@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.d.ts

@@ -0,0 +1,566 @@
+/**
+ * HTTP-API persistence binding — the declaration model for resources whose rows live in a system
+ * reached over an authenticated HTTP API (`PersistenceAdapter.HTTP_API`) rather than in a
+ * platform-provisioned database.
+ *
+ * Design source of truth: `.claude/plans/etl-post-repository.md` (decisions D0/D1/D6/D9/D10,
+ * requirements R7/R12/R15/R16) plus the two companion papers
+ * `.claude/plans/etl-composite-key-synthesis.md` (key declaration + id codec) and
+ * `.claude/plans/etl-filter-dialect-scope-down.md` (declared filter/sort/search surface).
+ *
+ * The binding is a REQUIRED companion declaration on any resource configuration that selects
+ * `PersistenceAdapter.HTTP_API`. It answers, statically and per resource:
+ * - WHERE the rows live (provider + entity), and in which transport dialect they are queried;
+ * - HOW a row is identified (ordered key components → the synthesized engine-facing `_id`);
+ * - WHOSE identity reaches the target system (service principal vs per-user delegation);
+ * - HOW tenancy confinement is expressed remotely — or the explicit single-tenant stance;
+ * - WHAT the erasure story is (all three stances are first-class; none is silently defaulted);
+ * - WHICH remote-call semantics apply (timeout, retry, rate budget, id-set bound).
+ *
+ * Credentials are NEVER declared here. They resolve at runtime through
+ * `ExternalProvidersRegistryBackendService` against the `providerRef`, exactly as email, SMS and
+ * billing providers do — the binding carries only the reference (plan decision D7).
+ */
+import { z } from 'zod';
+/**
+ * The query dialect the adapter speaks toward the target system. Closed vocabulary (slice 1);
+ * SOAP is a possible later member over the same HTTP transport, and a direct-database kind would
+ * be a NEW `PersistenceAdapter` member, never a dialect here.
+ */
+/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
+export declare enum HttpApiTransportDialect {
+    /**
+     * OData v4 (SAP S/4HANA, Microsoft Dataverse/Dynamics 365): one generic client — mechanical
+     * pushdown of `$filter`/`$select`/`$top`/`$skip`/`$orderby`/`$count`, with a `$metadata`
+     * boot-time verification probe of the committed declaration.
+     */
+    ODATA = "odata",
+    /**
+     * Declared per-binding REST/JSON operation mapping (bespoke enterprise APIs). Unlike ODATA
+     * there is no generic client: each binding declares how read/list/count/search map onto
+     * concrete HTTP operations.
+     */
+    REST_JSON = "rest-json",
+    /**
+     * Odoo's external API (`/jsonrpc` + `execute_kw`). Promoted to its OWN dialect 2026-08-27 —
+     * D0's original "JSON-RPC is a thin envelope variant of REST_JSON" was corrected by measuring
+     * the protocol: it is generic like ODATA (no per-binding operation declarations — the model
+     * name IS `entityRef`, and read/list/count map onto `read`/`search_read`/`search_count`
+     * mechanically), but it speaks POSITIONAL arguments, its own domain filter language
+     * (`[['field','=',value], …]` with polish-notation `'|'` disjunction), and authenticates
+     * INSIDE the RPC args (`execute_kw(db, uid, api_key, …)`) rather than via HTTP headers.
+     * Forcing that through REST_JSON's declared-parameter model would have been the
+     * merge-distinct-concepts failure `design-philosophy.md` forbids.
+     *
+     * Structural constraint (schema-enforced): exactly ONE key field with the `INTEGER` codec —
+     * Odoo row ids are integers, always.
+     */
+    ODOO_JSONRPC = "odoo-jsonrpc"
+}
+/**
+ * Whose identity the adapter presents to the target system. In BOTH modes audit rows carry the
+ * REAL initiating user — the shared-principal attribution failure documented for Power Platform
+ * ("credential-sharing as a service") must not be reproduced (requirement R12).
+ *
+ * D9 ruling (Paul, 2026-08-27 — re-scoping the original "both executable in slice 1"):
+ * **SERVICE_PRINCIPAL-first.** `USER_DELEGATED` stays DECLARED and representable so bindings
+ * need no reshape when it arrives, but resolving it REFUSES naming the missing substrate: the
+ * engine has no outbound per-user token store (measured — `OAuth2_CredentialSchema` is a model
+ * with no resource, persistence or service behind it). Building that store is its own workstream.
+ */
+export declare enum HttpApiIdentityMode {
+    /**
+     * One service account per binding (never shared across applications — blast-radius doctrine).
+     * Wildo's own roles/operations gate who may trigger calls. The default, and the only option
+     * when the target has no per-user OAuth surface.
+     */
+    SERVICE_PRINCIPAL = "service-principal",
+    /**
+     * Per-user OAuth 2.0 tokens against the target — encrypted, session-bound (the Retool model;
+     * on-behalf-of where the IdP is shared, e.g. Entra ID for Dynamics). Use when the TARGET's own
+     * authorization must decide per user: the tool can then never show a user more than the target
+     * would.
+     */
+    USER_DELEGATED = "user-delegated"
+}
+/**
+ * The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class
+ * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a
+ * registration refusal, because `exportSubject` is a fail-closed obligation on every resource and
+ * "we cannot delete rows we do not own" is not an answer the framework may imply silently.
+ */
+export declare enum HttpApiErasureStance {
+    /**
+     * (6a) The resource declares it holds NO personal/subject data. Registration verifies the
+     * declaration is coherent (e.g. `exportSubject` posture) and erasure is structurally N/A for
+     * the remote rows.
+     */
+    NO_SUBJECT_DATA = "no-subject-data",
+    /**
+     * (6b) The binding declares HOW erasure reaches the foreign system: one named API operation the
+     * engine invokes on a subject-erasure request. This is a single declared write and does NOT
+     * require general write support (slice 1 stays read-only otherwise).
+     */
+    EXTERNAL_ERASURE_OPERATION = "external-erasure-operation",
+    /**
+     * (6c) Erasure REFUSES by default; an explicit, per-request, audited controller acknowledgement
+     * lets it proceed and records the un-erased remote rows at high severity. Mirrors the existing
+     * administrative-floor acknowledgement shape (`administrative-continuity-floors.md`): the record
+     * is the control. NEVER a standing default — the acknowledgement is per erasure request.
+     */
+    CONTROLLER_ACKNOWLEDGED_NON_ERASURE = "controller-acknowledged-non-erasure"
+}
+/**
+ * How tenant confinement is enforced against the remote system (requirements R4/R16).
+ */
+export declare enum HttpApiTenancyStance {
+    /**
+     * The engine's contextual scope predicate is pushed down into every remote query against a
+     * declared remote field. Registration REFUSES a binding whose declared surface cannot express
+     * the scope predicate — a query-time refusal would be a data leak one missed branch away.
+     */
+    SCOPE_FILTER_PUSHDOWN = "scope-filter-pushdown",
+    /**
+     * The binding declares the target system serves exactly ONE tenant (the normal case for an
+     * internal tool on one enterprise's IS). Scope pushdown is then N/A by declaration — an
+     * explicit, audited stance, never an inferred one (R16).
+     */
+    SINGLE_TENANT_BINDING = "single-tenant-binding"
+}
+/**
+ * Per-component value normalization for key synthesis. The codec is what makes the synthesized
+ * `_id` STABLE: every component must round-trip byte-identically between the remote
+ * representation and the encoded id, or the same remote row would answer to different ids.
+ *
+ * `INTEGER` and `GUID` are the two codecs whose entire value space is URL-unreserved-safe, which
+ * is what qualifies a single-key binding for the VERBATIM id form (see
+ * `httpApiBindingUsesVerbatimKey`).
+ */
+export declare enum HttpApiKeyComponentCodec {
+    /** Arbitrary remote string. NOT charset-safe → always participates via the encoded id form. */
+    STRING = "string",
+    /** Integer key (Odoo `id`, SAP numeric keys). Digits only → verbatim-eligible. */
+    INTEGER = "integer",
+    /** GUID/UUID key (Dataverse row ids). Hex + dashes → verbatim-eligible. */
+    GUID = "guid",
+    /**
+     * Date/time key component, normalized to the RFC 3339 / ISO 8601 UTC string form before
+     * encoding. NOT verbatim-eligible (`:` is forbidden in ids — websocket room names are
+     * colon-parsed).
+     */
+    DATETIME_ISO = "datetime-iso"
+}
+/** @wildo_source:part:end saas.models.http-api-binding */
+/**
+ * One ordered component of the remote entity's key. `keyFields` order is the ENCODING order —
+ * declared, committed, and boot-verified against `$metadata` where the dialect provides one;
+ * never inferred at runtime (a silently adopted key change would orphan every stored FK value
+ * and bookmark).
+ */
+export declare const HttpApiKeyFieldSchema: z.ZodObject<{
+    localField: z.ZodString;
+    remoteField: z.ZodString;
+    codec: z.ZodEnum<typeof HttpApiKeyComponentCodec>;
+}, z.core.$strip>;
+export type HttpApiKeyField = z.infer<typeof HttpApiKeyFieldSchema>;
+/**
+ * Local-to-remote field name mapping for fields whose names differ. Fields not listed map by
+ * identity (same name both sides). Key components are declared in `keyFields`, not here.
+ */
+export declare const HttpApiFieldMappingSchema: z.ZodObject<{
+    localField: z.ZodString;
+    remoteField: z.ZodString;
+}, z.core.$strip>;
+export type HttpApiFieldMapping = z.infer<typeof HttpApiFieldMappingSchema>;
+/**
+ * Declared remote-call semantics. An enterprise API is 100ms–2s, rate-limited, and sometimes
+ * down; these are DECISIONS, not inherited pipeline defaults. Defaults are conservative on
+ * purpose — a binding that needs more declares more.
+ */
+export declare const HttpApiRemoteCallSemanticsSchema: z.ZodObject<{
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+    retry: z.ZodDefault<z.ZodObject<{
+        maxAttempts: z.ZodDefault<z.ZodNumber>;
+        backoffMs: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
+    maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export type HttpApiRemoteCallSemantics = z.infer<typeof HttpApiRemoteCallSemanticsSchema>;
+/**
+ * HTTP methods a declared read-family operation may use. Deliberately NOT the full HTTP verb set
+ * (`API_HttpMethod` in `@wildo-ai/external-connectors-models` describes provider-protocol
+ * operations): slice 1 is read-only, so the closed vocabulary is the read-safe verb plus POST —
+ * because JSON-RPC (Odoo) and many enterprise search endpoints are POST-shaped even for reads.
+ * Write verbs (PUT/PATCH/DELETE) enter only with the D4 write story, as their own decision.
+ */
+export declare enum HttpApiRestOperationMethod {
+    GET = "GET",
+    POST = "POST"
+}
+/**
+ * REST_JSON per-operation declaration: how one read-family member maps onto a concrete HTTP
+ * operation. Deliberately minimal in slice 1 — pagination/filter parameter NAMES are declared,
+ * their VALUES are supplied by the adapter from the translated query.
+ *
+ * Related but distinct: `REST_API_OperationSpecSchema` in `@wildo-ai/external-connectors-models`
+ * describes provider-protocol operations for capability transformers. This schema describes a
+ * RESOURCE read surface; if the two converge later that is a recorded decision, not an implicit
+ * merge of distinct concepts.
+ */
+export declare const HttpApiRestOperationSpecSchema: z.ZodObject<{
+    method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
+    pathTemplate: z.ZodString;
+    pagingParams: z.ZodOptional<z.ZodObject<{
+        limitParam: z.ZodString;
+        offsetParam: z.ZodString;
+    }, z.core.$strip>>;
+    filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    searchParam: z.ZodOptional<z.ZodString>;
+    resultPath: z.ZodOptional<z.ZodString>;
+    jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+        rpcMethod: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type HttpApiRestOperationSpec = z.infer<typeof HttpApiRestOperationSpecSchema>;
+/** The REST_JSON read-surface mapping: which lifecycle members exist remotely, and how. */
+export declare const HttpApiRestOperationsSchema: z.ZodObject<{
+    read: z.ZodObject<{
+        method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
+        pathTemplate: z.ZodString;
+        pagingParams: z.ZodOptional<z.ZodObject<{
+            limitParam: z.ZodString;
+            offsetParam: z.ZodString;
+        }, z.core.$strip>>;
+        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        searchParam: z.ZodOptional<z.ZodString>;
+        resultPath: z.ZodOptional<z.ZodString>;
+        jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+            rpcMethod: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    list: z.ZodObject<{
+        method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
+        pathTemplate: z.ZodString;
+        pagingParams: z.ZodOptional<z.ZodObject<{
+            limitParam: z.ZodString;
+            offsetParam: z.ZodString;
+        }, z.core.$strip>>;
+        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        searchParam: z.ZodOptional<z.ZodString>;
+        resultPath: z.ZodOptional<z.ZodString>;
+        jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+            rpcMethod: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    count: z.ZodOptional<z.ZodObject<{
+        method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
+        pathTemplate: z.ZodString;
+        pagingParams: z.ZodOptional<z.ZodObject<{
+            limitParam: z.ZodString;
+            offsetParam: z.ZodString;
+        }, z.core.$strip>>;
+        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        searchParam: z.ZodOptional<z.ZodString>;
+        resultPath: z.ZodOptional<z.ZodString>;
+        jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+            rpcMethod: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    search: z.ZodOptional<z.ZodObject<{
+        method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
+        pathTemplate: z.ZodString;
+        pagingParams: z.ZodOptional<z.ZodObject<{
+            limitParam: z.ZodString;
+            offsetParam: z.ZodString;
+        }, z.core.$strip>>;
+        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        searchParam: z.ZodOptional<z.ZodString>;
+        resultPath: z.ZodOptional<z.ZodString>;
+        jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+            rpcMethod: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type HttpApiRestOperations = z.infer<typeof HttpApiRestOperationsSchema>;
+/** Tenancy declaration — discriminated so each stance carries exactly its own obligations. */
+export declare const HttpApiTenancyDeclarationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
+    remoteScopeField: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
+    justification: z.ZodString;
+}, z.core.$strip>], "stance">;
+export type HttpApiTenancyDeclaration = z.infer<typeof HttpApiTenancyDeclarationSchema>;
+/**
+ * HTTP methods a declared EXPLICIT erasure operation (stance 6b, REST_JSON) may use.
+ *
+ * A separate vocabulary from {@link HttpApiRestOperationMethod} on purpose: that enum describes
+ * READ-family operations (GET/POST), and reusing it here would let an erasure declare `GET` — a
+ * read spelled as a deletion. Deletion is expressed as the resource-oriented `DELETE` or an
+ * RPC-style `POST`; nothing else is a deletion on the wire.
+ */
+export declare enum HttpApiErasureOperationMethod {
+    POST = "POST",
+    DELETE = "DELETE"
+}
+/**
+ * The EXPLICIT erasure call a REST_JSON binding declares for stance 6b. Deliberately narrower
+ * than {@link HttpApiRestOperationSpecSchema}: an erasure addresses ONE row by key — it has no
+ * pagination, no filter params, no search, no result path to project.
+ */
+export declare const HttpApiErasureOperationSpecSchema: z.ZodObject<{
+    method: z.ZodEnum<typeof HttpApiErasureOperationMethod>;
+    pathTemplate: z.ZodString;
+    jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+        rpcMethod: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type HttpApiErasureOperationSpec = z.infer<typeof HttpApiErasureOperationSpecSchema>;
+/** Erasure declaration — discriminated; stance 6b names the operation it invokes. */
+export declare const HttpApiErasureDeclarationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    stance: z.ZodLiteral<HttpApiErasureStance.NO_SUBJECT_DATA>;
+}, z.core.$strip>, z.ZodObject<{
+    stance: z.ZodLiteral<HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION>;
+    operation: z.ZodUnion<readonly [z.ZodObject<{
+        useCanonicalDelete: z.ZodLiteral<true>;
+    }, z.core.$strip>, z.ZodObject<{
+        method: z.ZodEnum<typeof HttpApiErasureOperationMethod>;
+        pathTemplate: z.ZodString;
+        jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+            rpcMethod: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>]>;
+    subjectLinkLocalField: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    stance: z.ZodLiteral<HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE>;
+    subjectLinkLocalField: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "stance">;
+export type HttpApiErasureDeclaration = z.infer<typeof HttpApiErasureDeclarationSchema>;
+/**
+ * The HTTP_API resource binding — discriminated on the transport dialect so each dialect carries
+ * exactly its own obligations: ODATA is generic (plus an optional `$metadata` probe opt-out for
+ * targets that do not serve one); REST_JSON must declare its whole read surface.
+ */
+/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
+export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    verifyMetadataAtBoot: z.ZodDefault<z.ZodBoolean>;
+    providerRef: z.ZodString;
+    entityRef: z.ZodString;
+    identityMode: z.ZodDefault<z.ZodEnum<typeof HttpApiIdentityMode>>;
+    keyFields: z.ZodArray<z.ZodObject<{
+        localField: z.ZodString;
+        remoteField: z.ZodString;
+        codec: z.ZodEnum<typeof HttpApiKeyComponentCodec>;
+    }, z.core.$strip>>;
+    fieldMappings: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        localField: z.ZodString;
+        remoteField: z.ZodString;
+    }, z.core.$strip>>>;
+    tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
+        remoteScopeField: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
+        justification: z.ZodString;
+    }, z.core.$strip>], "stance">;
+    erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiErasureStance.NO_SUBJECT_DATA>;
+    }, z.core.$strip>, z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION>;
+        operation: z.ZodUnion<readonly [z.ZodObject<{
+            useCanonicalDelete: z.ZodLiteral<true>;
+        }, z.core.$strip>, z.ZodObject<{
+            method: z.ZodEnum<typeof HttpApiErasureOperationMethod>;
+            pathTemplate: z.ZodString;
+            jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+                rpcMethod: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>]>;
+        subjectLinkLocalField: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE>;
+        subjectLinkLocalField: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>], "stance">;
+    remoteCallSemantics: z.ZodDefault<z.ZodObject<{
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        retry: z.ZodDefault<z.ZodObject<{
+            maxAttempts: z.ZodDefault<z.ZodNumber>;
+            backoffMs: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
+        maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    dialect: z.ZodLiteral<HttpApiTransportDialect.ODATA>;
+}, z.core.$strip>, z.ZodObject<{
+    operations: z.ZodObject<{
+        read: z.ZodObject<{
+            method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
+            pathTemplate: z.ZodString;
+            pagingParams: z.ZodOptional<z.ZodObject<{
+                limitParam: z.ZodString;
+                offsetParam: z.ZodString;
+            }, z.core.$strip>>;
+            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            searchParam: z.ZodOptional<z.ZodString>;
+            resultPath: z.ZodOptional<z.ZodString>;
+            jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+                rpcMethod: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        list: z.ZodObject<{
+            method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
+            pathTemplate: z.ZodString;
+            pagingParams: z.ZodOptional<z.ZodObject<{
+                limitParam: z.ZodString;
+                offsetParam: z.ZodString;
+            }, z.core.$strip>>;
+            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            searchParam: z.ZodOptional<z.ZodString>;
+            resultPath: z.ZodOptional<z.ZodString>;
+            jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+                rpcMethod: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        count: z.ZodOptional<z.ZodObject<{
+            method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
+            pathTemplate: z.ZodString;
+            pagingParams: z.ZodOptional<z.ZodObject<{
+                limitParam: z.ZodString;
+                offsetParam: z.ZodString;
+            }, z.core.$strip>>;
+            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            searchParam: z.ZodOptional<z.ZodString>;
+            resultPath: z.ZodOptional<z.ZodString>;
+            jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+                rpcMethod: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        search: z.ZodOptional<z.ZodObject<{
+            method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
+            pathTemplate: z.ZodString;
+            pagingParams: z.ZodOptional<z.ZodObject<{
+                limitParam: z.ZodString;
+                offsetParam: z.ZodString;
+            }, z.core.$strip>>;
+            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            searchParam: z.ZodOptional<z.ZodString>;
+            resultPath: z.ZodOptional<z.ZodString>;
+            jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+                rpcMethod: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    providerRef: z.ZodString;
+    entityRef: z.ZodString;
+    identityMode: z.ZodDefault<z.ZodEnum<typeof HttpApiIdentityMode>>;
+    keyFields: z.ZodArray<z.ZodObject<{
+        localField: z.ZodString;
+        remoteField: z.ZodString;
+        codec: z.ZodEnum<typeof HttpApiKeyComponentCodec>;
+    }, z.core.$strip>>;
+    fieldMappings: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        localField: z.ZodString;
+        remoteField: z.ZodString;
+    }, z.core.$strip>>>;
+    tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
+        remoteScopeField: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
+        justification: z.ZodString;
+    }, z.core.$strip>], "stance">;
+    erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiErasureStance.NO_SUBJECT_DATA>;
+    }, z.core.$strip>, z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION>;
+        operation: z.ZodUnion<readonly [z.ZodObject<{
+            useCanonicalDelete: z.ZodLiteral<true>;
+        }, z.core.$strip>, z.ZodObject<{
+            method: z.ZodEnum<typeof HttpApiErasureOperationMethod>;
+            pathTemplate: z.ZodString;
+            jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+                rpcMethod: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>]>;
+        subjectLinkLocalField: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE>;
+        subjectLinkLocalField: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>], "stance">;
+    remoteCallSemantics: z.ZodDefault<z.ZodObject<{
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        retry: z.ZodDefault<z.ZodObject<{
+            maxAttempts: z.ZodDefault<z.ZodNumber>;
+            backoffMs: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
+        maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    dialect: z.ZodLiteral<HttpApiTransportDialect.REST_JSON>;
+}, z.core.$strip>, z.ZodObject<{
+    providerRef: z.ZodString;
+    entityRef: z.ZodString;
+    identityMode: z.ZodDefault<z.ZodEnum<typeof HttpApiIdentityMode>>;
+    keyFields: z.ZodArray<z.ZodObject<{
+        localField: z.ZodString;
+        remoteField: z.ZodString;
+        codec: z.ZodEnum<typeof HttpApiKeyComponentCodec>;
+    }, z.core.$strip>>;
+    fieldMappings: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        localField: z.ZodString;
+        remoteField: z.ZodString;
+    }, z.core.$strip>>>;
+    tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
+        remoteScopeField: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
+        justification: z.ZodString;
+    }, z.core.$strip>], "stance">;
+    erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiErasureStance.NO_SUBJECT_DATA>;
+    }, z.core.$strip>, z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION>;
+        operation: z.ZodUnion<readonly [z.ZodObject<{
+            useCanonicalDelete: z.ZodLiteral<true>;
+        }, z.core.$strip>, z.ZodObject<{
+            method: z.ZodEnum<typeof HttpApiErasureOperationMethod>;
+            pathTemplate: z.ZodString;
+            jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+                rpcMethod: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>]>;
+        subjectLinkLocalField: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE>;
+        subjectLinkLocalField: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>], "stance">;
+    remoteCallSemantics: z.ZodDefault<z.ZodObject<{
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        retry: z.ZodDefault<z.ZodObject<{
+            maxAttempts: z.ZodDefault<z.ZodNumber>;
+            backoffMs: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
+        maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    dialect: z.ZodLiteral<HttpApiTransportDialect.ODOO_JSONRPC>;
+}, z.core.$strip>], "dialect">;
+/**
+ * Dialect-specific structural constraints that a discriminated union cannot express member-side.
+ * Called by the resource-configuration factory AFTER the schema parse; throws with the offending
+ * path named.
+ */
+export declare function assertHttpApiBindingDialectCoherence(binding: HttpApiResourceBinding): void;
+/** @wildo_source:part:end saas.models.http-api-binding */
+export type HttpApiResourceBinding = z.infer<typeof HttpApiResourceBindingSchema>;
+/**
+ * Whether this binding's synthesized `_id` is the single key value VERBATIM (legible ids for
+ * Dataverse GUIDs / Odoo integers) versus the encoded composite form. A STATIC property of the
+ * declaration — never sniffed per row — which is what keeps decode unambiguous (paper A).
+ */
+export declare function httpApiBindingUsesVerbatimKey(binding: {
+    keyFields: readonly HttpApiKeyField[];
+}): boolean;
+//# sourceMappingURL=http-api-binding.shared.schemas.d.ts.map

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-binding.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-binding.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;GAIG;AACH,4GAA4G;AAC5G,oBAAY,uBAAuB;IACjC;;;;OAIG;IACH,KAAK,UAAU;IAEf;;;;OAIG;IACH,SAAS,cAAc;IAEvB;;;;;;;;;;;;;OAaG;IACH,YAAY,iBAAiB;CAC9B;AAMD;;;;;;;;;;GAUG;AACH,oBAAY,mBAAmB;IAC7B;;;;OAIG;IACH,iBAAiB,sBAAsB;IAEvC;;;;;OAKG;IACH,cAAc,mBAAmB;CAClC;AAMD;;;;;GAKG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,eAAe,oBAAoB;IAEnC;;;;OAIG;IACH,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,mCAAmC,wCAAwC;CAC5E;AAMD;;GAEG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,qBAAqB,0BAA0B;IAE/C;;;;OAIG;IACH,qBAAqB,0BAA0B;CAChD;AAMD;;;;;;;;GAQG;AACH,oBAAY,wBAAwB;IAClC,+FAA+F;IAC/F,MAAM,WAAW;IAEjB,kFAAkF;IAClF,OAAO,YAAY;IAEnB,2EAA2E;IAC3E,IAAI,SAAS;IAEb;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AACD,0DAA0D;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;iBAShC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBA2B3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;;;GAMG;AACH,oBAAY,0BAA0B;IACpC,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;iBA6CzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAMhF,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B;;;;;;6BAW1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;GAOG;AACH,oBAAY,6BAA6B;IACvC,IAAI,SAAS;IACb,MAAM,WAAW;CAClB;AAED;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;;iBAc5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,qFAAqF;AACrF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;6BAwC1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AA2CxF;;;;GAIG;AACH,4GAA4G;AAC5G,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA0BvC,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAmC1F;AAED,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAgBlF;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE;IAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GACjD,OAAO,CAKT"}