is not\n * named here contributes no operation. That is also what keeps a provider package that augments many\n * engine-owned refs (`stripe`, `openai`…) inert until an application asks for one of them.\n *\n * ## Why application-level rather than per runtime scope\n *\n * An augmented provider has ONE operation catalogue per grant, whichever runtime spends it. Opting a package\n * in for the backend and not for a minion would give one grant two operation sets, and an operation id\n * would mean a request in one process and nothing in another. The augmentation applies wherever the base\n * provider is scoped.\n *\n * `wildo config sync` refuses a package it did not discover, a package that does not augment this ref, a\n * ref no scope declares, a base with no REST binding, and two opted-in packages sharing an operation id.\n *\n * Absent means none — never \"every installed augmentation\".\n */\nexport const ProviderAugmentationOptInsSchema = z.record(\n  z.string().min(1),\n  z.array(z.string().min(1)).min(1).superRefine((packageNames, ctx) => {\n    const seen = new Set<string>();\n    for (const [index, packageName] of packageNames.entries()) {\n      if (seen.has(packageName)) {\n        ctx.addIssue({ code: 'custom', path: [index], message: `\"${packageName}\" is opted in twice for one provider.` });\n      }\n      seen.add(packageName);\n    }\n  }),\n);\nexport type ProviderAugmentationOptIns = z.infer<typeof ProviderAugmentationOptInsSchema>;\n/** @wildo_source:part:end saas.config.providers.augmentations */\n"]}
+{"version":3,"file":"provider-augmentation-opt-ins.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-augmentation-opt-ins.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gJAAgJ;AAChJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,WAAW,uCAAuC,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACxB,CAAC;AACH,CAAC,CAAC,CACH,CAAC;AAEF,iEAAiE","sourcesContent":["import { z } from 'zod';\n\n/** @wildo_source:part:start saas.config.providers.augmentations facet:layer:shared facet:family:provider-config facet:audience:app-developer */\n/**\n * Which provider AUGMENTATIONS this application admits (#1672): `baseRef` → the packages allowed to add\n * operations to that provider.\n *\n * ```ts\n * providers: {\n *   scopes: { backend: { providers: { 'acme-crm': { protocols: ['REST_API'] } } } },\n *   augmentations: { 'acme-crm': ['@acme/provider-crm-chat'] },\n * }\n * ```\n *\n * The base provider must declare a `REST_API` binding, and the package must be one discovery walks: a\n * framework provider package, a provider package in the application's own scope\n * (`<application-scope>/provider-*`), or a package listed in `providers.packages`.\n *\n * ## Why an augmentation needs an opt-in at all\n *\n * An augmentation adds operations to a provider it does not own, and those operations run with the BASE\n * provider's credential — for a delegated connection, a person's own grant. Admitting one is therefore a\n * trust decision about third-party code spending a grant, of the same kind as `connections`, and it is the\n * application's to make. Installing a package decides nothing: a package that is a dependency and is not\n * named here contributes no operation. That is also what keeps a provider package that augments many\n * engine-owned refs (`stripe`, `openai`…) inert until an application asks for one of them.\n *\n * ## Why application-level rather than per runtime scope\n *\n * An augmented provider has ONE operation catalogue per grant, whichever runtime spends it. Opting a package\n * in for the backend and not for a minion would give one grant two operation sets, and an operation id\n * would mean a request in one process and nothing in another. The augmentation applies wherever the base\n * provider is scoped.\n *\n * `wildo config sync` refuses a package it did not discover, a package that does not augment this ref, a\n * ref no scope declares, a base with no REST binding, and two opted-in packages sharing an operation id.\n *\n * Absent means none — never \"every installed augmentation\".\n */\nexport const ProviderAugmentationOptInsSchema = z.record(\n  z.string().min(1),\n  z.array(z.string().min(1)).min(1).superRefine((packageNames, ctx) => {\n    const seen = new Set<string>();\n    for (const [index, packageName] of packageNames.entries()) {\n      if (seen.has(packageName)) {\n        ctx.addIssue({ code: 'custom', path: [index], message: `\"${packageName}\" is opted in twice for one provider.` });\n      }\n      seen.add(packageName);\n    }\n  }),\n);\nexport type ProviderAugmentationOptIns = z.infer<typeof ProviderAugmentationOptInsSchema>;\n/** @wildo_source:part:end saas.config.providers.augmentations */\n"]}

package/dist/esm/external-providers/provider-authentication-assurance.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-authentication-assurance.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-authentication-assurance.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yFAAyF;AACzF,oBAAY,4BAA4B;IACtC,IAAI,SAAS;IACb,MAAM,WAAW;CAClB;AAED,mGAAmG;AACnG,oBAAY,yBAAyB;IACnC,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,YAAY,iBAAiB;IAC7B,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AACD,oBAAY,uBAAuB;IACjC,mBAAmB,wBAAwB;IAC3C,qBAAqB,0BAA0B;IAC/C,WAAW,gBAAgB;IAC3B,gBAAgB,qBAAqB;IACrC,qBAAqB,0BAA0B;IAC/C,2BAA2B,gCAAgC;CAC5D;AAED,oFAAoF;AACpF,eAAO,MAAM,iCAAiC;;;;iBAI5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}
+{"version":3,"file":"provider-authentication-assurance.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-authentication-assurance.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yFAAyF;AACzF,oBAAY,4BAA4B;IACtC,IAAI,SAAS;IACb,MAAM,WAAW;CAClB;AAED,mGAAmG;AACnG,oBAAY,yBAAyB;IACnC,YAAY,iBAAiB;IAC7B,SAAS,cAAc;IACvB,YAAY,iBAAiB;IAC7B,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AACD,oBAAY,uBAAuB;IACjC,mBAAmB,wBAAwB;IAC3C,qBAAqB,0BAA0B;IAC/C,WAAW,gBAAgB;IAC3B,gBAAgB,qBAAqB;IACrC,qBAAqB,0BAA0B;IAC/C,2BAA2B,gCAAgC;CAC5D;AAED,oFAAoF;AACpF,eAAO,MAAM,iCAAiC;;;;iBAI5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC"}

package/dist/esm/external-providers/provider-authentication-assurance.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-authentication-assurance.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-authentication-assurance.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yFAAyF;AACzF,MAAM,CAAN,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IACtC,6CAAa,CAAA;IACb,iDAAiB,CAAA;AACnB,CAAC,EAHW,4BAA4B,KAA5B,4BAA4B,QAGvC;AAED,mGAAmG;AACnG,MAAM,CAAN,IAAY,yBAMX;AAND,WAAY,yBAAyB;IACnC,0DAA6B,CAAA;IAC7B,oDAAuB,CAAA;IACvB,0DAA6B,CAAA;IAC7B,8CAAiB,CAAA;IACjB,gDAAmB,CAAA;AACrB,CAAC,EANW,yBAAyB,KAAzB,yBAAyB,QAMpC;AACD,MAAM,CAAN,IAAY,uBAOX;AAPD,WAAY,uBAAuB;IACjC,sEAA2C,CAAA;IAC3C,0EAA+C,CAAA;IAC/C,sDAA2B,CAAA;IAC3B,gEAAqC,CAAA;IACrC,0EAA+C,CAAA;IAC/C,sFAA2D,CAAA;AAC7D,CAAC,EAPW,uBAAuB,KAAvB,uBAAuB,QAOlC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;CAClD,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/** Policy for an otherwise valid external login that cannot demonstrate required MFA. */\nexport enum ExternalAssuranceEnforcement {\n  WARN = 'warn',\n  STRICT = 'strict',\n}\n\n/** Do not collapse contractual delegation, measured MFA and warning admission into one boolean. */\nexport enum ExternalAssuranceDecision {\n  NOT_REQUIRED = 'not_required',\n  DELEGATED = 'delegated',\n  VERIFIED_MFA = 'verified_mfa',\n  WARNED = 'warned',\n  REFUSED = 'refused',\n}\nexport enum ExternalAssuranceReason {\n  POLICY_NOT_REQUIRED = 'policy_not_required',\n  ENTERPRISE_DELEGATION = 'enterprise_delegation',\n  SESSION_MFA = 'session_mfa',\n  EVIDENCE_MISSING = 'evidence_missing',\n  EVIDENCE_INSUFFICIENT = 'evidence_insufficient',\n  METHOD_REQUIREMENT_UNPROVEN = 'method_requirement_unproven',\n}\n\n/** Safe decision summary: no upstream token, raw claims, nonce, or user profile. */\nexport const ExternalAssuranceAssessmentSchema = z.object({\n  decision: z.enum(ExternalAssuranceDecision),\n  reason: z.enum(ExternalAssuranceReason),\n  enforcement: z.enum(ExternalAssuranceEnforcement),\n});\nexport type ExternalAssuranceAssessment = z.infer<typeof ExternalAssuranceAssessmentSchema>;\n"]}
+{"version":3,"file":"provider-authentication-assurance.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-authentication-assurance.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yFAAyF;AACzF,MAAM,CAAN,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IACtC,6CAAa,CAAA;IACb,iDAAiB,CAAA;AACnB,CAAC,EAHW,4BAA4B,KAA5B,4BAA4B,QAGvC;AAED,mGAAmG;AACnG,MAAM,CAAN,IAAY,yBAMX;AAND,WAAY,yBAAyB;IACnC,0DAA6B,CAAA;IAC7B,oDAAuB,CAAA;IACvB,0DAA6B,CAAA;IAC7B,8CAAiB,CAAA;IACjB,gDAAmB,CAAA;AACrB,CAAC,EANW,yBAAyB,KAAzB,yBAAyB,QAMpC;AACD,MAAM,CAAN,IAAY,uBAOX;AAPD,WAAY,uBAAuB;IACjC,sEAA2C,CAAA;IAC3C,0EAA+C,CAAA;IAC/C,sDAA2B,CAAA;IAC3B,gEAAqC,CAAA;IACrC,0EAA+C,CAAA;IAC/C,sFAA2D,CAAA;AAC7D,CAAC,EAPW,uBAAuB,KAAvB,uBAAuB,QAOlC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;CAClD,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\n/** Policy for an otherwise valid external login that cannot demonstrate required MFA. */\nexport enum ExternalAssuranceEnforcement {\n  WARN = 'warn',\n  STRICT = 'strict',\n}\n\n/** Do not collapse contractual delegation, measured MFA and warning admission into one boolean. */\nexport enum ExternalAssuranceDecision {\n  NOT_REQUIRED = 'not_required',\n  DELEGATED = 'delegated',\n  VERIFIED_MFA = 'verified_mfa',\n  WARNED = 'warned',\n  REFUSED = 'refused',\n}\nexport enum ExternalAssuranceReason {\n  POLICY_NOT_REQUIRED = 'policy_not_required',\n  ENTERPRISE_DELEGATION = 'enterprise_delegation',\n  SESSION_MFA = 'session_mfa',\n  EVIDENCE_MISSING = 'evidence_missing',\n  EVIDENCE_INSUFFICIENT = 'evidence_insufficient',\n  METHOD_REQUIREMENT_UNPROVEN = 'method_requirement_unproven',\n}\n\n/** Safe decision summary: no upstream token, raw claims, nonce, or user profile. */\nexport const ExternalAssuranceAssessmentSchema = z.object({\n  decision: z.enum(ExternalAssuranceDecision),\n  reason: z.enum(ExternalAssuranceReason),\n  enforcement: z.enum(ExternalAssuranceEnforcement),\n});\nexport type ExternalAssuranceAssessment = z.infer<typeof ExternalAssuranceAssessmentSchema>;\n"]}

package/dist/esm/external-providers/provider-browser-operations.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-browser-operations.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-browser-operations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,sCAAsC,EAEvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgC,KAAK,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEnH,kJAAkJ;AAClJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;kBAiC/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;GAOG;AACH,eAAO,MAAM,oDAAoD,EAAE,sBAGjE,CAAC;AAEH,8HAA8H;AAC9H,oBAAY,6CAA6C;IACvD,gEAAgE;IAChE,QAAQ,aAAa;IACrB,6DAA6D;IAC7D,iBAAiB,sBAAsB;CACxC;AAED,oGAAoG;AACpG,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,IAAI,CAAC,8BAA8B,EAAE,iBAAiB,CAAC,GAAG;IAC/H,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,6CAA6C,CAAC;CAChE,CAIA;AAED;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;qBAG9B,CAAC;AACtB,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AACtG,4EAA4E"}
+{"version":3,"file":"provider-browser-operations.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-browser-operations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,sCAAsC,EAEvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgC,KAAK,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEnH,kJAAkJ;AAClJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;kBAiC/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;GAOG;AACH,eAAO,MAAM,oDAAoD,EAAE,sBAGjE,CAAC;AAEH,8HAA8H;AAC9H,oBAAY,6CAA6C;IACvD,gEAAgE;IAChE,QAAQ,aAAa;IACrB,6DAA6D;IAC7D,iBAAiB,sBAAsB;CACxC;AAED,oGAAoG;AACpG,wBAAgB,8CAA8C,CAAC,MAAM,EAAE,IAAI,CAAC,8BAA8B,EAAE,iBAAiB,CAAC,GAAG;IAC/H,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,6CAA6C,CAAC;CAChE,CAIA;AAED;;;;;GAKG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;qBAG9B,CAAC;AACtB,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AACtG,4EAA4E"}

package/dist/esm/external-providers/provider-browser-operations.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-browser-operations.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-browser-operations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAA+B,MAAM,wCAAwC,CAAC;AAEnH,kJAAkJ;AAClJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,eAAe,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,wBAAwB,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CACtD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CACnF,CAAC;IACF,oHAAoH;IACpH,oGAAoG;IACpG,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS;WAClB,KAAK,CAAC,iBAAiB,KAAK,SAAS;WACrC,KAAK,CAAC,eAAe,KAAK,SAAS;WACnC,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EACL,qGAAqG;kBACnG,0GAA0G;SAC/G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,wBAAwB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EACL,6GAA6G;kBAC3G,sFAAsF;SAC3F,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAA2B,MAAM,CAAC,MAAM,CAAC;IACxG,iBAAiB,EAAE,EAAE;IACrB,eAAe,EAAE,IAAI;CACtB,CAAC,CAAC;AAEH,8HAA8H;AAC9H,MAAM,CAAN,IAAY,6CAKX;AALD,WAAY,6CAA6C;IACvD,gEAAgE;IAChE,sEAAqB,CAAA;IACrB,6DAA6D;IAC7D,wFAAuC,CAAA;AACzC,CAAC,EALW,6CAA6C,KAA7C,6CAA6C,QAKxD;AAED,oGAAoG;AACpG,MAAM,UAAU,8CAA8C,CAAC,MAA+D;IAI5H,OAAO,MAAM,CAAC,eAAe,KAAK,SAAS;QACzC,CAAC,CAAC,EAAE,KAAK,EAAE,oDAAoD,EAAE,MAAM,EAAE,6CAA6C,CAAC,iBAAiB,EAAE;QAC1I,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,6CAA6C,CAAC,QAAQ,EAAE,CAAC;AACxG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAClE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtB,4EAA4E","sourcesContent":["/**\n * WHICH provider operations a signed-in person's browser may trigger — the application's decision (#367).\n *\n * ## The question this answers, and why nothing else did\n *\n * A provider operation runs on the backend, through `ProviderOperationExecutorBackendService`, because\n * the credential it spends must never travel to a browser. A custom backend service reaches it through\n * a generated typed client. A custom FRONTEND component had no way to reach it at all, and the door\n * that gives it one has to answer a question no existing engine surface answers: *which operations may\n * a browser trigger, for whom, and on whose account*.\n *\n * The answer is a DECLARATION, authored in the application's SaaS config beside `providers.connections`\n * and with the same standing: both are the application's decisions about providers, as opposed to what\n * a vendor's catalogue says it can support.\n *\n * ## Fail closed, by construction\n *\n * An operation absent from this map is NOT reachable from a browser. There is no default, no\n * \"READ operations are fine\" shortcut — classification is not sufficient: a READ still spends a tenant's\n * credential, can page a vendor's whole account, and returns whatever the vendor holds. The map is the\n * only thing that opens the door, one operation at a time.\n *\n * ## Rejected: a flag on the operation in the provider catalogue\n *\n * The catalogue is generated from third-party sources and overwritten on every regeneration, and it\n * describes the VENDOR. Letting it decide what a browser may trigger would let a scraped listing grant\n * access in every application that installs the provider — and a regeneration could grant or revoke it\n * without anyone opening the application.\n */\n\nimport {\n  ExternalProvider_Connection_OwnerScope,\n  ExternalProvider_ConnectionShapeSchema,\n} from '@wildo-ai/external-connectors-models';\nimport { z } from 'zod';\nimport { RateLimitConfigurationSchema, type RateLimitConfiguration } from '../requests/rate-limits.shared.schemas';\n\n/** @wildo_source:part:start saas.models.providers.browser-operation-policy facet:layer:shared facet:family:config facet:audience:app-developer */\n/**\n * One browser-reachable operation.\n *\n * ## `connections` — whose account a browser-triggered call may spend\n *\n * Owner-scope × delegation pairs, in the vocabulary the catalogue, `providers.connections`, the connect\n * leg and the resolver already share. NARROWING ONLY: a call must satisfy this list AND the provider's\n * admissible connections as `providers.connections` narrows them. Naming a shape the provider does not\n * admit grants nothing.\n *\n * Every call still passes the target-authorization port before anything is spent — a person may name\n * only an organization they belong to organization-wide, and only their own user account. This list\n * narrows further; it can never widen what that port allows.\n *\n * ## `allowedRoles` — who may trigger it\n *\n * Role keys, resolved through the LIVE role hierarchy (a custom role inheriting from a listed one\n * qualifies), and read in the scope of the ACCOUNT BEING SPENT:\n *\n * | target | roles are read from |\n * |---|---|\n * | `organization` | the caller's organization-WIDE roles in THAT organization — a unit-scoped grant never counts |\n * | `application` | the caller's application roles |\n * | `user` | not applicable — a person acting on their own account holds no role over it, so declaring roles on a policy that admits `user` refuses those calls |\n *\n * Absent means any signed-in caller the target-authorization port admits. That is a legitimate choice\n * for a person's own account or a member acting for their own tenant, and it is REFUSED at parse time\n * when the policy admits an `application`-owned connection: without roles, every signed-in person could\n * spend the application's own vendor account.\n *\n * ## `callerRateLimit` — how often ONE person may trigger it (#561)\n *\n * Counted per signed-in person, per provider operation. Before it, the door's only limits were a\n * per-provider window (off unless a provider declared one) and the IP-keyed perimeter limiter, so one\n * person's typing into an address lookup could spend a vendor allowance the whole application shares.\n *\n * Absent does NOT mean unlimited: the framework applies\n * {@link DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT}, generous enough for a person typing into a\n * lookup. The two differ in one way that matters, and it is the same split the rest of the engine draws\n * between an authored and a default limit: a DECLARED limit fails CLOSED when the limiter's store is\n * unavailable (the application stated it, so an outage must not quietly lift it), while the framework\n * default fails OPEN (nobody declared it, so it must never be why a door stops working).\n */\nexport const ProviderBrowserOperationPolicySchema = z.strictObject({\n  connections: z.array(ExternalProvider_ConnectionShapeSchema).min(1),\n  allowedRoles: z.array(z.string().trim().min(1)).min(1).optional(),\n  callerRateLimit: RateLimitConfigurationSchema.optional(),\n}).superRefine((policy, ctx) => {\n  const admitsApplicationAccount = policy.connections.some(\n    (shape) => shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION,\n  );\n  // A declared limit with no window counts nothing, yet reads as DECLARED — the framework default is then not applied\n  // either. A control that looks enforced and enforces nothing is refused where it is written (#561).\n  const limit = policy.callerRateLimit;\n  if (limit !== undefined\n    && limit.requestsPerMinute === undefined\n    && limit.requestsPerHour === undefined\n    && limit.requestsPerDay === undefined\n    && (limit.customWindows === undefined || limit.customWindows.length === 0)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['callerRateLimit'],\n      message:\n        '`callerRateLimit` declares no window, so it would count nothing and replace the framework default. '\n        + 'Declare at least one of requestsPerMinute, requestsPerHour, requestsPerDay or customWindows, or omit it.',\n    });\n  }\n  if (admitsApplicationAccount && policy.allowedRoles === undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['allowedRoles'],\n      message:\n        'A browser-reachable operation that may spend the APPLICATION-owned connection must declare `allowedRoles`. '\n        + 'Without it every signed-in person could spend the application\\'s own vendor account.',\n    });\n  }\n});\nexport type ProviderBrowserOperationPolicy = z.infer<typeof ProviderBrowserOperationPolicySchema>;\n\n/**\n * The per-person limit a browser-reachable operation gets when its policy declares none (#561).\n *\n * Sized for the most frequent legitimate caller, a person typing into an address lookup: suggestions start at\n * three characters and are debounced, so one address is a handful of calls, and sixty a minute is a person\n * typing without pause. The hourly window is what stops a script holding a session from draining a vendor\n * allowance at a steady sixty a minute.\n */\nexport const DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT: RateLimitConfiguration = Object.freeze({\n  requestsPerMinute: 60,\n  requestsPerHour: 1000,\n});\n\n/** Where the limit a browser-triggered call is counted against came from — and so how an outage of the limiter is treated. */\nexport enum ProviderBrowserOperationCallerRateLimitSource {\n  /** Declared on the policy: fails CLOSED on a limiter outage. */\n  DECLARED = 'DECLARED',\n  /** The framework default: fails OPEN on a limiter outage. */\n  FRAMEWORK_DEFAULT = 'FRAMEWORK_DEFAULT',\n}\n\n/** The one reading of a policy's per-person limit: its own, or the framework default, and which. */\nexport function resolveProviderBrowserOperationCallerRateLimit(policy: Pick<ProviderBrowserOperationPolicy, 'callerRateLimit'>): {\n  readonly limit: RateLimitConfiguration;\n  readonly source: ProviderBrowserOperationCallerRateLimitSource;\n} {\n  return policy.callerRateLimit === undefined\n    ? { limit: DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT, source: ProviderBrowserOperationCallerRateLimitSource.FRAMEWORK_DEFAULT }\n    : { limit: policy.callerRateLimit, source: ProviderBrowserOperationCallerRateLimitSource.DECLARED };\n}\n\n/**\n * `providerRef` → `operationId` → policy. The operation id is the catalogue's own, exactly as a typed\n * client or an ETL binding reference names it.\n *\n * Absent is an EMPTY map — nothing is browser-reachable — never \"everything\".\n */\nexport const ProviderBrowserOperationPoliciesSchema = z.record(\n  z.string().min(1),\n  z.record(z.string().min(1), ProviderBrowserOperationPolicySchema),\n).default(() => ({}));\nexport type ProviderBrowserOperationPolicies = z.infer<typeof ProviderBrowserOperationPoliciesSchema>;\n/** @wildo_source:part:end saas.models.providers.browser-operation-policy */\n"]}
+{"version":3,"file":"provider-browser-operations.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-browser-operations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAA+B,MAAM,wCAAwC,CAAC;AAEnH,kJAAkJ;AAClJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,eAAe,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,wBAAwB,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CACtD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CACnF,CAAC;IACF,oHAAoH;IACpH,oGAAoG;IACpG,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS;WAClB,KAAK,CAAC,iBAAiB,KAAK,SAAS;WACrC,KAAK,CAAC,eAAe,KAAK,SAAS;WACnC,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EACL,qGAAqG;kBACnG,0GAA0G;SAC/G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,wBAAwB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EACL,6GAA6G;kBAC3G,sFAAsF;SAC3F,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAA2B,MAAM,CAAC,MAAM,CAAC;IACxG,iBAAiB,EAAE,EAAE;IACrB,eAAe,EAAE,IAAI;CACtB,CAAC,CAAC;AAEH,8HAA8H;AAC9H,MAAM,CAAN,IAAY,6CAKX;AALD,WAAY,6CAA6C;IACvD,gEAAgE;IAChE,sEAAqB,CAAA;IACrB,6DAA6D;IAC7D,wFAAuC,CAAA;AACzC,CAAC,EALW,6CAA6C,KAA7C,6CAA6C,QAKxD;AAED,oGAAoG;AACpG,MAAM,UAAU,8CAA8C,CAAC,MAA+D;IAI5H,OAAO,MAAM,CAAC,eAAe,KAAK,SAAS;QACzC,CAAC,CAAC,EAAE,KAAK,EAAE,oDAAoD,EAAE,MAAM,EAAE,6CAA6C,CAAC,iBAAiB,EAAE;QAC1I,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,6CAA6C,CAAC,QAAQ,EAAE,CAAC;AACxG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAClE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtB,4EAA4E","sourcesContent":["/**\n * WHICH provider operations a signed-in person's browser may trigger — the application's decision (#367).\n *\n * ## The question this answers, and why nothing else did\n *\n * A provider operation runs on the backend, through `ProviderOperationExecutorBackendService`, because\n * the credential it spends must never travel to a browser. A custom backend service reaches it through\n * a generated typed client. A custom FRONTEND component had no way to reach it at all, and the door\n * that gives it one has to answer a question no existing engine surface answers: *which operations may\n * a browser trigger, for whom, and on whose account*.\n *\n * The answer is a DECLARATION, authored in the application's SaaS config beside `providers.connections`\n * and with the same standing: both are the application's decisions about providers, as opposed to what\n * a vendor's catalogue says it can support.\n *\n * ## Fail closed, by construction\n *\n * An operation absent from this map is NOT reachable from a browser. There is no default, no\n * \"READ operations are fine\" shortcut — classification is not sufficient: a READ still spends a tenant's\n * credential, can page a vendor's whole account, and returns whatever the vendor holds. The map is the\n * only thing that opens the door, one operation at a time.\n *\n * ## Rejected: a flag on the operation in the provider catalogue\n *\n * The catalogue is generated from third-party sources and overwritten on every regeneration, and it\n * describes the VENDOR. Letting it decide what a browser may trigger would let a scraped listing grant\n * access in every application that installs the provider — and a regeneration could grant or revoke it\n * without anyone opening the application.\n */\n\nimport {\n  ExternalProvider_Connection_OwnerScope,\n  ExternalProvider_ConnectionShapeSchema,\n} from '@wildo-ai/external-connectors-models';\nimport { z } from 'zod';\nimport { RateLimitConfigurationSchema, type RateLimitConfiguration } from '../requests/rate-limits.shared.schemas';\n\n/** @wildo_source:part:start saas.models.providers.browser-operation-policy facet:layer:shared facet:family:config facet:audience:app-developer */\n/**\n * One browser-reachable operation.\n *\n * ## `connections` — whose account a browser-triggered call may spend\n *\n * Owner-scope × delegation pairs, in the vocabulary the catalogue, `providers.connections`, the connect\n * leg and the resolver already share. NARROWING ONLY: a call must satisfy this list AND the provider's\n * admissible connections as `providers.connections` narrows them. Naming a shape the provider does not\n * admit grants nothing.\n *\n * Every call still passes the target-authorization port before anything is spent — a person may name\n * only an organization they belong to organization-wide, and only their own user account. This list\n * narrows further; it can never widen what that port allows.\n *\n * ## `allowedRoles` — who may trigger it\n *\n * Role keys, resolved through the LIVE role hierarchy (a custom role inheriting from a listed one\n * qualifies), and read in the scope of the ACCOUNT BEING SPENT:\n *\n * | target | roles are read from |\n * |---|---|\n * | `organization` | the caller's organization-WIDE roles in THAT organization — a unit-scoped grant never counts |\n * | `application` | the caller's application roles |\n * | `user` | not applicable — a person acting on their own account holds no role over it, so declaring roles on a policy that admits `user` refuses those calls |\n *\n * Absent means any signed-in caller the target-authorization port admits. That is a legitimate choice\n * for a person's own account or a member acting for their own tenant, and it is REFUSED at parse time\n * when the policy admits an `application`-owned connection: without roles, every signed-in person could\n * spend the application's own vendor account.\n *\n * ## `callerRateLimit` — how often ONE person may trigger it (#561)\n *\n * Counted per signed-in person, per provider operation. Before it, the door's only limits were a\n * per-provider window (off unless a provider declared one) and the IP-keyed perimeter limiter, so one\n * person's typing into an address lookup could spend a vendor allowance the whole application shares.\n *\n * Absent does NOT mean unlimited: the framework applies\n * {@link DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT}, generous enough for a person typing into a\n * lookup. The two differ in one way that matters, and it is the same split the rest of the engine draws\n * between an authored and a default limit: a DECLARED limit fails CLOSED when the limiter's store is\n * unavailable (the application stated it, so an outage must not quietly lift it), while the framework\n * default fails OPEN (nobody declared it, so it must never be why a door stops working).\n */\nexport const ProviderBrowserOperationPolicySchema = z.strictObject({\n  connections: z.array(ExternalProvider_ConnectionShapeSchema).min(1),\n  allowedRoles: z.array(z.string().trim().min(1)).min(1).optional(),\n  callerRateLimit: RateLimitConfigurationSchema.optional(),\n}).superRefine((policy, ctx) => {\n  const admitsApplicationAccount = policy.connections.some(\n    (shape) => shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION,\n  );\n  // A declared limit with no window counts nothing, yet reads as DECLARED — the framework default is then not applied\n  // either. A control that looks enforced and enforces nothing is refused where it is written (#561).\n  const limit = policy.callerRateLimit;\n  if (limit !== undefined\n    && limit.requestsPerMinute === undefined\n    && limit.requestsPerHour === undefined\n    && limit.requestsPerDay === undefined\n    && (limit.customWindows === undefined || limit.customWindows.length === 0)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['callerRateLimit'],\n      message:\n        '`callerRateLimit` declares no window, so it would count nothing and replace the framework default. '\n        + 'Declare at least one of requestsPerMinute, requestsPerHour, requestsPerDay or customWindows, or omit it.',\n    });\n  }\n  if (admitsApplicationAccount && policy.allowedRoles === undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['allowedRoles'],\n      message:\n        'A browser-reachable operation that may spend the APPLICATION-owned connection must declare `allowedRoles`. '\n        + 'Without it every signed-in person could spend the application\\'s own vendor account.',\n    });\n  }\n});\nexport type ProviderBrowserOperationPolicy = z.infer<typeof ProviderBrowserOperationPolicySchema>;\n\n/**\n * The per-person limit a browser-reachable operation gets when its policy declares none (#561).\n *\n * Sized for the most frequent legitimate caller, a person typing into an address lookup: suggestions start at\n * three characters and are debounced, so one address is a handful of calls, and sixty a minute is a person\n * typing without pause. The hourly window is what stops a script holding a session from draining a vendor\n * allowance at a steady sixty a minute.\n */\nexport const DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT: RateLimitConfiguration = Object.freeze({\n  requestsPerMinute: 60,\n  requestsPerHour: 1000,\n});\n\n/** Where the limit a browser-triggered call is counted against came from — and so how an outage of the limiter is treated. */\nexport enum ProviderBrowserOperationCallerRateLimitSource {\n  /** Declared on the policy: fails CLOSED on a limiter outage. */\n  DECLARED = 'DECLARED',\n  /** The framework default: fails OPEN on a limiter outage. */\n  FRAMEWORK_DEFAULT = 'FRAMEWORK_DEFAULT',\n}\n\n/** The one reading of a policy's per-person limit: its own, or the framework default, and which. */\nexport function resolveProviderBrowserOperationCallerRateLimit(policy: Pick<ProviderBrowserOperationPolicy, 'callerRateLimit'>): {\n  readonly limit: RateLimitConfiguration;\n  readonly source: ProviderBrowserOperationCallerRateLimitSource;\n} {\n  return policy.callerRateLimit === undefined\n    ? { limit: DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT, source: ProviderBrowserOperationCallerRateLimitSource.FRAMEWORK_DEFAULT }\n    : { limit: policy.callerRateLimit, source: ProviderBrowserOperationCallerRateLimitSource.DECLARED };\n}\n\n/**\n * `providerRef` → `operationId` → policy. The operation id is the catalogue's own, exactly as a typed\n * client or an ETL binding reference names it.\n *\n * Absent is an EMPTY map — nothing is browser-reachable — never \"everything\".\n */\nexport const ProviderBrowserOperationPoliciesSchema = z.record(\n  z.string().min(1),\n  z.record(z.string().min(1), ProviderBrowserOperationPolicySchema),\n).default(() => ({}));\nexport type ProviderBrowserOperationPolicies = z.infer<typeof ProviderBrowserOperationPoliciesSchema>;\n/** @wildo_source:part:end saas.models.providers.browser-operation-policy */\n"]}

package/dist/esm/external-providers/provider-capability.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-capability.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-capability.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B;;;IAGtC;;;;;;;;;;OAUG;;;IAGH;;;;;;;;OAQG;;;IAGH,sEAAsE;;;;IAItE;;;;;;;;;;;;;;OAcG;;IAEH;;;;;;;;;;OAUG;;;;;IAKH;;;;;OAKG;;;;IAIH;;;;;;;;;;;;;;OAcG;;IAEH;;;;;OAKG;;IAEH;;;;;OAKG;;IAEH;;;;;;;OAOG;;CAEK,CAAC;AACX,+DAA+D;AAE/D,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAiBjF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"provider-capability.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-capability.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B;;;IAGtC;;;;;;;;;;OAUG;;;IAGH;;;;;;;;OAQG;;;IAGH,sEAAsE;;;;IAItE;;;;;;;;;;;;;;OAcG;;IAEH;;;;;;;;;;OAUG;;;;;IAKH;;;;;OAKG;;;;IAIH;;;;;;;;;;;;;;OAcG;;IAEH;;;;;OAKG;;IAEH;;;;;OAKG;;IAEH;;;;;;;OAOG;;CAEK,CAAC;AACX,+DAA+D;AAE/D,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAiBjF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC"}