@wildo-ai/saas-models 1.1.2 → 1.1.3

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.d.ts

@@ -22,6 +22,7 @@
  * billing providers do — the binding carries only the reference (plan decision D7).
  */
 import { z } from 'zod';
+import { ExternalProvider_Connection_DelegationMode, ExternalProvider_Connection_OwnerScope } from '@wildo-ai/external-connectors-models';
 /**
  * The query dialect the adapter speaks toward the target system. Closed vocabulary (slice 1);
  * SOAP is a possible later member over the same HTTP transport, and a direct-database kind would
@@ -83,32 +84,6 @@ export declare enum HttpApiTransportDialect {
      */
     ODOO_JSONRPC = "odoo-jsonrpc"
 }
-/**
- * Whose identity the adapter presents to the target system. In BOTH modes audit rows carry the
- * REAL initiating user — the shared-principal attribution failure documented for Power Platform
- * ("credential-sharing as a service") must not be reproduced (requirement R12).
- *
- * D9 ruling (Paul, 2026-08-27 — re-scoping the original "both executable in slice 1"):
- * **SERVICE_PRINCIPAL-first.** `USER_DELEGATED` stays DECLARED and representable so bindings
- * need no reshape when it arrives, but resolving it REFUSES naming the missing substrate: the
- * engine has no outbound per-user token store (measured — `OAuth2_CredentialSchema` is a model
- * with no resource, persistence or service behind it). Building that store is its own workstream.
- */
-export declare enum HttpApiIdentityMode {
-    /**
-     * One service account per binding (never shared across applications — blast-radius doctrine).
-     * Wildo's own roles/operations gate who may trigger calls. The default, and the only option
-     * when the target has no per-user OAuth surface.
-     */
-    SERVICE_PRINCIPAL = "service-principal",
-    /**
-     * Per-user OAuth 2.0 tokens against the target — encrypted, session-bound (the Retool model;
-     * on-behalf-of where the IdP is shared, e.g. Entra ID for Dynamics). Use when the TARGET's own
-     * authorization must decide per user: the tool can then never show a user more than the target
-     * would.
-     */
-    USER_DELEGATED = "user-delegated"
-}
 /**
  * The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class
  * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a
@@ -229,10 +204,23 @@ export declare enum HttpApiRestOperationMethod {
  * operation. Deliberately minimal in slice 1 — pagination/filter parameter NAMES are declared,
  * their VALUES are supplied by the adapter from the translated query.
  *
- * Related but distinct: `REST_API_OperationSpecSchema` in `@wildo-ai/external-connectors-models`
- * describes provider-protocol operations for capability transformers. This schema describes a
- * RESOURCE read surface; if the two converge later that is a recorded decision, not an implicit
- * merge of distinct concepts.
+ * Related but distinct: `ProviderRestOperation` on a provider's `rest` runtime contract describes a
+ * VENDOR operation — one entry in the catalogue a reference below names. This schema describes a
+ * RESOURCE read surface, which is a different thing and stays here.
+ *
+ * (An earlier revision pointed at `REST_API_OperationSpecSchema` in
+ * `@wildo-ai/external-connectors-models` "for capability transformers". Both are gone: the
+ * transformer layer was retired with `features/` in #327, and that OpenAPI-shaped operations layer
+ * — ten exported symbols with zero code readers — was deleted in #331 rather than wired up, so
+ * "what a provider can do" has one description instead of two.)
+ *
+ * The convergence this JSDoc asked to be RECORDED rather than performed implicitly happened in
+ * S3a (#331), and it is not the merge that sentence was written to prevent. A member of
+ * {@link HttpApiRestOperationsSchema} may now be a {@link HttpApiRestOperationReferenceSchema}
+ * naming an operation in the PROVIDER's own `rest.operations` catalogue — the vendor half stated
+ * once per provider, the resource half (local-field filter mapping, search parameter, which path
+ * token takes the key) still stated here, because a provider has never heard of a local field
+ * name. Both forms stay: an inline spec is still the right answer for a target no provider wraps.
  */
 export declare const HttpApiRestOperationSpecSchema: z.ZodObject<{
     method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
@@ -249,9 +237,106 @@ export declare const HttpApiRestOperationSpecSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type HttpApiRestOperationSpec = z.infer<typeof HttpApiRestOperationSpecSchema>;
+/**
+ * A REFERENCE into the PROVIDER's own operation catalogue, instead of restating the operation here
+ * (S3a, #331 — the convergence {@link HttpApiRestOperationSpecSchema}'s JSDoc asked to be recorded
+ * as a decision rather than performed implicitly).
+ *
+ * ## The split, and why it is not a merge
+ *
+ * The two schemas describe different things and both survive. A provider operation is VENDOR-
+ * shaped: method, path, result path, how the vendor pages. An ETL read surface is RESOURCE-shaped:
+ * which LOCAL field is translatable to which remote filter parameter, which parameter carries the
+ * search text, which path token receives this resource's synthesized key. The vendor half is the
+ * same for every resource that reads that vendor, and restating it per binding is how ten bindings
+ * come to disagree about one API. The resource half cannot live on the provider, because a provider
+ * has never heard of a local field name.
+ *
+ * So a reference carries the resource half and NAMES the vendor half. What it does not do is merge
+ * the two concepts: an inline spec is still the right answer for a target no provider wraps.
+ *
+ * ## What a reference refuses
+ *
+ * The referenced operation must be a READ (`classification`) and must speak GET or POST. A read
+ * surface that could reference a WRITE would let a LIST call delete rows, and the resource
+ * repository's whole read-only stance (D3) would rest on nobody having authored it that way.
+ */
+export declare const HttpApiRestOperationReferenceSchema: z.ZodObject<{
+    /** The `operationId` in the provider's own `rest.operations` catalogue. */
+    providerOperationId: z.ZodString;
+    /**
+     * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
+     * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+     */
+    domain: z.ZodOptional<z.ZodString>;
+    /**
+     * The referenced operation's PATH parameter that receives this resource's synthesized key.
+     * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
+     * collection member, where it is refused rather than ignored.
+     */
+    keyParameter: z.ZodOptional<z.ZodString>;
+    /**
+     * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
+     * spec, because the provider cannot know a local field name. Only fields listed here are
+     * translatable for this operation; everything else is refused at the adapter boundary.
+     */
+    filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
+    searchParam: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type HttpApiRestOperationReference = z.infer<typeof HttpApiRestOperationReferenceSchema>;
+/**
+ * One read-surface member: the operation stated INLINE, or a REFERENCE into the provider's
+ * catalogue.
+ *
+ * A plain union rather than a `kind`-discriminated one, deliberately: the two shapes are already
+ * unambiguous (an inline spec has a required `method` and `pathTemplate`, a reference a required
+ * `providerOperationId`, and neither satisfies the other), and adding a discriminator would have
+ * meant editing every binding that exists today to say `kind: 'inline'` — churn on working
+ * declarations to buy a slightly better parse error.
+ */
+export declare const HttpApiRestOperationDeclarationSchema: z.ZodUnion<readonly [z.ZodObject<{
+    method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
+    pathTemplate: z.ZodString;
+    pagingParams: z.ZodOptional<z.ZodObject<{
+        limitParam: z.ZodString;
+        offsetParam: z.ZodString;
+    }, z.core.$strip>>;
+    filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    searchParam: z.ZodOptional<z.ZodString>;
+    resultPath: z.ZodOptional<z.ZodString>;
+    jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+        rpcMethod: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    /** The `operationId` in the provider's own `rest.operations` catalogue. */
+    providerOperationId: z.ZodString;
+    /**
+     * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
+     * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+     */
+    domain: z.ZodOptional<z.ZodString>;
+    /**
+     * The referenced operation's PATH parameter that receives this resource's synthesized key.
+     * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
+     * collection member, where it is refused rather than ignored.
+     */
+    keyParameter: z.ZodOptional<z.ZodString>;
+    /**
+     * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
+     * spec, because the provider cannot know a local field name. Only fields listed here are
+     * translatable for this operation; everything else is refused at the adapter boundary.
+     */
+    filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
+    searchParam: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+export type HttpApiRestOperationDeclaration = z.infer<typeof HttpApiRestOperationDeclarationSchema>;
+/** Narrow a declared member to a catalogue reference. */
+export declare function isHttpApiRestOperationReference(declaration: HttpApiRestOperationDeclaration): declaration is HttpApiRestOperationReference;
 /** The REST_JSON read-surface mapping: which lifecycle members exist remotely, and how. */
 export declare const HttpApiRestOperationsSchema: z.ZodObject<{
-    read: z.ZodObject<{
+    read: z.ZodUnion<readonly [z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
@@ -264,8 +349,30 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>;
-    list: z.ZodObject<{
+    }, z.core.$strip>, z.ZodObject<{
+        /** The `operationId` in the provider's own `rest.operations` catalogue. */
+        providerOperationId: z.ZodString;
+        /**
+         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
+         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+         */
+        domain: z.ZodOptional<z.ZodString>;
+        /**
+         * The referenced operation's PATH parameter that receives this resource's synthesized key.
+         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
+         * collection member, where it is refused rather than ignored.
+         */
+        keyParameter: z.ZodOptional<z.ZodString>;
+        /**
+         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
+         * spec, because the provider cannot know a local field name. Only fields listed here are
+         * translatable for this operation; everything else is refused at the adapter boundary.
+         */
+        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
+        searchParam: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>;
+    list: z.ZodUnion<readonly [z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
@@ -278,8 +385,30 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>;
-    count: z.ZodOptional<z.ZodObject<{
+    }, z.core.$strip>, z.ZodObject<{
+        /** The `operationId` in the provider's own `rest.operations` catalogue. */
+        providerOperationId: z.ZodString;
+        /**
+         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
+         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+         */
+        domain: z.ZodOptional<z.ZodString>;
+        /**
+         * The referenced operation's PATH parameter that receives this resource's synthesized key.
+         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
+         * collection member, where it is refused rather than ignored.
+         */
+        keyParameter: z.ZodOptional<z.ZodString>;
+        /**
+         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
+         * spec, because the provider cannot know a local field name. Only fields listed here are
+         * translatable for this operation; everything else is refused at the adapter boundary.
+         */
+        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
+        searchParam: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>;
+    count: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
@@ -292,8 +421,30 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    search: z.ZodOptional<z.ZodObject<{
+    }, z.core.$strip>, z.ZodObject<{
+        /** The `operationId` in the provider's own `rest.operations` catalogue. */
+        providerOperationId: z.ZodString;
+        /**
+         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
+         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+         */
+        domain: z.ZodOptional<z.ZodString>;
+        /**
+         * The referenced operation's PATH parameter that receives this resource's synthesized key.
+         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
+         * collection member, where it is refused rather than ignored.
+         */
+        keyParameter: z.ZodOptional<z.ZodString>;
+        /**
+         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
+         * spec, because the provider cannot know a local field name. Only fields listed here are
+         * translatable for this operation; everything else is refused at the adapter boundary.
+         */
+        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
+        searchParam: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>>;
+    search: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
@@ -306,7 +457,29 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>>;
+    }, z.core.$strip>, z.ZodObject<{
+        /** The `operationId` in the provider's own `rest.operations` catalogue. */
+        providerOperationId: z.ZodString;
+        /**
+         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
+         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+         */
+        domain: z.ZodOptional<z.ZodString>;
+        /**
+         * The referenced operation's PATH parameter that receives this resource's synthesized key.
+         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
+         * collection member, where it is refused rather than ignored.
+         */
+        keyParameter: z.ZodOptional<z.ZodString>;
+        /**
+         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
+         * spec, because the provider cannot know a local field name. Only fields listed here are
+         * translatable for this operation; everything else is refused at the adapter boundary.
+         */
+        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
+        searchParam: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>>;
 }, z.core.$strip>;
 export type HttpApiRestOperations = z.infer<typeof HttpApiRestOperationsSchema>;
 /** Tenancy declaration — discriminated so each stance carries exactly its own obligations. */
@@ -373,7 +546,10 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
     verifyMetadataAtBoot: z.ZodDefault<z.ZodBoolean>;
     providerRef: z.ZodString;
     entityRef: z.ZodString;
-    identityMode: z.ZodDefault<z.ZodEnum<typeof HttpApiIdentityMode>>;
+    connection: z.ZodDefault<z.ZodObject<{
+        ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
+        delegation: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
+    }, z.core.$strip>>;
     keyFields: z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
@@ -420,7 +596,7 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
     dialect: z.ZodLiteral<HttpApiTransportDialect.ODATA>;
 }, z.core.$strip>, z.ZodObject<{
     operations: z.ZodObject<{
-        read: z.ZodObject<{
+        read: z.ZodUnion<readonly [z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
@@ -433,8 +609,30 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>;
-        list: z.ZodObject<{
+        }, z.core.$strip>, z.ZodObject<{
+            /** The `operationId` in the provider's own `rest.operations` catalogue. */
+            providerOperationId: z.ZodString;
+            /**
+             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
+             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+             */
+            domain: z.ZodOptional<z.ZodString>;
+            /**
+             * The referenced operation's PATH parameter that receives this resource's synthesized key.
+             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
+             * collection member, where it is refused rather than ignored.
+             */
+            keyParameter: z.ZodOptional<z.ZodString>;
+            /**
+             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
+             * spec, because the provider cannot know a local field name. Only fields listed here are
+             * translatable for this operation; everything else is refused at the adapter boundary.
+             */
+            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
+            searchParam: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>;
+        list: z.ZodUnion<readonly [z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
@@ -447,8 +645,30 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>;
-        count: z.ZodOptional<z.ZodObject<{
+        }, z.core.$strip>, z.ZodObject<{
+            /** The `operationId` in the provider's own `rest.operations` catalogue. */
+            providerOperationId: z.ZodString;
+            /**
+             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
+             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+             */
+            domain: z.ZodOptional<z.ZodString>;
+            /**
+             * The referenced operation's PATH parameter that receives this resource's synthesized key.
+             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
+             * collection member, where it is refused rather than ignored.
+             */
+            keyParameter: z.ZodOptional<z.ZodString>;
+            /**
+             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
+             * spec, because the provider cannot know a local field name. Only fields listed here are
+             * translatable for this operation; everything else is refused at the adapter boundary.
+             */
+            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
+            searchParam: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>;
+        count: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
@@ -461,8 +681,30 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>>;
-        search: z.ZodOptional<z.ZodObject<{
+        }, z.core.$strip>, z.ZodObject<{
+            /** The `operationId` in the provider's own `rest.operations` catalogue. */
+            providerOperationId: z.ZodString;
+            /**
+             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
+             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+             */
+            domain: z.ZodOptional<z.ZodString>;
+            /**
+             * The referenced operation's PATH parameter that receives this resource's synthesized key.
+             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
+             * collection member, where it is refused rather than ignored.
+             */
+            keyParameter: z.ZodOptional<z.ZodString>;
+            /**
+             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
+             * spec, because the provider cannot know a local field name. Only fields listed here are
+             * translatable for this operation; everything else is refused at the adapter boundary.
+             */
+            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
+            searchParam: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>>;
+        search: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
@@ -475,11 +717,36 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>>;
+        }, z.core.$strip>, z.ZodObject<{
+            /** The `operationId` in the provider's own `rest.operations` catalogue. */
+            providerOperationId: z.ZodString;
+            /**
+             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
+             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+             */
+            domain: z.ZodOptional<z.ZodString>;
+            /**
+             * The referenced operation's PATH parameter that receives this resource's synthesized key.
+             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
+             * collection member, where it is refused rather than ignored.
+             */
+            keyParameter: z.ZodOptional<z.ZodString>;
+            /**
+             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
+             * spec, because the provider cannot know a local field name. Only fields listed here are
+             * translatable for this operation; everything else is refused at the adapter boundary.
+             */
+            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
+            searchParam: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>>;
     }, z.core.$strip>;
     providerRef: z.ZodString;
     entityRef: z.ZodString;
-    identityMode: z.ZodDefault<z.ZodEnum<typeof HttpApiIdentityMode>>;
+    connection: z.ZodDefault<z.ZodObject<{
+        ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
+        delegation: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
+    }, z.core.$strip>>;
     keyFields: z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
@@ -527,7 +794,10 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
 }, z.core.$strip>, z.ZodObject<{
     providerRef: z.ZodString;
     entityRef: z.ZodString;
-    identityMode: z.ZodDefault<z.ZodEnum<typeof HttpApiIdentityMode>>;
+    connection: z.ZodDefault<z.ZodObject<{
+        ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
+        delegation: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
+    }, z.core.$strip>>;
     keyFields: z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
@@ -583,7 +853,7 @@ export declare function assertHttpApiBindingDialectCoherence(binding: HttpApiRes
 export type HttpApiResourceBinding = z.infer<typeof HttpApiResourceBindingSchema>;
 /**
  * What an APPLICATION AUTHOR writes — the INPUT shape, so defaulted fields (`verifyMetadataAtBoot`,
- * `identityMode`, the remote-call semantics) are optional to type. Consumers read the parsed shape
+ * `connection`, the remote-call semantics) are optional to type. Consumers read the parsed shape
  * above. Same split, and same reason, as `ExternalDataPipelineDeclarationAuthored`: a config field
  * typed with the PARSED shape makes every default mandatory for the one person the default exists
  * to serve.

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-api-binding.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-binding.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;GAIG;AACH,4GAA4G;AAC5G,oBAAY,uBAAuB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,KAAK,UAAU;IAEf;;;;OAIG;IACH,SAAS,cAAc;IAEvB;;;;;;;;;;;;;OAaG;IACH,YAAY,iBAAiB;CAC9B;AAMD;;;;;;;;;;GAUG;AACH,oBAAY,mBAAmB;IAC7B;;;;OAIG;IACH,iBAAiB,sBAAsB;IAEvC;;;;;OAKG;IACH,cAAc,mBAAmB;CAClC;AAMD;;;;;GAKG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,eAAe,oBAAoB;IAEnC;;;;OAIG;IACH,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,mCAAmC,wCAAwC;CAC5E;AAMD;;GAEG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,qBAAqB,0BAA0B;IAE/C;;;;OAIG;IACH,qBAAqB,0BAA0B;CAChD;AAMD;;;;;;;;GAQG;AACH,oBAAY,wBAAwB;IAClC,+FAA+F;IAC/F,MAAM,WAAW;IAEjB,kFAAkF;IAClF,OAAO,YAAY;IAEnB,2EAA2E;IAC3E,IAAI,SAAS;IAEb;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AACD,0DAA0D;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;iBAShC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBA2B3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;;;GAMG;AACH,oBAAY,0BAA0B;IACpC,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;iBA6CzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAMhF,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B;;;;;;6BAW1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;GAOG;AACH,oBAAY,6BAA6B;IACvC,IAAI,SAAS;IACb,MAAM,WAAW;CAClB;AAED;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;;iBAc5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,qFAAqF;AACrF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;6BAwC1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AA2CxF;;;;GAIG;AACH,4GAA4G;AAC5G,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA0BvC,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAmC1F;AAED,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAgB1F;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE;IAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GACjD,OAAO,CAKT"}
+{"version":3,"file":"http-api-binding.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-binding.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EAEvC,MAAM,sCAAsC,CAAC;AAM9C;;;;GAIG;AACH,4GAA4G;AAC5G,oBAAY,uBAAuB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,KAAK,UAAU;IAEf;;;;OAIG;IACH,SAAS,cAAc;IAEvB;;;;;;;;;;;;;OAaG;IACH,YAAY,iBAAiB;CAC9B;AA+BD;;;;;GAKG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,eAAe,oBAAoB;IAEnC;;;;OAIG;IACH,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,mCAAmC,wCAAwC;CAC5E;AAMD;;GAEG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,qBAAqB,0BAA0B;IAE/C;;;;OAIG;IACH,qBAAqB,0BAA0B;CAChD;AAMD;;;;;;;;GAQG;AACH,oBAAY,wBAAwB;IAClC,+FAA+F;IAC/F,MAAM,WAAW;IAEjB,kFAAkF;IAClF,OAAO,YAAY;IAEnB,2EAA2E;IAC3E,IAAI,SAAS;IAEb;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AACD,0DAA0D;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;iBAShC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBA2B3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;;;GAMG;AACH,oBAAY,0BAA0B;IACpC,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;iBA6CzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,mCAAmC;IAC9C,2EAA2E;;IAE3E;;;OAGG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH,gGAAgG;;kBAEhG,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;IAnChD,2EAA2E;;IAE3E;;;OAGG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH,gGAAgG;;oBAmBhG,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,yDAAyD;AACzD,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,+BAA+B,GAC3C,WAAW,IAAI,6BAA6B,CAE9C;AAED,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;QAlDtC,2EAA2E;;QAE3E;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;QAEH,gGAAgG;;;;;;;;;;;;;;;;;QAnBhG,2EAA2E;;QAE3E;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;QAEH,gGAAgG;;;;;;;;;;;;;;;;;QAnBhG,2EAA2E;;QAE3E;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;QAEH,gGAAgG;;;;;;;;;;;;;;;;;QAnBhG,2EAA2E;;QAE3E;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;QAEH,gGAAgG;;;iBAsChG,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAMhF,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B;;;;;;6BAW1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;GAOG;AACH,oBAAY,6BAA6B;IACvC,IAAI,SAAS;IACb,MAAM,WAAW;CAClB;AAED;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;;iBAc5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,qFAAqF;AACrF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;6BAwC1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAyDxF;;;;GAIG;AACH,4GAA4G;AAC5G,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA/NvC,2EAA2E;;YAE3E;;;eAGG;;YAEH;;;;eAIG;;YAEH;;;;eAIG;;YAEH,gGAAgG;;;;;;;;;;;;;;;;;YAnBhG,2EAA2E;;YAE3E;;;eAGG;;YAEH;;;;eAIG;;YAEH;;;;eAIG;;YAEH,gGAAgG;;;;;;;;;;;;;;;;;YAnBhG,2EAA2E;;YAE3E;;;eAGG;;YAEH;;;;eAIG;;YAEH;;;;eAIG;;YAEH,gGAAgG;;;;;;;;;;;;;;;;;YAnBhG,2EAA2E;;YAE3E;;;eAGG;;YAEH;;;;eAIG;;YAEH;;;;eAIG;;YAEH,gGAAgG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAsOhG,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAoD1F;AAED,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAgB1F;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE;IAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GACjD,OAAO,CAKT"}