@wildo-ai/saas-models 1.1.9 → 1.1.10

package/dist/esm/external-providers/provider-browser-operations.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-browser-operations.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-browser-operations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAA+B,MAAM,wCAAwC,CAAC;AAEnH,kJAAkJ;AAClJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,eAAe,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,wBAAwB,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CACtD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CACnF,CAAC;IACF,oHAAoH;IACpH,oGAAoG;IACpG,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS;WAClB,KAAK,CAAC,iBAAiB,KAAK,SAAS;WACrC,KAAK,CAAC,eAAe,KAAK,SAAS;WACnC,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EACL,qGAAqG;kBACnG,0GAA0G;SAC/G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,wBAAwB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EACL,6GAA6G;kBAC3G,sFAAsF;SAC3F,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAA2B,MAAM,CAAC,MAAM,CAAC;IACxG,iBAAiB,EAAE,EAAE;IACrB,eAAe,EAAE,IAAI;CACtB,CAAC,CAAC;AAEH,8HAA8H;AAC9H,MAAM,CAAN,IAAY,6CAKX;AALD,WAAY,6CAA6C;IACvD,gEAAgE;IAChE,sEAAqB,CAAA;IACrB,6DAA6D;IAC7D,wFAAuC,CAAA;AACzC,CAAC,EALW,6CAA6C,KAA7C,6CAA6C,QAKxD;AAED,oGAAoG;AACpG,MAAM,UAAU,8CAA8C,CAAC,MAA+D;IAI5H,OAAO,MAAM,CAAC,eAAe,KAAK,SAAS;QACzC,CAAC,CAAC,EAAE,KAAK,EAAE,oDAAoD,EAAE,MAAM,EAAE,6CAA6C,CAAC,iBAAiB,EAAE;QAC1I,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,6CAA6C,CAAC,QAAQ,EAAE,CAAC;AACxG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAClE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtB,4EAA4E","sourcesContent":["/**\n * WHICH provider operations a signed-in person's browser may trigger — the application's decision (#367).\n *\n * ## The question this answers, and why nothing else did\n *\n * A provider operation runs on the backend, through `ProviderOperationExecutorBackendService`, because\n * the credential it spends must never travel to a browser. A custom backend service reaches it through\n * a generated typed client. A custom FRONTEND component had no way to reach it at all, and the door\n * that gives it one has to answer a question no existing engine surface answers: *which operations may\n * a browser trigger, for whom, and on whose account*.\n *\n * The answer is a DECLARATION, authored in the application's SaaS config beside `providers.connections`\n * and with the same standing: both are the application's decisions about providers, as opposed to what\n * a vendor's catalogue says it can support.\n *\n * ## Fail closed, by construction\n *\n * An operation absent from this map is NOT reachable from a browser. There is no default, no\n * \"READ operations are fine\" shortcut — classification is not sufficient: a READ still spends a tenant's\n * credential, can page a vendor's whole account, and returns whatever the vendor holds. The map is the\n * only thing that opens the door, one operation at a time.\n *\n * ## Rejected: a flag on the operation in the provider catalogue\n *\n * The catalogue is generated from third-party sources and overwritten on every regeneration, and it\n * describes the VENDOR. Letting it decide what a browser may trigger would let a scraped listing grant\n * access in every application that installs the provider — and a regeneration could grant or revoke it\n * without anyone opening the application.\n */\n\nimport {\n  ExternalProvider_Connection_OwnerScope,\n  ExternalProvider_ConnectionShapeSchema,\n} from '@wildo-ai/external-connectors-models';\nimport { z } from 'zod';\nimport { RateLimitConfigurationSchema, type RateLimitConfiguration } from '../requests/rate-limits.shared.schemas';\n\n/** @wildo_source:part:start saas.models.providers.browser-operation-policy facet:layer:shared facet:family:config facet:audience:app-developer */\n/**\n * One browser-reachable operation.\n *\n * ## `connections` — whose account a browser-triggered call may spend\n *\n * Owner-scope × delegation pairs, in the vocabulary the catalogue, `providers.connections`, the connect\n * leg and the resolver already share. NARROWING ONLY: a call must satisfy this list AND the provider's\n * admissible connections as `providers.connections` narrows them. Naming a shape the provider does not\n * admit grants nothing.\n *\n * Every call still passes the target-authorization port before anything is spent — a person may name\n * only an organization they belong to organization-wide, and only their own user account. This list\n * narrows further; it can never widen what that port allows.\n *\n * ## `allowedRoles` — who may trigger it\n *\n * Role keys, resolved through the LIVE role hierarchy (a custom role inheriting from a listed one\n * qualifies), and read in the scope of the ACCOUNT BEING SPENT:\n *\n * | target | roles are read from |\n * |---|---|\n * | `organization` | the caller's organization-WIDE roles in THAT organization — a unit-scoped grant never counts |\n * | `application` | the caller's application roles |\n * | `user` | not applicable — a person acting on their own account holds no role over it, so declaring roles on a policy that admits `user` refuses those calls |\n *\n * Absent means any signed-in caller the target-authorization port admits. That is a legitimate choice\n * for a person's own account or a member acting for their own tenant, and it is REFUSED at parse time\n * when the policy admits an `application`-owned connection: without roles, every signed-in person could\n * spend the application's own vendor account.\n *\n * ## `callerRateLimit` — how often ONE person may trigger it (#561)\n *\n * Counted per signed-in person, per provider operation. Before it, the door's only limits were a\n * per-provider window (off unless a provider declared one) and the IP-keyed perimeter limiter, so one\n * person's typing into an address lookup could spend a vendor allowance the whole application shares.\n *\n * Absent does NOT mean unlimited: the framework applies\n * {@link DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT}, generous enough for a person typing into a\n * lookup. The two differ in one way that matters, and it is the same split the rest of the engine draws\n * between an authored and a default limit: a DECLARED limit fails CLOSED when the limiter's store is\n * unavailable (the application stated it, so an outage must not quietly lift it), while the framework\n * default fails OPEN (nobody declared it, so it must never be why a door stops working).\n */\nexport const ProviderBrowserOperationPolicySchema = z.strictObject({\n  connections: z.array(ExternalProvider_ConnectionShapeSchema).min(1),\n  allowedRoles: z.array(z.string().trim().min(1)).min(1).optional(),\n  callerRateLimit: RateLimitConfigurationSchema.optional(),\n}).superRefine((policy, ctx) => {\n  const admitsApplicationAccount = policy.connections.some(\n    (shape) => shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION,\n  );\n  // A declared limit with no window counts nothing, yet reads as DECLARED — the framework default is then not applied\n  // either. A control that looks enforced and enforces nothing is refused where it is written (#561).\n  const limit = policy.callerRateLimit;\n  if (limit !== undefined\n    && limit.requestsPerMinute === undefined\n    && limit.requestsPerHour === undefined\n    && limit.requestsPerDay === undefined\n    && (limit.customWindows === undefined || limit.customWindows.length === 0)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['callerRateLimit'],\n      message:\n        '`callerRateLimit` declares no window, so it would count nothing and replace the framework default. '\n        + 'Declare at least one of requestsPerMinute, requestsPerHour, requestsPerDay or customWindows, or omit it.',\n    });\n  }\n  if (admitsApplicationAccount && policy.allowedRoles === undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['allowedRoles'],\n      message:\n        'A browser-reachable operation that may spend the APPLICATION-owned connection must declare `allowedRoles`. '\n        + 'Without it every signed-in person could spend the application\\'s own vendor account.',\n    });\n  }\n});\nexport type ProviderBrowserOperationPolicy = z.infer<typeof ProviderBrowserOperationPolicySchema>;\n\n/**\n * The per-person limit a browser-reachable operation gets when its policy declares none (#561).\n *\n * Sized for the most frequent legitimate caller, a person typing into an address lookup: suggestions start at\n * three characters and are debounced, so one address is a handful of calls, and sixty a minute is a person\n * typing without pause. The hourly window is what stops a script holding a session from draining a vendor\n * allowance at a steady sixty a minute.\n */\nexport const DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT: RateLimitConfiguration = Object.freeze({\n  requestsPerMinute: 60,\n  requestsPerHour: 1000,\n});\n\n/** Where the limit a browser-triggered call is counted against came from — and so how an outage of the limiter is treated. */\nexport enum ProviderBrowserOperationCallerRateLimitSource {\n  /** Declared on the policy: fails CLOSED on a limiter outage. */\n  DECLARED = 'DECLARED',\n  /** The framework default: fails OPEN on a limiter outage. */\n  FRAMEWORK_DEFAULT = 'FRAMEWORK_DEFAULT',\n}\n\n/** The one reading of a policy's per-person limit: its own, or the framework default, and which. */\nexport function resolveProviderBrowserOperationCallerRateLimit(policy: Pick<ProviderBrowserOperationPolicy, 'callerRateLimit'>): {\n  readonly limit: RateLimitConfiguration;\n  readonly source: ProviderBrowserOperationCallerRateLimitSource;\n} {\n  return policy.callerRateLimit === undefined\n    ? { limit: DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT, source: ProviderBrowserOperationCallerRateLimitSource.FRAMEWORK_DEFAULT }\n    : { limit: policy.callerRateLimit, source: ProviderBrowserOperationCallerRateLimitSource.DECLARED };\n}\n\n/**\n * `providerRef` → `operationId` → policy. The operation id is the catalogue's own, exactly as a typed\n * client or an ETL binding reference names it.\n *\n * Absent is an EMPTY map — nothing is browser-reachable — never \"everything\".\n */\nexport const ProviderBrowserOperationPoliciesSchema = z.record(\n  z.string().min(1),\n  z.record(z.string().min(1), ProviderBrowserOperationPolicySchema),\n).default(() => ({}));\nexport type ProviderBrowserOperationPolicies = z.infer<typeof ProviderBrowserOperationPoliciesSchema>;\n/** @wildo_source:part:end saas.models.providers.browser-operation-policy */\n"]}
+{"version":3,"file":"provider-browser-operations.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-browser-operations.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,4BAA4B,EAA+B,MAAM,wCAAwC,CAAC;AAEnH,kJAAkJ;AAClJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,eAAe,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,wBAAwB,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CACtD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,sCAAsC,CAAC,WAAW,CACnF,CAAC;IACF,oHAAoH;IACpH,oGAAoG;IACpG,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS;WAClB,KAAK,CAAC,iBAAiB,KAAK,SAAS;WACrC,KAAK,CAAC,eAAe,KAAK,SAAS;WACnC,KAAK,CAAC,cAAc,KAAK,SAAS;WAClC,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EACL,qGAAqG;kBACnG,0GAA0G;SAC/G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,wBAAwB,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,cAAc,CAAC;YACtB,OAAO,EACL,6GAA6G;kBAC3G,sFAAsF;SAC3F,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oDAAoD,GAA2B,MAAM,CAAC,MAAM,CAAC;IACxG,iBAAiB,EAAE,EAAE;IACrB,eAAe,EAAE,IAAI;CACtB,CAAC,CAAC;AAEH,8HAA8H;AAC9H,MAAM,CAAN,IAAY,6CAKX;AALD,WAAY,6CAA6C;IACvD,gEAAgE;IAChE,sEAAqB,CAAA;IACrB,6DAA6D;IAC7D,wFAAuC,CAAA;AACzC,CAAC,EALW,6CAA6C,KAA7C,6CAA6C,QAKxD;AAED,oGAAoG;AACpG,MAAM,UAAU,8CAA8C,CAAC,MAA+D;IAI5H,OAAO,MAAM,CAAC,eAAe,KAAK,SAAS;QACzC,CAAC,CAAC,EAAE,KAAK,EAAE,oDAAoD,EAAE,MAAM,EAAE,6CAA6C,CAAC,iBAAiB,EAAE;QAC1I,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,6CAA6C,CAAC,QAAQ,EAAE,CAAC;AACxG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAClE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEtB,4EAA4E","sourcesContent":["/**\n * WHICH provider operations a signed-in person's browser may trigger — the application's decision (#367).\n *\n * ## The question this answers, and why nothing else did\n *\n * A provider operation runs on the backend, through `ProviderOperationExecutorBackendService`, because\n * the credential it spends must never travel to a browser. A custom backend service reaches it through\n * a generated typed client. A custom FRONTEND component had no way to reach it at all, and the door\n * that gives it one has to answer a question no existing engine surface answers: *which operations may\n * a browser trigger, for whom, and on whose account*.\n *\n * The answer is a DECLARATION, authored in the application's SaaS config beside `providers.connections`\n * and with the same standing: both are the application's decisions about providers, as opposed to what\n * a vendor's catalogue says it can support.\n *\n * ## Fail closed, by construction\n *\n * An operation absent from this map is NOT reachable from a browser. There is no default, no\n * \"READ operations are fine\" shortcut — classification is not sufficient: a READ still spends a tenant's\n * credential, can page a vendor's whole account, and returns whatever the vendor holds. The map is the\n * only thing that opens the door, one operation at a time.\n *\n * ## Rejected: a flag on the operation in the provider catalogue\n *\n * The catalogue is generated from third-party sources and overwritten on every regeneration, and it\n * describes the VENDOR. Letting it decide what a browser may trigger would let a scraped listing grant\n * access in every application that installs the provider — and a regeneration could grant or revoke it\n * without anyone opening the application.\n */\n\nimport {\n  ExternalProvider_Connection_OwnerScope,\n  ExternalProvider_ConnectionShapeSchema,\n} from '@wildo-ai/external-connectors-models';\nimport { z } from 'zod';\nimport { RateLimitConfigurationSchema, type RateLimitConfiguration } from '../requests/rate-limits.shared.schemas';\n\n/** @wildo_source:part:start saas.models.providers.browser-operation-policy facet:layer:shared facet:family:config facet:audience:app-developer */\n/**\n * One browser-reachable operation.\n *\n * ## `connections` — whose account a browser-triggered call may spend\n *\n * Owner-scope × delegation pairs, in the vocabulary the catalogue, `providers.connections`, the connect\n * leg and the resolver already share. NARROWING ONLY: a call must satisfy this list AND the provider's\n * admissible connections as `providers.connections` narrows them. Naming a shape the provider does not\n * admit grants nothing.\n *\n * Every call still passes the target-authorization port before anything is spent — a person may name\n * only an organization they belong to organization-wide, and only their own user account. This list\n * narrows further; it can never widen what that port allows.\n *\n * ## `allowedRoles` — who may trigger it\n *\n * Role keys, resolved through the LIVE role hierarchy (a custom role inheriting from a listed one\n * qualifies), and read in the scope of the ACCOUNT BEING SPENT:\n *\n * | target | roles are read from |\n * |---|---|\n * | `organization` | the caller's organization-WIDE roles in THAT organization — a unit-scoped grant never counts |\n * | `application` | the caller's application roles |\n * | `user` | not applicable — a person acting on their own account holds no role over it, so declaring roles on a policy that admits `user` refuses those calls |\n *\n * Absent means any signed-in caller the target-authorization port admits. That is a legitimate choice\n * for a person's own account or a member acting for their own tenant, and it is REFUSED at parse time\n * when the policy admits an `application`-owned connection: without roles, every signed-in person could\n * spend the application's own vendor account.\n *\n * ## `callerRateLimit` — how often ONE person may trigger it (#561)\n *\n * Counted per signed-in person, per provider operation. Before it, the door's only limits were a\n * per-provider window (off unless a provider declared one) and the IP-keyed perimeter limiter, so one\n * person's typing into an address lookup could spend a vendor allowance the whole application shares.\n *\n * Absent does NOT mean unlimited: the framework applies\n * {@link DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT}, generous enough for a person typing into a\n * lookup. The two differ in one way that matters, and it is the same split the rest of the engine draws\n * between an authored and a default limit: a DECLARED limit fails CLOSED when the limiter's store is\n * unavailable (the application stated it, so an outage must not quietly lift it), while the framework\n * default fails OPEN (nobody declared it, so it must never be why a door stops working).\n */\nexport const ProviderBrowserOperationPolicySchema = z.strictObject({\n  connections: z.array(ExternalProvider_ConnectionShapeSchema).min(1),\n  allowedRoles: z.array(z.string().trim().min(1)).min(1).optional(),\n  callerRateLimit: RateLimitConfigurationSchema.optional(),\n}).superRefine((policy, ctx) => {\n  const admitsApplicationAccount = policy.connections.some(\n    (shape) => shape.ownerScope === ExternalProvider_Connection_OwnerScope.APPLICATION,\n  );\n  // A declared limit with no window counts nothing, yet reads as DECLARED — the framework default is then not applied\n  // either. A control that looks enforced and enforces nothing is refused where it is written (#561).\n  const limit = policy.callerRateLimit;\n  if (limit !== undefined\n    && limit.requestsPerMinute === undefined\n    && limit.requestsPerHour === undefined\n    && limit.requestsPerDay === undefined\n    && (limit.customWindows === undefined || limit.customWindows.length === 0)) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['callerRateLimit'],\n      message:\n        '`callerRateLimit` declares no window, so it would count nothing and replace the framework default. '\n        + 'Declare at least one of requestsPerMinute, requestsPerHour, requestsPerDay or customWindows, or omit it.',\n    });\n  }\n  if (admitsApplicationAccount && policy.allowedRoles === undefined) {\n    ctx.addIssue({\n      code: 'custom',\n      path: ['allowedRoles'],\n      message:\n        'A browser-reachable operation that may spend the APPLICATION-owned connection must declare `allowedRoles`. '\n        + 'Without it every signed-in person could spend the application\\'s own vendor account.',\n    });\n  }\n});\nexport type ProviderBrowserOperationPolicy = z.infer<typeof ProviderBrowserOperationPolicySchema>;\n\n/**\n * The per-person limit a browser-reachable operation gets when its policy declares none (#561).\n *\n * Sized for the most frequent legitimate caller, a person typing into an address lookup: suggestions start at\n * three characters and are debounced, so one address is a handful of calls, and sixty a minute is a person\n * typing without pause. The hourly window is what stops a script holding a session from draining a vendor\n * allowance at a steady sixty a minute.\n */\nexport const DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT: RateLimitConfiguration = Object.freeze({\n  requestsPerMinute: 60,\n  requestsPerHour: 1000,\n});\n\n/** Where the limit a browser-triggered call is counted against came from — and so how an outage of the limiter is treated. */\nexport enum ProviderBrowserOperationCallerRateLimitSource {\n  /** Declared on the policy: fails CLOSED on a limiter outage. */\n  DECLARED = 'DECLARED',\n  /** The framework default: fails OPEN on a limiter outage. */\n  FRAMEWORK_DEFAULT = 'FRAMEWORK_DEFAULT',\n}\n\n/** The one reading of a policy's per-person limit: its own, or the framework default, and which. */\nexport function resolveProviderBrowserOperationCallerRateLimit(policy: Pick<ProviderBrowserOperationPolicy, 'callerRateLimit'>): {\n  readonly limit: RateLimitConfiguration;\n  readonly source: ProviderBrowserOperationCallerRateLimitSource;\n} {\n  return policy.callerRateLimit === undefined\n    ? { limit: DEFAULT_PROVIDER_BROWSER_OPERATION_CALLER_RATE_LIMIT, source: ProviderBrowserOperationCallerRateLimitSource.FRAMEWORK_DEFAULT }\n    : { limit: policy.callerRateLimit, source: ProviderBrowserOperationCallerRateLimitSource.DECLARED };\n}\n\n/**\n * `providerRef` → `operationId` → policy. The operation id is the catalogue's own, exactly as a typed\n * client or an ETL binding reference names it.\n *\n * Absent is an EMPTY map — nothing is browser-reachable — never \"everything\".\n */\nexport const ProviderBrowserOperationPoliciesSchema = z.record(\n  z.string().min(1),\n  z.record(z.string().min(1), ProviderBrowserOperationPolicySchema),\n).default(() => ({}));\nexport type ProviderBrowserOperationPolicies = z.infer<typeof ProviderBrowserOperationPoliciesSchema>;\n/** @wildo_source:part:end saas.models.providers.browser-operation-policy */\n"]}

package/dist/esm/external-providers/provider-capability.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-capability.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-capability.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B;;;IAGtC;;;;;;;;;;OAUG;;;IAGH;;;;;;;;OAQG;;;IAGH,sEAAsE;;;;IAItE;;;;;;;;;;;;;;OAcG;;IAEH;;;;;;;;;;OAUG;;;;;IAKH;;;;;OAKG;;;;IAIH;;;;;;;;;;;;;;OAcG;;IAEH;;;;;OAKG;;IAEH;;;;;OAKG;;IAEH;;;;;;;OAOG;;CAEK,CAAC;AACX,+DAA+D;AAE/D,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAiBjF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC"}
+{"version":3,"file":"provider-capability.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-capability.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B;;;IAGtC;;;;;;;;;;OAUG;;;IAGH;;;;;;;;OAQG;;;IAGH,sEAAsE;;;;IAItE;;;;;;;;;;;;;;OAcG;;IAEH;;;;;;;;;;OAUG;;;;;IAKH;;;;;OAKG;;;;IAIH;;;;;;;;;;;;;;OAcG;;IAEH;;;;;OAKG;;IAEH;;;;;OAKG;;IAEH;;;;;;;OAOG;;CAEK,CAAC;AACX,+DAA+D;AAE/D,MAAM,MAAM,yBAAyB,GACnC,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAC;AAiBjF;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,yBAAyB,CAAC"}

package/dist/esm/external-providers/provider-capability.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-capability.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-capability.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,eAAe,EAAE,iBAAiB;IAClC;;;;;;;;;;OAUG;IACH,aAAa,EAAE,eAAe;IAC9B,GAAG,EAAE,KAAK;IACV;;;;;;;;OAQG;IACH,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,YAAY;IACxB,sEAAsE;IACtE,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;IAChC;;;;;;;;;;;;;;OAcG;IACH,wBAAwB,EAAE,0BAA0B;IACpD;;;;;;;;;;OAUG;IACH,YAAY,EAAE,cAAc;IAC5B,gBAAgB,EAAE,kBAAkB;IACpC,yBAAyB,EAAE,2BAA2B;IACtD,0BAA0B,EAAE,4BAA4B;IACxD;;;;;OAKG;IACH,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,gBAAgB,EAAE,kBAAkB;IACpC;;;;;;;;;;;;;;OAcG;IACH,uBAAuB,EAAE,yBAAyB;IAClD;;;;;OAKG;IACH,iBAAiB,EAAE,mBAAmB;IACtC;;;;;OAKG;IACH,uBAAuB,EAAE,yBAAyB;IAClD;;;;;;;OAOG;IACH,sBAAsB,EAAE,wBAAwB;CACxC,CAAC","sourcesContent":["/**\n * `ProviderCapability` — the closed vocabulary of standardized behaviors\n * a provider claims to implement.\n *\n * Distinct from `EngineCapability` (closed, engine-defined slots that\n * may require fulfillment): a provider CLAIMS a `ProviderCapability`, and\n * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` projects the claims that fill\n * an engine slot.\n *\n * This header described the vocabulary as \"open, app-extensible\", with a\n * kebab-case convention for app-augmented values, until 2026-09-12. The\n * augmentation point was removed by #502 (see below), so no second namespace\n * exists; the `.cursor/plans/` citation it carried named a directory that no\n * longer exists.\n */\n\n/** @wildo_source:part:start saas.models.provider-capabilities facet:kind:api facet:audience:app-developer\n *\n * Built-in provider capabilities shipped by the framework.\n *\n * Authoring rule: keep this list narrow and stable. Adding a new\n * built-in capability is a framework-level decision (it implies the\n * engine knows how to consume the capability via a transformer or a\n * platform binding). There is no app-side extension point: an application\n * needing a capability this vocabulary does not name is a decision to widen\n * the vocabulary, taken with the resolution path that would make it mean\n * something (#502).\n */\nexport const BUILTIN_PROVIDER_CAPABILITY = {\n  EMAIL_TRANSACTIONAL: 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING: 'EMAIL_MARKETING',\n  /**\n   * Provider RECEIVES email for the application: it hosts the MX for a receiving domain, notifies the\n   * application of each message through a signed webhook, and serves the message (bodies,\n   * authentication results, attachments) on request. Maps to `EngineCapability.EMAIL_INBOUND`.\n   *\n   * A token of its own rather than a reading of `EMAIL_TRANSACTIONAL`, because sending and receiving\n   * are separate procurement decisions: one vendor may send and another receive, and threading only\n   * needs standard headers, so the two never have to agree (#1630). Delivery of the notification is\n   * NOT this capability — like billing's, it rides the `WEBHOOK_ORIGINATOR` protocol through an\n   * endpoint whose `capability` names this token.\n   */\n  EMAIL_INBOUND: 'EMAIL_INBOUND',\n  SMS: 'SMS',\n  /**\n   * Single billing-engagement capability covering everything from\n   * Checkout-style hosted flows to first-party PaymentIntent flows.\n   * Webhook delivery is NOT a separate capability — it is modelled at\n   * the protocol layer (e.g. Stripe declares both a `BILLING_PROVIDER`\n   * and a `WEBHOOK_ORIGINATOR` protocol but a single `BILLING`\n   * capability). This 1:1 matches the billing slot from the older\n   * external connector transformer vocabulary.\n   */\n  BILLING: 'BILLING',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  /** Reserved for future SAML-based SSO providers (none ship today). */\n  SSO_SAML: 'SSO_SAML',\n  LLM_CHAT: 'LLM_CHAT',\n  LLM_EMBEDDINGS: 'LLM_EMBEDDINGS',\n  /**\n   * Provider turns DOCUMENT BYTES into text — OCR over scans and photographs of pages, not merely\n   * a read of a PDF's existing text layer. Maps to `EngineCapability.AI_DOCUMENT_EXTRACTION`.\n   *\n   * A NEW token was genuinely required rather than convenient: `IMAGE_GENERATION` is an OUTPUT\n   * capability (text → image), and PDF *generation* — the `pdfTemplates` surface — is this\n   * capability's exact opposite. Nothing in the existing vocabulary claimed the document-INPUT\n   * slot. (This paragraph used to name `EngineCapability.DOCUMENT_GENERATION`; that member was\n   * withdrawn because no provider capability could fill it.)\n   *\n   * Distinct from `LLM_CHAT` even where a vendor serves both from one API key: the work is\n   * different (a page-layout model, billed per page, with no sampling parameters), and fusing\n   * them would make the OCR provider unselectable independently of the chat provider — the exact\n   * defect that splitting `AI_EMBEDDINGS` out of `AI_LLM` existed to fix.\n   */\n  DOCUMENT_TEXT_EXTRACTION: 'DOCUMENT_TEXT_EXTRACTION',\n  /**\n   * Provider ships an autonomous CODING AGENT: a process that reads and writes\n   * a workspace, runs commands, and requests authorisation, reachable over the\n   * Agent Client Protocol.\n   *\n   * Distinct from `LLM_CHAT` because the WORK is\n   * different, not merely its transport. A chat model returns text for a caller\n   * to act on; a coding agent acts, and the resulting obligations — permission\n   * decisions, mutation scope, change attribution, verification — have no\n   * counterpart in a completion call.\n   */\n  CODING_AGENT: 'CODING_AGENT',\n  IMAGE_GENERATION: 'IMAGE_GENERATION',\n  FRONTEND_ERROR_MONITORING: 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS: 'FRONTEND_PRODUCT_ANALYTICS',\n  /**\n   * A hosted search a browser module brings to a surface. The engine ships no provider for it since #1737\n   * (Algolia DocSearch loaded nothing; the documentation site searches its own generated index). Kept\n   * because an application or package module may still declare one, and the consent classification and the\n   * privacy disclosure map both answer for it.\n   */\n  FRONTEND_SEARCH: 'FRONTEND_SEARCH',\n  FRONTEND_FILE_PICKER: 'FRONTEND_FILE_PICKER',\n  FRONTEND_CAPTCHA: 'FRONTEND_CAPTCHA',\n  /**\n   * A browser component that turns what a person types into a STRUCTURED postal address — the\n   * `z_address()` value — optionally with the vendor's own identifier for the place it matched (#1702,\n   * consumed by the address field of #561).\n   *\n   * The component's contract is `ProviderAddressLookupProps` (`@wildo-ai/saas-models`): it hands back a\n   * `ProviderAddressLookupSelection`. Whether the vendor's place id comes back at all is a static\n   * declaration on the component (`placeIdRetention`), refused at the framework boundary when a selection\n   * contradicts it — the #383 pattern — and the id is never stored (#561 D3). The component reaches its\n   * vendor through the application backend's provider-operation door, never from the page (#561 D2).\n   *\n   * Fills no engine slot: nothing in the engine requires an address lookup to exist, and a field that\n   * finds none is typed by hand. Needs no consent at the capability floor (the person asked for the\n   * lookup); a vendor whose terms make it more than that adds purposes on its own module.\n   */\n  FRONTEND_ADDRESS_LOOKUP: 'FRONTEND_ADDRESS_LOOKUP',\n  /**\n   * Backend LLM-call observability — a provider that ingests per-`invokeAgent`\n   * generation traces (model / tokens / cost / latency), e.g. PostHog\n   * `$ai_generation`. Maps to `EngineCapability.LLM_OBSERVABILITY`. The engine\n   * consumes it via the `AgentCallTraceSink` (not a request/response transformer).\n   */\n  LLM_OBSERVABILITY: 'LLM_OBSERVABILITY',\n  /**\n   * Operational-telemetry sink — a provider that ingests OpenTelemetry traces,\n   * metrics, and logs over OTLP (e.g. BetterStack). Maps to\n   * `EngineCapability.OBSERVABILITY_TELEMETRY`. Consumed by the OTel SDK preload\n   * (env-var-driven), NOT a request/response transformer or a DI sink.\n   */\n  OBSERVABILITY_TELEMETRY: 'OBSERVABILITY_TELEMETRY',\n  /**\n   * Audit-log sink — a provider that stores or forwards compliance audit\n   * events (who-did-what-when), e.g. immudb (tamper-evident) or a SIEM\n   * webhook. Maps to `EngineCapability.COMPLIANCE_AUDIT_TRAIL`, a FAN_OUT\n   * capability: every declared audit provider receives every event (see\n   * `getEngineCapabilityResolutionMode`). The engine consumes it via the\n   * `AuditLogSink` DI fan-out, layered on the always-on database audit store.\n   */\n  COMPLIANCE_AUDIT_TRAIL: 'COMPLIANCE_AUDIT_TRAIL',\n} as const;\n/** @wildo_source:part:end saas.models.provider-capabilities */\n\nexport type BuiltinProviderCapability =\n  (typeof BUILTIN_PROVIDER_CAPABILITY)[keyof typeof BUILTIN_PROVIDER_CAPABILITY];\n\n/*\n * The app-side augmentation point was REMOVED here (#502, decided 2026-09-08).\n *\n * `AppCustomProviderCapabilities` was an empty interface, extended by no application in the\n * repository, whose own docstring described wiring it into `getProvidersByProviderCapability()` as a\n * later phase nobody scheduled. It offered a choice that did not exist: `keyof` an empty interface is\n * `never`, so the union below already resolved to `BuiltinProviderCapability` and removing it changes\n * the resolved type for none of its consumers.\n *\n * If an application genuinely needs a capability the built-in vocabulary does not name, that is a\n * decision about widening a CLOSED semantic vocabulary — with a resolution path built at the same\n * time — not an empty interface left open in advance. An extension point with no resolver is not\n * extensibility; it is a promise nothing can keep.\n */\n\n/**\n * Every provider capability — exactly the closed built-in set. There is no\n * app-side augmentation (removed by #502, see above), so this is a name for\n * `BuiltinProviderCapability` that consumers (the provider registries, the\n * provider component registry, lock-file digests) accept.\n */\nexport type ProviderCapability = BuiltinProviderCapability;\n"]}
+{"version":3,"file":"provider-capability.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-capability.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,eAAe,EAAE,iBAAiB;IAClC;;;;;;;;;;OAUG;IACH,aAAa,EAAE,eAAe;IAC9B,GAAG,EAAE,KAAK;IACV;;;;;;;;OAQG;IACH,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,YAAY;IACxB,sEAAsE;IACtE,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;IAChC;;;;;;;;;;;;;;OAcG;IACH,wBAAwB,EAAE,0BAA0B;IACpD;;;;;;;;;;OAUG;IACH,YAAY,EAAE,cAAc;IAC5B,gBAAgB,EAAE,kBAAkB;IACpC,yBAAyB,EAAE,2BAA2B;IACtD,0BAA0B,EAAE,4BAA4B;IACxD;;;;;OAKG;IACH,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,gBAAgB,EAAE,kBAAkB;IACpC;;;;;;;;;;;;;;OAcG;IACH,uBAAuB,EAAE,yBAAyB;IAClD;;;;;OAKG;IACH,iBAAiB,EAAE,mBAAmB;IACtC;;;;;OAKG;IACH,uBAAuB,EAAE,yBAAyB;IAClD;;;;;;;OAOG;IACH,sBAAsB,EAAE,wBAAwB;CACxC,CAAC","sourcesContent":["/**\n * `ProviderCapability` — the closed vocabulary of standardized behaviors\n * a provider claims to implement.\n *\n * Distinct from `EngineCapability` (closed, engine-defined slots that\n * may require fulfillment): a provider CLAIMS a `ProviderCapability`, and\n * `PROVIDER_CAPABILITY_TO_ENGINE_CAPABILITY` projects the claims that fill\n * an engine slot.\n *\n * This header described the vocabulary as \"open, app-extensible\", with a\n * kebab-case convention for app-augmented values, until 2026-09-12. The\n * augmentation point was removed by #502 (see below), so no second namespace\n * exists; the `.cursor/plans/` citation it carried named a directory that no\n * longer exists.\n */\n\n/** @wildo_source:part:start saas.models.provider-capabilities facet:kind:api facet:audience:app-developer\n *\n * Built-in provider capabilities shipped by the framework.\n *\n * Authoring rule: keep this list narrow and stable. Adding a new\n * built-in capability is a framework-level decision (it implies the\n * engine knows how to consume the capability via a transformer or a\n * platform binding). There is no app-side extension point: an application\n * needing a capability this vocabulary does not name is a decision to widen\n * the vocabulary, taken with the resolution path that would make it mean\n * something (#502).\n */\nexport const BUILTIN_PROVIDER_CAPABILITY = {\n  EMAIL_TRANSACTIONAL: 'EMAIL_TRANSACTIONAL',\n  EMAIL_MARKETING: 'EMAIL_MARKETING',\n  /**\n   * Provider RECEIVES email for the application: it hosts the MX for a receiving domain, notifies the\n   * application of each message through a signed webhook, and serves the message (bodies,\n   * authentication results, attachments) on request. Maps to `EngineCapability.EMAIL_INBOUND`.\n   *\n   * A token of its own rather than a reading of `EMAIL_TRANSACTIONAL`, because sending and receiving\n   * are separate procurement decisions: one vendor may send and another receive, and threading only\n   * needs standard headers, so the two never have to agree (#1630). Delivery of the notification is\n   * NOT this capability — like billing's, it rides the `WEBHOOK_ORIGINATOR` protocol through an\n   * endpoint whose `capability` names this token.\n   */\n  EMAIL_INBOUND: 'EMAIL_INBOUND',\n  SMS: 'SMS',\n  /**\n   * Single billing-engagement capability covering everything from\n   * Checkout-style hosted flows to first-party PaymentIntent flows.\n   * Webhook delivery is NOT a separate capability — it is modelled at\n   * the protocol layer (e.g. Stripe declares both a `BILLING_PROVIDER`\n   * and a `WEBHOOK_ORIGINATOR` protocol but a single `BILLING`\n   * capability). This 1:1 matches the billing slot from the older\n   * external connector transformer vocabulary.\n   */\n  BILLING: 'BILLING',\n  SSO_OAUTH2: 'SSO_OAUTH2',\n  /** Reserved for future SAML-based SSO providers (none ship today). */\n  SSO_SAML: 'SSO_SAML',\n  LLM_CHAT: 'LLM_CHAT',\n  LLM_EMBEDDINGS: 'LLM_EMBEDDINGS',\n  /**\n   * Provider turns DOCUMENT BYTES into text — OCR over scans and photographs of pages, not merely\n   * a read of a PDF's existing text layer. Maps to `EngineCapability.AI_DOCUMENT_EXTRACTION`.\n   *\n   * A NEW token was genuinely required rather than convenient: `IMAGE_GENERATION` is an OUTPUT\n   * capability (text → image), and PDF *generation* — the `pdfTemplates` surface — is this\n   * capability's exact opposite. Nothing in the existing vocabulary claimed the document-INPUT\n   * slot. (This paragraph used to name `EngineCapability.DOCUMENT_GENERATION`; that member was\n   * withdrawn because no provider capability could fill it.)\n   *\n   * Distinct from `LLM_CHAT` even where a vendor serves both from one API key: the work is\n   * different (a page-layout model, billed per page, with no sampling parameters), and fusing\n   * them would make the OCR provider unselectable independently of the chat provider — the exact\n   * defect that splitting `AI_EMBEDDINGS` out of `AI_LLM` existed to fix.\n   */\n  DOCUMENT_TEXT_EXTRACTION: 'DOCUMENT_TEXT_EXTRACTION',\n  /**\n   * Provider ships an autonomous CODING AGENT: a process that reads and writes\n   * a workspace, runs commands, and requests authorisation, reachable over the\n   * Agent Client Protocol.\n   *\n   * Distinct from `LLM_CHAT` because the WORK is\n   * different, not merely its transport. A chat model returns text for a caller\n   * to act on; a coding agent acts, and the resulting obligations — permission\n   * decisions, mutation scope, change attribution, verification — have no\n   * counterpart in a completion call.\n   */\n  CODING_AGENT: 'CODING_AGENT',\n  IMAGE_GENERATION: 'IMAGE_GENERATION',\n  FRONTEND_ERROR_MONITORING: 'FRONTEND_ERROR_MONITORING',\n  FRONTEND_PRODUCT_ANALYTICS: 'FRONTEND_PRODUCT_ANALYTICS',\n  /**\n   * A hosted search a browser module brings to a surface. The engine ships no provider for it since #1737\n   * (Algolia DocSearch loaded nothing; the documentation site searches its own generated index). Kept\n   * because an application or package module may still declare one, and the consent classification and the\n   * privacy disclosure map both answer for it.\n   */\n  FRONTEND_SEARCH: 'FRONTEND_SEARCH',\n  FRONTEND_FILE_PICKER: 'FRONTEND_FILE_PICKER',\n  FRONTEND_CAPTCHA: 'FRONTEND_CAPTCHA',\n  /**\n   * A browser component that turns what a person types into a STRUCTURED postal address — the\n   * `z_address()` value — optionally with the vendor's own identifier for the place it matched (#1702,\n   * consumed by the address field of #561).\n   *\n   * The component's contract is `ProviderAddressLookupProps` (`@wildo-ai/saas-models`): it hands back a\n   * `ProviderAddressLookupSelection`. Whether the vendor's place id comes back at all is a static\n   * declaration on the component (`placeIdRetention`), refused at the framework boundary when a selection\n   * contradicts it — the #383 pattern — and the id is never stored (#561 D3). The component reaches its\n   * vendor through the application backend's provider-operation door, never from the page (#561 D2).\n   *\n   * Fills no engine slot: nothing in the engine requires an address lookup to exist, and a field that\n   * finds none is typed by hand. Needs no consent at the capability floor (the person asked for the\n   * lookup); a vendor whose terms make it more than that adds purposes on its own module.\n   */\n  FRONTEND_ADDRESS_LOOKUP: 'FRONTEND_ADDRESS_LOOKUP',\n  /**\n   * Backend LLM-call observability — a provider that ingests per-`invokeAgent`\n   * generation traces (model / tokens / cost / latency), e.g. PostHog\n   * `$ai_generation`. Maps to `EngineCapability.LLM_OBSERVABILITY`. The engine\n   * consumes it via the `AgentCallTraceSink` (not a request/response transformer).\n   */\n  LLM_OBSERVABILITY: 'LLM_OBSERVABILITY',\n  /**\n   * Operational-telemetry sink — a provider that ingests OpenTelemetry traces,\n   * metrics, and logs over OTLP (e.g. BetterStack). Maps to\n   * `EngineCapability.OBSERVABILITY_TELEMETRY`. Consumed by the OTel SDK preload\n   * (env-var-driven), NOT a request/response transformer or a DI sink.\n   */\n  OBSERVABILITY_TELEMETRY: 'OBSERVABILITY_TELEMETRY',\n  /**\n   * Audit-log sink — a provider that stores or forwards compliance audit\n   * events (who-did-what-when), e.g. immudb (tamper-evident) or a SIEM\n   * webhook. Maps to `EngineCapability.COMPLIANCE_AUDIT_TRAIL`, a FAN_OUT\n   * capability: every declared audit provider receives every event (see\n   * `getEngineCapabilityResolutionMode`). The engine consumes it via the\n   * `AuditLogSink` DI fan-out, layered on the always-on database audit store.\n   */\n  COMPLIANCE_AUDIT_TRAIL: 'COMPLIANCE_AUDIT_TRAIL',\n} as const;\n/** @wildo_source:part:end saas.models.provider-capabilities */\n\nexport type BuiltinProviderCapability =\n  (typeof BUILTIN_PROVIDER_CAPABILITY)[keyof typeof BUILTIN_PROVIDER_CAPABILITY];\n\n/*\n * The app-side augmentation point was REMOVED here (#502, decided 2026-09-08).\n *\n * `AppCustomProviderCapabilities` was an empty interface, extended by no application in the\n * repository, whose own docstring described wiring it into `getProvidersByProviderCapability()` as a\n * later phase nobody scheduled. It offered a choice that did not exist: `keyof` an empty interface is\n * `never`, so the union below already resolved to `BuiltinProviderCapability` and removing it changes\n * the resolved type for none of its consumers.\n *\n * If an application genuinely needs a capability the built-in vocabulary does not name, that is a\n * decision about widening a CLOSED semantic vocabulary — with a resolution path built at the same\n * time — not an empty interface left open in advance. An extension point with no resolver is not\n * extensibility; it is a promise nothing can keep.\n */\n\n/**\n * Every provider capability — exactly the closed built-in set. There is no\n * app-side augmentation (removed by #502, see above), so this is a name for\n * `BuiltinProviderCapability` that consumers (the provider registries, the\n * provider component registry, lock-file digests) accept.\n */\nexport type ProviderCapability = BuiltinProviderCapability;\n"]}

package/dist/esm/external-providers/provider-compliance-profile.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-compliance-profile.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,oBAAY,uBAAuB;IACjC;;;OAGG;IACH,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,WAAW,gBAAgB;CAC5B;AAED;;;;;;;;GAQG;AACH,oBAAY,+BAA+B;IACzC,iGAAiG;IACjG,WAAW,gBAAgB;IAC3B,mGAAmG;IACnG,YAAY,iBAAiB;CAC9B;AAED;;;GAGG;AACH,oBAAY,sBAAsB;IAChC,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,iBAAiB,sBAAsB;IACvC,yBAAyB,8BAA8B;CACxD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC;IAC/C,yCAAyC;;IAEzC,6FAA6F;;IAE7F,+CAA+C;;kBAE/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,0CAA0C;IACrD;;;;OAIG;;IAEH;;;;;;OAMG;;IAEH;;;;;;;;;;;;;OAaG;;IAEH;;;;;;;OAOG;;IAEH,wHAAwH;;IAExH;;;OAGG;;IAEH,mGAAmG;;QAvFnG,yCAAyC;;QAEzC,6FAA6F;;QAE7F,+CAA+C;;;IAqF/C;;;;;;;OAOG;;;;;;;kBA8BH,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;GAKG;AACH,eAAO,MAAM,2CAA2C;;IAEtD,0FAA0F;;kBAE1F,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B;IA1G1C;;;;OAIG;;IAEH;;;;;;OAMG;;IAEH;;;;;;;;;;;;;OAaG;;IAEH;;;;;;;OAOG;;IAEH,wHAAwH;;IAExH;;;OAGG;;IAEH,mGAAmG;;QAvFnG,yCAAyC;;QAEzC,6FAA6F;;QAE7F,+CAA+C;;;IAqF/C;;;;;;;OAOG;;;;;;;;;IAyCH,0FAA0F;;oBAWqD,CAAC;AAClJ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,mHAAmH;AACnH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,oCAAoC,EAAE,uBAAuB,GAAG,qBAAqB,GAAG,4BAA4B,CAAC,GAClI,WAAW,CAAC,sBAAsB,CAAC,CAMrC;AAED,+GAA+G;AAC/G,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,yBAAyB,GAAG,IAAI,GAAG,SAAS,GACpD,oCAAoC,GAAG,IAAI,CAG7C;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,oCAAoC,GAAG,MAAM,GAAG,IAAI,CAGjH;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAGtF;AAED;;;;;;GAMG;AACH,wBAAgB,yCAAyC,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAGrG;AAED,uHAAuH;AACvH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;;OAKG;;;;kBAyBH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G,qEAAqE;AACrE,eAAO,MAAM,0CAA0C;IAzErD;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;;OAKG;;;;mBAgCJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;;;GAOG;AACH,oBAAY,kCAAkC;IAC5C,4GAA4G;IAC5G,6BAA6B,kCAAkC;IAC/D,2EAA2E;IAC3E,4BAA4B,iCAAiC;IAC7D,uFAAuF;IACvF,kBAAkB,uBAAuB;IACzC,gGAAgG;IAChG,oBAAoB,yBAAyB;IAC7C,0DAA0D;IAC1D,UAAU,eAAe;CAC1B;AAED,4BAA4B;AAC5B,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,kCAAkC,CAAC;IACxD,oGAAoG;IACpG,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;QAAC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAC3I;AAED,wGAAwG;AACxG,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,mCAAmC,EAC3C,OAAO,EAAE,yBAAyB,GAAG,IAAI,GAAG,SAAS,GACpD,kCAAkC,CAUpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC;IACvD,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;CACrF,GAAG,SAAS,uCAAuC,EAAE,CAYrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE;IACnD,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC;IACvD,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;CACrF,GAAG,aAAa,CAAC;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3E;AACD,qEAAqE;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAC/C,oGAAoG;IACpG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,GAAG,IAAI,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,oCAAoC,CAClD,UAAU,EACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAA;KAAE,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC,GACvI,SAAS,GACZ,SAAS,gCAAgC,EAAE,CAS7C;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oCAAoC,GAAG,SAAS,MAAM,EAAE,CAKzG"}
+{"version":3,"file":"provider-compliance-profile.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,oBAAY,uBAAuB;IACjC;;;OAGG;IACH,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,WAAW,gBAAgB;CAC5B;AAED;;;;;;;;GAQG;AACH,oBAAY,+BAA+B;IACzC,iGAAiG;IACjG,WAAW,gBAAgB;IAC3B,mGAAmG;IACnG,YAAY,iBAAiB;CAC9B;AAED;;;GAGG;AACH,oBAAY,sBAAsB;IAChC,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,iBAAiB,sBAAsB;IACvC,yBAAyB,8BAA8B;CACxD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC;IAC/C,yCAAyC;;IAEzC,6FAA6F;;IAE7F,+CAA+C;;kBAE/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,0CAA0C;IACrD;;;;OAIG;;IAEH;;;;;;OAMG;;IAEH;;;;;;;;;;;;;OAaG;;IAEH;;;;;;;OAOG;;IAEH,wHAAwH;;IAExH;;;OAGG;;IAEH,mGAAmG;;QAvFnG,yCAAyC;;QAEzC,6FAA6F;;QAE7F,+CAA+C;;;IAqF/C;;;;;;;OAOG;;;;;;;kBA8BH,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;GAKG;AACH,eAAO,MAAM,2CAA2C;;IAEtD,0FAA0F;;kBAE1F,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B;IA1G1C;;;;OAIG;;IAEH;;;;;;OAMG;;IAEH;;;;;;;;;;;;;OAaG;;IAEH;;;;;;;OAOG;;IAEH,wHAAwH;;IAExH;;;OAGG;;IAEH,mGAAmG;;QAvFnG,yCAAyC;;QAEzC,6FAA6F;;QAE7F,+CAA+C;;;IAqF/C;;;;;;;OAOG;;;;;;;;;IAyCH,0FAA0F;;oBAWqD,CAAC;AAClJ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,mHAAmH;AACnH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,oCAAoC,EAAE,uBAAuB,GAAG,qBAAqB,GAAG,4BAA4B,CAAC,GAClI,WAAW,CAAC,sBAAsB,CAAC,CAMrC;AAED,+GAA+G;AAC/G,wBAAgB,oCAAoC,CAClD,OAAO,EAAE,yBAAyB,GAAG,IAAI,GAAG,SAAS,GACpD,oCAAoC,GAAG,IAAI,CAG7C;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,oCAAoC,GAAG,MAAM,GAAG,IAAI,CAGjH;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAGtF;AAED;;;;;;GAMG;AACH,wBAAgB,yCAAyC,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAGrG;AAED,uHAAuH;AACvH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;;OAKG;;;;kBAyBH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G,qEAAqE;AACrE,eAAO,MAAM,0CAA0C;IAzErD;;;;;;;OAOG;;IAEH;;;;;;;;;;;;;;;;OAgBG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;;OAKG;;;;mBAgCJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;;;GAOG;AACH,oBAAY,kCAAkC;IAC5C,4GAA4G;IAC5G,6BAA6B,kCAAkC;IAC/D,2EAA2E;IAC3E,4BAA4B,iCAAiC;IAC7D,uFAAuF;IACvF,kBAAkB,uBAAuB;IACzC,gGAAgG;IAChG,oBAAoB,yBAAyB;IAC7C,0DAA0D;IAC1D,UAAU,eAAe;CAC1B;AAED,4BAA4B;AAC5B,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,mCAAmC,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,kCAAkC,CAAC;IACxD,oGAAoG;IACpG,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,gBAAgB,EAAE,SAAS,uBAAuB,EAAE,CAAC;QAAC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAC3I;AAED,wGAAwG;AACxG,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,mCAAmC,EAC3C,OAAO,EAAE,yBAAyB,GAAG,IAAI,GAAG,SAAS,GACpD,kCAAkC,CAUpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC;IACvD,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;CACrF,GAAG,SAAS,uCAAuC,EAAE,CAYrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE;IACnD,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC;IACvD,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAC;CACrF,GAAG,aAAa,CAAC;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAI3E;AACD,qEAAqE;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAC/C,oGAAoG;IACpG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,yBAAyB,GAAG,IAAI,CAAC;CAC9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,oCAAoC,CAClD,UAAU,EACN,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,yBAAyB,CAAA;KAAE,CAAC,CAAC,CAAA;CAAE,CAAC,CAAC,GACvI,SAAS,GACZ,SAAS,gCAAgC,EAAE,CAS7C;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oCAAoC,GAAG,SAAS,MAAM,EAAE,CAKzG"}

package/dist/esm/external-providers/provider-compliance-profile.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-compliance-profile.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EACL,2CAA2C,EAC3C,uCAAuC,GACxC,MAAM,8DAA8D,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,uBAYX;AAZD,WAAY,uBAAuB;IACjC;;;OAGG;IACH,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;AAC7B,CAAC,EAZW,uBAAuB,KAAvB,uBAAuB,QAYlC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,iGAAiG;IACjG,8DAA2B,CAAA;IAC3B,mGAAmG;IACnG,gEAA6B,CAAA;AAC/B,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,sBAMX;AAND,WAAY,sBAAsB;IAChC,iEAAuC,CAAA;IACvC,mEAAyC,CAAA;IACzC,qEAA2C,CAAA;IAC3C,iEAAuC,CAAA;IACvC,iFAAuD,CAAA;AACzD,CAAC,EANW,sBAAsB,KAAtB,sBAAsB,QAMjC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,yCAAyC;IACzC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,6FAA6F;IAC7F,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtC,+CAA+C;IAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;CACzB,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,YAAY,CAAC;IACvE;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;IAChF;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,wHAAwH;IACxH,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9D;;;OAGG;IACH,0BAA0B,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzE;;;;;;;OAOG;IACH,cAAc,EAAE,uCAAuC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAClC;;;;;;;OAOG;IACH,IAAI,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvH,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,mIAAmI;SAC7I,CAAC,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAChD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,kBAAkB,IAAI,qCAAqC,EAAE,CAAC,CAAC;YACjJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,YAAY,CAAC;IACtE,0FAA0F;IAC1F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,0CAA0C,EAAE,2CAA2C,CAAC,CAAC,CAAC;AAGlJ,mHAAmH;AACnH,MAAM,UAAU,6BAA6B,CAC3C,OAAmI;IAEnI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAyB,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACtI,IAAI,OAAO,CAAC,qBAAqB,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IACpG,IAAI,OAAO,CAAC,0BAA0B,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,CAAC;IACnH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,oCAAoC,CAClD,OAAqD;IAErD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,OAAO,CAAC,aAAa,KAAK,+BAA+B,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAA6C;IAChG,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAkC;IAC3E,MAAM,WAAW,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAC9H,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yCAAyC,CAAC,OAAkC;IAC1F,MAAM,WAAW,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,uHAAuH;AACvH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAChD;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;;;;;;OAUG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnE;;;;;OAKG;IACH,6BAA6B,EAAE,2CAA2C,CAAC,QAAQ,EAAE;CACtF,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC;;;;;;;OAOG;IACH,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC9G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,qIAAqI;SAC/I,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC5G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,wIAAwI;SAClJ,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,qEAAqE;AACrE,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACxB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kCAWX;AAXD,WAAY,kCAAkC;IAC5C,4GAA4G;IAC5G,qGAA+D,CAAA;IAC/D,2EAA2E;IAC3E,mGAA6D,CAAA;IAC7D,uFAAuF;IACvF,+EAAyC,CAAA;IACzC,gGAAgG;IAChG,mFAA6C,CAAA;IAC7C,0DAA0D;IAC1D,+DAAyB,CAAA;AAC3B,CAAC,EAXW,kCAAkC,KAAlC,kCAAkC,QAW7C;AAWD,wGAAwG;AACxG,MAAM,UAAU,8BAA8B,CAC5C,MAA2C,EAC3C,OAAqD;IAErD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,kCAAkC,CAAC,UAAU,CAAC;IACpG,MAAM,WAAW,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,kCAAkC,CAAC,oBAAoB,CAAC;IACzF,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC;QAAE,OAAO,kCAAkC,CAAC,4BAA4B,CAAC;IAC3I,iHAAiH;IACjH,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9G,OAAO,kCAAkC,CAAC,kBAAkB,CAAC;IAC/D,CAAC;IACD,OAAO,kCAAkC,CAAC,6BAA6B,CAAC;AAC1E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAG/C;IACC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,oCAAoC,CAAC,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;QACpG,OAAO;YACL,WAAW;YACX,MAAM;YACN,UAAU,EAAE,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAC7F,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,EAAE;SAC5I,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAG5C;IACC,OAAO,+BAA+B,CAAC,MAAM,CAAC;SAC3C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,kCAAkC,CAAC,kBAAkB,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC;SAC5I,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAiB,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,oCAAoC,CAClD,UAEa;IAEb,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,IAAI,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA6C;IACpF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,CAAC;SACxF,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;SACnC,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { LawfulBasisPurposeRefSchema } from '../compliance/privacy/purpose-ref.shared.schemas';\nimport {\n  ProviderSubjectErasureAcknowledgementSchema,\n  ProviderSubjectErasureDeclarationSchema,\n} from '../compliance/privacy/subject-data-recipients.shared.schemas';\n\n/**\n * WHO RUNS the software a provider module drives.\n *\n * This is the axis that decides whether a provider is a third-party RECIPIENT of personal data at\n * all, and until 2026-08-30 it did not exist anywhere in the provider model. immudb is described in\n * `BUILTIN_PROVIDER_CAPABILITY` as an audit-trail provider with nothing separating the container an\n * operator runs themselves from a hosted service — so the first privacy notice to ENUMERATE\n * recipients would have named a self-hosted audit ledger as a third party. That is false, and false\n * in the direction that alarms a reader rather than the direction they can check.\n *\n * ⚠️ NOT a hosting-topology field and not an infrastructure concern. It answers one compliance\n * question — does personal data leave the operator's control by reaching this provider — and a\n * consumer must not read it as \"where is it deployed\".\n */\nexport enum ProviderDeploymentModel {\n  /**\n   * The vendor runs it. Data reaching this provider reaches a third party, so it is a processor\n   * under Art. 28 and belongs in the subprocessor register.\n   */\n  VENDOR_HOSTED = 'VENDOR_HOSTED',\n  /**\n   * The operator runs it — their own container, their own infrastructure. No third party receives\n   * anything, so it is NOT a recipient. A notice states it as processing under the operator's own\n   * control, which is a different sentence and a stronger one.\n   */\n  SELF_HOSTED = 'SELF_HOSTED',\n}\n\n/**\n * Whether a provider's compliance facts have been ESTABLISHED at all (#1708).\n *\n * The profile could only be a guess or absent until this existed: `deploymentModels` is non-empty and a\n * vendor-hosted profile must name a region, so a catalogue vendor nobody has researched had two options —\n * invent a profile, or carry none, which every reader reports as NOT ESTABLISHED with no way to tell \"nobody\n * looked\" from \"the module forgot\". UNDETERMINED is that first answer, stated: the provider is known, its facts\n * are not, and a reader treats it as a gap to fill — never as an empty answer, and never as vendor-hosted.\n */\nexport enum ProviderComplianceDetermination {\n  /** The facts below were stated by the module's author or the catalogue record, from a source. */\n  ESTABLISHED = 'ESTABLISHED',\n  /** Nobody has established who runs this provider or where it processes. A gap, reported as one. */\n  UNDETERMINED = 'UNDETERMINED',\n}\n\n/**\n * The facts an ESTABLISHED profile can state, each of which a piece of {@link ProviderComplianceFactEvidenceSchema}\n * can cite. Named so a staleness report can say WHICH fact is old, not merely that \"the profile\" is.\n */\nexport enum ProviderComplianceFact {\n  DEPLOYMENT_MODELS = 'DEPLOYMENT_MODELS',\n  PROCESSING_REGIONS = 'PROCESSING_REGIONS',\n  VENDOR_LEGAL_ENTITY = 'VENDOR_LEGAL_ENTITY',\n  SUBPROCESSOR_LIST = 'SUBPROCESSOR_LIST',\n  DATA_PROCESSING_AGREEMENT = 'DATA_PROCESSING_AGREEMENT',\n}\n\n/**\n * Where one or more facts of a profile were READ, and when (#1708, #1744).\n *\n * A vendor fact has a shelf life: vendors reorganise, open data centres and change their sub-processors, and a\n * fact that was true when a module was written can be false when a notice is published. So a researched fact\n * carries the page it was read from and the date it was read, which is what makes a staleness report possible\n * and what lets an operator check the suggestion before adopting it into its own register.\n *\n * Required for every fact a CATALOGUE vendor states (the transposer refuses a profile without it); optional on\n * an engine module, whose author states facts in code review, and reported as UNDATED there.\n */\nexport const ProviderComplianceFactEvidenceSchema = z.strictObject({\n  /** The facts this source establishes. */\n  facts: z.array(z.enum(ProviderComplianceFact)).min(1),\n  /** The vendor page the facts were read from — its own legal, trust or documentation page. */\n  source: z.url({ protocol: /^https$/ }),\n  /** The day the page was read, `YYYY-MM-DD`. */\n  verifiedAt: z.iso.date(),\n});\nexport type ProviderComplianceFactEvidence = z.infer<typeof ProviderComplianceFactEvidenceSchema>;\n\n/**\n * The compliance-relevant facts a PROVIDER MODULE knows about itself, once they are ESTABLISHED.\n *\n * ## Why these live on the provider and not on the application\n *\n * The processor register shipped by issue #88 was fully application-authored, and that made every\n * application restate facts the framework already holds. What a provider IS — who runs it, which\n * regions its vendor offers, what legal entity stands behind it — does not vary per application, and\n * an application asked to restate it will eventually get it wrong. What DOES vary is the operator's\n * CHOICE among those possibilities, and that is configuration.\n *\n * So the split is: possibilities here, choice in `wildo.saas.config.ts`, and the register entry\n * derived from both (issue #130).\n *\n * ## These are SUGGESTIONS to the operator, never the operator's answer (#1744)\n *\n * The legal facts below (entity, sub-processor list, data processing agreement) are what the framework READ,\n * on a date, at a URL. They reach a published document only after the operator copies them into its own\n * processor register and commits it — Paul's decision of 2026-09-25. A reader offers them as the question\n * to answer, never as the answer.\n *\n * ## What is deliberately NOT here\n *\n * **A transfer mechanism.** Adequacy decisions move by court ruling rather than by release cycle, so\n * a list baked into the engine goes stale silently and emits a false compliance statement — the worst\n * failure mode in this lane. The mechanism is a legal determination with a shelf life, recorded per\n * subprocessor entry by a human, never derived here (issue #126).\n *\n * **What the provider RECEIVES.** That is already implied by the capability it serves —\n * `BUILTIN_PROVIDER_CAPABILITY` describes the data flow per member. Restating it here would be a\n * second authority for one fact.\n */\nexport const EstablishedProviderComplianceProfileSchema = z.strictObject({\n  /**\n   * Optional, and absent reads as ESTABLISHED: the facts below ARE the establishment, and the engine's own\n   * modules state them without the marker. The transposer always writes it, so a generated profile is\n   * explicit either way.\n   */\n  determination: z.literal(ProviderComplianceDetermination.ESTABLISHED).optional(),\n  /**\n   * The deployment models this provider SUPPORTS — one, or both where the provider genuinely offers\n   * a choice (immudb: a hosted service and a container you run).\n   *\n   * A single entry means the answer is not the operator's to make and no configuration should offer\n   * it. Two means the application must choose, and a register entry cannot be derived until it has.\n   */\n  deploymentModels: z.array(z.enum(ProviderDeploymentModel)).min(1),\n  /**\n   * The regions this vendor can process in — POSSIBILITIES the operator chooses from, never a\n   * choice already made.\n   *\n   * Open strings, deliberately, because these are the VENDOR's own labels (`eu-west-1`,\n   * `us-east-1`, `EU`) and a closed enum here would be this repository inventing a vocabulary it\n   * does not own. The compliance question a transfer statement asks is about JURISDICTION rather\n   * than datacentre, and mapping one to the other is part of the legal determination that is\n   * deliberately not modelled (see above).\n   *\n   * EMPTY is meaningful and is the honest answer for a provider that is only ever self-hosted: the\n   * region is wherever the operator runs it, which the framework cannot know. A configuration\n   * choosing `SELF_HOSTED` therefore needs no region from this list.\n   */\n  processingRegions: z.array(z.string().trim().min(1)),\n  /**\n   * The vendor's legal entity, where the provider module's author can state it.\n   *\n   * OPTIONAL, and the reason is that this is the field most likely to go stale: vendors reorganise,\n   * and a stale legal entity published as a current one is worse than an absent one. Absent means\n   * the application must declare it on the register entry, which is where an operator's own contract\n   * makes it checkable.\n   */\n  vendorLegalEntityName: z.string().trim().min(1).optional(),\n  /** Where the vendor publishes its own list of sub-processors. A suggestion for the register entry's `subprocessors`. */\n  subprocessorListUrl: z.url({ protocol: /^https$/ }).optional(),\n  /**\n   * Where the vendor offers its data processing agreement — its AVAILABILITY. Whether THIS operator signed one\n   * is the operator's fact and lives on its register entry (#1709), never here.\n   */\n  dataProcessingAgreementUrl: z.url({ protocol: /^https$/ }).optional(),\n  /** Where each stated fact was read, and when. See {@link ProviderComplianceFactEvidenceSchema}. */\n  evidence: z.array(ProviderComplianceFactEvidenceSchema).min(1).optional(),\n  /**\n   * What the VENDOR keeps about a data subject, and whether an erasure can reach it (#1710) — the D6 stance\n   * vocabulary: `NO_SUBJECT_DATA`, or `EXTERNAL_ERASURE_OPERATION` when an erasure effect reaches this vendor.\n   *\n   * Optional, and absent means UNDECLARED: a subject erasure then reports this vendor UNMEASURED — incomplete, never\n   * a silent pass. Declare it only with a source: `NO_SUBJECT_DATA` is a claim about the vendor's product that a\n   * reviewer must be able to check, and it closes the erasure question for every application using the provider.\n   */\n  subjectErasure: ProviderSubjectErasureDeclarationSchema.optional(),\n}).superRefine((profile, context) => {\n  /*\n   * A VENDOR_HOSTED provider that offers no region cannot support a transfer statement, and the\n   * whole point of carrying regions is that a transfer statement becomes derivable. Refused at the\n   * schema so the gap surfaces where the provider module is authored, rather than as an\n   * unexplainable hole in a produced notice months later.\n   *\n   * The SELF_HOSTED-only case is exempt above: its region is wherever the operator runs it.\n   */\n  if (profile.deploymentModels.includes(ProviderDeploymentModel.VENDOR_HOSTED) && profile.processingRegions.length === 0) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegions'],\n      message: 'a VENDOR_HOSTED provider must declare at least one processing region — without one, no transfer statement about it can be derived',\n    });\n  }\n  /*\n   * Evidence may cite only a fact the profile STATES. A source cited for a sub-processor list the profile does\n   * not carry is a citation of nothing, and would make the staleness report date a fact that is not there.\n   */\n  const stated = statedProviderComplianceFacts(profile);\n  (profile.evidence ?? []).forEach((entry, index) => {\n    for (const fact of entry.facts) {\n      if (!stated.has(fact)) {\n        context.addIssue({ code: 'custom', path: ['evidence', index, 'facts'], message: `evidence cites ${fact}, which this profile does not state` });\n      }\n    }\n  });\n});\nexport type EstablishedProviderComplianceProfile = z.infer<typeof EstablishedProviderComplianceProfileSchema>;\n\n/**\n * A provider whose compliance facts nobody has established (#1708). A provider carries this until its facts are\n * researched — for a registry provider, into its module's own profile in `providers-registry/<ref>/` (the archived\n * catalogue's vendors kept theirs in `_code_archive/providers/catalogue-record/`) — and a reader reports it as a gap\n * to fill.\n */\nexport const UndeterminedProviderComplianceProfileSchema = z.strictObject({\n  determination: z.literal(ProviderComplianceDetermination.UNDETERMINED),\n  /** Why the facts are not established, and where the operator establishes them instead. */\n  reason: z.string().trim().min(1),\n});\nexport type UndeterminedProviderComplianceProfile = z.infer<typeof UndeterminedProviderComplianceProfileSchema>;\n\n/**\n * What a provider declares about who runs it and where it processes: ESTABLISHED facts, or UNDETERMINED.\n *\n * A provider that declares NO profile at all is a third state, and a different gap: its author said nothing.\n * Every reader keeps the three apart — UNDETERMINED names research owed, absence names a module to fix.\n */\nexport const ProviderComplianceProfileSchema = z.union([EstablishedProviderComplianceProfileSchema, UndeterminedProviderComplianceProfileSchema]);\nexport type ProviderComplianceProfile = z.infer<typeof ProviderComplianceProfileSchema>;\n\n/** The facts an established profile states — the population its evidence may cite and a staleness report dates. */\nexport function statedProviderComplianceFacts(\n  profile: Pick<EstablishedProviderComplianceProfile, 'vendorLegalEntityName' | 'subprocessorListUrl' | 'dataProcessingAgreementUrl'>,\n): ReadonlySet<ProviderComplianceFact> {\n  const stated = new Set<ProviderComplianceFact>([ProviderComplianceFact.DEPLOYMENT_MODELS, ProviderComplianceFact.PROCESSING_REGIONS]);\n  if (profile.vendorLegalEntityName !== undefined) stated.add(ProviderComplianceFact.VENDOR_LEGAL_ENTITY);\n  if (profile.subprocessorListUrl !== undefined) stated.add(ProviderComplianceFact.SUBPROCESSOR_LIST);\n  if (profile.dataProcessingAgreementUrl !== undefined) stated.add(ProviderComplianceFact.DATA_PROCESSING_AGREEMENT);\n  return stated;\n}\n\n/** The established profile, or `null` for an UNDETERMINED one or none. The one narrowing every reader uses. */\nexport function establishedProviderComplianceProfile(\n  profile: ProviderComplianceProfile | null | undefined,\n): EstablishedProviderComplianceProfile | null {\n  if (profile === null || profile === undefined) return null;\n  return profile.determination === ProviderComplianceDetermination.UNDETERMINED ? null : profile;\n}\n\n/**\n * The oldest `verifiedAt` across an established profile's evidence, or `null` when it cites none (UNDATED).\n *\n * The OLDEST, because a profile is only as current as its most stale fact: a fresh region list beside a legal\n * entity read two years ago is a profile whose entity may be wrong.\n */\nexport function oldestProviderComplianceEvidenceDate(profile: EstablishedProviderComplianceProfile): string | null {\n  const dates = (profile.evidence ?? []).map((entry) => entry.verifiedAt).sort();\n  return dates[0] ?? null;\n}\n\n/**\n * True when this provider can only ever be run by the operator, so it is never a third-party recipient.\n * An UNDETERMINED profile answers `false`: nobody established it, so it is not established as operator-run.\n */\nexport function providerIsAlwaysSelfHosted(profile: ProviderComplianceProfile): boolean {\n  const established = establishedProviderComplianceProfile(profile);\n  return established !== null && established.deploymentModels.every((model) => model === ProviderDeploymentModel.SELF_HOSTED);\n}\n\n/**\n * True when the operator must CHOOSE, because the provider supports both.\n *\n * A register entry for such a provider cannot be derived from the provider module alone — the\n * application's configuration decides whether it is a recipient at all. An UNDETERMINED profile answers\n * `false`: what it offers is unknown, which is a research gap rather than a known choice.\n */\nexport function providerDeploymentModelIsAnOperatorChoice(profile: ProviderComplianceProfile): boolean {\n  const established = establishedProviderComplianceProfile(profile);\n  return established !== null && established.deploymentModels.length > 1;\n}\n\n/** @wildo_source:part:start saas.models.providers.compliance-choice facet:layer:shared facet:audience:app-developer */\n/**\n * The application's CHOICE among what a provider offers — one entry per configured provider.\n *\n * The provider declares possibilities ({@link ProviderComplianceProfileSchema}); this is where an\n * operator says which of them applies to their deployment. Keeping the two apart is the whole point\n * of the layering: a vendor's regions change when it opens a data centre, an operator's choice\n * changes when they migrate, and collapsing them would make one edit look like the other.\n *\n * Not carried inside `providerConfigurations`, which is an opaque `Record<string, unknown>` bag for a\n * provider's own runtime profile. A compliance answer must not live somewhere nothing can read it\n * without knowing the provider.\n */\nexport const ApplicationProviderComplianceChoiceSchema = z.strictObject({\n  /**\n   * Who runs this provider in THIS deployment.\n   *\n   * Required even when the provider supports only one model. The redundancy is deliberate: whether\n   * personal data leaves the operator's control is the single most consequential fact a notice states\n   * about a provider, and reading it out of a framework default rather than an operator's declaration\n   * is how a wrong one goes unnoticed.\n   */\n  deploymentModel: z.enum(ProviderDeploymentModel),\n  /**\n   * Which region this provider processes in, chosen from what the provider declares possible.\n   *\n   * NOT validated here, and NOT validated at boot either. This schema cannot see the provider\n   * registry, and refusing an unlisted region would make a vendor's new data centre an application\n   * build failure, so the intended posture is warn-do-not-block: a region outside the provider's\n   * declared list is APP-ASSERTED and reported, never refused.\n   *\n   * WIRED since 2026-09-10 (issue #308). `appAssertedProcessingRegions` below computes exactly that\n   * set, and the companion's compliance-primary-facts section reports it per provider, naming both the\n   * configured value and what the provider declares — because a divergence is either a typo or a stale\n   * provider module, and those are opposite work. It took this long only because of a DATA PATH: the\n   * vendor's region list lives on the backend provider module and the renderer reads provider\n   * SPECIFICATIONS, so the helper could not be called until `complianceProfile` was mirrored onto the\n   * specification contract. Any future report must call this helper rather than re-derive the\n   * comparison.\n   */\n  processingRegion: z.string().trim().min(1).optional(),\n  /**\n   * The processing PURPOSES sending data to this recipient serves, by the `purposeRef` of a lawful basis in\n   * `operatorComplianceIdentity.lawfulBases` (#1709). Keyed like every choice: a provider ref, or a\n   * `systemsOfRecord.<name>` instance.\n   *\n   * Here, on the operator's compliance statement about the recipient, and deliberately NOT on the runtime provider\n   * selection (`providers.scopes.<scope>.providers.<ref>`): a purpose is a compliance fact no runtime reads, and the\n   * selection schema has four strict copies (config, backend app-config, runtime artifact, lockfile) that would each\n   * refuse a key the others admit. Absent means no purpose is linked, which the recipients report names as such;\n   * a ref naming no declared purpose is reported as a broken link, never refused.\n   */\n  purposeRefs: z.array(LawfulBasisPurposeRefSchema).min(1).optional(),\n  /**\n   * The operator ACKNOWLEDGES that erasure does not reach this recipient (#1710) — the D6 stance\n   * CONTROLLER_ACKNOWLEDGED_NON_ERASURE for a provider. An erasure then reports ACKNOWLEDGED_NON_ERASURE for it,\n   * which is still incomplete: the data stays live at the vendor. The controller's decision, which is why it lives\n   * here on the operator's statement and never on the provider's profile.\n   */\n  subjectErasureAcknowledgement: ProviderSubjectErasureAcknowledgementSchema.optional(),\n}).superRefine((choice, context) => {\n  /*\n   * The pairing, in both directions.\n   *\n   * A VENDOR_HOSTED choice with no region leaves the notice unable to state where the data goes,\n   * which is the question this whole layer exists to answer. A SELF_HOSTED choice WITH one is the\n   * fiction the provider layer already refuses: the operator runs it, so its region is wherever they\n   * run it, and a value here would be a guess presented as a configuration.\n   */\n  if (choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED && choice.processingRegion === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a VENDOR_HOSTED provider must be configured with the region it processes in — without one, no notice can state where this data goes',\n    });\n  }\n  if (choice.deploymentModel === ProviderDeploymentModel.SELF_HOSTED && choice.processingRegion !== undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a SELF_HOSTED provider runs wherever the operator runs it, so a processing region here is a guess presented as configuration — drop it',\n    });\n  }\n});\nexport type ApplicationProviderComplianceChoice = z.infer<typeof ApplicationProviderComplianceChoiceSchema>;\n\n/** Per configured provider ref, the operator's compliance choice. */\nexport const ApplicationProviderComplianceChoicesSchema = z.record(\n  z.string().trim().min(1),\n  ApplicationProviderComplianceChoiceSchema,\n);\nexport type ApplicationProviderComplianceChoices = z.infer<typeof ApplicationProviderComplianceChoicesSchema>;\n\n/**\n * How an operator's compliance CHOICE for one provider stands against what the provider DECLARES possible (#1708).\n *\n * Five answers, because they are five different pieces of work and a reader must not round one into another:\n * a region the vendor does not list is a typo or a stale profile; a deployment model it does not offer is a\n * configuration error; an UNDETERMINED profile is research owed; no profile at all is a module that states\n * nothing. Reported, never refused — the choice schema's own rule.\n */\nexport enum ProviderComplianceChoiceAssessment {\n  /** The chosen deployment model is offered, and a vendor-hosted choice names a region the provider lists. */\n  WITHIN_DECLARED_POSSIBILITIES = 'WITHIN_DECLARED_POSSIBILITIES',\n  /** The provider does not offer the deployment model the operator chose. */\n  DEPLOYMENT_MODEL_NOT_OFFERED = 'DEPLOYMENT_MODEL_NOT_OFFERED',\n  /** A vendor-hosted choice names a region the provider does not list — APP-ASSERTED. */\n  REGION_NOT_OFFERED = 'REGION_NOT_OFFERED',\n  /** The provider's profile is UNDETERMINED, so the choice cannot be checked against anything. */\n  PROFILE_UNDETERMINED = 'PROFILE_UNDETERMINED',\n  /** The provider declares no compliance profile at all. */\n  NO_PROFILE = 'NO_PROFILE',\n}\n\n/** One choice, assessed. */\nexport interface ProviderComplianceChoiceAssessmentEntry {\n  readonly providerRef: string;\n  readonly choice: ApplicationProviderComplianceChoice;\n  readonly assessment: ProviderComplianceChoiceAssessment;\n  /** What the provider offers, when established — so a report can name both sides of a divergence. */\n  readonly offered: { readonly deploymentModels: readonly ProviderDeploymentModel[]; readonly processingRegions: readonly string[] } | null;\n}\n\n/** Assess ONE choice against the provider's profile. See {@link ProviderComplianceChoiceAssessment}. */\nexport function assessProviderComplianceChoice(\n  choice: ApplicationProviderComplianceChoice,\n  profile: ProviderComplianceProfile | null | undefined,\n): ProviderComplianceChoiceAssessment {\n  if (profile === null || profile === undefined) return ProviderComplianceChoiceAssessment.NO_PROFILE;\n  const established = establishedProviderComplianceProfile(profile);\n  if (established === null) return ProviderComplianceChoiceAssessment.PROFILE_UNDETERMINED;\n  if (!established.deploymentModels.includes(choice.deploymentModel)) return ProviderComplianceChoiceAssessment.DEPLOYMENT_MODEL_NOT_OFFERED;\n  // A self-hosted choice names no region (the choice schema refuses one), so only a vendor-hosted one is compared.\n  if (choice.processingRegion !== undefined && !established.processingRegions.includes(choice.processingRegion)) {\n    return ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED;\n  }\n  return ProviderComplianceChoiceAssessment.WITHIN_DECLARED_POSSIBILITIES;\n}\n\n/**\n * Every choice assessed against the profiles the application's providers declare, sorted by provider ref.\n *\n * `profilesByProviderRef` maps a ref to what its package declares; a ref absent from it declares nothing\n * ({@link ProviderComplianceChoiceAssessment.NO_PROFILE}). The one comparison the brief, the recipient population\n * and the evidence collector all make — never re-derived beside it.\n *\n * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING — each operator choice of a processor's deployment and\n * region is checked against what the processor declares possible, and an unresearched processor is named.\n */\nexport function assessProviderComplianceChoices(params: {\n  readonly choices: ApplicationProviderComplianceChoices;\n  readonly profilesByProviderRef: Readonly<Record<string, ProviderComplianceProfile>>;\n}): readonly ProviderComplianceChoiceAssessmentEntry[] {\n  return Object.entries(params.choices)\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([providerRef, choice]) => {\n      const established = establishedProviderComplianceProfile(params.profilesByProviderRef[providerRef]);\n      return {\n        providerRef,\n        choice,\n        assessment: assessProviderComplianceChoice(choice, params.profilesByProviderRef[providerRef]),\n        offered: established === null ? null : { deploymentModels: established.deploymentModels, processingRegions: established.processingRegions },\n      };\n    });\n}\n\n/**\n * Regions an application asserts that the provider does not declare.\n *\n * Reported, never refused — a vendor opening a data centre must not become a build failure, and an\n * operator who genuinely knows better than a stale framework list should be able to say so. What the\n * framework owes is that the divergence is VISIBLE, which is the same trade the personal-data\n * declaration report makes.\n *\n * The {@link ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED} slice of {@link assessProviderComplianceChoices};\n * an UNDETERMINED profile or none is a different gap and is not reported here.\n */\nexport function appAssertedProcessingRegions(params: {\n  readonly choices: ApplicationProviderComplianceChoices;\n  readonly profilesByProviderRef: Readonly<Record<string, ProviderComplianceProfile>>;\n}): ReadonlyArray<{ readonly providerRef: string; readonly region: string }> {\n  return assessProviderComplianceChoices(params)\n    .filter((entry) => entry.assessment === ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED && entry.choice.processingRegion !== undefined)\n    .map((entry) => ({ providerRef: entry.providerRef, region: entry.choice.processingRegion! }));\n}\n/** @wildo_source:part:end saas.models.providers.compliance-choice */\n\n/**\n * One provider a FRONTEND service serves, beside the compliance profile its facet module declares.\n *\n * `complianceProfile: null` is an answer, not an omission: the module's author stated nothing, so\n * whether that browser vendor is a third-party recipient is NOT ESTABLISHED. A reader must report\n * it; skipping it would make the least-documented browser vendor the one a notice never names.\n */\nexport interface ServedFrontendProviderCompliance {\n  /** The frontend service declaration key (`app`, `website`, `docs`, …) the provider is served on. */\n  readonly serviceKey: string;\n  /** The provider ref as the application selects it under that service's provider scope. */\n  readonly providerRef: string;\n  readonly complianceProfile: ProviderComplianceProfile | null;\n}\n\n/**\n * Every provider the application's frontend services SERVE, with the profile its facet declares\n * (#1743) — the browser half of a recipient population.\n *\n * ## The join point\n *\n * The input is `frontendProviderBootstraps` from the application's generated frontend-services\n * runtime artifact (`.wildo-saas/generated/providers/frontend-services.runtime-providers.generated.json`,\n * written by `wildo config sync`), i.e. a `Record<serviceKey, { providers: Record<ref, entry> }>`.\n * Each entry is a `FrontendProviderEntry`, and since #1743 it carries the facet module's\n * `complianceProfile`. That record is the right population on its own: materialized per service,\n * for exactly the providers the service is configured to serve, and readable as JSON without\n * loading a provider package.\n *\n * Typed STRUCTURALLY rather than as `FrontendProvidersBlock`, so this module does not import the\n * frontend-entry module that imports it, and so a caller holding raw parsed JSON can pass it.\n *\n * ## What it does NOT decide\n *\n * Whether a browser vendor is the operator's sub-processor or the person's own vendor. A browser SDK\n * the application keys with its OWN public key (an error-monitoring DSN, an analytics project key, a\n * captcha site key, a search app id) is engaged by the operator; a file picker opening a person's own\n * Drive under THEIR vendor account is not. That classification belongs to the recipient population\n * (#1707), which reads this list rather than re-walking the artifact.\n *\n * The same ref served on two services appears twice, deliberately — a per-service record is what\n * lets a reader say WHICH surface loads the vendor, and the two facets of one vendor may declare\n * different profiles. Sorted by service, then provider, so the output is deterministic.\n */\nexport function listServedFrontendProviderCompliance(\n  bootstraps:\n    | Readonly<Record<string, { readonly providers?: Readonly<Record<string, { readonly complianceProfile?: ProviderComplianceProfile }>> }>>\n    | undefined,\n): readonly ServedFrontendProviderCompliance[] {\n  const served: ServedFrontendProviderCompliance[] = [];\n  for (const [serviceKey, block] of Object.entries(bootstraps ?? {})) {\n    for (const [providerRef, entry] of Object.entries(block?.providers ?? {})) {\n      served.push({ serviceKey, providerRef, complianceProfile: entry?.complianceProfile ?? null });\n    }\n  }\n  return served.sort((left, right) =>\n    left.serviceKey.localeCompare(right.serviceKey) || left.providerRef.localeCompare(right.providerRef));\n}\n\n/**\n * The configured providers that are THIRD-PARTY RECIPIENTS — vendor-hosted, and therefore processors.\n *\n * A self-hosted provider is excluded by construction rather than by a filter a caller must remember:\n * no data leaves the operator, so it is not a recipient and must never be enumerated as one.\n */\nexport function vendorHostedProviderRefs(choices: ApplicationProviderComplianceChoices): readonly string[] {\n  return Object.entries(choices)\n    .filter(([, choice]) => choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED)\n    .map(([providerRef]) => providerRef)\n    .sort();\n}\n"]}
+{"version":3,"file":"provider-compliance-profile.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-compliance-profile.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EACL,2CAA2C,EAC3C,uCAAuC,GACxC,MAAM,8DAA8D,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAN,IAAY,uBAYX;AAZD,WAAY,uBAAuB;IACjC;;;OAGG;IACH,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;AAC7B,CAAC,EAZW,uBAAuB,KAAvB,uBAAuB,QAYlC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,iGAAiG;IACjG,8DAA2B,CAAA;IAC3B,mGAAmG;IACnG,gEAA6B,CAAA;AAC/B,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,sBAMX;AAND,WAAY,sBAAsB;IAChC,iEAAuC,CAAA;IACvC,mEAAyC,CAAA;IACzC,qEAA2C,CAAA;IAC3C,iEAAuC,CAAA;IACvC,iFAAuD,CAAA;AACzD,CAAC,EANW,sBAAsB,KAAtB,sBAAsB,QAMjC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,yCAAyC;IACzC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,6FAA6F;IAC7F,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtC,+CAA+C;IAC/C,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;CACzB,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,YAAY,CAAC;IACvE;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;IAChF;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,wHAAwH;IACxH,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9D;;;OAGG;IACH,0BAA0B,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrE,mGAAmG;IACnG,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzE;;;;;;;OAOG;IACH,cAAc,EAAE,uCAAuC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAClC;;;;;;;OAOG;IACH,IAAI,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvH,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,mBAAmB,CAAC;YAC3B,OAAO,EAAE,mIAAmI;SAC7I,CAAC,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAChD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,kBAAkB,IAAI,qCAAqC,EAAE,CAAC,CAAC;YACjJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,YAAY,CAAC;IACtE,0FAA0F;IAC1F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,0CAA0C,EAAE,2CAA2C,CAAC,CAAC,CAAC;AAGlJ,mHAAmH;AACnH,MAAM,UAAU,6BAA6B,CAC3C,OAAmI;IAEnI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAyB,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACtI,IAAI,OAAO,CAAC,qBAAqB,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;IACxG,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;IACpG,IAAI,OAAO,CAAC,0BAA0B,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,CAAC;IACnH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,oCAAoC,CAClD,OAAqD;IAErD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,OAAO,CAAC,aAAa,KAAK,+BAA+B,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAA6C;IAChG,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAkC;IAC3E,MAAM,WAAW,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,uBAAuB,CAAC,WAAW,CAAC,CAAC;AAC9H,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yCAAyC,CAAC,OAAkC;IAC1F,MAAM,WAAW,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAClE,OAAO,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;AACzE,CAAC;AAED,uHAAuH;AACvH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAChD;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD;;;;;;;;;;OAUG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnE;;;;;OAKG;IACH,6BAA6B,EAAE,2CAA2C,CAAC,QAAQ,EAAE;CACtF,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IACjC;;;;;;;OAOG;IACH,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC9G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,qIAAqI;SAC/I,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC5G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,kBAAkB,CAAC;YAC1B,OAAO,EAAE,wIAAwI;SAClJ,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,qEAAqE;AACrE,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACxB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,kCAWX;AAXD,WAAY,kCAAkC;IAC5C,4GAA4G;IAC5G,qGAA+D,CAAA;IAC/D,2EAA2E;IAC3E,mGAA6D,CAAA;IAC7D,uFAAuF;IACvF,+EAAyC,CAAA;IACzC,gGAAgG;IAChG,mFAA6C,CAAA;IAC7C,0DAA0D;IAC1D,+DAAyB,CAAA;AAC3B,CAAC,EAXW,kCAAkC,KAAlC,kCAAkC,QAW7C;AAWD,wGAAwG;AACxG,MAAM,UAAU,8BAA8B,CAC5C,MAA2C,EAC3C,OAAqD;IAErD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,kCAAkC,CAAC,UAAU,CAAC;IACpG,MAAM,WAAW,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,kCAAkC,CAAC,oBAAoB,CAAC;IACzF,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC;QAAE,OAAO,kCAAkC,CAAC,4BAA4B,CAAC;IAC3I,iHAAiH;IACjH,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9G,OAAO,kCAAkC,CAAC,kBAAkB,CAAC;IAC/D,CAAC;IACD,OAAO,kCAAkC,CAAC,6BAA6B,CAAC;AAC1E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAG/C;IACC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE;QAC7B,MAAM,WAAW,GAAG,oCAAoC,CAAC,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;QACpG,OAAO;YACL,WAAW;YACX,MAAM;YACN,UAAU,EAAE,8BAA8B,CAAC,MAAM,EAAE,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAC7F,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,WAAW,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,EAAE;SAC5I,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAG5C;IACC,OAAO,+BAA+B,CAAC,MAAM,CAAC;SAC3C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,kCAAkC,CAAC,kBAAkB,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC;SAC5I,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAiB,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,oCAAoC,CAClD,UAEa;IAEb,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;QACnE,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,IAAI,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA6C;IACpF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,KAAK,uBAAuB,CAAC,aAAa,CAAC;SACxF,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC;SACnC,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport { LawfulBasisPurposeRefSchema } from '../compliance/privacy/purpose-ref.shared.schemas';\nimport {\n  ProviderSubjectErasureAcknowledgementSchema,\n  ProviderSubjectErasureDeclarationSchema,\n} from '../compliance/privacy/subject-data-recipients.shared.schemas';\n\n/**\n * WHO RUNS the software a provider module drives.\n *\n * This is the axis that decides whether a provider is a third-party RECIPIENT of personal data at\n * all, and until 2026-08-30 it did not exist anywhere in the provider model. immudb is described in\n * `BUILTIN_PROVIDER_CAPABILITY` as an audit-trail provider with nothing separating the container an\n * operator runs themselves from a hosted service — so the first privacy notice to ENUMERATE\n * recipients would have named a self-hosted audit ledger as a third party. That is false, and false\n * in the direction that alarms a reader rather than the direction they can check.\n *\n * ⚠️ NOT a hosting-topology field and not an infrastructure concern. It answers one compliance\n * question — does personal data leave the operator's control by reaching this provider — and a\n * consumer must not read it as \"where is it deployed\".\n */\nexport enum ProviderDeploymentModel {\n  /**\n   * The vendor runs it. Data reaching this provider reaches a third party, so it is a processor\n   * under Art. 28 and belongs in the subprocessor register.\n   */\n  VENDOR_HOSTED = 'VENDOR_HOSTED',\n  /**\n   * The operator runs it — their own container, their own infrastructure. No third party receives\n   * anything, so it is NOT a recipient. A notice states it as processing under the operator's own\n   * control, which is a different sentence and a stronger one.\n   */\n  SELF_HOSTED = 'SELF_HOSTED',\n}\n\n/**\n * Whether a provider's compliance facts have been ESTABLISHED at all (#1708).\n *\n * The profile could only be a guess or absent until this existed: `deploymentModels` is non-empty and a\n * vendor-hosted profile must name a region, so a catalogue vendor nobody has researched had two options —\n * invent a profile, or carry none, which every reader reports as NOT ESTABLISHED with no way to tell \"nobody\n * looked\" from \"the module forgot\". UNDETERMINED is that first answer, stated: the provider is known, its facts\n * are not, and a reader treats it as a gap to fill — never as an empty answer, and never as vendor-hosted.\n */\nexport enum ProviderComplianceDetermination {\n  /** The facts below were stated by the module's author or the catalogue record, from a source. */\n  ESTABLISHED = 'ESTABLISHED',\n  /** Nobody has established who runs this provider or where it processes. A gap, reported as one. */\n  UNDETERMINED = 'UNDETERMINED',\n}\n\n/**\n * The facts an ESTABLISHED profile can state, each of which a piece of {@link ProviderComplianceFactEvidenceSchema}\n * can cite. Named so a staleness report can say WHICH fact is old, not merely that \"the profile\" is.\n */\nexport enum ProviderComplianceFact {\n  DEPLOYMENT_MODELS = 'DEPLOYMENT_MODELS',\n  PROCESSING_REGIONS = 'PROCESSING_REGIONS',\n  VENDOR_LEGAL_ENTITY = 'VENDOR_LEGAL_ENTITY',\n  SUBPROCESSOR_LIST = 'SUBPROCESSOR_LIST',\n  DATA_PROCESSING_AGREEMENT = 'DATA_PROCESSING_AGREEMENT',\n}\n\n/**\n * Where one or more facts of a profile were READ, and when (#1708, #1744).\n *\n * A vendor fact has a shelf life: vendors reorganise, open data centres and change their sub-processors, and a\n * fact that was true when a module was written can be false when a notice is published. So a researched fact\n * carries the page it was read from and the date it was read, which is what makes a staleness report possible\n * and what lets an operator check the suggestion before adopting it into its own register.\n *\n * Required for every fact a CATALOGUE vendor states (the transposer refuses a profile without it); optional on\n * an engine module, whose author states facts in code review, and reported as UNDATED there.\n */\nexport const ProviderComplianceFactEvidenceSchema = z.strictObject({\n  /** The facts this source establishes. */\n  facts: z.array(z.enum(ProviderComplianceFact)).min(1),\n  /** The vendor page the facts were read from — its own legal, trust or documentation page. */\n  source: z.url({ protocol: /^https$/ }),\n  /** The day the page was read, `YYYY-MM-DD`. */\n  verifiedAt: z.iso.date(),\n});\nexport type ProviderComplianceFactEvidence = z.infer<typeof ProviderComplianceFactEvidenceSchema>;\n\n/**\n * The compliance-relevant facts a PROVIDER MODULE knows about itself, once they are ESTABLISHED.\n *\n * ## Why these live on the provider and not on the application\n *\n * The processor register shipped by issue #88 was fully application-authored, and that made every\n * application restate facts the framework already holds. What a provider IS — who runs it, which\n * regions its vendor offers, what legal entity stands behind it — does not vary per application, and\n * an application asked to restate it will eventually get it wrong. What DOES vary is the operator's\n * CHOICE among those possibilities, and that is configuration.\n *\n * So the split is: possibilities here, choice in `wildo.saas.config.ts`, and the register entry\n * derived from both (issue #130).\n *\n * ## These are SUGGESTIONS to the operator, never the operator's answer (#1744)\n *\n * The legal facts below (entity, sub-processor list, data processing agreement) are what the framework READ,\n * on a date, at a URL. They reach a published document only after the operator copies them into its own\n * processor register and commits it — Paul's decision of 2026-09-25. A reader offers them as the question\n * to answer, never as the answer.\n *\n * ## What is deliberately NOT here\n *\n * **A transfer mechanism.** Adequacy decisions move by court ruling rather than by release cycle, so\n * a list baked into the engine goes stale silently and emits a false compliance statement — the worst\n * failure mode in this lane. The mechanism is a legal determination with a shelf life, recorded per\n * subprocessor entry by a human, never derived here (issue #126).\n *\n * **What the provider RECEIVES.** That is already implied by the capability it serves —\n * `BUILTIN_PROVIDER_CAPABILITY` describes the data flow per member. Restating it here would be a\n * second authority for one fact.\n */\nexport const EstablishedProviderComplianceProfileSchema = z.strictObject({\n  /**\n   * Optional, and absent reads as ESTABLISHED: the facts below ARE the establishment, and the engine's own\n   * modules state them without the marker. The transposer always writes it, so a generated profile is\n   * explicit either way.\n   */\n  determination: z.literal(ProviderComplianceDetermination.ESTABLISHED).optional(),\n  /**\n   * The deployment models this provider SUPPORTS — one, or both where the provider genuinely offers\n   * a choice (immudb: a hosted service and a container you run).\n   *\n   * A single entry means the answer is not the operator's to make and no configuration should offer\n   * it. Two means the application must choose, and a register entry cannot be derived until it has.\n   */\n  deploymentModels: z.array(z.enum(ProviderDeploymentModel)).min(1),\n  /**\n   * The regions this vendor can process in — POSSIBILITIES the operator chooses from, never a\n   * choice already made.\n   *\n   * Open strings, deliberately, because these are the VENDOR's own labels (`eu-west-1`,\n   * `us-east-1`, `EU`) and a closed enum here would be this repository inventing a vocabulary it\n   * does not own. The compliance question a transfer statement asks is about JURISDICTION rather\n   * than datacentre, and mapping one to the other is part of the legal determination that is\n   * deliberately not modelled (see above).\n   *\n   * EMPTY is meaningful and is the honest answer for a provider that is only ever self-hosted: the\n   * region is wherever the operator runs it, which the framework cannot know. A configuration\n   * choosing `SELF_HOSTED` therefore needs no region from this list.\n   */\n  processingRegions: z.array(z.string().trim().min(1)),\n  /**\n   * The vendor's legal entity, where the provider module's author can state it.\n   *\n   * OPTIONAL, and the reason is that this is the field most likely to go stale: vendors reorganise,\n   * and a stale legal entity published as a current one is worse than an absent one. Absent means\n   * the application must declare it on the register entry, which is where an operator's own contract\n   * makes it checkable.\n   */\n  vendorLegalEntityName: z.string().trim().min(1).optional(),\n  /** Where the vendor publishes its own list of sub-processors. A suggestion for the register entry's `subprocessors`. */\n  subprocessorListUrl: z.url({ protocol: /^https$/ }).optional(),\n  /**\n   * Where the vendor offers its data processing agreement — its AVAILABILITY. Whether THIS operator signed one\n   * is the operator's fact and lives on its register entry (#1709), never here.\n   */\n  dataProcessingAgreementUrl: z.url({ protocol: /^https$/ }).optional(),\n  /** Where each stated fact was read, and when. See {@link ProviderComplianceFactEvidenceSchema}. */\n  evidence: z.array(ProviderComplianceFactEvidenceSchema).min(1).optional(),\n  /**\n   * What the VENDOR keeps about a data subject, and whether an erasure can reach it (#1710) — the D6 stance\n   * vocabulary: `NO_SUBJECT_DATA`, or `EXTERNAL_ERASURE_OPERATION` when an erasure effect reaches this vendor.\n   *\n   * Optional, and absent means UNDECLARED: a subject erasure then reports this vendor UNMEASURED — incomplete, never\n   * a silent pass. Declare it only with a source: `NO_SUBJECT_DATA` is a claim about the vendor's product that a\n   * reviewer must be able to check, and it closes the erasure question for every application using the provider.\n   */\n  subjectErasure: ProviderSubjectErasureDeclarationSchema.optional(),\n}).superRefine((profile, context) => {\n  /*\n   * A VENDOR_HOSTED provider that offers no region cannot support a transfer statement, and the\n   * whole point of carrying regions is that a transfer statement becomes derivable. Refused at the\n   * schema so the gap surfaces where the provider module is authored, rather than as an\n   * unexplainable hole in a produced notice months later.\n   *\n   * The SELF_HOSTED-only case is exempt above: its region is wherever the operator runs it.\n   */\n  if (profile.deploymentModels.includes(ProviderDeploymentModel.VENDOR_HOSTED) && profile.processingRegions.length === 0) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegions'],\n      message: 'a VENDOR_HOSTED provider must declare at least one processing region — without one, no transfer statement about it can be derived',\n    });\n  }\n  /*\n   * Evidence may cite only a fact the profile STATES. A source cited for a sub-processor list the profile does\n   * not carry is a citation of nothing, and would make the staleness report date a fact that is not there.\n   */\n  const stated = statedProviderComplianceFacts(profile);\n  (profile.evidence ?? []).forEach((entry, index) => {\n    for (const fact of entry.facts) {\n      if (!stated.has(fact)) {\n        context.addIssue({ code: 'custom', path: ['evidence', index, 'facts'], message: `evidence cites ${fact}, which this profile does not state` });\n      }\n    }\n  });\n});\nexport type EstablishedProviderComplianceProfile = z.infer<typeof EstablishedProviderComplianceProfileSchema>;\n\n/**\n * A provider whose compliance facts nobody has established (#1708). A provider carries this until its facts are\n * researched — for a registry provider, into its module's own profile in `providers-registry/<ref>/` (the archived\n * catalogue's vendors kept theirs in `_code_archive/providers/catalogue-record/`) — and a reader reports it as a gap\n * to fill.\n */\nexport const UndeterminedProviderComplianceProfileSchema = z.strictObject({\n  determination: z.literal(ProviderComplianceDetermination.UNDETERMINED),\n  /** Why the facts are not established, and where the operator establishes them instead. */\n  reason: z.string().trim().min(1),\n});\nexport type UndeterminedProviderComplianceProfile = z.infer<typeof UndeterminedProviderComplianceProfileSchema>;\n\n/**\n * What a provider declares about who runs it and where it processes: ESTABLISHED facts, or UNDETERMINED.\n *\n * A provider that declares NO profile at all is a third state, and a different gap: its author said nothing.\n * Every reader keeps the three apart — UNDETERMINED names research owed, absence names a module to fix.\n */\nexport const ProviderComplianceProfileSchema = z.union([EstablishedProviderComplianceProfileSchema, UndeterminedProviderComplianceProfileSchema]);\nexport type ProviderComplianceProfile = z.infer<typeof ProviderComplianceProfileSchema>;\n\n/** The facts an established profile states — the population its evidence may cite and a staleness report dates. */\nexport function statedProviderComplianceFacts(\n  profile: Pick<EstablishedProviderComplianceProfile, 'vendorLegalEntityName' | 'subprocessorListUrl' | 'dataProcessingAgreementUrl'>,\n): ReadonlySet<ProviderComplianceFact> {\n  const stated = new Set<ProviderComplianceFact>([ProviderComplianceFact.DEPLOYMENT_MODELS, ProviderComplianceFact.PROCESSING_REGIONS]);\n  if (profile.vendorLegalEntityName !== undefined) stated.add(ProviderComplianceFact.VENDOR_LEGAL_ENTITY);\n  if (profile.subprocessorListUrl !== undefined) stated.add(ProviderComplianceFact.SUBPROCESSOR_LIST);\n  if (profile.dataProcessingAgreementUrl !== undefined) stated.add(ProviderComplianceFact.DATA_PROCESSING_AGREEMENT);\n  return stated;\n}\n\n/** The established profile, or `null` for an UNDETERMINED one or none. The one narrowing every reader uses. */\nexport function establishedProviderComplianceProfile(\n  profile: ProviderComplianceProfile | null | undefined,\n): EstablishedProviderComplianceProfile | null {\n  if (profile === null || profile === undefined) return null;\n  return profile.determination === ProviderComplianceDetermination.UNDETERMINED ? null : profile;\n}\n\n/**\n * The oldest `verifiedAt` across an established profile's evidence, or `null` when it cites none (UNDATED).\n *\n * The OLDEST, because a profile is only as current as its most stale fact: a fresh region list beside a legal\n * entity read two years ago is a profile whose entity may be wrong.\n */\nexport function oldestProviderComplianceEvidenceDate(profile: EstablishedProviderComplianceProfile): string | null {\n  const dates = (profile.evidence ?? []).map((entry) => entry.verifiedAt).sort();\n  return dates[0] ?? null;\n}\n\n/**\n * True when this provider can only ever be run by the operator, so it is never a third-party recipient.\n * An UNDETERMINED profile answers `false`: nobody established it, so it is not established as operator-run.\n */\nexport function providerIsAlwaysSelfHosted(profile: ProviderComplianceProfile): boolean {\n  const established = establishedProviderComplianceProfile(profile);\n  return established !== null && established.deploymentModels.every((model) => model === ProviderDeploymentModel.SELF_HOSTED);\n}\n\n/**\n * True when the operator must CHOOSE, because the provider supports both.\n *\n * A register entry for such a provider cannot be derived from the provider module alone — the\n * application's configuration decides whether it is a recipient at all. An UNDETERMINED profile answers\n * `false`: what it offers is unknown, which is a research gap rather than a known choice.\n */\nexport function providerDeploymentModelIsAnOperatorChoice(profile: ProviderComplianceProfile): boolean {\n  const established = establishedProviderComplianceProfile(profile);\n  return established !== null && established.deploymentModels.length > 1;\n}\n\n/** @wildo_source:part:start saas.models.providers.compliance-choice facet:layer:shared facet:audience:app-developer */\n/**\n * The application's CHOICE among what a provider offers — one entry per configured provider.\n *\n * The provider declares possibilities ({@link ProviderComplianceProfileSchema}); this is where an\n * operator says which of them applies to their deployment. Keeping the two apart is the whole point\n * of the layering: a vendor's regions change when it opens a data centre, an operator's choice\n * changes when they migrate, and collapsing them would make one edit look like the other.\n *\n * Not carried inside `providerConfigurations`, which is an opaque `Record<string, unknown>` bag for a\n * provider's own runtime profile. A compliance answer must not live somewhere nothing can read it\n * without knowing the provider.\n */\nexport const ApplicationProviderComplianceChoiceSchema = z.strictObject({\n  /**\n   * Who runs this provider in THIS deployment.\n   *\n   * Required even when the provider supports only one model. The redundancy is deliberate: whether\n   * personal data leaves the operator's control is the single most consequential fact a notice states\n   * about a provider, and reading it out of a framework default rather than an operator's declaration\n   * is how a wrong one goes unnoticed.\n   */\n  deploymentModel: z.enum(ProviderDeploymentModel),\n  /**\n   * Which region this provider processes in, chosen from what the provider declares possible.\n   *\n   * NOT validated here, and NOT validated at boot either. This schema cannot see the provider\n   * registry, and refusing an unlisted region would make a vendor's new data centre an application\n   * build failure, so the intended posture is warn-do-not-block: a region outside the provider's\n   * declared list is APP-ASSERTED and reported, never refused.\n   *\n   * WIRED since 2026-09-10 (issue #308). `appAssertedProcessingRegions` below computes exactly that\n   * set, and the companion's compliance-primary-facts section reports it per provider, naming both the\n   * configured value and what the provider declares — because a divergence is either a typo or a stale\n   * provider module, and those are opposite work. It took this long only because of a DATA PATH: the\n   * vendor's region list lives on the backend provider module and the renderer reads provider\n   * SPECIFICATIONS, so the helper could not be called until `complianceProfile` was mirrored onto the\n   * specification contract. Any future report must call this helper rather than re-derive the\n   * comparison.\n   */\n  processingRegion: z.string().trim().min(1).optional(),\n  /**\n   * The processing PURPOSES sending data to this recipient serves, by the `purposeRef` of a lawful basis in\n   * `operatorComplianceIdentity.lawfulBases` (#1709). Keyed like every choice: a provider ref, or a\n   * `systemsOfRecord.<name>` instance.\n   *\n   * Here, on the operator's compliance statement about the recipient, and deliberately NOT on the runtime provider\n   * selection (`providers.scopes.<scope>.providers.<ref>`): a purpose is a compliance fact no runtime reads, and the\n   * selection schema has four strict copies (config, backend app-config, runtime artifact, lockfile) that would each\n   * refuse a key the others admit. Absent means no purpose is linked, which the recipients report names as such;\n   * a ref naming no declared purpose is reported as a broken link, never refused.\n   */\n  purposeRefs: z.array(LawfulBasisPurposeRefSchema).min(1).optional(),\n  /**\n   * The operator ACKNOWLEDGES that erasure does not reach this recipient (#1710) — the D6 stance\n   * CONTROLLER_ACKNOWLEDGED_NON_ERASURE for a provider. An erasure then reports ACKNOWLEDGED_NON_ERASURE for it,\n   * which is still incomplete: the data stays live at the vendor. The controller's decision, which is why it lives\n   * here on the operator's statement and never on the provider's profile.\n   */\n  subjectErasureAcknowledgement: ProviderSubjectErasureAcknowledgementSchema.optional(),\n}).superRefine((choice, context) => {\n  /*\n   * The pairing, in both directions.\n   *\n   * A VENDOR_HOSTED choice with no region leaves the notice unable to state where the data goes,\n   * which is the question this whole layer exists to answer. A SELF_HOSTED choice WITH one is the\n   * fiction the provider layer already refuses: the operator runs it, so its region is wherever they\n   * run it, and a value here would be a guess presented as a configuration.\n   */\n  if (choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED && choice.processingRegion === undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a VENDOR_HOSTED provider must be configured with the region it processes in — without one, no notice can state where this data goes',\n    });\n  }\n  if (choice.deploymentModel === ProviderDeploymentModel.SELF_HOSTED && choice.processingRegion !== undefined) {\n    context.addIssue({\n      code: 'custom',\n      path: ['processingRegion'],\n      message: 'a SELF_HOSTED provider runs wherever the operator runs it, so a processing region here is a guess presented as configuration — drop it',\n    });\n  }\n});\nexport type ApplicationProviderComplianceChoice = z.infer<typeof ApplicationProviderComplianceChoiceSchema>;\n\n/** Per configured provider ref, the operator's compliance choice. */\nexport const ApplicationProviderComplianceChoicesSchema = z.record(\n  z.string().trim().min(1),\n  ApplicationProviderComplianceChoiceSchema,\n);\nexport type ApplicationProviderComplianceChoices = z.infer<typeof ApplicationProviderComplianceChoicesSchema>;\n\n/**\n * How an operator's compliance CHOICE for one provider stands against what the provider DECLARES possible (#1708).\n *\n * Five answers, because they are five different pieces of work and a reader must not round one into another:\n * a region the vendor does not list is a typo or a stale profile; a deployment model it does not offer is a\n * configuration error; an UNDETERMINED profile is research owed; no profile at all is a module that states\n * nothing. Reported, never refused — the choice schema's own rule.\n */\nexport enum ProviderComplianceChoiceAssessment {\n  /** The chosen deployment model is offered, and a vendor-hosted choice names a region the provider lists. */\n  WITHIN_DECLARED_POSSIBILITIES = 'WITHIN_DECLARED_POSSIBILITIES',\n  /** The provider does not offer the deployment model the operator chose. */\n  DEPLOYMENT_MODEL_NOT_OFFERED = 'DEPLOYMENT_MODEL_NOT_OFFERED',\n  /** A vendor-hosted choice names a region the provider does not list — APP-ASSERTED. */\n  REGION_NOT_OFFERED = 'REGION_NOT_OFFERED',\n  /** The provider's profile is UNDETERMINED, so the choice cannot be checked against anything. */\n  PROFILE_UNDETERMINED = 'PROFILE_UNDETERMINED',\n  /** The provider declares no compliance profile at all. */\n  NO_PROFILE = 'NO_PROFILE',\n}\n\n/** One choice, assessed. */\nexport interface ProviderComplianceChoiceAssessmentEntry {\n  readonly providerRef: string;\n  readonly choice: ApplicationProviderComplianceChoice;\n  readonly assessment: ProviderComplianceChoiceAssessment;\n  /** What the provider offers, when established — so a report can name both sides of a divergence. */\n  readonly offered: { readonly deploymentModels: readonly ProviderDeploymentModel[]; readonly processingRegions: readonly string[] } | null;\n}\n\n/** Assess ONE choice against the provider's profile. See {@link ProviderComplianceChoiceAssessment}. */\nexport function assessProviderComplianceChoice(\n  choice: ApplicationProviderComplianceChoice,\n  profile: ProviderComplianceProfile | null | undefined,\n): ProviderComplianceChoiceAssessment {\n  if (profile === null || profile === undefined) return ProviderComplianceChoiceAssessment.NO_PROFILE;\n  const established = establishedProviderComplianceProfile(profile);\n  if (established === null) return ProviderComplianceChoiceAssessment.PROFILE_UNDETERMINED;\n  if (!established.deploymentModels.includes(choice.deploymentModel)) return ProviderComplianceChoiceAssessment.DEPLOYMENT_MODEL_NOT_OFFERED;\n  // A self-hosted choice names no region (the choice schema refuses one), so only a vendor-hosted one is compared.\n  if (choice.processingRegion !== undefined && !established.processingRegions.includes(choice.processingRegion)) {\n    return ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED;\n  }\n  return ProviderComplianceChoiceAssessment.WITHIN_DECLARED_POSSIBILITIES;\n}\n\n/**\n * Every choice assessed against the profiles the application's providers declare, sorted by provider ref.\n *\n * `profilesByProviderRef` maps a ref to what its package declares; a ref absent from it declares nothing\n * ({@link ProviderComplianceChoiceAssessment.NO_PROFILE}). The one comparison the brief, the recipient population\n * and the evidence collector all make — never re-derived beside it.\n *\n * assurance-control: WILDO.PRIVACY.THIRD_PARTY_PROCESSING — each operator choice of a processor's deployment and\n * region is checked against what the processor declares possible, and an unresearched processor is named.\n */\nexport function assessProviderComplianceChoices(params: {\n  readonly choices: ApplicationProviderComplianceChoices;\n  readonly profilesByProviderRef: Readonly<Record<string, ProviderComplianceProfile>>;\n}): readonly ProviderComplianceChoiceAssessmentEntry[] {\n  return Object.entries(params.choices)\n    .sort(([left], [right]) => left.localeCompare(right))\n    .map(([providerRef, choice]) => {\n      const established = establishedProviderComplianceProfile(params.profilesByProviderRef[providerRef]);\n      return {\n        providerRef,\n        choice,\n        assessment: assessProviderComplianceChoice(choice, params.profilesByProviderRef[providerRef]),\n        offered: established === null ? null : { deploymentModels: established.deploymentModels, processingRegions: established.processingRegions },\n      };\n    });\n}\n\n/**\n * Regions an application asserts that the provider does not declare.\n *\n * Reported, never refused — a vendor opening a data centre must not become a build failure, and an\n * operator who genuinely knows better than a stale framework list should be able to say so. What the\n * framework owes is that the divergence is VISIBLE, which is the same trade the personal-data\n * declaration report makes.\n *\n * The {@link ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED} slice of {@link assessProviderComplianceChoices};\n * an UNDETERMINED profile or none is a different gap and is not reported here.\n */\nexport function appAssertedProcessingRegions(params: {\n  readonly choices: ApplicationProviderComplianceChoices;\n  readonly profilesByProviderRef: Readonly<Record<string, ProviderComplianceProfile>>;\n}): ReadonlyArray<{ readonly providerRef: string; readonly region: string }> {\n  return assessProviderComplianceChoices(params)\n    .filter((entry) => entry.assessment === ProviderComplianceChoiceAssessment.REGION_NOT_OFFERED && entry.choice.processingRegion !== undefined)\n    .map((entry) => ({ providerRef: entry.providerRef, region: entry.choice.processingRegion! }));\n}\n/** @wildo_source:part:end saas.models.providers.compliance-choice */\n\n/**\n * One provider a FRONTEND service serves, beside the compliance profile its facet module declares.\n *\n * `complianceProfile: null` is an answer, not an omission: the module's author stated nothing, so\n * whether that browser vendor is a third-party recipient is NOT ESTABLISHED. A reader must report\n * it; skipping it would make the least-documented browser vendor the one a notice never names.\n */\nexport interface ServedFrontendProviderCompliance {\n  /** The frontend service declaration key (`app`, `website`, `docs`, …) the provider is served on. */\n  readonly serviceKey: string;\n  /** The provider ref as the application selects it under that service's provider scope. */\n  readonly providerRef: string;\n  readonly complianceProfile: ProviderComplianceProfile | null;\n}\n\n/**\n * Every provider the application's frontend services SERVE, with the profile its facet declares\n * (#1743) — the browser half of a recipient population.\n *\n * ## The join point\n *\n * The input is `frontendProviderBootstraps` from the application's generated frontend-services\n * runtime artifact (`.wildo-saas/generated/providers/frontend-services.runtime-providers.generated.json`,\n * written by `wildo config sync`), i.e. a `Record<serviceKey, { providers: Record<ref, entry> }>`.\n * Each entry is a `FrontendProviderEntry`, and since #1743 it carries the facet module's\n * `complianceProfile`. That record is the right population on its own: materialized per service,\n * for exactly the providers the service is configured to serve, and readable as JSON without\n * loading a provider package.\n *\n * Typed STRUCTURALLY rather than as `FrontendProvidersBlock`, so this module does not import the\n * frontend-entry module that imports it, and so a caller holding raw parsed JSON can pass it.\n *\n * ## What it does NOT decide\n *\n * Whether a browser vendor is the operator's sub-processor or the person's own vendor. A browser SDK\n * the application keys with its OWN public key (an error-monitoring DSN, an analytics project key, a\n * captcha site key, a search app id) is engaged by the operator; a file picker opening a person's own\n * Drive under THEIR vendor account is not. That classification belongs to the recipient population\n * (#1707), which reads this list rather than re-walking the artifact.\n *\n * The same ref served on two services appears twice, deliberately — a per-service record is what\n * lets a reader say WHICH surface loads the vendor, and the two facets of one vendor may declare\n * different profiles. Sorted by service, then provider, so the output is deterministic.\n */\nexport function listServedFrontendProviderCompliance(\n  bootstraps:\n    | Readonly<Record<string, { readonly providers?: Readonly<Record<string, { readonly complianceProfile?: ProviderComplianceProfile }>> }>>\n    | undefined,\n): readonly ServedFrontendProviderCompliance[] {\n  const served: ServedFrontendProviderCompliance[] = [];\n  for (const [serviceKey, block] of Object.entries(bootstraps ?? {})) {\n    for (const [providerRef, entry] of Object.entries(block?.providers ?? {})) {\n      served.push({ serviceKey, providerRef, complianceProfile: entry?.complianceProfile ?? null });\n    }\n  }\n  return served.sort((left, right) =>\n    left.serviceKey.localeCompare(right.serviceKey) || left.providerRef.localeCompare(right.providerRef));\n}\n\n/**\n * The configured providers that are THIRD-PARTY RECIPIENTS — vendor-hosted, and therefore processors.\n *\n * A self-hosted provider is excluded by construction rather than by a filter a caller must remember:\n * no data leaves the operator, so it is not a recipient and must never be enumerated as one.\n */\nexport function vendorHostedProviderRefs(choices: ApplicationProviderComplianceChoices): readonly string[] {\n  return Object.entries(choices)\n    .filter(([, choice]) => choice.deploymentModel === ProviderDeploymentModel.VENDOR_HOSTED)\n    .map(([providerRef]) => providerRef)\n    .sort();\n}\n"]}

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-component-contract.shared.types.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IACA,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,gBAAgB,CAAC;IAClE,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GACC;IACA,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,qBAAqB,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACC;IACA,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,oBAAoB,CAAC;IACtE,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,qBAAqB,EAAE,GAAG,IAAI,CAAC;IAC7D,sDAAsD;IACtD,QAAQ,IAAI,IAAI,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC7B"}
+{"version":3,"file":"provider-frontend-component-contract.shared.types.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAEpG;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IACA,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,gBAAgB,CAAC;IAClE,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GACC;IACA,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,qBAAqB,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB,GACC;IACA,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC,oBAAoB,CAAC;IACtE,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,WAAW,EAAE,6BAA6B,CAAC;IACpD;;;;;;;;;;;;;;;;OAgBG;IACH,cAAc,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,SAAS,qBAAqB,EAAE,GAAG,IAAI,CAAC;IAC7D,sDAAsD;IACtD,QAAQ,IAAI,IAAI,CAAC;IACjB;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC7B"}

package/dist/esm/external-providers/provider-frontend-component-contract.shared.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-component-contract.shared.types.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG","sourcesContent":["/**\n * The contract between a provider's frontend COMPONENT and the framework surface\n * that mounts it.\n *\n * ## Why it lives here and not beside the module types it serves\n *\n * These types were written in `@wildo-ai/external-connectors-public`, next to the\n * facet module types that declare a component — which reads as the right place\n * until you follow what depends on what:\n *\n *   - a component lives outside the connectors package because it carries React,\n *     which the connectors package must not: in the engine's facet library\n *     (`presets-components`), or in a provider's own frontend facet package\n *     (`<scope>/provider-<ref>-frontend`, a registry provider's `frontend/`\n *     facet as an install leaves it — #2019; until then the archived catalogue\n *     carried hand-authored facets under a per-vendor subpath, #1700);\n *   - that package needs this contract to type its component;\n *   - the connectors package needs to RESOLVE that package, because it reaches the\n *     component by a bare dynamic import.\n *\n * With the contract in the connectors package that is a cycle *through emitted\n * declarations*: the component package's `.d.ts` references the connectors\n * package's `.d.ts`, which makes the connectors package's own `dist` an INPUT of\n * its own build. Measured, not predicted — `tsc` refuses with `TS5055 Cannot\n * write file … because it would overwrite input file`, once per emitted\n * declaration.\n *\n * So the contract belongs BELOW both, and `saas-models` is where \"below both\"\n * already is.\n *\n * ## Why function-valued types are allowed in this package\n *\n * The sibling `provider-frontend-surface.shared.schemas.ts` states that\n * everything in it is the DATA half, and that nothing function-valued may join\n * it. That rule is about VALUES crossing a JSON channel — a projected `activate`\n * would be dropped by `JSON.stringify` with no error anywhere. A TYPE crosses\n * nothing. `onSelect` here is a compile-time obligation on two parties, and it\n * never appears in a wire record.\n *\n * `File` is a DOM type, which this package already uses\n * (`files.shared.utils.ts`), so nothing new is required of its lib.\n */\n\nimport type { ProviderFrontendSelectionDelivery } from './provider-frontend-surface.shared.schemas';\n\n/**\n * What a provider's file picker hands back for ONE chosen file.\n *\n * The three arms are the three answers to issue #383, and the union exists\n * because the decision was **per vendor**: a picker for a credentialed vendor and\n * a picker for a vendor with a browser-safe public token genuinely cannot return\n * the same thing, and both must ship.\n *\n * `kind` is not a runtime choice. Each arm corresponds to exactly one\n * `ProviderFrontendSelectionDelivery`, the provider DECLARES which one it emits,\n * and the framework refuses a selection whose `kind` contradicts that\n * declaration. Without the refusal the union would be the hedge the decision\n * rejected — a contract that says \"one of these three, we will find out at\n * runtime\" is not one an application's file field can be written against.\n */\nexport type ProviderFileSelection =\n  | {\n    /** @see ProviderFrontendSelectionDelivery.REMOTE_REFERENCE */\n    readonly kind: ProviderFrontendSelectionDelivery.REMOTE_REFERENCE;\n    /** Opaque to everything in the browser. Only the application backend can resolve it. */\n    readonly externalId: string;\n    /** What to show the user before the backend has resolved anything. */\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE;\n    readonly file: File;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL;\n    /** Fetchable by the browser. Its origin must be admitted by the surface's composed CSP. */\n    readonly url: string;\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  };\n\n/**\n * The constraints a framework file field imposes on a picker.\n *\n * Resolved by the framework — schema metadata first, then the provider's own\n * `publicConfig` through the capability's named schema — so a picker never\n * re-reads either. `maxSize` is BYTES; a provider stating megabytes in its public\n * config (`maxFileSizeMb`) is converted before it reaches here.\n *\n * ## Why the field names are these and not clearer ones\n *\n * They are the framework file field's OWN names:\n * `resolveFormFieldFileProviderConstraints` in `@wildo-ai/saas-frontend-lib`\n * produces exactly this shape and its `ResolvedFormFieldFileProviderConstraints`\n * is an alias of this type, so there is one source rather than two spellings of\n * one contract.\n *\n * That is not tidiness. The first draft called the size cap `maxSizeBytes` while\n * the resolver called it `maxSize` — both BYTES, both optional — and TypeScript\n * accepts the assignment: the weak-type check is satisfied by the two names that\n * DO match, so wiring the resolver into a picker would have compiled and silently\n * dropped the size cap. A picker would then accept files the field rejects, and\n * the user finds out after choosing one.\n */\nexport interface ProviderFilePickerConstraints {\n  /**\n   * A MUTABLE array, deliberately: `@wildo-ai/zod-decorators`' MIME helpers\n   * (`isMimeTypeAllowed`, `buildAcceptAttribute`) take `string[]`, and this\n   * type's whole reason for existing is to BE the framework file field's own\n   * shape rather than a second one. A `readonly string[]` here would be a better\n   * type in isolation and would force a cast at every one of those call sites,\n   * which is how the drift this type prevents starts again.\n   */\n  allowedMimeTypes?: string[];\n  /** BYTES, not megabytes. */\n  maxSize?: number;\n  maxFiles?: number;\n}\n\n/**\n * The props every `FRONTEND_FILE_PICKER` component receives.\n *\n * `onSelect` takes an ARRAY even for a single-file field. A picker that supports\n * multi-select otherwise needs a second callback or a hidden convention, and a\n * field that allows one file can reject a second selection with a message instead\n * of silently keeping whichever arrived first — which is what a single-value\n * callback forces it to do.\n */\nexport interface ProviderFilePickerProps {\n  /** The provider's own `ref`, so a picker can label what it renders without being told twice. */\n  readonly providerRef: string;\n  /**\n   * The provider's public configuration, already validated against the module's\n   * `publicConfigSchema` when it declares one. A picker never re-coerces it.\n   */\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n  readonly constraints: ProviderFilePickerConstraints;\n  /**\n   * An access token for THIS provider, on behalf of the current user, when the\n   * application has one.\n   *\n   * Optional, and its absence is a real state rather than a defect: a picker that\n   * authenticates through its own vendor popup (OneDrive's does) needs nothing\n   * here, and an application that has not connected a user's account to this\n   * provider has nothing to give. A picker that does need one must call this and\n   * report through `onError` when it is absent — never fall back to a token from\n   * `publicConfig`, which is served to every browser.\n   *\n   * Supplying it is the account-connection surface's job (issue #333), which does\n   * not exist yet; until it does, the framework passes nothing and a picker that\n   * requires a token says so. The prop is declared now so that the dependency is\n   * VISIBLE in the contract rather than discovered by whoever writes the second\n   * picker.\n   */\n  getAccessToken?(): Promise<string | undefined>;\n  /**\n   * Called with everything the user chose. May be called once with several files;\n   * must not be called after `onCancel`.\n   */\n  onSelect(selections: readonly ProviderFileSelection[]): void;\n  /** The user dismissed the picker without choosing. */\n  onCancel(): void;\n  /**\n   * The picker could not run — the vendor SDK failed to load, a grant was\n   * refused, the vendor returned an error. Reported rather than thrown: a throw\n   * inside a picker's own event handler does not reach a React error boundary, so\n   * it would be a surface that silently stops responding.\n   */\n  onError(error: Error): void;\n}\n"]}
+{"version":3,"file":"provider-frontend-component-contract.shared.types.js","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-component-contract.shared.types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG","sourcesContent":["/**\n * The contract between a provider's frontend COMPONENT and the framework surface\n * that mounts it.\n *\n * ## Why it lives here and not beside the module types it serves\n *\n * These types were written in `@wildo-ai/external-connectors-public`, next to the\n * facet module types that declare a component — which reads as the right place\n * until you follow what depends on what:\n *\n *   - a component lives outside the connectors package because it carries React,\n *     which the connectors package must not: in the engine's facet library\n *     (`presets-components`), or in a provider's own frontend facet package\n *     (`<scope>/provider-<ref>-frontend`, a registry provider's `frontend/`\n *     facet as an install leaves it — #2019; until then the archived catalogue\n *     carried hand-authored facets under a per-vendor subpath, #1700);\n *   - that package needs this contract to type its component;\n *   - the connectors package needs to RESOLVE that package, because it reaches the\n *     component by a bare dynamic import.\n *\n * With the contract in the connectors package that is a cycle *through emitted\n * declarations*: the component package's `.d.ts` references the connectors\n * package's `.d.ts`, which makes the connectors package's own `dist` an INPUT of\n * its own build. Measured, not predicted — `tsc` refuses with `TS5055 Cannot\n * write file … because it would overwrite input file`, once per emitted\n * declaration.\n *\n * So the contract belongs BELOW both, and `saas-models` is where \"below both\"\n * already is.\n *\n * ## Why function-valued types are allowed in this package\n *\n * The sibling `provider-frontend-surface.shared.schemas.ts` states that\n * everything in it is the DATA half, and that nothing function-valued may join\n * it. That rule is about VALUES crossing a JSON channel — a projected `activate`\n * would be dropped by `JSON.stringify` with no error anywhere. A TYPE crosses\n * nothing. `onSelect` here is a compile-time obligation on two parties, and it\n * never appears in a wire record.\n *\n * `File` is a DOM type, which this package already uses\n * (`files.shared.utils.ts`), so nothing new is required of its lib.\n */\n\nimport type { ProviderFrontendSelectionDelivery } from './provider-frontend-surface.shared.schemas';\n\n/**\n * What a provider's file picker hands back for ONE chosen file.\n *\n * The three arms are the three answers to issue #383, and the union exists\n * because the decision was **per vendor**: a picker for a credentialed vendor and\n * a picker for a vendor with a browser-safe public token genuinely cannot return\n * the same thing, and both must ship.\n *\n * `kind` is not a runtime choice. Each arm corresponds to exactly one\n * `ProviderFrontendSelectionDelivery`, the provider DECLARES which one it emits,\n * and the framework refuses a selection whose `kind` contradicts that\n * declaration. Without the refusal the union would be the hedge the decision\n * rejected — a contract that says \"one of these three, we will find out at\n * runtime\" is not one an application's file field can be written against.\n */\nexport type ProviderFileSelection =\n  | {\n    /** @see ProviderFrontendSelectionDelivery.REMOTE_REFERENCE */\n    readonly kind: ProviderFrontendSelectionDelivery.REMOTE_REFERENCE;\n    /** Opaque to everything in the browser. Only the application backend can resolve it. */\n    readonly externalId: string;\n    /** What to show the user before the backend has resolved anything. */\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_FILE;\n    readonly file: File;\n  }\n  | {\n    /** @see ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL */\n    readonly kind: ProviderFrontendSelectionDelivery.BROWSER_READABLE_URL;\n    /** Fetchable by the browser. Its origin must be admitted by the surface's composed CSP. */\n    readonly url: string;\n    readonly displayName?: string;\n    readonly mimeType?: string;\n    readonly sizeBytes?: number;\n  };\n\n/**\n * The constraints a framework file field imposes on a picker.\n *\n * Resolved by the framework — schema metadata first, then the provider's own\n * `publicConfig` through the capability's named schema — so a picker never\n * re-reads either. `maxSize` is BYTES; a provider stating megabytes in its public\n * config (`maxFileSizeMb`) is converted before it reaches here.\n *\n * ## Why the field names are these and not clearer ones\n *\n * They are the framework file field's OWN names:\n * `resolveFormFieldFileProviderConstraints` in `@wildo-ai/saas-frontend-lib`\n * produces exactly this shape and its `ResolvedFormFieldFileProviderConstraints`\n * is an alias of this type, so there is one source rather than two spellings of\n * one contract.\n *\n * That is not tidiness. The first draft called the size cap `maxSizeBytes` while\n * the resolver called it `maxSize` — both BYTES, both optional — and TypeScript\n * accepts the assignment: the weak-type check is satisfied by the two names that\n * DO match, so wiring the resolver into a picker would have compiled and silently\n * dropped the size cap. A picker would then accept files the field rejects, and\n * the user finds out after choosing one.\n */\nexport interface ProviderFilePickerConstraints {\n  /**\n   * A MUTABLE array, deliberately: `@wildo-ai/zod-decorators`' MIME helpers\n   * (`isMimeTypeAllowed`, `buildAcceptAttribute`) take `string[]`, and this\n   * type's whole reason for existing is to BE the framework file field's own\n   * shape rather than a second one. A `readonly string[]` here would be a better\n   * type in isolation and would force a cast at every one of those call sites,\n   * which is how the drift this type prevents starts again.\n   */\n  allowedMimeTypes?: string[];\n  /** BYTES, not megabytes. */\n  maxSize?: number;\n  maxFiles?: number;\n}\n\n/**\n * The props every `FRONTEND_FILE_PICKER` component receives.\n *\n * `onSelect` takes an ARRAY even for a single-file field. A picker that supports\n * multi-select otherwise needs a second callback or a hidden convention, and a\n * field that allows one file can reject a second selection with a message instead\n * of silently keeping whichever arrived first — which is what a single-value\n * callback forces it to do.\n */\nexport interface ProviderFilePickerProps {\n  /** The provider's own `ref`, so a picker can label what it renders without being told twice. */\n  readonly providerRef: string;\n  /**\n   * The provider's public configuration, already validated against the module's\n   * `publicConfigSchema` when it declares one. A picker never re-coerces it.\n   */\n  readonly publicConfig: Readonly<Record<string, unknown>>;\n  readonly constraints: ProviderFilePickerConstraints;\n  /**\n   * An access token for THIS provider, on behalf of the current user, when the\n   * application has one.\n   *\n   * Optional, and its absence is a real state rather than a defect: a picker that\n   * authenticates through its own vendor popup (OneDrive's does) needs nothing\n   * here, and an application that has not connected a user's account to this\n   * provider has nothing to give. A picker that does need one must call this and\n   * report through `onError` when it is absent — never fall back to a token from\n   * `publicConfig`, which is served to every browser.\n   *\n   * Supplying it is the account-connection surface's job (issue #333), which does\n   * not exist yet; until it does, the framework passes nothing and a picker that\n   * requires a token says so. The prop is declared now so that the dependency is\n   * VISIBLE in the contract rather than discovered by whoever writes the second\n   * picker.\n   */\n  getAccessToken?(): Promise<string | undefined>;\n  /**\n   * Called with everything the user chose. May be called once with several files;\n   * must not be called after `onCancel`.\n   */\n  onSelect(selections: readonly ProviderFileSelection[]): void;\n  /** The user dismissed the picker without choosing. */\n  onCancel(): void;\n  /**\n   * The picker could not run — the vendor SDK failed to load, a grant was\n   * refused, the vendor returned an error. Reported rather than thrown: a throw\n   * inside a picker's own event handler does not reach a React error boundary, so\n   * it would be a surface that silently stops responding.\n   */\n  onError(error: Error): void;\n}\n"]}

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-surface.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,MAAM,kBAAkB;IACxB,OAAO,mBAAmB;IAC1B,KAAK,iBAAiB;IACtB,GAAG,eAAe;IAClB,KAAK,iBAAiB;IACtB,IAAI,gBAAgB;IACpB;;;;OAIG;IACH,MAAM,kBAAkB;IACxB,gHAAgH;IAChH,KAAK,iBAAiB;CACvB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,EAAE,SAAS,+BAA+B,EAE1F,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC;IACjD,kEAAkE;;;kBAGlE,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,kCAAkC;IAC7C,uEAAuE;;IAEvE,gGAAgG;;IAEhG,gGAAgG;;IAEhG,oEAAoE;;IAEpE,iEAAiE;;IAEjE,8DAA8D;;IAE9D,+HAA+H;;IAE/H,oEAAoE;;IAEpE;;;;OAIG;;QA3BH,kEAAkE;;;;kBA6BlE,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAEzG;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,uCAAuC,GACnD,4BAA4B,CAE9B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mCAAmC;IAC9C,kEAAkE;;IAElE;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,oBAAY,iCAAiC;IAC3C,gIAAgI;IAChI,SAAS,cAAc;IACvB,kHAAkH;IAClH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uCAAuC;IAEhD,sFAAsF;;IAEtF,mDAAmD;;;;;kBAgBnD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,gBAAgB,qBAAqB;IACrC;;;;;;OAMG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,oBAAY,qCAAqC;IAC/C,8GAA8G;IAC9G,IAAI,SAAS;IACb;;;OAGG;IACH,SAAS,cAAc;CACxB;AAED,qJAAqJ;AACrJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,sCAAsC;IACjD,6FAA6F;;IAE7F,wGAAwG;;IAExG;;;OAGG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AACtG,6EAA6E;AAE7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;OAIG;;IAEH;;;;;OAKG;;IAEH;;;;;OAKG;;QArDH,6FAA6F;;QAE7F,wGAAwG;;QAExG;;;WAGG;;QAEH;;;;;;WAMG;;;kBAwCH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0CAA0C;IAlCrD;;;;OAIG;;IAEH;;;;;OAKG;;IAEH;;;;;OAKG;;QArDH,6FAA6F;;QAE7F,wGAAwG;;QAExG;;;WAGG;;QAEH;;;;;;WAMG;;;mBAyDJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}
+{"version":3,"file":"provider-frontend-surface.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,MAAM,kBAAkB;IACxB,OAAO,mBAAmB;IAC1B,KAAK,iBAAiB;IACtB,GAAG,eAAe;IAClB,KAAK,iBAAiB;IACtB,IAAI,gBAAgB;IACpB;;;;OAIG;IACH,MAAM,kBAAkB;IACxB,gHAAgH;IAChH,KAAK,iBAAiB;CACvB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC,EAAE,SAAS,+BAA+B,EAE1F,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC;IACjD,kEAAkE;;;kBAGlE,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,kCAAkC;IAC7C,uEAAuE;;IAEvE,gGAAgG;;IAEhG,gGAAgG;;IAEhG,oEAAoE;;IAEpE,iEAAiE;;IAEjE,8DAA8D;;IAE9D,+HAA+H;;IAE/H,oEAAoE;;IAEpE;;;;OAIG;;QA3BH,kEAAkE;;;;kBA6BlE,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAEzG;;;;;;;;GAQG;AACH,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,uCAAuC,GACnD,4BAA4B,CAE9B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mCAAmC;IAC9C,kEAAkE;;IAElE;;;;OAIG;;kBAEH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,oBAAY,iCAAiC;IAC3C,gIAAgI;IAChI,SAAS,cAAc;IACvB,kHAAkH;IAClH,eAAe,oBAAoB;CACpC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uCAAuC;IAEhD,sFAAsF;;IAEtF,mDAAmD;;;;;kBAgBnD,CAAC;AACL,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,oBAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,gBAAgB,qBAAqB;IACrC;;;;;;OAMG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,oBAAY,qCAAqC;IAC/C,8GAA8G;IAC9G,IAAI,SAAS;IACb;;;OAGG;IACH,SAAS,cAAc;CACxB;AAED,qJAAqJ;AACrJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,sCAAsC;IACjD,6FAA6F;;IAE7F,wGAAwG;;IAExG;;;OAGG;;IAEH;;;;;;OAMG;;kBAEH,CAAC;AACH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AACtG,6EAA6E;AAE7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,yCAAyC;IACpD;;;;OAIG;;IAEH;;;;;OAKG;;IAEH;;;;;OAKG;;QArDH,6FAA6F;;QAE7F,wGAAwG;;QAExG;;;WAGG;;QAEH;;;;;;WAMG;;;kBAwCH,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0CAA0C;IAlCrD;;;;OAIG;;IAEH;;;;;OAKG;;IAEH;;;;;OAKG;;QArDH,6FAA6F;;QAE7F,wGAAwG;;QAExG;;;WAGG;;QAEH;;;;;;WAMG;;;mBAyDJ,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC"}

package/dist/esm/external-providers/provider-frontend-surface.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-frontend-surface.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAeX;AAfD,WAAY,+BAA+B;IACzC,2DAAwB,CAAA;IACxB,6DAA0B,CAAA;IAC1B,yDAAsB,CAAA;IACtB,qDAAkB,CAAA;IAClB,yDAAsB,CAAA;IACtB,uDAAoB,CAAA;IACpB;;;;OAIG;IACH,2DAAwB,CAAA;IACxB,gHAAgH;IAChH,yDAAsB,CAAA;AACxB,CAAC,EAfW,+BAA+B,KAA/B,+BAA+B,QAe1C;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,MAAM,CAAC,MAAM,CAC3G,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,8DAA8D;IAC9D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,+HAA+H;IAC/H,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAyBH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAoD;IAEpD,OAAO,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,kEAAkE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,gIAAgI;IAChI,4DAAuB,CAAA;IACvB,kHAAkH;IAClH,wEAAmC,CAAA;AACrC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,mDAAmD;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACjE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mGAAmG;kBACjG,+EAA+E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,iCAuBX;AAvBD,WAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,0EAAqC,CAAA;IACrC;;;;;;OAMG;IACH,oFAA+C,CAAA;IAC/C;;;;;OAKG;IACH,kFAA6C,CAAA;AAC/C,CAAC,EAvBW,iCAAiC,KAAjC,iCAAiC,QAuB5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAN,IAAY,qCAQX;AARD,WAAY,qCAAqC;IAC/C,8GAA8G;IAC9G,sDAAa,CAAA;IACb;;;OAGG;IACH,gEAAuB,CAAA;AACzB,CAAC,EARW,qCAAqC,KAArC,qCAAqC,QAQhD;AAED,qJAAqJ;AACrJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,6FAA6F;IAC7F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,wGAAwG;IACxG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,6EAA6E;AAE7E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACvE;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;IAC1E;;;;;OAKG;IACH,aAAa,EAAE,sCAAsC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,gCAAgC,GAGlC;IACF,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,gBAAgB;IAC3D,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,GAAG,CAAC,EAAE,YAAY;IACnD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,aAAa;IACrD,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;CACxD,CAAC;AACF,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * Frontend-surface atoms a provider declares: what it needs the page to be\n * ALLOWED to reach (its CSP footprint), which vendor SDK package it loads, and\n * which third-party `<script>` tags it asks the surface to add.\n *\n * ## Why these are DATA and live here\n *\n * A frontend provider reaches its surface through TWO channels, and only one of\n * them can carry code:\n *\n *   - the **DATA** channel — `FrontendProviderEntry`, projected by the backend\n *     into `/application-config` and materialized into the generated\n *     frontend-services artifact. It is JSON end to end, so nothing\n *     function-valued survives it (it used to be cast to a module type anyway,\n *     which is the defect this split closes);\n *   - the **CODE** channel — the provider package's own facet barrel, imported\n *     by the bundle through the generated `frontend-providers.generated.ts`.\n *\n * Everything in this file is the DATA half. It is what the CLI, the CSP\n * composer and the bundle-isolation policy need to SEE without executing any\n * frontend module — and the CLI genuinely cannot execute one: it is a Node\n * process and these modules are browser-bound. The executable half (`sdk.activate`,\n * `publicConfigSchema`) lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this boundary.\n *\n * Added by slice S4a of epic #337 (issue #332).\n */\n\nimport { z } from 'zod';\n\n/**\n * The origins a provider needs the composed Content-Security-Policy to admit,\n * grouped by WHAT THE PROVIDER IS REACHING rather than by CSP directive name.\n *\n * ## Why semantic buckets and not directive names\n *\n * `CSP_DIRECTIVE_NAMES` is a closed vocabulary that already has one named\n * runtime source, in `@wildo-ai/platform-config-lib`. That package DEPENDS on\n * this one, so this file cannot reference it, and re-declaring the list here\n * would create a second source for one vocabulary — precisely what the\n * one-named-source rule exists to prevent, and the way the two copies would\n * drift the first time a directive is added.\n *\n * Keying on intent instead is also the better contract. A provider author knows\n * \"my SDK is fetched from `https://js.stripe.com` and it calls back to\n * `https://api.stripe.com`\"; which directive grades which fetch is framework\n * knowledge, and it lives in exactly one place — the bucket-to-directive\n * mapping in `platform-config-lib`'s `csp-emit.ts`.\n *\n * ## Why it is STRICT while the entry that carries it is loose\n *\n * The entry is a WIRE record read by a possibly-older consumer, so it tolerates\n * unknown keys (see `frontend-provider-entry.shared.schemas.ts`). This footprint\n * is AUTHORED, by a provider package, and validated where it is authored — so a\n * misspelled bucket must fail loudly rather than contribute nothing. That\n * distinction matters more here than anywhere else in the frontend surface:\n * CSP is enforced in production and report-only in development, so a bucket that\n * silently contributes nothing is invisible until the provider breaks in\n * production only.\n *\n * Adding a bucket is not a one-sided producer change either — a new bucket is\n * useless until `csp-emit.ts` maps it to a directive — so strictness costs no\n * version-skew tolerance that was ever available.\n *\n * Every field defaults to `[]`: a provider that declares a footprint at all is\n * making a complete statement about the buckets it did not name.\n */\n/**\n * Which bucket an origin lands in, as a value a provider can name.\n *\n * The bucket names are already the footprint's field names; this enum is what\n * lets a provider REFER to one — a derived origin has to say where it goes, and\n * a bare string there would be a second, unexplained spelling of a closed\n * vocabulary. A compile-time check below pins the two together.\n */\nexport enum ProviderFrontendCspOriginBucket {\n  SCRIPT = 'scriptOrigins',\n  CONNECT = 'connectOrigins',\n  FRAME = 'frameOrigins',\n  IMG = 'imgOrigins',\n  STYLE = 'styleOrigins',\n  FONT = 'fontOrigins',\n  /**\n   * Origins a provider starts a Web Worker, Shared Worker or service worker from (`worker-src`) — a map\n   * SDK's tile decoder, a session-replay compressor. Frequently `blob:`, which a provider may name here\n   * as a scheme source (#1702).\n   */\n  WORKER = 'workerOrigins',\n  /** Origins a provider plays audio or video from (`media-src`) — an embed with sound, a video player (#1702). */\n  MEDIA = 'mediaOrigins',\n}\n\n/**\n * Every bucket, in declaration order — the ONE list a consumer iterates when it has to visit each\n * bucket of a footprint (the hydration staleness join, the CLI's derived-origin resolution).\n *\n * Derived from the enum rather than written out, because a hand-kept list of buckets is how a new one\n * gets authored, serialized and then silently dropped by the one consumer that did not learn about it:\n * the CLI's derived-origin resolver re-listed the six buckets by hand until #1702, so a seventh would\n * have been erased there for any provider that also derives an origin.\n */\nexport const PROVIDER_FRONTEND_CSP_ORIGIN_BUCKETS: readonly ProviderFrontendCspOriginBucket[] = Object.freeze(\n  Object.values(ProviderFrontendCspOriginBucket),\n);\n\n/**\n * An origin the framework must READ OUT OF the provider's own public config,\n * because the provider cannot know it.\n *\n * The case that forced this: an error-monitoring provider sends to the host\n * inside its DSN, and a product-analytics provider to whatever `apiHost` the\n * application configured — including a self-hosted one. Both are per\n * APPLICATION, and often per ENVIRONMENT, so no static list on the provider\n * module can contain them. Without this the application would have to author\n * the same host twice — once as the provider's config and once in its CSP — and\n * the copy that drifts fails in production only, because development is\n * report-only.\n *\n * Resolution is data, not code: the CLI takes `publicConfig[publicConfigKey]`,\n * reads its URL origin, and adds it to `bucket`. An absent key contributes\n * nothing (the provider simply is not configured for that service); a key that\n * is present and is NOT a URL fails the sync loudly, because silently dropping\n * it is the exact failure this exists to prevent.\n */\nexport const ProviderFrontendCspDerivedOriginSchema = z.strictObject({\n  /** Key in this provider's `publicConfig` whose value is a URL. */\n  publicConfigKey: z.string().min(1),\n  bucket: z.enum(ProviderFrontendCspOriginBucket),\n});\nexport type ProviderFrontendCspDerivedOrigin = z.infer<typeof ProviderFrontendCspDerivedOriginSchema>;\n\nexport const ProviderFrontendCspFootprintSchema = z.strictObject({\n  /** Origins the surface loads executable script from (`script-src`). */\n  scriptOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider's code opens fetch / XHR / WebSocket connections to (`connect-src`). */\n  connectOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider embeds in an iframe — a picker, a checkout, a meeting (`frame-src`). */\n  frameOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads images or pixels from (`img-src`). */\n  imgOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads stylesheets from (`style-src`). */\n  styleOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads web fonts from (`font-src`). */\n  fontOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider starts workers from (`worker-src`), `blob:` included. See `ProviderFrontendCspOriginBucket.WORKER`. */\n  workerOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider plays audio or video from (`media-src`). */\n  mediaOrigins: z.array(z.string().min(1)).default([]),\n  /**\n   * Origins the framework reads out of this provider's own `publicConfig`,\n   * for the endpoints a provider cannot know in advance. See\n   * {@link ProviderFrontendCspDerivedOriginSchema}.\n   */\n  derivedOrigins: z.array(ProviderFrontendCspDerivedOriginSchema).default([]),\n});\nexport type ProviderFrontendCspFootprint = z.infer<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * The footprint as a provider AUTHORS it: name only the buckets you reach.\n *\n * Authoring and the wire are deliberately different shapes, and the asymmetry\n * is the point.\n *\n *   - **Authoring is partial.** A provider that only loads a script should write\n *     `{ scriptOrigins: ['https://js.acme.com'] }`, not that plus four empty\n *     arrays. Four empty arrays are noise at exactly the place the declaration\n *     should be readable, and noise is what stops a reviewer noticing the one\n *     line that grants an origin.\n *   - **The wire is total.** Every bucket is present by the time the footprint\n *     reaches an entry, so the CSP composer never branches on absence and the\n *     staleness comparison between a served footprint and its module's has two\n *     comparable shapes rather than a partial and a total that differ in every\n *     bucket nobody named.\n *\n * Derived as `z.input` rather than written as a `Partial<…>`, so it cannot drift\n * from the schema: adding a bucket makes it optional here automatically.\n */\nexport type ProviderFrontendCspFootprintDeclaration = z.input<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * Fills in the buckets a declaration did not name.\n *\n * The ONE place that normalization happens, used by the projection that builds\n * an entry and by the hydration join that compares one against a module. Two\n * copies would eventually disagree about whether an unnamed bucket is `[]` or\n * absent, and the join reads that difference as a stale artifact — a false\n * alarm on the diagnostic whose whole job is to be believed.\n */\nexport function normalizeProviderFrontendCspFootprint(\n  declaration: ProviderFrontendCspFootprintDeclaration,\n): ProviderFrontendCspFootprint {\n  return ProviderFrontendCspFootprintSchema.parse(declaration);\n}\n\n/**\n * The DATA half of a provider's `sdk` declaration: WHICH npm package carries the\n * vendor SDK, and at which range.\n *\n * The CODE half — the dynamic import and the vendor's initialization call — is\n * `ProviderFrontendSdk.activate` on the facet module type, and is deliberately\n * absent here: a function cannot cross a JSON channel, and a channel that\n * silently drops one is worse than a channel that never carried it.\n *\n * The descriptor is not decoration. It is what the bundle-isolation policy reads\n * to decide whether a bare specifier a provider package imports was DECLARED,\n * what an application's dependency alignment needs in order to install the SDK\n * as an optional peer, and what a human reads when asking why a bundle grew.\n *\n * Who authors it, since the epic's bulk-integration model was reversed on\n * 2026-09-06: a FIRST-CLASS provider package or an application's own provider\n * module. The scraper-mapper that fills the catalogue emits identity, auth, a\n * secrets contract and an operation catalogue on the `rest` arm — a\n * backend-only package — so a scraped provider has no frontend facet to carry\n * this. That is a narrowing of the population, not of the contract: the pickers\n * and embeds this surface exists for were always the hand-authored kind.\n */\nexport const ProviderFrontendSdkDescriptorSchema = z.strictObject({\n  /** npm package name of the vendor SDK, e.g. `@sentry/browser`. */\n  packageName: z.string().min(1),\n  /**\n   * Semver range the provider was built against. Optional because a provider\n   * that pins its SDK as a direct dependency has already said so in its own\n   * manifest; stating it here as well would be a second copy of that pin.\n   */\n  versionRange: z.string().min(1).optional(),\n});\nexport type ProviderFrontendSdkDescriptor = z.infer<typeof ProviderFrontendSdkDescriptorSchema>;\n\n/**\n * `crossorigin` attribute values for a provider-declared `<script>`.\n *\n * A closed vocabulary with a named runtime source rather than a bare literal\n * union, so each member can carry why it exists — and there are exactly two\n * reasons to pick one over the other.\n */\nexport enum ProviderFrontendScriptCrossOrigin {\n  /** No credentials are sent; the response must carry `Access-Control-Allow-Origin`. The right choice for a public CDN script. */\n  ANONYMOUS = 'anonymous',\n  /** Cookies and TLS client certificates are sent. Only for a vendor that authenticates the script fetch itself. */\n  USE_CREDENTIALS = 'use-credentials',\n}\n\n/**\n * A third-party `<script>` a provider asks its surface to add — the case a\n * dynamic `import()` cannot serve, because the vendor ships a global-installing\n * tag rather than an npm module (reCAPTCHA, most tag managers, several chat\n * widgets).\n *\n * `integrity` is Subresource Integrity. It is optional because a vendor that\n * versionless-serves a mutable URL (again, reCAPTCHA) cannot publish a stable\n * hash — but when it IS given the surface must also send `crossorigin`, or the\n * browser refuses the integrity check outright. That coupling is enforced below\n * rather than left to each surface to remember.\n */\nexport const ProviderFrontendScriptDeclarationSchema = z\n  .strictObject({\n    /** Absolute URL of the script. Its origin must also appear in `csp.scriptOrigins`. */\n    src: z.string().min(1),\n    /** Subresource-integrity hash, e.g. `sha384-…`. */\n    integrity: z.string().min(1).optional(),\n    crossOrigin: z.enum(ProviderFrontendScriptCrossOrigin).optional(),\n    async: z.boolean().optional(),\n    defer: z.boolean().optional(),\n  })\n  .superRefine((declaration, context) => {\n    if (declaration.integrity !== undefined && declaration.crossOrigin === undefined) {\n      context.addIssue({\n        code: 'custom',\n        path: ['crossOrigin'],\n        message:\n          'A script declaring `integrity` must also declare `crossOrigin`; without it the browser skips the '\n          + 'integrity check for a cross-origin script, so the hash would protect nothing.',\n      });\n    }\n  });\nexport type ProviderFrontendScriptDeclaration = z.infer<typeof ProviderFrontendScriptDeclarationSchema>;\n\n/**\n * WHAT a provider's component hands back, when what it hands back is a thing\n * rather than a value.\n *\n * ## The question this answers, and why it is a DECLARATION\n *\n * An application's objective is that it calls third-party APIs directly from\n * custom frontend components. On the backend that is unambiguous. In a browser\n * it is not, because a tenant credential must never get there — so a picker for\n * a credentialed vendor and a picker for a vendor with a browser-safe public\n * token cannot hand back the same thing, and the framework surface that\n * receives a selection has to know which before it mounts anything.\n *\n * Settled 2026-09-07 (issue #383, recorded as Q5 of the provider-architecture\n * plan): **per vendor, DECLARED.** Both shapes are real and both ship; which one\n * a provider emits is a static fact about that provider, stated here and\n * visible on the DATA channel without executing a line of its code.\n *\n * The word doing the work is *declared*. A discriminated union alone would let a\n * provider decide at runtime, which is the shape the decision explicitly\n * rejected — so the framework REFUSES a selection whose discriminant contradicts\n * this field. Without that refusal the declaration is decoration, and a reviewer\n * reading a provider's manifest would be reading a wish.\n *\n * ## Why a single value and not a set\n *\n * A provider that genuinely could emit either — Google's Picker hands back both\n * a file id and a URL, and which is usable depends on the granted OAuth scope —\n * was the argument for `selectionDelivery: [...]`. Rejected: an array puts the\n * choice back at runtime, which is the half of the decision that carries all the\n * weight. A vendor whose two modes are both wanted contributes two components,\n * and the chooser then shows them as what they are — two different things a user\n * can pick between — rather than one component whose behaviour a reader cannot\n * predict.\n *\n * ## What it means for CSP\n *\n * `REMOTE_REFERENCE` does NOT imply a provider needs no `connectOrigins`: a\n * picker still talks to its vendor to RENDER, even when the bytes it selects are\n * fetched later by the backend. So this field does not gate the CSP buckets, and\n * a guard inferring otherwise would break every real picker. What it does gate\n * is where the SELECTED OBJECT travels.\n */\nexport enum ProviderFrontendSelectionDelivery {\n  /**\n   * An opaque handle only the application backend can resolve — a Drive file id,\n   * a DAM asset key. The browser never holds the bytes and never authenticates\n   * to the vendor for them; the framework routes the reference to the\n   * application's executor door, which holds the tenant credential.\n   */\n  REMOTE_REFERENCE = 'REMOTE_REFERENCE',\n  /**\n   * Bytes the browser already holds, as a `File`. Available only to a vendor\n   * whose picker runs on a browser-safe grant — a publishable key, a\n   * user-consented OAuth token, a picker's own scoped grant — so nothing\n   * tenant-secret is involved. The framework uploads it exactly as it uploads a\n   * file chosen from disk.\n   */\n  BROWSER_READABLE_FILE = 'BROWSER_READABLE_FILE',\n  /**\n   * A URL the browser may fetch, under the same browser-safe-grant condition as\n   * `BROWSER_READABLE_FILE`. Distinct from it because the framework must fetch\n   * before it can upload, and that fetch is a network call the composed CSP has\n   * to admit — a difference the surface cannot discover from a `File`.\n   */\n  BROWSER_READABLE_URL = 'BROWSER_READABLE_URL',\n}\n\n/**\n * Whether an address-lookup component hands back the VENDOR'S identifier for the place it matched (#1702,\n * narrowed by #561 D3).\n *\n * ## Why this is DECLARED, per component\n *\n * The structured address a lookup returns is the application's own data: the person typed it, the\n * vendor only helped spell it. The vendor's place identifier is different — it is the vendor's key, and\n * vendors disagree on whether it may be kept (Google allows it indefinitely, Mapbox does not promise it is\n * stable, Loqate's public documentation says nothing). So a component declares once, statically, whether\n * it returns one, and the framework holds every selection to it — the #383 rule for `selectionDelivery`,\n * applied here. A runtime flag on each selection was the rejected alternative: it would let the component\n * decide per selection, which is not a decision a component can own.\n *\n * ## Why there is no \"storable\" member (#561 D3)\n *\n * The framework NEVER stores a vendor place id, whatever the vendor allows. It travels only inside one\n * lookup session, from the suggestion to the retrieval, and what is saved is the address the person\n * confirmed. A `STORABLE` member existed from #1702 until #561 and nothing read it: a declaration that\n * permits storage while nothing can store is a claim nothing checks, and a later reader would take it as a\n * licence. Rejected with it: a `placeRef` slot on `AddressValue`, which would mix vendor data into\n * application data under a retention that differs per vendor.\n *\n * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — \"Place ID\n * caching exception\": the place ID \"is exempt from the caching restrictions\". Fetched 2026-09-29. The Mapbox\n * and Loqate readings are #561's 2026-09-14 research, summarised rather than quoted.\n */\nexport enum ProviderAddressLookupPlaceIdRetention {\n  /** The component returns no place id. A selection carrying one contradicts the declaration and is refused. */\n  NONE = 'NONE',\n  /**\n   * A place id may be returned for the current interaction (re-querying the vendor for the same place),\n   * and is never stored: the field keeps only the address.\n   */\n  TRANSIENT = 'TRANSIENT',\n}\n\n/** @wildo_source:part:start saas.models.provider-address-lookup-declaration facet:layer:shared facet:family:provider facet:audience:app-developer */\n/**\n * How a `FRONTEND_ADDRESS_LOOKUP` component reaches its vendor, and what the vendor's terms require of the\n * page (#561) — the DATA half a reviewer reads, and the half the framework's host ENFORCES.\n *\n * ## Why the lookup names backend OPERATIONS rather than a vendor URL (#561 D2)\n *\n * The vendor is never called from the page. Each suggestion and the final retrieval run through the\n * application backend's provider-operation door (`POST /provider-operations/:providerRef/:operationId`),\n * which spends the application's own credential, admits the operation by `providers.browserOperations`,\n * throttles each caller, and records a `PROVIDER_OPERATION_CALL` row that carries no typed input. So the\n * page holds no vendor key and needs no vendor origin in its CSP, and every vendor is reached one way.\n * Google recommends exactly this for its web services: \"Using a secure proxy server provides a solid source\n * for interacting with a Google Maps Platform web service endpoint from a client-side application without\n * exposing your API key\".\n * spec-cite: https://developers.google.com/maps/api-security-best-practices — \"Proxy server\", fetched 2026-09-29.\n *\n * The host hands the component two functions, `suggest` and `retrieve`, bound to the two operation ids\n * declared here, so a reviewer reading the manifest sees which backend operations the application must open to\n * browsers. What BOUNDS a component is the door, not this declaration: a component is code and could call the\n * browser door itself, and the door runs only the operations the application listed in `providers.browserOperations`.\n *\n * ## Why the session token and the attribution are declared rather than left to the component (#561 D4)\n *\n * Both are vendor TERMS, and a term a component may forget is not held. The host generates one UUIDv4 per\n * lookup session and writes it into the input field named by `sessionTokenInput` on every suggestion and on\n * the retrieval, then starts a new session after a retrieval or when the lookup is abandoned — the vendor\n * bills per session, and a missing or reused token bills every keystroke. The host renders\n * `attributionMark` beside the lookup whenever it is mounted.\n */\nexport const ProviderAddressLookupDeclarationSchema = z.strictObject({\n  /** The backend operation of the SAME provider ref that turns typed text into suggestions. */\n  suggestOperationId: z.string().trim().min(1),\n  /** The backend operation of the same ref that turns one chosen suggestion into a structured address. */\n  retrieveOperationId: z.string().trim().min(1),\n  /**\n   * The operation INPUT field the vendor reads its session token from, when the vendor bills by session.\n   * Absent: the vendor takes none, and the host sends none.\n   */\n  sessionTokenInput: z.string().trim().min(1).optional(),\n  /**\n   * The attribution the vendor requires beside its suggestions, VERBATIM — a trademark, never translated\n   * (Google: \"the text Google Maps is acceptable\" where its logo does not fit). The host renders it inside a\n   * sentence from the application's own labels.\n   * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — attribution without a\n   * Google map, fetched 2026-09-29.\n   */\n  attributionMark: z.string().trim().min(1).optional(),\n});\nexport type ProviderAddressLookupDeclaration = z.infer<typeof ProviderAddressLookupDeclarationSchema>;\n/** @wildo_source:part:end saas.models.provider-address-lookup-declaration */\n\n/**\n * The DATA half of one component a provider contributes — everything about it\n * that a reviewer, the CLI or a build step can read without running a browser.\n *\n * The loader is the CODE half and stays on the facet module in\n * `@wildo-ai/external-connectors-public`, exactly as `sdk.activate` does. What\n * crosses the wire is the fact that a component EXISTS for this capability, plus\n * the contract it commits to.\n *\n * Strict, and for the same reason the CSP footprint is: this is AUTHORED by a\n * provider package rather than received from an older producer, so a misspelled\n * key must fail where it is written instead of contributing nothing.\n */\nexport const ProviderFrontendComponentDescriptorSchema = z.strictObject({\n  /**\n   * What a selection from this component contains. Absent for a capability whose\n   * component returns a plain value rather than a thing — a captcha widget hands\n   * back a token, and there is no delivery question to answer about a string.\n   */\n  selectionDelivery: z.enum(ProviderFrontendSelectionDelivery).optional(),\n  /**\n   * For a `FRONTEND_ADDRESS_LOOKUP` component: whether it hands back the vendor's own identifier for\n   * the place it matched (#1702). It is never stored either way (#561 D3). See\n   * {@link ProviderAddressLookupPlaceIdRetention}. Absent means the component returns no place id — the\n   * safe reading, since the vendor identifier is the one part of a lookup vendor terms restrict.\n   */\n  placeIdRetention: z.enum(ProviderAddressLookupPlaceIdRetention).optional(),\n  /**\n   * For a `FRONTEND_ADDRESS_LOOKUP` component: the backend operations it runs through the provider-operation\n   * door, and the vendor terms the host enforces (#561). See {@link ProviderAddressLookupDeclarationSchema}.\n   * Absent on an address lookup, the framework's host does not offer it: a lookup with no declared\n   * operations has no way to reach its vendor that the framework admits.\n   */\n  addressLookup: ProviderAddressLookupDeclarationSchema.optional(),\n});\nexport type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFrontendComponentDescriptorSchema>;\n\n/**\n * A provider's component descriptors, keyed by the CAPABILITY each fills.\n *\n * The key is validated as a non-empty string, not as a `ProviderCapability`\n * member. The reason this gave until 2026-09-12 — that `ProviderCapability` is\n * OPEN through module augmentation, so a `z.enum` would refuse an application's\n * own capability — stopped being true with #502: the vocabulary is the closed\n * built-in set. A member-checked key is now possible and has NOT been adopted;\n * until it is, an unknown capability key parses here and simply never matches a\n * surface that asks for a real one.\n */\nexport const ProviderFrontendComponentDescriptorsSchema = z.record(\n  z.string().min(1),\n  ProviderFrontendComponentDescriptorSchema,\n);\nexport type ProviderFrontendComponentDescriptors = z.infer<typeof ProviderFrontendComponentDescriptorsSchema>;\n\n/**\n * Pins every bucket member to a real field of the footprint.\n *\n * A member whose value is not a footprint key would be authorable, would parse,\n * and would contribute nothing — in production only, because CSP is report-only\n * in development. This makes it a compile error instead.\n */\nconst _everyBucketNamesAFootprintField: Record<\n  ProviderFrontendCspOriginBucket,\n  keyof Omit<ProviderFrontendCspFootprint, 'derivedOrigins'>\n> = {\n  [ProviderFrontendCspOriginBucket.SCRIPT]: 'scriptOrigins',\n  [ProviderFrontendCspOriginBucket.CONNECT]: 'connectOrigins',\n  [ProviderFrontendCspOriginBucket.FRAME]: 'frameOrigins',\n  [ProviderFrontendCspOriginBucket.IMG]: 'imgOrigins',\n  [ProviderFrontendCspOriginBucket.STYLE]: 'styleOrigins',\n  [ProviderFrontendCspOriginBucket.FONT]: 'fontOrigins',\n  [ProviderFrontendCspOriginBucket.WORKER]: 'workerOrigins',\n  [ProviderFrontendCspOriginBucket.MEDIA]: 'mediaOrigins',\n};\nvoid _everyBucketNamesAFootprintField;\n"]}
+{"version":3,"file":"provider-frontend-surface.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-providers/provider-frontend-surface.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAeX;AAfD,WAAY,+BAA+B;IACzC,2DAAwB,CAAA;IACxB,6DAA0B,CAAA;IAC1B,yDAAsB,CAAA;IACtB,qDAAkB,CAAA;IAClB,yDAAsB,CAAA;IACtB,uDAAoB,CAAA;IACpB;;;;OAIG;IACH,2DAAwB,CAAA;IACxB,gHAAgH;IAChH,yDAAsB,CAAA;AACxB,CAAC,EAfW,+BAA+B,KAA/B,+BAA+B,QAe1C;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAA+C,MAAM,CAAC,MAAM,CAC3G,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,kEAAkE;IAClE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,uEAAuE;IACvE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,gGAAgG;IAChG,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,iEAAiE;IACjE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,8DAA8D;IAC9D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,+HAA+H;IAC/H,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5E,CAAC,CAAC;AAyBH;;;;;;;;GAQG;AACH,MAAM,UAAU,qCAAqC,CACnD,WAAoD;IAEpD,OAAO,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,kEAAkE;IAClE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,gIAAgI;IAChI,4DAAuB,CAAA;IACvB,kHAAkH;IAClH,wEAAmC,CAAA;AACrC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC;KACrD,YAAY,CAAC;IACZ,sFAAsF;IACtF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,mDAAmD;IACnD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACjE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE;IACpC,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,mGAAmG;kBACjG,+EAA+E;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,CAAN,IAAY,iCAuBX;AAvBD,WAAY,iCAAiC;IAC3C;;;;;OAKG;IACH,0EAAqC,CAAA;IACrC;;;;;;OAMG;IACH,oFAA+C,CAAA;IAC/C;;;;;OAKG;IACH,kFAA6C,CAAA;AAC/C,CAAC,EAvBW,iCAAiC,KAAjC,iCAAiC,QAuB5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAN,IAAY,qCAQX;AARD,WAAY,qCAAqC;IAC/C,8GAA8G;IAC9G,sDAAa,CAAA;IACb;;;OAGG;IACH,gEAAuB,CAAA;AACzB,CAAC,EARW,qCAAqC,KAArC,qCAAqC,QAQhD;AAED,qJAAqJ;AACrJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IACnE,6FAA6F;IAC7F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,wGAAwG;IACxG,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C;;;OAGG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,6EAA6E;AAE7E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,QAAQ,EAAE;IACvE;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;IAC1E;;;;;OAKG;IACH,aAAa,EAAE,sCAAsC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,yCAAyC,CAC1C,CAAC;AAGF;;;;;;GAMG;AACH,MAAM,gCAAgC,GAGlC;IACF,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,OAAO,CAAC,EAAE,gBAAgB;IAC3D,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,GAAG,CAAC,EAAE,YAAY;IACnD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;IACvD,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,aAAa;IACrD,CAAC,+BAA+B,CAAC,MAAM,CAAC,EAAE,eAAe;IACzD,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,cAAc;CACxD,CAAC;AACF,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * Frontend-surface atoms a provider declares: what it needs the page to be\n * ALLOWED to reach (its CSP footprint), which vendor SDK package it loads, and\n * which third-party `<script>` tags it asks the surface to add.\n *\n * ## Why these are DATA and live here\n *\n * A frontend provider reaches its surface through TWO channels, and only one of\n * them can carry code:\n *\n *   - the **DATA** channel — `FrontendProviderEntry`, projected by the backend\n *     into `/application-config` and materialized into the generated\n *     frontend-services artifact. It is JSON end to end, so nothing\n *     function-valued survives it (it used to be cast to a module type anyway,\n *     which is the defect this split closes);\n *   - the **CODE** channel — the provider package's own facet barrel, imported\n *     by the bundle through the generated `frontend-providers.generated.ts`.\n *\n * Everything in this file is the DATA half. It is what the CLI, the CSP\n * composer and the bundle-isolation policy need to SEE without executing any\n * frontend module — and the CLI genuinely cannot execute one: it is a Node\n * process and these modules are browser-bound. The executable half (`sdk.activate`,\n * `publicConfigSchema`) lives on the facet module types in\n * `@wildo-ai/external-connectors-public` and never crosses this boundary.\n *\n * Added by slice S4a of epic #337 (issue #332).\n */\n\nimport { z } from 'zod';\n\n/**\n * The origins a provider needs the composed Content-Security-Policy to admit,\n * grouped by WHAT THE PROVIDER IS REACHING rather than by CSP directive name.\n *\n * ## Why semantic buckets and not directive names\n *\n * `CSP_DIRECTIVE_NAMES` is a closed vocabulary that already has one named\n * runtime source, in `@wildo-ai/platform-config-lib`. That package DEPENDS on\n * this one, so this file cannot reference it, and re-declaring the list here\n * would create a second source for one vocabulary — precisely what the\n * one-named-source rule exists to prevent, and the way the two copies would\n * drift the first time a directive is added.\n *\n * Keying on intent instead is also the better contract. A provider author knows\n * \"my SDK is fetched from `https://js.stripe.com` and it calls back to\n * `https://api.stripe.com`\"; which directive grades which fetch is framework\n * knowledge, and it lives in exactly one place — the bucket-to-directive\n * mapping in `platform-config-lib`'s `csp-emit.ts`.\n *\n * ## Why it is STRICT while the entry that carries it is loose\n *\n * The entry is a WIRE record read by a possibly-older consumer, so it tolerates\n * unknown keys (see `frontend-provider-entry.shared.schemas.ts`). This footprint\n * is AUTHORED, by a provider package, and validated where it is authored — so a\n * misspelled bucket must fail loudly rather than contribute nothing. That\n * distinction matters more here than anywhere else in the frontend surface:\n * CSP is enforced in production and report-only in development, so a bucket that\n * silently contributes nothing is invisible until the provider breaks in\n * production only.\n *\n * Adding a bucket is not a one-sided producer change either — a new bucket is\n * useless until `csp-emit.ts` maps it to a directive — so strictness costs no\n * version-skew tolerance that was ever available.\n *\n * Every field defaults to `[]`: a provider that declares a footprint at all is\n * making a complete statement about the buckets it did not name.\n */\n/**\n * Which bucket an origin lands in, as a value a provider can name.\n *\n * The bucket names are already the footprint's field names; this enum is what\n * lets a provider REFER to one — a derived origin has to say where it goes, and\n * a bare string there would be a second, unexplained spelling of a closed\n * vocabulary. A compile-time check below pins the two together.\n */\nexport enum ProviderFrontendCspOriginBucket {\n  SCRIPT = 'scriptOrigins',\n  CONNECT = 'connectOrigins',\n  FRAME = 'frameOrigins',\n  IMG = 'imgOrigins',\n  STYLE = 'styleOrigins',\n  FONT = 'fontOrigins',\n  /**\n   * Origins a provider starts a Web Worker, Shared Worker or service worker from (`worker-src`) — a map\n   * SDK's tile decoder, a session-replay compressor. Frequently `blob:`, which a provider may name here\n   * as a scheme source (#1702).\n   */\n  WORKER = 'workerOrigins',\n  /** Origins a provider plays audio or video from (`media-src`) — an embed with sound, a video player (#1702). */\n  MEDIA = 'mediaOrigins',\n}\n\n/**\n * Every bucket, in declaration order — the ONE list a consumer iterates when it has to visit each\n * bucket of a footprint (the hydration staleness join, the CLI's derived-origin resolution).\n *\n * Derived from the enum rather than written out, because a hand-kept list of buckets is how a new one\n * gets authored, serialized and then silently dropped by the one consumer that did not learn about it:\n * the CLI's derived-origin resolver re-listed the six buckets by hand until #1702, so a seventh would\n * have been erased there for any provider that also derives an origin.\n */\nexport const PROVIDER_FRONTEND_CSP_ORIGIN_BUCKETS: readonly ProviderFrontendCspOriginBucket[] = Object.freeze(\n  Object.values(ProviderFrontendCspOriginBucket),\n);\n\n/**\n * An origin the framework must READ OUT OF the provider's own public config,\n * because the provider cannot know it.\n *\n * The case that forced this: an error-monitoring provider sends to the host\n * inside its DSN, and a product-analytics provider to whatever `apiHost` the\n * application configured — including a self-hosted one. Both are per\n * APPLICATION, and often per ENVIRONMENT, so no static list on the provider\n * module can contain them. Without this the application would have to author\n * the same host twice — once as the provider's config and once in its CSP — and\n * the copy that drifts fails in production only, because development is\n * report-only.\n *\n * Resolution is data, not code: the CLI takes `publicConfig[publicConfigKey]`,\n * reads its URL origin, and adds it to `bucket`. An absent key contributes\n * nothing (the provider simply is not configured for that service); a key that\n * is present and is NOT a URL fails the sync loudly, because silently dropping\n * it is the exact failure this exists to prevent.\n */\nexport const ProviderFrontendCspDerivedOriginSchema = z.strictObject({\n  /** Key in this provider's `publicConfig` whose value is a URL. */\n  publicConfigKey: z.string().min(1),\n  bucket: z.enum(ProviderFrontendCspOriginBucket),\n});\nexport type ProviderFrontendCspDerivedOrigin = z.infer<typeof ProviderFrontendCspDerivedOriginSchema>;\n\nexport const ProviderFrontendCspFootprintSchema = z.strictObject({\n  /** Origins the surface loads executable script from (`script-src`). */\n  scriptOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider's code opens fetch / XHR / WebSocket connections to (`connect-src`). */\n  connectOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider embeds in an iframe — a picker, a checkout, a meeting (`frame-src`). */\n  frameOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads images or pixels from (`img-src`). */\n  imgOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads stylesheets from (`style-src`). */\n  styleOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider loads web fonts from (`font-src`). */\n  fontOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider starts workers from (`worker-src`), `blob:` included. See `ProviderFrontendCspOriginBucket.WORKER`. */\n  workerOrigins: z.array(z.string().min(1)).default([]),\n  /** Origins the provider plays audio or video from (`media-src`). */\n  mediaOrigins: z.array(z.string().min(1)).default([]),\n  /**\n   * Origins the framework reads out of this provider's own `publicConfig`,\n   * for the endpoints a provider cannot know in advance. See\n   * {@link ProviderFrontendCspDerivedOriginSchema}.\n   */\n  derivedOrigins: z.array(ProviderFrontendCspDerivedOriginSchema).default([]),\n});\nexport type ProviderFrontendCspFootprint = z.infer<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * The footprint as a provider AUTHORS it: name only the buckets you reach.\n *\n * Authoring and the wire are deliberately different shapes, and the asymmetry\n * is the point.\n *\n *   - **Authoring is partial.** A provider that only loads a script should write\n *     `{ scriptOrigins: ['https://js.acme.com'] }`, not that plus four empty\n *     arrays. Four empty arrays are noise at exactly the place the declaration\n *     should be readable, and noise is what stops a reviewer noticing the one\n *     line that grants an origin.\n *   - **The wire is total.** Every bucket is present by the time the footprint\n *     reaches an entry, so the CSP composer never branches on absence and the\n *     staleness comparison between a served footprint and its module's has two\n *     comparable shapes rather than a partial and a total that differ in every\n *     bucket nobody named.\n *\n * Derived as `z.input` rather than written as a `Partial<…>`, so it cannot drift\n * from the schema: adding a bucket makes it optional here automatically.\n */\nexport type ProviderFrontendCspFootprintDeclaration = z.input<typeof ProviderFrontendCspFootprintSchema>;\n\n/**\n * Fills in the buckets a declaration did not name.\n *\n * The ONE place that normalization happens, used by the projection that builds\n * an entry and by the hydration join that compares one against a module. Two\n * copies would eventually disagree about whether an unnamed bucket is `[]` or\n * absent, and the join reads that difference as a stale artifact — a false\n * alarm on the diagnostic whose whole job is to be believed.\n */\nexport function normalizeProviderFrontendCspFootprint(\n  declaration: ProviderFrontendCspFootprintDeclaration,\n): ProviderFrontendCspFootprint {\n  return ProviderFrontendCspFootprintSchema.parse(declaration);\n}\n\n/**\n * The DATA half of a provider's `sdk` declaration: WHICH npm package carries the\n * vendor SDK, and at which range.\n *\n * The CODE half — the dynamic import and the vendor's initialization call — is\n * `ProviderFrontendSdk.activate` on the facet module type, and is deliberately\n * absent here: a function cannot cross a JSON channel, and a channel that\n * silently drops one is worse than a channel that never carried it.\n *\n * The descriptor is not decoration. It is what the bundle-isolation policy reads\n * to decide whether a bare specifier a provider package imports was DECLARED,\n * what an application's dependency alignment needs in order to install the SDK\n * as an optional peer, and what a human reads when asking why a bundle grew.\n *\n * Who authors it, since the epic's bulk-integration model was reversed on\n * 2026-09-06: a FIRST-CLASS provider package or an application's own provider\n * module. The scraper-mapper that fills the catalogue emits identity, auth, a\n * secrets contract and an operation catalogue on the `rest` arm — a\n * backend-only package — so a scraped provider has no frontend facet to carry\n * this. That is a narrowing of the population, not of the contract: the pickers\n * and embeds this surface exists for were always the hand-authored kind.\n */\nexport const ProviderFrontendSdkDescriptorSchema = z.strictObject({\n  /** npm package name of the vendor SDK, e.g. `@sentry/browser`. */\n  packageName: z.string().min(1),\n  /**\n   * Semver range the provider was built against. Optional because a provider\n   * that pins its SDK as a direct dependency has already said so in its own\n   * manifest; stating it here as well would be a second copy of that pin.\n   */\n  versionRange: z.string().min(1).optional(),\n});\nexport type ProviderFrontendSdkDescriptor = z.infer<typeof ProviderFrontendSdkDescriptorSchema>;\n\n/**\n * `crossorigin` attribute values for a provider-declared `<script>`.\n *\n * A closed vocabulary with a named runtime source rather than a bare literal\n * union, so each member can carry why it exists — and there are exactly two\n * reasons to pick one over the other.\n */\nexport enum ProviderFrontendScriptCrossOrigin {\n  /** No credentials are sent; the response must carry `Access-Control-Allow-Origin`. The right choice for a public CDN script. */\n  ANONYMOUS = 'anonymous',\n  /** Cookies and TLS client certificates are sent. Only for a vendor that authenticates the script fetch itself. */\n  USE_CREDENTIALS = 'use-credentials',\n}\n\n/**\n * A third-party `<script>` a provider asks its surface to add — the case a\n * dynamic `import()` cannot serve, because the vendor ships a global-installing\n * tag rather than an npm module (reCAPTCHA, most tag managers, several chat\n * widgets).\n *\n * `integrity` is Subresource Integrity. It is optional because a vendor that\n * versionless-serves a mutable URL (again, reCAPTCHA) cannot publish a stable\n * hash — but when it IS given the surface must also send `crossorigin`, or the\n * browser refuses the integrity check outright. That coupling is enforced below\n * rather than left to each surface to remember.\n */\nexport const ProviderFrontendScriptDeclarationSchema = z\n  .strictObject({\n    /** Absolute URL of the script. Its origin must also appear in `csp.scriptOrigins`. */\n    src: z.string().min(1),\n    /** Subresource-integrity hash, e.g. `sha384-…`. */\n    integrity: z.string().min(1).optional(),\n    crossOrigin: z.enum(ProviderFrontendScriptCrossOrigin).optional(),\n    async: z.boolean().optional(),\n    defer: z.boolean().optional(),\n  })\n  .superRefine((declaration, context) => {\n    if (declaration.integrity !== undefined && declaration.crossOrigin === undefined) {\n      context.addIssue({\n        code: 'custom',\n        path: ['crossOrigin'],\n        message:\n          'A script declaring `integrity` must also declare `crossOrigin`; without it the browser skips the '\n          + 'integrity check for a cross-origin script, so the hash would protect nothing.',\n      });\n    }\n  });\nexport type ProviderFrontendScriptDeclaration = z.infer<typeof ProviderFrontendScriptDeclarationSchema>;\n\n/**\n * WHAT a provider's component hands back, when what it hands back is a thing\n * rather than a value.\n *\n * ## The question this answers, and why it is a DECLARATION\n *\n * An application's objective is that it calls third-party APIs directly from\n * custom frontend components. On the backend that is unambiguous. In a browser\n * it is not, because a tenant credential must never get there — so a picker for\n * a credentialed vendor and a picker for a vendor with a browser-safe public\n * token cannot hand back the same thing, and the framework surface that\n * receives a selection has to know which before it mounts anything.\n *\n * Settled 2026-09-07 (issue #383, recorded as Q5 of the provider-architecture\n * plan): **per vendor, DECLARED.** Both shapes are real and both ship; which one\n * a provider emits is a static fact about that provider, stated here and\n * visible on the DATA channel without executing a line of its code.\n *\n * The word doing the work is *declared*. A discriminated union alone would let a\n * provider decide at runtime, which is the shape the decision explicitly\n * rejected — so the framework REFUSES a selection whose discriminant contradicts\n * this field. Without that refusal the declaration is decoration, and a reviewer\n * reading a provider's manifest would be reading a wish.\n *\n * ## Why a single value and not a set\n *\n * A provider that genuinely could emit either — Google's Picker hands back both\n * a file id and a URL, and which is usable depends on the granted OAuth scope —\n * was the argument for `selectionDelivery: [...]`. Rejected: an array puts the\n * choice back at runtime, which is the half of the decision that carries all the\n * weight. A vendor whose two modes are both wanted contributes two components,\n * and the chooser then shows them as what they are — two different things a user\n * can pick between — rather than one component whose behaviour a reader cannot\n * predict.\n *\n * ## What it means for CSP\n *\n * `REMOTE_REFERENCE` does NOT imply a provider needs no `connectOrigins`: a\n * picker still talks to its vendor to RENDER, even when the bytes it selects are\n * fetched later by the backend. So this field does not gate the CSP buckets, and\n * a guard inferring otherwise would break every real picker. What it does gate\n * is where the SELECTED OBJECT travels.\n */\nexport enum ProviderFrontendSelectionDelivery {\n  /**\n   * An opaque handle only the application backend can resolve — a Drive file id,\n   * a DAM asset key. The browser never holds the bytes and never authenticates\n   * to the vendor for them; the framework routes the reference to the\n   * application's executor door, which holds the tenant credential.\n   */\n  REMOTE_REFERENCE = 'REMOTE_REFERENCE',\n  /**\n   * Bytes the browser already holds, as a `File`. Available only to a vendor\n   * whose picker runs on a browser-safe grant — a publishable key, a\n   * user-consented OAuth token, a picker's own scoped grant — so nothing\n   * tenant-secret is involved. The framework uploads it exactly as it uploads a\n   * file chosen from disk.\n   */\n  BROWSER_READABLE_FILE = 'BROWSER_READABLE_FILE',\n  /**\n   * A URL the browser may fetch, under the same browser-safe-grant condition as\n   * `BROWSER_READABLE_FILE`. Distinct from it because the framework must fetch\n   * before it can upload, and that fetch is a network call the composed CSP has\n   * to admit — a difference the surface cannot discover from a `File`.\n   */\n  BROWSER_READABLE_URL = 'BROWSER_READABLE_URL',\n}\n\n/**\n * Whether an address-lookup component hands back the VENDOR'S identifier for the place it matched (#1702,\n * narrowed by #561 D3).\n *\n * ## Why this is DECLARED, per component\n *\n * The structured address a lookup returns is the application's own data: the person typed it, the\n * vendor only helped spell it. The vendor's place identifier is different — it is the vendor's key, and\n * vendors disagree on whether it may be kept (Google allows it indefinitely, Mapbox does not promise it is\n * stable, Loqate's public documentation says nothing). So a component declares once, statically, whether\n * it returns one, and the framework holds every selection to it — the #383 rule for `selectionDelivery`,\n * applied here. A runtime flag on each selection was the rejected alternative: it would let the component\n * decide per selection, which is not a decision a component can own.\n *\n * ## Why there is no \"storable\" member (#561 D3)\n *\n * The framework NEVER stores a vendor place id, whatever the vendor allows. It travels only inside one\n * lookup session, from the suggestion to the retrieval, and what is saved is the address the person\n * confirmed. A `STORABLE` member existed from #1702 until #561 and nothing read it: a declaration that\n * permits storage while nothing can store is a claim nothing checks, and a later reader would take it as a\n * licence. Rejected with it: a `placeRef` slot on `AddressValue`, which would mix vendor data into\n * application data under a retention that differs per vendor.\n *\n * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — \"Place ID\n * caching exception\": the place ID \"is exempt from the caching restrictions\". Fetched 2026-09-29. The Mapbox\n * and Loqate readings are #561's 2026-09-14 research, summarised rather than quoted.\n */\nexport enum ProviderAddressLookupPlaceIdRetention {\n  /** The component returns no place id. A selection carrying one contradicts the declaration and is refused. */\n  NONE = 'NONE',\n  /**\n   * A place id may be returned for the current interaction (re-querying the vendor for the same place),\n   * and is never stored: the field keeps only the address.\n   */\n  TRANSIENT = 'TRANSIENT',\n}\n\n/** @wildo_source:part:start saas.models.provider-address-lookup-declaration facet:layer:shared facet:family:provider facet:audience:app-developer */\n/**\n * How a `FRONTEND_ADDRESS_LOOKUP` component reaches its vendor, and what the vendor's terms require of the\n * page (#561) — the DATA half a reviewer reads, and the half the framework's host ENFORCES.\n *\n * ## Why the lookup names backend OPERATIONS rather than a vendor URL (#561 D2)\n *\n * The vendor is never called from the page. Each suggestion and the final retrieval run through the\n * application backend's provider-operation door (`POST /provider-operations/:providerRef/:operationId`),\n * which spends the application's own credential, admits the operation by `providers.browserOperations`,\n * throttles each caller, and records a `PROVIDER_OPERATION_CALL` row that carries no typed input. So the\n * page holds no vendor key and needs no vendor origin in its CSP, and every vendor is reached one way.\n * Google recommends exactly this for its web services: \"Using a secure proxy server provides a solid source\n * for interacting with a Google Maps Platform web service endpoint from a client-side application without\n * exposing your API key\".\n * spec-cite: https://developers.google.com/maps/api-security-best-practices — \"Proxy server\", fetched 2026-09-29.\n *\n * The host hands the component two functions, `suggest` and `retrieve`, bound to the two operation ids\n * declared here, so a reviewer reading the manifest sees which backend operations the application must open to\n * browsers. What BOUNDS a component is the door, not this declaration: a component is code and could call the\n * browser door itself, and the door runs only the operations the application listed in `providers.browserOperations`.\n *\n * ## Why the session token and the attribution are declared rather than left to the component (#561 D4)\n *\n * Both are vendor TERMS, and a term a component may forget is not held. The host generates one UUIDv4 per\n * lookup session and writes it into the input field named by `sessionTokenInput` on every suggestion and on\n * the retrieval, then starts a new session after a retrieval or when the lookup is abandoned — the vendor\n * bills per session, and a missing or reused token bills every keystroke. The host renders\n * `attributionMark` beside the lookup whenever it is mounted.\n */\nexport const ProviderAddressLookupDeclarationSchema = z.strictObject({\n  /** The backend operation of the SAME provider ref that turns typed text into suggestions. */\n  suggestOperationId: z.string().trim().min(1),\n  /** The backend operation of the same ref that turns one chosen suggestion into a structured address. */\n  retrieveOperationId: z.string().trim().min(1),\n  /**\n   * The operation INPUT field the vendor reads its session token from, when the vendor bills by session.\n   * Absent: the vendor takes none, and the host sends none.\n   */\n  sessionTokenInput: z.string().trim().min(1).optional(),\n  /**\n   * The attribution the vendor requires beside its suggestions, VERBATIM — a trademark, never translated\n   * (Google: \"the text Google Maps is acceptable\" where its logo does not fit). The host renders it inside a\n   * sentence from the application's own labels.\n   * spec-cite: https://developers.google.com/maps/documentation/places/web-service/policies — attribution without a\n   * Google map, fetched 2026-09-29.\n   */\n  attributionMark: z.string().trim().min(1).optional(),\n});\nexport type ProviderAddressLookupDeclaration = z.infer<typeof ProviderAddressLookupDeclarationSchema>;\n/** @wildo_source:part:end saas.models.provider-address-lookup-declaration */\n\n/**\n * The DATA half of one component a provider contributes — everything about it\n * that a reviewer, the CLI or a build step can read without running a browser.\n *\n * The loader is the CODE half and stays on the facet module in\n * `@wildo-ai/external-connectors-public`, exactly as `sdk.activate` does. What\n * crosses the wire is the fact that a component EXISTS for this capability, plus\n * the contract it commits to.\n *\n * Strict, and for the same reason the CSP footprint is: this is AUTHORED by a\n * provider package rather than received from an older producer, so a misspelled\n * key must fail where it is written instead of contributing nothing.\n */\nexport const ProviderFrontendComponentDescriptorSchema = z.strictObject({\n  /**\n   * What a selection from this component contains. Absent for a capability whose\n   * component returns a plain value rather than a thing — a captcha widget hands\n   * back a token, and there is no delivery question to answer about a string.\n   */\n  selectionDelivery: z.enum(ProviderFrontendSelectionDelivery).optional(),\n  /**\n   * For a `FRONTEND_ADDRESS_LOOKUP` component: whether it hands back the vendor's own identifier for\n   * the place it matched (#1702). It is never stored either way (#561 D3). See\n   * {@link ProviderAddressLookupPlaceIdRetention}. Absent means the component returns no place id — the\n   * safe reading, since the vendor identifier is the one part of a lookup vendor terms restrict.\n   */\n  placeIdRetention: z.enum(ProviderAddressLookupPlaceIdRetention).optional(),\n  /**\n   * For a `FRONTEND_ADDRESS_LOOKUP` component: the backend operations it runs through the provider-operation\n   * door, and the vendor terms the host enforces (#561). See {@link ProviderAddressLookupDeclarationSchema}.\n   * Absent on an address lookup, the framework's host does not offer it: a lookup with no declared\n   * operations has no way to reach its vendor that the framework admits.\n   */\n  addressLookup: ProviderAddressLookupDeclarationSchema.optional(),\n});\nexport type ProviderFrontendComponentDescriptor = z.infer<typeof ProviderFrontendComponentDescriptorSchema>;\n\n/**\n * A provider's component descriptors, keyed by the CAPABILITY each fills.\n *\n * The key is validated as a non-empty string, not as a `ProviderCapability`\n * member. The reason this gave until 2026-09-12 — that `ProviderCapability` is\n * OPEN through module augmentation, so a `z.enum` would refuse an application's\n * own capability — stopped being true with #502: the vocabulary is the closed\n * built-in set. A member-checked key is now possible and has NOT been adopted;\n * until it is, an unknown capability key parses here and simply never matches a\n * surface that asks for a real one.\n */\nexport const ProviderFrontendComponentDescriptorsSchema = z.record(\n  z.string().min(1),\n  ProviderFrontendComponentDescriptorSchema,\n);\nexport type ProviderFrontendComponentDescriptors = z.infer<typeof ProviderFrontendComponentDescriptorsSchema>;\n\n/**\n * Pins every bucket member to a real field of the footprint.\n *\n * A member whose value is not a footprint key would be authorable, would parse,\n * and would contribute nothing — in production only, because CSP is report-only\n * in development. This makes it a compile error instead.\n */\nconst _everyBucketNamesAFootprintField: Record<\n  ProviderFrontendCspOriginBucket,\n  keyof Omit<ProviderFrontendCspFootprint, 'derivedOrigins'>\n> = {\n  [ProviderFrontendCspOriginBucket.SCRIPT]: 'scriptOrigins',\n  [ProviderFrontendCspOriginBucket.CONNECT]: 'connectOrigins',\n  [ProviderFrontendCspOriginBucket.FRAME]: 'frameOrigins',\n  [ProviderFrontendCspOriginBucket.IMG]: 'imgOrigins',\n  [ProviderFrontendCspOriginBucket.STYLE]: 'styleOrigins',\n  [ProviderFrontendCspOriginBucket.FONT]: 'fontOrigins',\n  [ProviderFrontendCspOriginBucket.WORKER]: 'workerOrigins',\n  [ProviderFrontendCspOriginBucket.MEDIA]: 'mediaOrigins',\n};\nvoid _everyBucketNamesAFootprintField;\n"]}

package/dist/esm/external-providers/provider-metadata.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED,iDAAiD;AACjD,oBAAY,kBAAkB;IAC5B,yDAAyD;IACzD,MAAM,WAAW;IACjB,yEAAyE;IACzE,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,uBAAuB;IACjC,YAAY,iBAAiB;IAC7B,GAAG,QAAQ;IACX,gBAAgB,qBAAqB;CACtC;AAED,eAAO,MAAM,iCAAiC;;;;iBAa5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAa7B,CAAC;AACL,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEnF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,EAAE,cAAmE,CAAC;AAEzG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBA2CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAW3F"}
+{"version":3,"file":"provider-metadata.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/external-providers/provider-metadata.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;GAOG;AACH,oBAAY,YAAY;IACtB;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;OAKG;IACH,SAAS,cAAc;IACvB;;;;;OAKG;IACH,SAAS,cAAc;CACxB;AAED,iDAAiD;AACjD,oBAAY,kBAAkB;IAC5B,yDAAyD;IACzD,MAAM,WAAW;IACjB,yEAAyE;IACzE,WAAW,gBAAgB;IAC3B;;;;OAIG;IACH,SAAS,cAAc;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,oBAAY,uBAAuB;IACjC,YAAY,iBAAiB;IAC7B,GAAG,QAAQ;IACX,gBAAgB,qBAAqB;CACtC;AAED,eAAO,MAAM,iCAAiC;;;;iBAa5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;iBAa7B,CAAC;AACL,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC1D;IAAE,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAEnF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,EAAE,cAAmE,CAAC;AAEzG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBA2CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,EAAE,QAAQ,CAAC,GAAG;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,gBAAgB,CAW3F"}