Validation: project array items before selecting values

[rudycelekli]

Owned fork validation only. No upstream submission is made by this PR. All four unchanged canonical CI jobs must pass before the root coordinator publishes upstream.

What & why

The documented [] response projection promises the first non-empty projected value, but the walker takes the first array item before reading the rest of the path. A provider response such as {"results": [{}, {"email": "person@example.test"}]} is therefore classified as no_data; an HTTP action with the same extractor reports no_match.

Walk the remaining path for each array item until a non-null, non-empty-string value is found. Keep explicit indexes, response order, zero/false values and no-match behavior. The same existing projection helper fixes both declarative provider mappings and HTTP action extracts.

Type

• Bug fix
• New feature
• New enrichment provider / source
• Docs
• Refactor / chore

Verification

Frozen regressions execute compiled manifest providers through httpx.MockTransport and the HTTP action entry point. Missing, null and empty first values plus nested fan-out previously failed five cases; seven controls already passed. The controls retain first-result priority, explicit [0]/[1], typed zero/false values and empty/invalid-array no-match behavior.

With the patch, all 33 tests in the new projection suite and existing declarative-provider/HTTP-action suites pass locally. Full unchanged canonical CI pending.

Checklist

• Commits are signed off (git commit -s) per the DCO
• Backend tests pass — full frozen canonical CI pending
• Monorepo lint and build pass (bun run lint && bun run build) — canonical CI pending
• I did not add scraping of paywalled / pirated / login-gated content
• Credentialed providers are opt-in and inert by default

Security-sensitive?

Only post-response value projection changes. Existing URL/DNS guards, auth/credential resolution, transports and tenant boundaries are unchanged. Offline tests stub HTTP responses and resolve the test host to a public IP; they do not prove live provider delivery. No vulnerability disclosure is included.

Notes

AI-assisted implementation and tests; independently reviewed reproduction and patch. No public API, schema, dependency or workflow changes. No bundled manifest currently uses []; this corrects the already advertised custom mapping and HTTP-extraction behavior.