core: BoxMetadata#version can constrain by providers
core: BoxAdd adds matching provider even if lower version