fix(providers): project array items before selecting values

[rudycelekli]

What & why

The documented [] response projection promises the first non-empty projected value, but the walker takes the first array item before reading the rest of the path. A provider response such as {"results": [{}, {"email": "person@example.test"}]} is therefore classified as no_data; an HTTP action with the same extractor reports no_match.

Walk the remaining path for each array item until a non-null, non-empty-string value is found. Keep explicit indexes, response order, zero/false values and no-match behavior. The same existing projection helper fixes both declarative provider mappings and HTTP action extracts.

Type

• Bug fix
• New feature
• New enrichment provider / source
• Docs
• Refactor / chore

Verification

Frozen regressions execute compiled manifest providers through httpx.MockTransport and the HTTP action entry point. Missing, null and empty first values plus nested fan-out previously failed five cases; seven controls already passed. The controls retain first-result priority, explicit [0]/[1], typed zero/false values and empty/invalid-array no-match behavior.

With the patch, all 33 tests in the new projection suite and existing declarative-provider/HTTP-action suites pass locally. Full unchanged canonical CI passed all four jobs on the signed head: SQLite (2,104 passed; 134 skipped; 3 deselected), PostgreSQL (18 passed), frontend lint/tests/build (63 tests), and browser regressions (3 passed).

Checklist

• Commits are signed off (git commit -s) per the DCO
• Backend tests pass — frozen canonical SQLite and PostgreSQL CI
• Monorepo lint and build pass (bun run lint && bun run build) — canonical CI
• I did not add scraping of paywalled / pirated / login-gated content
• Credentialed providers are opt-in and inert by default

Security-sensitive?

Only post-response value projection changes. Existing URL/DNS guards, auth/credential resolution, transports and tenant boundaries are unchanged. Offline tests stub HTTP responses and resolve the test host to a public IP; they do not prove live provider delivery. No vulnerability disclosure is included.

Notes

AI-assisted implementation and tests; independently reviewed reproduction and patch. No public API, schema, dependency or workflow changes. No bundled manifest currently uses []; this corrects the already advertised custom mapping and HTTP-extraction behavior.

Root independently replayed the 33 focused and adjacent tests (33 passed) and refreshed all nine authored open PRs with complete paginated feedback/CI snapshots before publication; no actionable feedback, failed checks or overlap was found.