@wildo-ai/saas-models 1.1.2 → 1.1.3

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.js

@@ -22,6 +22,7 @@
  * billing providers do — the binding carries only the reference (plan decision D7).
  */
 import { z } from 'zod';
+import { ExternalProvider_Connection_DelegationMode, ExternalProvider_Connection_OwnerScope, ExternalProvider_ConnectionShapeSchema, } from '@wildo-ai/external-connectors-models';
 // --------------------------------
 // Transport dialect
 // --------------------------------
@@ -88,35 +89,28 @@ export var HttpApiTransportDialect;
     HttpApiTransportDialect["ODOO_JSONRPC"] = "odoo-jsonrpc";
 })(HttpApiTransportDialect || (HttpApiTransportDialect = {}));
 // --------------------------------
-// Identity mode (whose identity reaches the target)
+// Whose identity reaches the target
 // --------------------------------
-/**
- * Whose identity the adapter presents to the target system. In BOTH modes audit rows carry the
- * REAL initiating user — the shared-principal attribution failure documented for Power Platform
- * ("credential-sharing as a service") must not be reproduced (requirement R12).
+/*
+ * ─── `HttpApiIdentityMode` was REMOVED here (#333), and replaced rather than widened ────────────
+ *
+ * It had two values — `SERVICE_PRINCIPAL` and `USER_DELEGATED` — and its own docstring said it
+ * stayed declared "so bindings need no reshape when it arrives". That is the one thing it got
+ * wrong. `USER_DELEGATED` names a delegation without naming WHOSE ACCOUNT is spent, and those are
+ * two independent questions with five real answers (`ExternalProvider_ConnectionShape`):
+ *
+ *   - a user's own personal grant is `USER × SERVICE`;
+ *   - a tenant's registration acting for one of its members is `ORGANIZATION × USER`.
  *
- * D9 ruling (Paul, 2026-08-27 — re-scoping the original "both executable in slice 1"):
- * **SERVICE_PRINCIPAL-first.** `USER_DELEGATED` stays DECLARED and representable so bindings
- * need no reshape when it arrives, but resolving it REFUSES naming the missing substrate: the
- * engine has no outbound per-user token store (measured — `OAuth2_CredentialSchema` is a model
- * with no resource, persistence or service behind it). Building that store is its own workstream.
+ * Both are "per-user OAuth against the target", they resolve DIFFERENT credentials, and the single
+ * field cannot distinguish them. So mapping it onto a target would have silently picked a lane —
+ * which is why `connectionTargetForBinding` refused instead of guessing, and why the fix is the
+ * richer vocabulary rather than a translation table.
+ *
+ * The audit contract is unchanged and was never the identity mode's to keep: every row carries the
+ * REAL initiating user whatever the connection, so the shared-principal attribution failure
+ * documented for Power Platform ("credential-sharing as a service") stays closed (requirement R12).
  */
-export var HttpApiIdentityMode;
-(function (HttpApiIdentityMode) {
-    /**
-     * One service account per binding (never shared across applications — blast-radius doctrine).
-     * Wildo's own roles/operations gate who may trigger calls. The default, and the only option
-     * when the target has no per-user OAuth surface.
-     */
-    HttpApiIdentityMode["SERVICE_PRINCIPAL"] = "service-principal";
-    /**
-     * Per-user OAuth 2.0 tokens against the target — encrypted, session-bound (the Retool model;
-     * on-behalf-of where the IdP is shared, e.g. Entra ID for Dynamics). Use when the TARGET's own
-     * authorization must decide per user: the tool can then never show a user more than the target
-     * would.
-     */
-    HttpApiIdentityMode["USER_DELEGATED"] = "user-delegated";
-})(HttpApiIdentityMode || (HttpApiIdentityMode = {}));
 // --------------------------------
 // Erasure stance (GDPR Art. 17 on rows we do not own)
 // --------------------------------
@@ -275,10 +269,23 @@ export var HttpApiRestOperationMethod;
  * operation. Deliberately minimal in slice 1 — pagination/filter parameter NAMES are declared,
  * their VALUES are supplied by the adapter from the translated query.
  *
- * Related but distinct: `REST_API_OperationSpecSchema` in `@wildo-ai/external-connectors-models`
- * describes provider-protocol operations for capability transformers. This schema describes a
- * RESOURCE read surface; if the two converge later that is a recorded decision, not an implicit
- * merge of distinct concepts.
+ * Related but distinct: `ProviderRestOperation` on a provider's `rest` runtime contract describes a
+ * VENDOR operation — one entry in the catalogue a reference below names. This schema describes a
+ * RESOURCE read surface, which is a different thing and stays here.
+ *
+ * (An earlier revision pointed at `REST_API_OperationSpecSchema` in
+ * `@wildo-ai/external-connectors-models` "for capability transformers". Both are gone: the
+ * transformer layer was retired with `features/` in #327, and that OpenAPI-shaped operations layer
+ * — ten exported symbols with zero code readers — was deleted in #331 rather than wired up, so
+ * "what a provider can do" has one description instead of two.)
+ *
+ * The convergence this JSDoc asked to be RECORDED rather than performed implicitly happened in
+ * S3a (#331), and it is not the merge that sentence was written to prevent. A member of
+ * {@link HttpApiRestOperationsSchema} may now be a {@link HttpApiRestOperationReferenceSchema}
+ * naming an operation in the PROVIDER's own `rest.operations` catalogue — the vendor half stated
+ * once per provider, the resource half (local-field filter mapping, search parameter, which path
+ * token takes the key) still stated here, because a provider has never heard of a local field
+ * name. Both forms stay: an inline spec is still the right answer for a target no provider wraps.
  */
 export const HttpApiRestOperationSpecSchema = z.object({
     /** HTTP method for this read-family operation. */
@@ -320,14 +327,79 @@ export const HttpApiRestOperationSpecSchema = z.object({
     })
         .optional(),
 });
+/**
+ * A REFERENCE into the PROVIDER's own operation catalogue, instead of restating the operation here
+ * (S3a, #331 — the convergence {@link HttpApiRestOperationSpecSchema}'s JSDoc asked to be recorded
+ * as a decision rather than performed implicitly).
+ *
+ * ## The split, and why it is not a merge
+ *
+ * The two schemas describe different things and both survive. A provider operation is VENDOR-
+ * shaped: method, path, result path, how the vendor pages. An ETL read surface is RESOURCE-shaped:
+ * which LOCAL field is translatable to which remote filter parameter, which parameter carries the
+ * search text, which path token receives this resource's synthesized key. The vendor half is the
+ * same for every resource that reads that vendor, and restating it per binding is how ten bindings
+ * come to disagree about one API. The resource half cannot live on the provider, because a provider
+ * has never heard of a local field name.
+ *
+ * So a reference carries the resource half and NAMES the vendor half. What it does not do is merge
+ * the two concepts: an inline spec is still the right answer for a target no provider wraps.
+ *
+ * ## What a reference refuses
+ *
+ * The referenced operation must be a READ (`classification`) and must speak GET or POST. A read
+ * surface that could reference a WRITE would let a LIST call delete rows, and the resource
+ * repository's whole read-only stance (D3) would rest on nobody having authored it that way.
+ */
+export const HttpApiRestOperationReferenceSchema = z.strictObject({
+    /** The `operationId` in the provider's own `rest.operations` catalogue. */
+    providerOperationId: z.string().min(1),
+    /**
+     * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
+     * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+     */
+    domain: z.string().min(1).optional(),
+    /**
+     * The referenced operation's PATH parameter that receives this resource's synthesized key.
+     * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
+     * collection member, where it is refused rather than ignored.
+     */
+    keyParameter: z.string().min(1).optional(),
+    /**
+     * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
+     * spec, because the provider cannot know a local field name. Only fields listed here are
+     * translatable for this operation; everything else is refused at the adapter boundary.
+     */
+    filterParams: z.record(z.string().min(1), z.string().min(1)).optional(),
+    /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
+    searchParam: z.string().min(1).optional(),
+});
+/**
+ * One read-surface member: the operation stated INLINE, or a REFERENCE into the provider's
+ * catalogue.
+ *
+ * A plain union rather than a `kind`-discriminated one, deliberately: the two shapes are already
+ * unambiguous (an inline spec has a required `method` and `pathTemplate`, a reference a required
+ * `providerOperationId`, and neither satisfies the other), and adding a discriminator would have
+ * meant editing every binding that exists today to say `kind: 'inline'` — churn on working
+ * declarations to buy a slightly better parse error.
+ */
+export const HttpApiRestOperationDeclarationSchema = z.union([
+    HttpApiRestOperationSpecSchema,
+    HttpApiRestOperationReferenceSchema,
+]);
+/** Narrow a declared member to a catalogue reference. */
+export function isHttpApiRestOperationReference(declaration) {
+    return typeof declaration.providerOperationId === 'string';
+}
 /** The REST_JSON read-surface mapping: which lifecycle members exist remotely, and how. */
 export const HttpApiRestOperationsSchema = z.object({
-    read: HttpApiRestOperationSpecSchema,
-    list: HttpApiRestOperationSpecSchema,
+    read: HttpApiRestOperationDeclarationSchema,
+    list: HttpApiRestOperationDeclarationSchema,
     /** Absent = COUNT is refused for this binding (honest refusal, never an emulated scan). */
-    count: HttpApiRestOperationSpecSchema.optional(),
+    count: HttpApiRestOperationDeclarationSchema.optional(),
     /** Absent = SEARCH is refused for this binding. */
-    search: HttpApiRestOperationSpecSchema.optional(),
+    search: HttpApiRestOperationDeclarationSchema.optional(),
 });
 // --------------------------------
 // Stance sub-declarations
@@ -433,8 +505,22 @@ const httpApiResourceBindingBaseShape = {
      * a REST_JSON surface. One binding, one remote entity set.
      */
     entityRef: z.string().min(1),
-    /** Whose identity reaches the target (D9). */
-    identityMode: z.enum(HttpApiIdentityMode).default(HttpApiIdentityMode.SERVICE_PRINCIPAL),
+    /**
+     * WHOSE ACCOUNT this binding spends, and ON WHOSE BEHALF — the two axes a provider also declares
+     * as `admissibleConnections`, so a binding and the provider it targets are compared in one
+     * vocabulary instead of through an adapter.
+     *
+     * A SHAPE, not a target: the binding says `ORGANIZATION × USER`, and WHICH organization and
+     * WHICH member are supplied per call from the execution that triggered the read. A binding that
+     * named an instance would be a binding per tenant.
+     *
+     * Defaults to the application acting as itself, which is what every binding authored before this
+     * field existed meant.
+     */
+    connection: ExternalProvider_ConnectionShapeSchema.default({
+        ownerScope: ExternalProvider_Connection_OwnerScope.APPLICATION,
+        delegation: ExternalProvider_Connection_DelegationMode.SERVICE,
+    }),
     /** Ordered key declaration — the source of the synthesized engine-facing `_id` (paper A). */
     keyFields: z.array(HttpApiKeyFieldSchema).min(1),
     /** Non-key field name mappings; unlisted fields map by identity. */
@@ -497,6 +583,21 @@ export function assertHttpApiBindingDialectCoherence(binding) {
             throw new Error("keyFields: an ODOO_JSONRPC binding must declare exactly one key field with the INTEGER codec — Odoo row ids are integers ('id').");
         }
     }
+    // A read member must be ONE form or the other. The union parses an object carrying both as an
+    // INLINE spec (the first branch that matches wins) and drops the reference without a word — an
+    // author who wrote `providerOperationId` beside a `method` believes it does something, so the
+    // ambiguity is refused at authoring rather than resolved by branch order at parse time.
+    if (binding.dialect === HttpApiTransportDialect.REST_JSON) {
+        for (const [member, declaration] of Object.entries(binding.operations)) {
+            if (declaration === undefined)
+                continue;
+            const asAny = declaration;
+            if (asAny.providerOperationId !== undefined && asAny.method !== undefined) {
+                throw new Error(`operations.${member}: a read member is either stated INLINE (method + pathTemplate) or a REFERENCE `
+                    + '(providerOperationId) into the provider\'s operation catalogue — never both.');
+            }
+        }
+    }
     // D6 stance 6b — the declared erasure operation's FORM is dialect-specific. The union schema
     // admits both forms; only the pairing below is executable, so an incoherent pairing must refuse
     // at authoring rather than on the first subject-erasure request:

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-api-binding.shared.schemas.js","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-binding.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,mCAAmC;AACnC,oBAAoB;AACpB,mCAAmC;AAEnC;;;;GAIG;AACH,4GAA4G;AAC5G,MAAM,CAAN,IAAY,uBAwDX;AAxDD,WAAY,uBAAuB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,0CAAe,CAAA;IAEf;;;;OAIG;IACH,kDAAuB,CAAA;IAEvB;;;;;;;;;;;;;OAaG;IACH,wDAA6B,CAAA;AAC/B,CAAC,EAxDW,uBAAuB,KAAvB,uBAAuB,QAwDlC;AAED,mCAAmC;AACnC,oDAAoD;AACpD,mCAAmC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,mBAeX;AAfD,WAAY,mBAAmB;IAC7B;;;;OAIG;IACH,8DAAuC,CAAA;IAEvC;;;;;OAKG;IACH,wDAAiC,CAAA;AACnC,CAAC,EAfW,mBAAmB,KAAnB,mBAAmB,QAe9B;AAED,mCAAmC;AACnC,sDAAsD;AACtD,mCAAmC;AAEnC;;;;;GAKG;AACH,MAAM,CAAN,IAAY,oBAsBX;AAtBD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,2DAAmC,CAAA;IAEnC;;;;OAIG;IACH,iFAAyD,CAAA;IAEzD;;;;;OAKG;IACH,mGAA2E,CAAA;AAC7E,CAAC,EAtBW,oBAAoB,KAApB,oBAAoB,QAsB/B;AAED,mCAAmC;AACnC,iBAAiB;AACjB,mCAAmC;AAEnC;;GAEG;AACH,MAAM,CAAN,IAAY,oBAcX;AAdD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,uEAA+C,CAAA;IAE/C;;;;OAIG;IACH,uEAA+C,CAAA;AACjD,CAAC,EAdW,oBAAoB,KAApB,oBAAoB,QAc/B;AAED,mCAAmC;AACnC,+CAA+C;AAC/C,mCAAmC;AAEnC;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,wBAgBX;AAhBD,WAAY,wBAAwB;IAClC,+FAA+F;IAC/F,6CAAiB,CAAA;IAEjB,kFAAkF;IAClF,+CAAmB,CAAA;IAEnB,2EAA2E;IAC3E,yCAAa,CAAA;IAEb;;;;OAIG;IACH,yDAA6B,CAAA;AAC/B,CAAC,EAhBW,wBAAwB,KAAxB,wBAAwB,QAgBnC;AACD,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,+EAA+E;IAC/E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B,4DAA4D;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;CACxC,CAAC,CAAC;AAIH,mCAAmC;AACnC,gBAAgB;AAChB,mCAAmC;AAEnC;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,mCAAmC;AACnC,yDAAyD;AACzD,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,wBAAwB;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEnE;;;OAGG;IACH,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KAChE,CAAC;SACD,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAE9C;;;OAGG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE5D;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/D,CAAC,CAAC;AAIH,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,yCAAW,CAAA;IACX,2CAAa,CAAA;AACf,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,kDAAkD;IAClD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE1C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,iFAAiF;IACjF,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,QAAQ,EAAE;IAEb;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvE;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEzC;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC,2EAA2E;IAC3E,eAAe,EAAE,CAAC;SACf,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE,8BAA8B;IACpC,2FAA2F;IAC3F,KAAK,EAAE,8BAA8B,CAAC,QAAQ,EAAE;IAChD,mDAAmD;IACnD,MAAM,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAIH,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC5E,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,qBAAqB,CAAC;QAC7D,mFAAmF;QACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACpC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,qBAAqB,CAAC;QAC7D,iFAAiF;QACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;CACH,CAAC,CAAC;AAIH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,8CAAa,CAAA;IACb,kDAAiB,CAAA;AACnB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAE7C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B;;;OAGG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAIH,qFAAqF;AACrF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC5E,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,eAAe,CAAC;KACxD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC;QAClE;;;;;WAKG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,iCAAiC;SAClC,CAAC;QACF;;;;;;;;;;WAUG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAChD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,mCAAmC,CAAC;QAC3E;;;;;;WAMG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;CACH,CAAC,CAAC;AAIH,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC,MAAM,+BAA+B,GAAG;IACtC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B,8CAA8C;IAC9C,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;IAExF,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,oEAAoE;IACpE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,+BAA+B;IAC/B,OAAO,EAAE,+BAA+B;IAExC,yDAAyD;IACzD,OAAO,EAAE,+BAA+B;IAExC,uCAAuC;IACvC,mBAAmB,EAAE,gCAAgC,CAAC,OAAO,CAAC;QAC5D,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACzC,YAAY,EAAE,EAAE;KACjB,CAAC;CACH,CAAC;AAEF;;;;GAIG;AACH,4GAA4G;AAC5G,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC1E,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACjD,GAAG,+BAA+B;QAClC;;;;WAIG;QACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAChD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC;QACrD,GAAG,+BAA+B;QAClC,8EAA8E;QAC9E,UAAU,EAAE,2BAA2B;KACxC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,YAAY,CAAC;QACxD,GAAG,+BAA+B;QAClC,4FAA4F;QAC5F,6FAA6F;QAC7F,0FAA0F;QAC1F,6FAA6F;QAC7F,uDAAuD;KACxD,CAAC;CACH,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAA+B;IAClF,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EAAE,CAAC;QAC7D,0FAA0F;QAC1F,6BAA6B;QAC7B,IACE,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;eAC3B,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,wBAAwB,CAAC,OAAO,EAClE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kIAAkI,CACnI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,gGAAgG;IAChG,iEAAiE;IACjE,yFAAyF;IACzF,6FAA6F;IAC7F,mDAAmD;IACnD,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,0BAA0B,EAAE,CAAC;QAC/E,MAAM,mBAAmB,GAAG,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9E,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,mBAAmB,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CACb,iKAAiK,CAClK,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,OAAO,qKAAqK,CAC7M,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAcD,mCAAmC;AACnC,4BAA4B;AAC5B,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,wBAAwB,GAAwC;IACpE,wBAAwB,CAAC,OAAO;IAChC,wBAAwB,CAAC,IAAI;CAC9B,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAkD;IAElD,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;WAC3B,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CACjE,CAAC;AACJ,CAAC","sourcesContent":["/**\n * HTTP-API persistence binding — the declaration model for resources whose rows live in a system\n * reached over an authenticated HTTP API (`PersistenceAdapter.HTTP_API`) rather than in a\n * platform-provisioned database.\n *\n * Design source of truth: `.claude/plans/etl-post-repository.md` (decisions D0/D1/D6/D9/D10,\n * requirements R7/R12/R15/R16) plus the two companion papers\n * `.claude/plans/etl-composite-key-synthesis.md` (key declaration + id codec) and\n * `.claude/plans/etl-filter-dialect-scope-down.md` (declared filter/sort/search surface).\n *\n * The binding is a REQUIRED companion declaration on any resource configuration that selects\n * `PersistenceAdapter.HTTP_API`. It answers, statically and per resource:\n * - WHERE the rows live (provider + entity), and in which transport dialect they are queried;\n * - HOW a row is identified (ordered key components → the synthesized engine-facing `_id`);\n * - WHOSE identity reaches the target system (service principal vs per-user delegation);\n * - HOW tenancy confinement is expressed remotely — or the explicit single-tenant stance;\n * - WHAT the erasure story is (all three stances are first-class; none is silently defaulted);\n * - WHICH remote-call semantics apply (timeout, retry, rate budget, id-set bound).\n *\n * Credentials are NEVER declared here. They resolve at runtime through\n * `ExternalProvidersRegistryBackendService` against the `providerRef`, exactly as email, SMS and\n * billing providers do — the binding carries only the reference (plan decision D7).\n */\n\nimport { z } from 'zod';\n\n// --------------------------------\n// Transport dialect\n// --------------------------------\n\n/**\n * The query dialect the adapter speaks toward the target system. Closed vocabulary (slice 1);\n * SOAP is a possible later member over the same HTTP transport, and a direct-database kind would\n * be a NEW `PersistenceAdapter` member, never a dialect here.\n */\n/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */\nexport enum HttpApiTransportDialect {\n  /**\n   * OData **v4** — one generic client: mechanical pushdown of\n   * `$filter`/`$select`/`$top`/`$skip`/`$orderby`/`$count`, with a `$metadata` boot-time\n   * verification probe of the committed declaration.\n   *\n   * ⚠ **This member is v4 ONLY, and that excludes SAP's most-used API.** An earlier revision of\n   * this comment named \"SAP S/4HANA, Microsoft Dataverse/Dynamics 365\" here, which is half right\n   * and was load-bearing — it is why nobody looked:\n   *\n   * | Target | Version | Consumable today |\n   * |---|---|---|\n   * | Microsoft Dataverse / Dynamics 365 Web API (`/api/data/v9.2/`) | v4 | ✅ |\n   * | SAP S/4HANA OData **v4** services (`/sap/opu/odata4/…`) | v4 | ✅ |\n   * | SAP `API_BUSINESS_PARTNER` (`/sap/opu/odata/sap/API_BUSINESS_PARTNER`) | **v2** | ❌ |\n   *\n   * v2 is not a v4 variant with a different header. Its collection envelope is\n   * `{ \"d\": { \"results\": [...], \"__next\": …, \"__count\": … } }` rather than\n   * `{ \"value\": [...], \"@odata.nextLink\": … }`; `Edm.DateTime` serializes as `\"/Date(<ticks>)/\"`\n   * rather than ISO 8601; `Edm.Decimal` and `Edm.Int64` serialize as JSON STRINGS rather than\n   * numbers; and JSON must be requested (`$format=json`) because v2 defaults to Atom/XML. So it\n   * changes the envelope, the paging property, the count property AND the value encoding — a\n   * reader written for one cannot read the other, and the mapping layer needs coercions the way\n   * Odoo needs `ODOO_FALSE_AS_NULL`.\n   * spec-cite: OData Version 2.0 JSON Format\n   * (https://www.odata.org/documentation/odata-version-2-0/json-format/) — the `d`/`results`/\n   * `__next`/`__count` envelope, the `/Date(<ticks>)/` DateTime literal, and Edm.Decimal /\n   * Edm.Int64 \"formatted as a JSON string\".\n   *\n   * Supporting v2 is an OPEN decision, not an oversight. Until it lands, point an ODATA binding at\n   * a v4 service: for SAP that means the OData v4 edition of the API where one is published.\n   */\n  ODATA = 'odata',\n\n  /**\n   * Declared per-binding REST/JSON operation mapping (bespoke enterprise APIs). Unlike ODATA\n   * there is no generic client: each binding declares how read/list/count/search map onto\n   * concrete HTTP operations.\n   */\n  REST_JSON = 'rest-json',\n\n  /**\n   * Odoo's external API (`/jsonrpc` + `execute_kw`). Promoted to its OWN dialect 2026-08-27 —\n   * D0's original \"JSON-RPC is a thin envelope variant of REST_JSON\" was corrected by measuring\n   * the protocol: it is generic like ODATA (no per-binding operation declarations — the model\n   * name IS `entityRef`, and read/list/count map onto `read`/`search_read`/`search_count`\n   * mechanically), but it speaks POSITIONAL arguments, its own domain filter language\n   * (`[['field','=',value], …]` with polish-notation `'|'` disjunction), and authenticates\n   * INSIDE the RPC args (`execute_kw(db, uid, api_key, …)`) rather than via HTTP headers.\n   * Forcing that through REST_JSON's declared-parameter model would have been the\n   * merge-distinct-concepts failure `design-philosophy.md` forbids.\n   *\n   * Structural constraint (schema-enforced): exactly ONE key field with the `INTEGER` codec —\n   * Odoo row ids are integers, always.\n   */\n  ODOO_JSONRPC = 'odoo-jsonrpc',\n}\n\n// --------------------------------\n// Identity mode (whose identity reaches the target)\n// --------------------------------\n\n/**\n * Whose identity the adapter presents to the target system. In BOTH modes audit rows carry the\n * REAL initiating user — the shared-principal attribution failure documented for Power Platform\n * (\"credential-sharing as a service\") must not be reproduced (requirement R12).\n *\n * D9 ruling (Paul, 2026-08-27 — re-scoping the original \"both executable in slice 1\"):\n * **SERVICE_PRINCIPAL-first.** `USER_DELEGATED` stays DECLARED and representable so bindings\n * need no reshape when it arrives, but resolving it REFUSES naming the missing substrate: the\n * engine has no outbound per-user token store (measured — `OAuth2_CredentialSchema` is a model\n * with no resource, persistence or service behind it). Building that store is its own workstream.\n */\nexport enum HttpApiIdentityMode {\n  /**\n   * One service account per binding (never shared across applications — blast-radius doctrine).\n   * Wildo's own roles/operations gate who may trigger calls. The default, and the only option\n   * when the target has no per-user OAuth surface.\n   */\n  SERVICE_PRINCIPAL = 'service-principal',\n\n  /**\n   * Per-user OAuth 2.0 tokens against the target — encrypted, session-bound (the Retool model;\n   * on-behalf-of where the IdP is shared, e.g. Entra ID for Dynamics). Use when the TARGET's own\n   * authorization must decide per user: the tool can then never show a user more than the target\n   * would.\n   */\n  USER_DELEGATED = 'user-delegated',\n}\n\n// --------------------------------\n// Erasure stance (GDPR Art. 17 on rows we do not own)\n// --------------------------------\n\n/**\n * The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class\n * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a\n * registration refusal, because `exportSubject` is a fail-closed obligation on every resource and\n * \"we cannot delete rows we do not own\" is not an answer the framework may imply silently.\n */\nexport enum HttpApiErasureStance {\n  /**\n   * (6a) The resource declares it holds NO personal/subject data. Registration verifies the\n   * declaration is coherent (e.g. `exportSubject` posture) and erasure is structurally N/A for\n   * the remote rows.\n   */\n  NO_SUBJECT_DATA = 'no-subject-data',\n\n  /**\n   * (6b) The binding declares HOW erasure reaches the foreign system: one named API operation the\n   * engine invokes on a subject-erasure request. This is a single declared write and does NOT\n   * require general write support (slice 1 stays read-only otherwise).\n   */\n  EXTERNAL_ERASURE_OPERATION = 'external-erasure-operation',\n\n  /**\n   * (6c) Erasure REFUSES by default; an explicit, per-request, audited controller acknowledgement\n   * lets it proceed and records the un-erased remote rows at high severity. Mirrors the existing\n   * administrative-floor acknowledgement shape (`administrative-continuity-floors.md`): the record\n   * is the control. NEVER a standing default — the acknowledgement is per erasure request.\n   */\n  CONTROLLER_ACKNOWLEDGED_NON_ERASURE = 'controller-acknowledged-non-erasure',\n}\n\n// --------------------------------\n// Tenancy stance\n// --------------------------------\n\n/**\n * How tenant confinement is enforced against the remote system (requirements R4/R16).\n */\nexport enum HttpApiTenancyStance {\n  /**\n   * The engine's contextual scope predicate is pushed down into every remote query against a\n   * declared remote field. Registration REFUSES a binding whose declared surface cannot express\n   * the scope predicate — a query-time refusal would be a data leak one missed branch away.\n   */\n  SCOPE_FILTER_PUSHDOWN = 'scope-filter-pushdown',\n\n  /**\n   * The binding declares the target system serves exactly ONE tenant (the normal case for an\n   * internal tool on one enterprise's IS). Scope pushdown is then N/A by declaration — an\n   * explicit, audited stance, never an inferred one (R16).\n   */\n  SINGLE_TENANT_BINDING = 'single-tenant-binding',\n}\n\n// --------------------------------\n// Key declaration + component codecs (paper A)\n// --------------------------------\n\n/**\n * Per-component value normalization for key synthesis. The codec is what makes the synthesized\n * `_id` STABLE: every component must round-trip byte-identically between the remote\n * representation and the encoded id, or the same remote row would answer to different ids.\n *\n * `INTEGER` and `GUID` are the two codecs whose entire value space is URL-unreserved-safe, which\n * is what qualifies a single-key binding for the VERBATIM id form (see\n * `httpApiBindingUsesVerbatimKey`).\n */\nexport enum HttpApiKeyComponentCodec {\n  /** Arbitrary remote string. NOT charset-safe → always participates via the encoded id form. */\n  STRING = 'string',\n\n  /** Integer key (Odoo `id`, SAP numeric keys). Digits only → verbatim-eligible. */\n  INTEGER = 'integer',\n\n  /** GUID/UUID key (Dataverse row ids). Hex + dashes → verbatim-eligible. */\n  GUID = 'guid',\n\n  /**\n   * Date/time key component, normalized to the RFC 3339 / ISO 8601 UTC string form before\n   * encoding. NOT verbatim-eligible (`:` is forbidden in ids — websocket room names are\n   * colon-parsed).\n   */\n  DATETIME_ISO = 'datetime-iso',\n}\n/** @wildo_source:part:end saas.models.http-api-binding */\n\n/**\n * One ordered component of the remote entity's key. `keyFields` order is the ENCODING order —\n * declared, committed, and boot-verified against `$metadata` where the dialect provides one;\n * never inferred at runtime (a silently adopted key change would orphan every stored FK value\n * and bookmark).\n */\nexport const HttpApiKeyFieldSchema = z.object({\n  /** The field name on the Wildo resource schema that carries this component. */\n  localField: z.string().min(1),\n\n  /** The remote entity's property name for this component. */\n  remoteField: z.string().min(1),\n\n  /** Value normalization for stable synthesis. */\n  codec: z.enum(HttpApiKeyComponentCodec),\n});\n\nexport type HttpApiKeyField = z.infer<typeof HttpApiKeyFieldSchema>;\n\n// --------------------------------\n// Field mapping\n// --------------------------------\n\n/**\n * Local-to-remote field name mapping for fields whose names differ. Fields not listed map by\n * identity (same name both sides). Key components are declared in `keyFields`, not here.\n */\nexport const HttpApiFieldMappingSchema = z.object({\n  localField: z.string().min(1),\n  remoteField: z.string().min(1),\n});\n\nexport type HttpApiFieldMapping = z.infer<typeof HttpApiFieldMappingSchema>;\n\n// --------------------------------\n// Remote-call semantics (decision D10 / requirement R15)\n// --------------------------------\n\n/**\n * Declared remote-call semantics. An enterprise API is 100ms–2s, rate-limited, and sometimes\n * down; these are DECISIONS, not inherited pipeline defaults. Defaults are conservative on\n * purpose — a binding that needs more declares more.\n */\nexport const HttpApiRemoteCallSemanticsSchema = z.object({\n  /** Per-call timeout. */\n  timeoutMs: z.number().int().positive().max(120_000).default(10_000),\n\n  /**\n   * Retry policy for idempotent READ-family calls only. Writes (when D4 lands) never retry\n   * implicitly.\n   */\n  retry: z\n    .object({\n      maxAttempts: z.number().int().min(1).max(5).default(2),\n      backoffMs: z.number().int().positive().max(30_000).default(500),\n    })\n    .default({ maxAttempts: 2, backoffMs: 500 }),\n\n  /**\n   * Rate budget toward the target, per process. `undefined` = no local throttle (the target's own\n   * limits still apply and surface as refusals).\n   */\n  maxRequestsPerMinute: z.number().int().positive().optional(),\n\n  /**\n   * Upper bound for translated id-set predicates (`_id ∈ {…}` → key-predicate disjunction /\n   * `in`). Above the bound the adapter REFUSES rather than emitting an unbounded URL\n   * (scope-down paper, shape T2).\n   */\n  maxIdSetSize: z.number().int().positive().max(500).default(50),\n});\n\nexport type HttpApiRemoteCallSemantics = z.infer<typeof HttpApiRemoteCallSemanticsSchema>;\n\n// --------------------------------\n// Dialect-specific declarations\n// --------------------------------\n\n/**\n * HTTP methods a declared read-family operation may use. Deliberately NOT the full HTTP verb set\n * (`API_HttpMethod` in `@wildo-ai/external-connectors-models` describes provider-protocol\n * operations): slice 1 is read-only, so the closed vocabulary is the read-safe verb plus POST —\n * because JSON-RPC (Odoo) and many enterprise search endpoints are POST-shaped even for reads.\n * Write verbs (PUT/PATCH/DELETE) enter only with the D4 write story, as their own decision.\n */\nexport enum HttpApiRestOperationMethod {\n  GET = 'GET',\n  POST = 'POST',\n}\n\n/**\n * REST_JSON per-operation declaration: how one read-family member maps onto a concrete HTTP\n * operation. Deliberately minimal in slice 1 — pagination/filter parameter NAMES are declared,\n * their VALUES are supplied by the adapter from the translated query.\n *\n * Related but distinct: `REST_API_OperationSpecSchema` in `@wildo-ai/external-connectors-models`\n * describes provider-protocol operations for capability transformers. This schema describes a\n * RESOURCE read surface; if the two converge later that is a recorded decision, not an implicit\n * merge of distinct concepts.\n */\nexport const HttpApiRestOperationSpecSchema = z.object({\n  /** HTTP method for this read-family operation. */\n  method: z.enum(HttpApiRestOperationMethod),\n\n  /**\n   * Path template relative to the provider's base URL. `{key}` interpolates the synthesized\n   * key's remote addressing form; other `{param}` tokens must be declared parameter names.\n   */\n  pathTemplate: z.string().min(1),\n\n  /** Query/body parameter names for pagination, when the operation supports it. */\n  pagingParams: z\n    .object({\n      limitParam: z.string().min(1),\n      offsetParam: z.string().min(1),\n    })\n    .optional(),\n\n  /**\n   * Declared filter parameter name per LOCAL field. Only fields listed here are translatable for\n   * this operation (scope-down paper, shape T3); everything else is refused at the adapter\n   * boundary.\n   */\n  filterParams: z.record(z.string().min(1), z.string().min(1)).optional(),\n\n  /**\n   * The parameter that receives the SEARCH text (T4), for a `search` operation. Absent =\n   * search is refused for this binding even when the operation exists.\n   */\n  searchParam: z.string().min(1).optional(),\n\n  /**\n   * Dot-path to the payload inside the response body — the rows array (list/search), the entity\n   * object (read), or the number (count). Absent = the body IS the payload. Declared, never\n   * sniffed: response shapes vary per target (`items`, `result`, `value`, raw array) and a wrong\n   * guess would silently read zero rows.\n   */\n  resultPath: z.string().min(1).optional(),\n\n  /** Wrap request/response in a JSON-RPC 2.0 envelope (the Odoo variant). */\n  jsonRpcEnvelope: z\n    .object({\n      rpcMethod: z.string().min(1),\n    })\n    .optional(),\n});\n\nexport type HttpApiRestOperationSpec = z.infer<typeof HttpApiRestOperationSpecSchema>;\n\n/** The REST_JSON read-surface mapping: which lifecycle members exist remotely, and how. */\nexport const HttpApiRestOperationsSchema = z.object({\n  read: HttpApiRestOperationSpecSchema,\n  list: HttpApiRestOperationSpecSchema,\n  /** Absent = COUNT is refused for this binding (honest refusal, never an emulated scan). */\n  count: HttpApiRestOperationSpecSchema.optional(),\n  /** Absent = SEARCH is refused for this binding. */\n  search: HttpApiRestOperationSpecSchema.optional(),\n});\n\nexport type HttpApiRestOperations = z.infer<typeof HttpApiRestOperationsSchema>;\n\n// --------------------------------\n// Stance sub-declarations\n// --------------------------------\n\n/** Tenancy declaration — discriminated so each stance carries exactly its own obligations. */\nexport const HttpApiTenancyDeclarationSchema = z.discriminatedUnion('stance', [\n  z.object({\n    stance: z.literal(HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN),\n    /** The remote field the engine's tenant-scope predicate is pushed down against. */\n    remoteScopeField: z.string().min(1),\n  }),\n  z.object({\n    stance: z.literal(HttpApiTenancyStance.SINGLE_TENANT_BINDING),\n    /** Why this binding is single-tenant — recorded, audited justification (R16). */\n    justification: z.string().min(1),\n  }),\n]);\n\nexport type HttpApiTenancyDeclaration = z.infer<typeof HttpApiTenancyDeclarationSchema>;\n\n/**\n * HTTP methods a declared EXPLICIT erasure operation (stance 6b, REST_JSON) may use.\n *\n * A separate vocabulary from {@link HttpApiRestOperationMethod} on purpose: that enum describes\n * READ-family operations (GET/POST), and reusing it here would let an erasure declare `GET` — a\n * read spelled as a deletion. Deletion is expressed as the resource-oriented `DELETE` or an\n * RPC-style `POST`; nothing else is a deletion on the wire.\n */\nexport enum HttpApiErasureOperationMethod {\n  POST = 'POST',\n  DELETE = 'DELETE',\n}\n\n/**\n * The EXPLICIT erasure call a REST_JSON binding declares for stance 6b. Deliberately narrower\n * than {@link HttpApiRestOperationSpecSchema}: an erasure addresses ONE row by key — it has no\n * pagination, no filter params, no search, no result path to project.\n */\nexport const HttpApiErasureOperationSpecSchema = z.object({\n  method: z.enum(HttpApiErasureOperationMethod),\n\n  /**\n   * Path template relative to the provider base URL. `{key}` interpolates the row's remote key\n   * addressing form, exactly as in the read-family `pathTemplate`.\n   */\n  pathTemplate: z.string().min(1),\n\n  /**\n   * JSON-RPC envelope for RPC-style targets (pairs with `method: POST`), mirroring the\n   * read-family declaration.\n   */\n  jsonRpcEnvelope: z.object({ rpcMethod: z.string().min(1) }).optional(),\n});\n\nexport type HttpApiErasureOperationSpec = z.infer<typeof HttpApiErasureOperationSpecSchema>;\n\n/** Erasure declaration — discriminated; stance 6b names the operation it invokes. */\nexport const HttpApiErasureDeclarationSchema = z.discriminatedUnion('stance', [\n  z.object({\n    stance: z.literal(HttpApiErasureStance.NO_SUBJECT_DATA),\n  }),\n  z.object({\n    stance: z.literal(HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION),\n    /**\n     * The declared erasure call. ODATA and ODOO_JSONRPC bindings rely on their CANONICAL delete\n     * (`DELETE /EntitySet(key)` / `execute_kw('unlink', [[ids]])`) by declaring\n     * `useCanonicalDelete`; REST_JSON bindings declare the operation explicitly. The pairing is\n     * enforced by {@link assertHttpApiBindingDialectCoherence}.\n     */\n    operation: z.union([\n      z.object({ useCanonicalDelete: z.literal(true) }),\n      HttpApiErasureOperationSpecSchema,\n    ]),\n    /**\n     * The LOCAL field naming the DATA SUBJECT whose erasure deletes a remote row — the rows the\n     * declared operation applies to are exactly `{ [subjectLinkLocalField]: <erased subject id> }`.\n     *\n     * DECLARED, never inferred, for the same reason `dataSubjectPolicy` exists on retention: a\n     * foreign key usually names an OWNER or an ACTOR, not the subject — inferring from \"any FK to\n     * the erased user\" would delete a purchase-order row because the erased user merely CREATED\n     * it, destroying a business record no erasure asked for. One field, mirroring\n     * `sessionPrincipalField`'s \"one field names the person\". Registration verifies a declared\n     * relationship carries this field as its FK (so the subject type it links is known).\n     */\n    subjectLinkLocalField: z.string().trim().min(1),\n  }),\n  z.object({\n    stance: z.literal(HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE),\n    /**\n     * Optional evidence link: the LOCAL field naming the data subject, used ONLY to COUNT the\n     * remaining remote rows for the acknowledgement's CRITICAL audit record (`remainingRowCount`).\n     * Optional because 6c legitimately covers linkage no FK expresses (an email inside remote\n     * rows) — absent, the record carries no count rather than a fabricated zero. Never used to\n     * delete anything.\n     */\n    subjectLinkLocalField: z.string().trim().min(1).optional(),\n  }),\n]);\n\nexport type HttpApiErasureDeclaration = z.infer<typeof HttpApiErasureDeclarationSchema>;\n\n// --------------------------------\n// The binding declaration\n// --------------------------------\n\nconst httpApiResourceBindingBaseShape = {\n  /**\n   * The external provider whose declared protocol configuration carries the base URL and whose\n   * credentials resolve through `ExternalProvidersRegistryBackendService` (decision D7 — no new\n   * secret store, no connection string on the resource config).\n   */\n  providerRef: z.string().min(1),\n\n  /**\n   * The remote entity addressed by this binding — an OData entity-set name, or a logical name for\n   * a REST_JSON surface. One binding, one remote entity set.\n   */\n  entityRef: z.string().min(1),\n\n  /** Whose identity reaches the target (D9). */\n  identityMode: z.enum(HttpApiIdentityMode).default(HttpApiIdentityMode.SERVICE_PRINCIPAL),\n\n  /** Ordered key declaration — the source of the synthesized engine-facing `_id` (paper A). */\n  keyFields: z.array(HttpApiKeyFieldSchema).min(1),\n\n  /** Non-key field name mappings; unlisted fields map by identity. */\n  fieldMappings: z.array(HttpApiFieldMappingSchema).default([]),\n\n  /** Tenancy stance (R4/R16). */\n  tenancy: HttpApiTenancyDeclarationSchema,\n\n  /** Erasure stance (D6) — required; no silent default. */\n  erasure: HttpApiErasureDeclarationSchema,\n\n  /** Remote-call semantics (D10/R15). */\n  remoteCallSemantics: HttpApiRemoteCallSemanticsSchema.default({\n    timeoutMs: 10_000,\n    retry: { maxAttempts: 2, backoffMs: 500 },\n    maxIdSetSize: 50,\n  }),\n};\n\n/**\n * The HTTP_API resource binding — discriminated on the transport dialect so each dialect carries\n * exactly its own obligations: ODATA is generic (plus an optional `$metadata` probe opt-out for\n * targets that do not serve one); REST_JSON must declare its whole read surface.\n */\n/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */\nexport const HttpApiResourceBindingSchema = z.discriminatedUnion('dialect', [\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.ODATA),\n    ...httpApiResourceBindingBaseShape,\n    /**\n     * Verify the committed declaration against the live `$metadata` at boot (decision D5 —\n     * drift is detected at boot and the fix is re-authoring, never silent adaptation). Opt out\n     * only for targets that genuinely do not serve `$metadata`.\n     */\n    verifyMetadataAtBoot: z.boolean().default(true),\n  }),\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.REST_JSON),\n    ...httpApiResourceBindingBaseShape,\n    /** The declared read surface — absent members are refused, never emulated. */\n    operations: HttpApiRestOperationsSchema,\n  }),\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.ODOO_JSONRPC),\n    ...httpApiResourceBindingBaseShape,\n    // Generic like ODATA — no per-binding operation declarations: `entityRef` is the Odoo model\n    // (e.g. 'res.partner'); read/list/count map onto read/search_read/search_count mechanically.\n    // The single-INTEGER-key constraint is enforced by `assertHttpApiBindingDialectCoherence`\n    // (called by the resource-configuration factory) — a refine here would wrap the union member\n    // in effects, which discriminated unions do not admit.\n  }),\n]);\n\n/**\n * Dialect-specific structural constraints that a discriminated union cannot express member-side.\n * Called by the resource-configuration factory AFTER the schema parse; throws with the offending\n * path named.\n */\nexport function assertHttpApiBindingDialectCoherence(binding: HttpApiResourceBinding): void {\n  if (binding.dialect === HttpApiTransportDialect.ODOO_JSONRPC) {\n    // Odoo row ids are INTEGERS, always — one key field, INTEGER codec, or the synthesized id\n    // could never address a row.\n    if (\n      binding.keyFields.length !== 1\n      || binding.keyFields[0].codec !== HttpApiKeyComponentCodec.INTEGER\n    ) {\n      throw new Error(\n        \"keyFields: an ODOO_JSONRPC binding must declare exactly one key field with the INTEGER codec — Odoo row ids are integers ('id').\",\n      );\n    }\n  }\n\n  // D6 stance 6b — the declared erasure operation's FORM is dialect-specific. The union schema\n  // admits both forms; only the pairing below is executable, so an incoherent pairing must refuse\n  // at authoring rather than on the first subject-erasure request:\n  //   - ODATA        → `useCanonicalDelete` only (the canonical `DELETE /EntitySet(key)`);\n  //   - ODOO_JSONRPC → `useCanonicalDelete` only (compiles to `execute_kw('unlink', [[ids]])`,\n  //                    Odoo's own canonical delete);\n  //   - REST_JSON    → an explicit operation spec only (there IS no canonical delete to rely on —\n  //                    the binding declares the exact call, like every other REST_JSON operation).\n  if (binding.erasure.stance === HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION) {\n    const usesCanonicalDelete = 'useCanonicalDelete' in binding.erasure.operation;\n    if (binding.dialect === HttpApiTransportDialect.REST_JSON && usesCanonicalDelete) {\n      throw new Error(\n        'erasure.operation: a REST_JSON binding has no canonical delete — declare the explicit erasure operation spec (method/path), like its other declared operations.',\n      );\n    }\n    if (binding.dialect !== HttpApiTransportDialect.REST_JSON && !usesCanonicalDelete) {\n      throw new Error(\n        `erasure.operation: a ${binding.dialect} binding executes erasure through its CANONICAL delete (declare { useCanonicalDelete: true }) — an explicit REST operation spec has no translation on this dialect.`,\n      );\n    }\n  }\n}\n\n/** @wildo_source:part:end saas.models.http-api-binding */\nexport type HttpApiResourceBinding = z.infer<typeof HttpApiResourceBindingSchema>;\n\n/**\n * What an APPLICATION AUTHOR writes — the INPUT shape, so defaulted fields (`verifyMetadataAtBoot`,\n * `identityMode`, the remote-call semantics) are optional to type. Consumers read the parsed shape\n * above. Same split, and same reason, as `ExternalDataPipelineDeclarationAuthored`: a config field\n * typed with the PARSED shape makes every default mandatory for the one person the default exists\n * to serve.\n */\nexport type HttpApiResourceBindingAuthored = z.input<typeof HttpApiResourceBindingSchema>;\n\n// --------------------------------\n// Static binding properties\n// --------------------------------\n\n/**\n * Codecs whose ENTIRE value space stays within the synthesized-id charset law\n * (`^[A-Za-z0-9._~-]+$`, see `http-api-binding-id.shared.utils.ts`). Membership here is what\n * qualifies a single-key binding for the verbatim id form.\n */\nconst VERBATIM_ELIGIBLE_CODECS: readonly HttpApiKeyComponentCodec[] = [\n  HttpApiKeyComponentCodec.INTEGER,\n  HttpApiKeyComponentCodec.GUID,\n];\n\n/**\n * Whether this binding's synthesized `_id` is the single key value VERBATIM (legible ids for\n * Dataverse GUIDs / Odoo integers) versus the encoded composite form. A STATIC property of the\n * declaration — never sniffed per row — which is what keeps decode unambiguous (paper A).\n */\nexport function httpApiBindingUsesVerbatimKey(\n  binding: { keyFields: readonly HttpApiKeyField[] },\n): boolean {\n  return (\n    binding.keyFields.length === 1\n    && VERBATIM_ELIGIBLE_CODECS.includes(binding.keyFields[0].codec)\n  );\n}\n"]}
+{"version":3,"file":"http-api-binding.shared.schemas.js","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-binding.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAE9C,mCAAmC;AACnC,oBAAoB;AACpB,mCAAmC;AAEnC;;;;GAIG;AACH,4GAA4G;AAC5G,MAAM,CAAN,IAAY,uBAwDX;AAxDD,WAAY,uBAAuB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,0CAAe,CAAA;IAEf;;;;OAIG;IACH,kDAAuB,CAAA;IAEvB;;;;;;;;;;;;;OAaG;IACH,wDAA6B,CAAA;AAC/B,CAAC,EAxDW,uBAAuB,KAAvB,uBAAuB,QAwDlC;AAED,mCAAmC;AACnC,oCAAoC;AACpC,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,mCAAmC;AACnC,sDAAsD;AACtD,mCAAmC;AAEnC;;;;;GAKG;AACH,MAAM,CAAN,IAAY,oBAsBX;AAtBD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,2DAAmC,CAAA;IAEnC;;;;OAIG;IACH,iFAAyD,CAAA;IAEzD;;;;;OAKG;IACH,mGAA2E,CAAA;AAC7E,CAAC,EAtBW,oBAAoB,KAApB,oBAAoB,QAsB/B;AAED,mCAAmC;AACnC,iBAAiB;AACjB,mCAAmC;AAEnC;;GAEG;AACH,MAAM,CAAN,IAAY,oBAcX;AAdD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,uEAA+C,CAAA;IAE/C;;;;OAIG;IACH,uEAA+C,CAAA;AACjD,CAAC,EAdW,oBAAoB,KAApB,oBAAoB,QAc/B;AAED,mCAAmC;AACnC,+CAA+C;AAC/C,mCAAmC;AAEnC;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,wBAgBX;AAhBD,WAAY,wBAAwB;IAClC,+FAA+F;IAC/F,6CAAiB,CAAA;IAEjB,kFAAkF;IAClF,+CAAmB,CAAA;IAEnB,2EAA2E;IAC3E,yCAAa,CAAA;IAEb;;;;OAIG;IACH,yDAA6B,CAAA;AAC/B,CAAC,EAhBW,wBAAwB,KAAxB,wBAAwB,QAgBnC;AACD,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,+EAA+E;IAC/E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B,4DAA4D;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;CACxC,CAAC,CAAC;AAIH,mCAAmC;AACnC,gBAAgB;AAChB,mCAAmC;AAEnC;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,mCAAmC;AACnC,yDAAyD;AACzD,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,wBAAwB;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEnE;;;OAGG;IACH,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KAChE,CAAC;SACD,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAE9C;;;OAGG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE5D;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/D,CAAC,CAAC;AAIH,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,yCAAW,CAAA;IACX,2CAAa,CAAA;AACf,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,kDAAkD;IAClD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE1C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,iFAAiF;IACjF,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,QAAQ,EAAE;IAEb;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvE;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEzC;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC,2EAA2E;IAC3E,eAAe,EAAE,CAAC;SACf,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,2EAA2E;IAC3E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvE,gGAAgG;IAChG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC3D,8BAA8B;IAC9B,mCAAmC;CACpC,CAAC,CAAC;AAIH,yDAAyD;AACzD,MAAM,UAAU,+BAA+B,CAC7C,WAA4C;IAE5C,OAAO,OAAQ,WAA6C,CAAC,mBAAmB,KAAK,QAAQ,CAAC;AAChG,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,qCAAqC;IAC3C,2FAA2F;IAC3F,KAAK,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACvD,mDAAmD;IACnD,MAAM,EAAE,qCAAqC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAIH,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC5E,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,qBAAqB,CAAC;QAC7D,mFAAmF;QACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACpC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,qBAAqB,CAAC;QAC7D,iFAAiF;QACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;CACH,CAAC,CAAC;AAIH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,8CAAa,CAAA;IACb,kDAAiB,CAAA;AACnB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAE7C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B;;;OAGG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAIH,qFAAqF;AACrF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC5E,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,eAAe,CAAC;KACxD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC;QAClE;;;;;WAKG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,iCAAiC;SAClC,CAAC;QACF;;;;;;;;;;WAUG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAChD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,mCAAmC,CAAC;QAC3E;;;;;;WAMG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;CACH,CAAC,CAAC;AAIH,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC,MAAM,+BAA+B,GAAG;IACtC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B;;;;;;;;;;;OAWG;IACH,UAAU,EAAE,sCAAsC,CAAC,OAAO,CAAC;QACzD,UAAU,EAAE,sCAAsC,CAAC,WAAW;QAC9D,UAAU,EAAE,0CAA0C,CAAC,OAAO;KAC/D,CAAC;IAEF,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,oEAAoE;IACpE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,+BAA+B;IAC/B,OAAO,EAAE,+BAA+B;IAExC,yDAAyD;IACzD,OAAO,EAAE,+BAA+B;IAExC,uCAAuC;IACvC,mBAAmB,EAAE,gCAAgC,CAAC,OAAO,CAAC;QAC5D,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACzC,YAAY,EAAE,EAAE;KACjB,CAAC;CACH,CAAC;AAEF;;;;GAIG;AACH,4GAA4G;AAC5G,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC1E,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACjD,GAAG,+BAA+B;QAClC;;;;WAIG;QACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAChD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC;QACrD,GAAG,+BAA+B;QAClC,8EAA8E;QAC9E,UAAU,EAAE,2BAA2B;KACxC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,YAAY,CAAC;QACxD,GAAG,+BAA+B;QAClC,4FAA4F;QAC5F,6FAA6F;QAC7F,0FAA0F;QAC1F,6FAA6F;QAC7F,uDAAuD;KACxD,CAAC;CACH,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAA+B;IAClF,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EAAE,CAAC;QAC7D,0FAA0F;QAC1F,6BAA6B;QAC7B,IACE,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;eAC3B,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,wBAAwB,CAAC,OAAO,EAClE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kIAAkI,CACnI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,+FAA+F;IAC/F,8FAA8F;IAC9F,wFAAwF;IACxF,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,IAAI,WAAW,KAAK,SAAS;gBAAE,SAAS;YACxC,MAAM,KAAK,GAAG,WAAsC,CAAC;YACrD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,iFAAiF;sBACnG,8EAA8E,CACjF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,gGAAgG;IAChG,iEAAiE;IACjE,yFAAyF;IACzF,6FAA6F;IAC7F,mDAAmD;IACnD,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,0BAA0B,EAAE,CAAC;QAC/E,MAAM,mBAAmB,GAAG,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9E,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,mBAAmB,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CACb,iKAAiK,CAClK,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,OAAO,qKAAqK,CAC7M,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAcD,mCAAmC;AACnC,4BAA4B;AAC5B,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,wBAAwB,GAAwC;IACpE,wBAAwB,CAAC,OAAO;IAChC,wBAAwB,CAAC,IAAI;CAC9B,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAkD;IAElD,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;WAC3B,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CACjE,CAAC;AACJ,CAAC","sourcesContent":["/**\n * HTTP-API persistence binding — the declaration model for resources whose rows live in a system\n * reached over an authenticated HTTP API (`PersistenceAdapter.HTTP_API`) rather than in a\n * platform-provisioned database.\n *\n * Design source of truth: `.claude/plans/etl-post-repository.md` (decisions D0/D1/D6/D9/D10,\n * requirements R7/R12/R15/R16) plus the two companion papers\n * `.claude/plans/etl-composite-key-synthesis.md` (key declaration + id codec) and\n * `.claude/plans/etl-filter-dialect-scope-down.md` (declared filter/sort/search surface).\n *\n * The binding is a REQUIRED companion declaration on any resource configuration that selects\n * `PersistenceAdapter.HTTP_API`. It answers, statically and per resource:\n * - WHERE the rows live (provider + entity), and in which transport dialect they are queried;\n * - HOW a row is identified (ordered key components → the synthesized engine-facing `_id`);\n * - WHOSE identity reaches the target system (service principal vs per-user delegation);\n * - HOW tenancy confinement is expressed remotely — or the explicit single-tenant stance;\n * - WHAT the erasure story is (all three stances are first-class; none is silently defaulted);\n * - WHICH remote-call semantics apply (timeout, retry, rate budget, id-set bound).\n *\n * Credentials are NEVER declared here. They resolve at runtime through\n * `ExternalProvidersRegistryBackendService` against the `providerRef`, exactly as email, SMS and\n * billing providers do — the binding carries only the reference (plan decision D7).\n */\n\nimport { z } from 'zod';\nimport {\n  ExternalProvider_Connection_DelegationMode,\n  ExternalProvider_Connection_OwnerScope,\n  ExternalProvider_ConnectionShapeSchema,\n} from '@wildo-ai/external-connectors-models';\n\n// --------------------------------\n// Transport dialect\n// --------------------------------\n\n/**\n * The query dialect the adapter speaks toward the target system. Closed vocabulary (slice 1);\n * SOAP is a possible later member over the same HTTP transport, and a direct-database kind would\n * be a NEW `PersistenceAdapter` member, never a dialect here.\n */\n/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */\nexport enum HttpApiTransportDialect {\n  /**\n   * OData **v4** — one generic client: mechanical pushdown of\n   * `$filter`/`$select`/`$top`/`$skip`/`$orderby`/`$count`, with a `$metadata` boot-time\n   * verification probe of the committed declaration.\n   *\n   * ⚠ **This member is v4 ONLY, and that excludes SAP's most-used API.** An earlier revision of\n   * this comment named \"SAP S/4HANA, Microsoft Dataverse/Dynamics 365\" here, which is half right\n   * and was load-bearing — it is why nobody looked:\n   *\n   * | Target | Version | Consumable today |\n   * |---|---|---|\n   * | Microsoft Dataverse / Dynamics 365 Web API (`/api/data/v9.2/`) | v4 | ✅ |\n   * | SAP S/4HANA OData **v4** services (`/sap/opu/odata4/…`) | v4 | ✅ |\n   * | SAP `API_BUSINESS_PARTNER` (`/sap/opu/odata/sap/API_BUSINESS_PARTNER`) | **v2** | ❌ |\n   *\n   * v2 is not a v4 variant with a different header. Its collection envelope is\n   * `{ \"d\": { \"results\": [...], \"__next\": …, \"__count\": … } }` rather than\n   * `{ \"value\": [...], \"@odata.nextLink\": … }`; `Edm.DateTime` serializes as `\"/Date(<ticks>)/\"`\n   * rather than ISO 8601; `Edm.Decimal` and `Edm.Int64` serialize as JSON STRINGS rather than\n   * numbers; and JSON must be requested (`$format=json`) because v2 defaults to Atom/XML. So it\n   * changes the envelope, the paging property, the count property AND the value encoding — a\n   * reader written for one cannot read the other, and the mapping layer needs coercions the way\n   * Odoo needs `ODOO_FALSE_AS_NULL`.\n   * spec-cite: OData Version 2.0 JSON Format\n   * (https://www.odata.org/documentation/odata-version-2-0/json-format/) — the `d`/`results`/\n   * `__next`/`__count` envelope, the `/Date(<ticks>)/` DateTime literal, and Edm.Decimal /\n   * Edm.Int64 \"formatted as a JSON string\".\n   *\n   * Supporting v2 is an OPEN decision, not an oversight. Until it lands, point an ODATA binding at\n   * a v4 service: for SAP that means the OData v4 edition of the API where one is published.\n   */\n  ODATA = 'odata',\n\n  /**\n   * Declared per-binding REST/JSON operation mapping (bespoke enterprise APIs). Unlike ODATA\n   * there is no generic client: each binding declares how read/list/count/search map onto\n   * concrete HTTP operations.\n   */\n  REST_JSON = 'rest-json',\n\n  /**\n   * Odoo's external API (`/jsonrpc` + `execute_kw`). Promoted to its OWN dialect 2026-08-27 —\n   * D0's original \"JSON-RPC is a thin envelope variant of REST_JSON\" was corrected by measuring\n   * the protocol: it is generic like ODATA (no per-binding operation declarations — the model\n   * name IS `entityRef`, and read/list/count map onto `read`/`search_read`/`search_count`\n   * mechanically), but it speaks POSITIONAL arguments, its own domain filter language\n   * (`[['field','=',value], …]` with polish-notation `'|'` disjunction), and authenticates\n   * INSIDE the RPC args (`execute_kw(db, uid, api_key, …)`) rather than via HTTP headers.\n   * Forcing that through REST_JSON's declared-parameter model would have been the\n   * merge-distinct-concepts failure `design-philosophy.md` forbids.\n   *\n   * Structural constraint (schema-enforced): exactly ONE key field with the `INTEGER` codec —\n   * Odoo row ids are integers, always.\n   */\n  ODOO_JSONRPC = 'odoo-jsonrpc',\n}\n\n// --------------------------------\n// Whose identity reaches the target\n// --------------------------------\n\n/*\n * ─── `HttpApiIdentityMode` was REMOVED here (#333), and replaced rather than widened ────────────\n *\n * It had two values — `SERVICE_PRINCIPAL` and `USER_DELEGATED` — and its own docstring said it\n * stayed declared \"so bindings need no reshape when it arrives\". That is the one thing it got\n * wrong. `USER_DELEGATED` names a delegation without naming WHOSE ACCOUNT is spent, and those are\n * two independent questions with five real answers (`ExternalProvider_ConnectionShape`):\n *\n *   - a user's own personal grant is `USER × SERVICE`;\n *   - a tenant's registration acting for one of its members is `ORGANIZATION × USER`.\n *\n * Both are \"per-user OAuth against the target\", they resolve DIFFERENT credentials, and the single\n * field cannot distinguish them. So mapping it onto a target would have silently picked a lane —\n * which is why `connectionTargetForBinding` refused instead of guessing, and why the fix is the\n * richer vocabulary rather than a translation table.\n *\n * The audit contract is unchanged and was never the identity mode's to keep: every row carries the\n * REAL initiating user whatever the connection, so the shared-principal attribution failure\n * documented for Power Platform (\"credential-sharing as a service\") stays closed (requirement R12).\n */\n\n// --------------------------------\n// Erasure stance (GDPR Art. 17 on rows we do not own)\n// --------------------------------\n\n/**\n * The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class\n * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a\n * registration refusal, because `exportSubject` is a fail-closed obligation on every resource and\n * \"we cannot delete rows we do not own\" is not an answer the framework may imply silently.\n */\nexport enum HttpApiErasureStance {\n  /**\n   * (6a) The resource declares it holds NO personal/subject data. Registration verifies the\n   * declaration is coherent (e.g. `exportSubject` posture) and erasure is structurally N/A for\n   * the remote rows.\n   */\n  NO_SUBJECT_DATA = 'no-subject-data',\n\n  /**\n   * (6b) The binding declares HOW erasure reaches the foreign system: one named API operation the\n   * engine invokes on a subject-erasure request. This is a single declared write and does NOT\n   * require general write support (slice 1 stays read-only otherwise).\n   */\n  EXTERNAL_ERASURE_OPERATION = 'external-erasure-operation',\n\n  /**\n   * (6c) Erasure REFUSES by default; an explicit, per-request, audited controller acknowledgement\n   * lets it proceed and records the un-erased remote rows at high severity. Mirrors the existing\n   * administrative-floor acknowledgement shape (`administrative-continuity-floors.md`): the record\n   * is the control. NEVER a standing default — the acknowledgement is per erasure request.\n   */\n  CONTROLLER_ACKNOWLEDGED_NON_ERASURE = 'controller-acknowledged-non-erasure',\n}\n\n// --------------------------------\n// Tenancy stance\n// --------------------------------\n\n/**\n * How tenant confinement is enforced against the remote system (requirements R4/R16).\n */\nexport enum HttpApiTenancyStance {\n  /**\n   * The engine's contextual scope predicate is pushed down into every remote query against a\n   * declared remote field. Registration REFUSES a binding whose declared surface cannot express\n   * the scope predicate — a query-time refusal would be a data leak one missed branch away.\n   */\n  SCOPE_FILTER_PUSHDOWN = 'scope-filter-pushdown',\n\n  /**\n   * The binding declares the target system serves exactly ONE tenant (the normal case for an\n   * internal tool on one enterprise's IS). Scope pushdown is then N/A by declaration — an\n   * explicit, audited stance, never an inferred one (R16).\n   */\n  SINGLE_TENANT_BINDING = 'single-tenant-binding',\n}\n\n// --------------------------------\n// Key declaration + component codecs (paper A)\n// --------------------------------\n\n/**\n * Per-component value normalization for key synthesis. The codec is what makes the synthesized\n * `_id` STABLE: every component must round-trip byte-identically between the remote\n * representation and the encoded id, or the same remote row would answer to different ids.\n *\n * `INTEGER` and `GUID` are the two codecs whose entire value space is URL-unreserved-safe, which\n * is what qualifies a single-key binding for the VERBATIM id form (see\n * `httpApiBindingUsesVerbatimKey`).\n */\nexport enum HttpApiKeyComponentCodec {\n  /** Arbitrary remote string. NOT charset-safe → always participates via the encoded id form. */\n  STRING = 'string',\n\n  /** Integer key (Odoo `id`, SAP numeric keys). Digits only → verbatim-eligible. */\n  INTEGER = 'integer',\n\n  /** GUID/UUID key (Dataverse row ids). Hex + dashes → verbatim-eligible. */\n  GUID = 'guid',\n\n  /**\n   * Date/time key component, normalized to the RFC 3339 / ISO 8601 UTC string form before\n   * encoding. NOT verbatim-eligible (`:` is forbidden in ids — websocket room names are\n   * colon-parsed).\n   */\n  DATETIME_ISO = 'datetime-iso',\n}\n/** @wildo_source:part:end saas.models.http-api-binding */\n\n/**\n * One ordered component of the remote entity's key. `keyFields` order is the ENCODING order —\n * declared, committed, and boot-verified against `$metadata` where the dialect provides one;\n * never inferred at runtime (a silently adopted key change would orphan every stored FK value\n * and bookmark).\n */\nexport const HttpApiKeyFieldSchema = z.object({\n  /** The field name on the Wildo resource schema that carries this component. */\n  localField: z.string().min(1),\n\n  /** The remote entity's property name for this component. */\n  remoteField: z.string().min(1),\n\n  /** Value normalization for stable synthesis. */\n  codec: z.enum(HttpApiKeyComponentCodec),\n});\n\nexport type HttpApiKeyField = z.infer<typeof HttpApiKeyFieldSchema>;\n\n// --------------------------------\n// Field mapping\n// --------------------------------\n\n/**\n * Local-to-remote field name mapping for fields whose names differ. Fields not listed map by\n * identity (same name both sides). Key components are declared in `keyFields`, not here.\n */\nexport const HttpApiFieldMappingSchema = z.object({\n  localField: z.string().min(1),\n  remoteField: z.string().min(1),\n});\n\nexport type HttpApiFieldMapping = z.infer<typeof HttpApiFieldMappingSchema>;\n\n// --------------------------------\n// Remote-call semantics (decision D10 / requirement R15)\n// --------------------------------\n\n/**\n * Declared remote-call semantics. An enterprise API is 100ms–2s, rate-limited, and sometimes\n * down; these are DECISIONS, not inherited pipeline defaults. Defaults are conservative on\n * purpose — a binding that needs more declares more.\n */\nexport const HttpApiRemoteCallSemanticsSchema = z.object({\n  /** Per-call timeout. */\n  timeoutMs: z.number().int().positive().max(120_000).default(10_000),\n\n  /**\n   * Retry policy for idempotent READ-family calls only. Writes (when D4 lands) never retry\n   * implicitly.\n   */\n  retry: z\n    .object({\n      maxAttempts: z.number().int().min(1).max(5).default(2),\n      backoffMs: z.number().int().positive().max(30_000).default(500),\n    })\n    .default({ maxAttempts: 2, backoffMs: 500 }),\n\n  /**\n   * Rate budget toward the target, per process. `undefined` = no local throttle (the target's own\n   * limits still apply and surface as refusals).\n   */\n  maxRequestsPerMinute: z.number().int().positive().optional(),\n\n  /**\n   * Upper bound for translated id-set predicates (`_id ∈ {…}` → key-predicate disjunction /\n   * `in`). Above the bound the adapter REFUSES rather than emitting an unbounded URL\n   * (scope-down paper, shape T2).\n   */\n  maxIdSetSize: z.number().int().positive().max(500).default(50),\n});\n\nexport type HttpApiRemoteCallSemantics = z.infer<typeof HttpApiRemoteCallSemanticsSchema>;\n\n// --------------------------------\n// Dialect-specific declarations\n// --------------------------------\n\n/**\n * HTTP methods a declared read-family operation may use. Deliberately NOT the full HTTP verb set\n * (`API_HttpMethod` in `@wildo-ai/external-connectors-models` describes provider-protocol\n * operations): slice 1 is read-only, so the closed vocabulary is the read-safe verb plus POST —\n * because JSON-RPC (Odoo) and many enterprise search endpoints are POST-shaped even for reads.\n * Write verbs (PUT/PATCH/DELETE) enter only with the D4 write story, as their own decision.\n */\nexport enum HttpApiRestOperationMethod {\n  GET = 'GET',\n  POST = 'POST',\n}\n\n/**\n * REST_JSON per-operation declaration: how one read-family member maps onto a concrete HTTP\n * operation. Deliberately minimal in slice 1 — pagination/filter parameter NAMES are declared,\n * their VALUES are supplied by the adapter from the translated query.\n *\n * Related but distinct: `ProviderRestOperation` on a provider's `rest` runtime contract describes a\n * VENDOR operation — one entry in the catalogue a reference below names. This schema describes a\n * RESOURCE read surface, which is a different thing and stays here.\n *\n * (An earlier revision pointed at `REST_API_OperationSpecSchema` in\n * `@wildo-ai/external-connectors-models` \"for capability transformers\". Both are gone: the\n * transformer layer was retired with `features/` in #327, and that OpenAPI-shaped operations layer\n * — ten exported symbols with zero code readers — was deleted in #331 rather than wired up, so\n * \"what a provider can do\" has one description instead of two.)\n *\n * The convergence this JSDoc asked to be RECORDED rather than performed implicitly happened in\n * S3a (#331), and it is not the merge that sentence was written to prevent. A member of\n * {@link HttpApiRestOperationsSchema} may now be a {@link HttpApiRestOperationReferenceSchema}\n * naming an operation in the PROVIDER's own `rest.operations` catalogue — the vendor half stated\n * once per provider, the resource half (local-field filter mapping, search parameter, which path\n * token takes the key) still stated here, because a provider has never heard of a local field\n * name. Both forms stay: an inline spec is still the right answer for a target no provider wraps.\n */\nexport const HttpApiRestOperationSpecSchema = z.object({\n  /** HTTP method for this read-family operation. */\n  method: z.enum(HttpApiRestOperationMethod),\n\n  /**\n   * Path template relative to the provider's base URL. `{key}` interpolates the synthesized\n   * key's remote addressing form; other `{param}` tokens must be declared parameter names.\n   */\n  pathTemplate: z.string().min(1),\n\n  /** Query/body parameter names for pagination, when the operation supports it. */\n  pagingParams: z\n    .object({\n      limitParam: z.string().min(1),\n      offsetParam: z.string().min(1),\n    })\n    .optional(),\n\n  /**\n   * Declared filter parameter name per LOCAL field. Only fields listed here are translatable for\n   * this operation (scope-down paper, shape T3); everything else is refused at the adapter\n   * boundary.\n   */\n  filterParams: z.record(z.string().min(1), z.string().min(1)).optional(),\n\n  /**\n   * The parameter that receives the SEARCH text (T4), for a `search` operation. Absent =\n   * search is refused for this binding even when the operation exists.\n   */\n  searchParam: z.string().min(1).optional(),\n\n  /**\n   * Dot-path to the payload inside the response body — the rows array (list/search), the entity\n   * object (read), or the number (count). Absent = the body IS the payload. Declared, never\n   * sniffed: response shapes vary per target (`items`, `result`, `value`, raw array) and a wrong\n   * guess would silently read zero rows.\n   */\n  resultPath: z.string().min(1).optional(),\n\n  /** Wrap request/response in a JSON-RPC 2.0 envelope (the Odoo variant). */\n  jsonRpcEnvelope: z\n    .object({\n      rpcMethod: z.string().min(1),\n    })\n    .optional(),\n});\n\nexport type HttpApiRestOperationSpec = z.infer<typeof HttpApiRestOperationSpecSchema>;\n\n/**\n * A REFERENCE into the PROVIDER's own operation catalogue, instead of restating the operation here\n * (S3a, #331 — the convergence {@link HttpApiRestOperationSpecSchema}'s JSDoc asked to be recorded\n * as a decision rather than performed implicitly).\n *\n * ## The split, and why it is not a merge\n *\n * The two schemas describe different things and both survive. A provider operation is VENDOR-\n * shaped: method, path, result path, how the vendor pages. An ETL read surface is RESOURCE-shaped:\n * which LOCAL field is translatable to which remote filter parameter, which parameter carries the\n * search text, which path token receives this resource's synthesized key. The vendor half is the\n * same for every resource that reads that vendor, and restating it per binding is how ten bindings\n * come to disagree about one API. The resource half cannot live on the provider, because a provider\n * has never heard of a local field name.\n *\n * So a reference carries the resource half and NAMES the vendor half. What it does not do is merge\n * the two concepts: an inline spec is still the right answer for a target no provider wraps.\n *\n * ## What a reference refuses\n *\n * The referenced operation must be a READ (`classification`) and must speak GET or POST. A read\n * surface that could reference a WRITE would let a LIST call delete rows, and the resource\n * repository's whole read-only stance (D3) would rest on nobody having authored it that way.\n */\nexport const HttpApiRestOperationReferenceSchema = z.strictObject({\n  /** The `operationId` in the provider's own `rest.operations` catalogue. */\n  providerOperationId: z.string().min(1),\n  /**\n   * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.\n   * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.\n   */\n  domain: z.string().min(1).optional(),\n  /**\n   * The referenced operation's PATH parameter that receives this resource's synthesized key.\n   * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a\n   * collection member, where it is refused rather than ignored.\n   */\n  keyParameter: z.string().min(1).optional(),\n  /**\n   * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline\n   * spec, because the provider cannot know a local field name. Only fields listed here are\n   * translatable for this operation; everything else is refused at the adapter boundary.\n   */\n  filterParams: z.record(z.string().min(1), z.string().min(1)).optional(),\n  /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */\n  searchParam: z.string().min(1).optional(),\n});\n\nexport type HttpApiRestOperationReference = z.infer<typeof HttpApiRestOperationReferenceSchema>;\n\n/**\n * One read-surface member: the operation stated INLINE, or a REFERENCE into the provider's\n * catalogue.\n *\n * A plain union rather than a `kind`-discriminated one, deliberately: the two shapes are already\n * unambiguous (an inline spec has a required `method` and `pathTemplate`, a reference a required\n * `providerOperationId`, and neither satisfies the other), and adding a discriminator would have\n * meant editing every binding that exists today to say `kind: 'inline'` — churn on working\n * declarations to buy a slightly better parse error.\n */\nexport const HttpApiRestOperationDeclarationSchema = z.union([\n  HttpApiRestOperationSpecSchema,\n  HttpApiRestOperationReferenceSchema,\n]);\n\nexport type HttpApiRestOperationDeclaration = z.infer<typeof HttpApiRestOperationDeclarationSchema>;\n\n/** Narrow a declared member to a catalogue reference. */\nexport function isHttpApiRestOperationReference(\n  declaration: HttpApiRestOperationDeclaration,\n): declaration is HttpApiRestOperationReference {\n  return typeof (declaration as HttpApiRestOperationReference).providerOperationId === 'string';\n}\n\n/** The REST_JSON read-surface mapping: which lifecycle members exist remotely, and how. */\nexport const HttpApiRestOperationsSchema = z.object({\n  read: HttpApiRestOperationDeclarationSchema,\n  list: HttpApiRestOperationDeclarationSchema,\n  /** Absent = COUNT is refused for this binding (honest refusal, never an emulated scan). */\n  count: HttpApiRestOperationDeclarationSchema.optional(),\n  /** Absent = SEARCH is refused for this binding. */\n  search: HttpApiRestOperationDeclarationSchema.optional(),\n});\n\nexport type HttpApiRestOperations = z.infer<typeof HttpApiRestOperationsSchema>;\n\n// --------------------------------\n// Stance sub-declarations\n// --------------------------------\n\n/** Tenancy declaration — discriminated so each stance carries exactly its own obligations. */\nexport const HttpApiTenancyDeclarationSchema = z.discriminatedUnion('stance', [\n  z.object({\n    stance: z.literal(HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN),\n    /** The remote field the engine's tenant-scope predicate is pushed down against. */\n    remoteScopeField: z.string().min(1),\n  }),\n  z.object({\n    stance: z.literal(HttpApiTenancyStance.SINGLE_TENANT_BINDING),\n    /** Why this binding is single-tenant — recorded, audited justification (R16). */\n    justification: z.string().min(1),\n  }),\n]);\n\nexport type HttpApiTenancyDeclaration = z.infer<typeof HttpApiTenancyDeclarationSchema>;\n\n/**\n * HTTP methods a declared EXPLICIT erasure operation (stance 6b, REST_JSON) may use.\n *\n * A separate vocabulary from {@link HttpApiRestOperationMethod} on purpose: that enum describes\n * READ-family operations (GET/POST), and reusing it here would let an erasure declare `GET` — a\n * read spelled as a deletion. Deletion is expressed as the resource-oriented `DELETE` or an\n * RPC-style `POST`; nothing else is a deletion on the wire.\n */\nexport enum HttpApiErasureOperationMethod {\n  POST = 'POST',\n  DELETE = 'DELETE',\n}\n\n/**\n * The EXPLICIT erasure call a REST_JSON binding declares for stance 6b. Deliberately narrower\n * than {@link HttpApiRestOperationSpecSchema}: an erasure addresses ONE row by key — it has no\n * pagination, no filter params, no search, no result path to project.\n */\nexport const HttpApiErasureOperationSpecSchema = z.object({\n  method: z.enum(HttpApiErasureOperationMethod),\n\n  /**\n   * Path template relative to the provider base URL. `{key}` interpolates the row's remote key\n   * addressing form, exactly as in the read-family `pathTemplate`.\n   */\n  pathTemplate: z.string().min(1),\n\n  /**\n   * JSON-RPC envelope for RPC-style targets (pairs with `method: POST`), mirroring the\n   * read-family declaration.\n   */\n  jsonRpcEnvelope: z.object({ rpcMethod: z.string().min(1) }).optional(),\n});\n\nexport type HttpApiErasureOperationSpec = z.infer<typeof HttpApiErasureOperationSpecSchema>;\n\n/** Erasure declaration — discriminated; stance 6b names the operation it invokes. */\nexport const HttpApiErasureDeclarationSchema = z.discriminatedUnion('stance', [\n  z.object({\n    stance: z.literal(HttpApiErasureStance.NO_SUBJECT_DATA),\n  }),\n  z.object({\n    stance: z.literal(HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION),\n    /**\n     * The declared erasure call. ODATA and ODOO_JSONRPC bindings rely on their CANONICAL delete\n     * (`DELETE /EntitySet(key)` / `execute_kw('unlink', [[ids]])`) by declaring\n     * `useCanonicalDelete`; REST_JSON bindings declare the operation explicitly. The pairing is\n     * enforced by {@link assertHttpApiBindingDialectCoherence}.\n     */\n    operation: z.union([\n      z.object({ useCanonicalDelete: z.literal(true) }),\n      HttpApiErasureOperationSpecSchema,\n    ]),\n    /**\n     * The LOCAL field naming the DATA SUBJECT whose erasure deletes a remote row — the rows the\n     * declared operation applies to are exactly `{ [subjectLinkLocalField]: <erased subject id> }`.\n     *\n     * DECLARED, never inferred, for the same reason `dataSubjectPolicy` exists on retention: a\n     * foreign key usually names an OWNER or an ACTOR, not the subject — inferring from \"any FK to\n     * the erased user\" would delete a purchase-order row because the erased user merely CREATED\n     * it, destroying a business record no erasure asked for. One field, mirroring\n     * `sessionPrincipalField`'s \"one field names the person\". Registration verifies a declared\n     * relationship carries this field as its FK (so the subject type it links is known).\n     */\n    subjectLinkLocalField: z.string().trim().min(1),\n  }),\n  z.object({\n    stance: z.literal(HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE),\n    /**\n     * Optional evidence link: the LOCAL field naming the data subject, used ONLY to COUNT the\n     * remaining remote rows for the acknowledgement's CRITICAL audit record (`remainingRowCount`).\n     * Optional because 6c legitimately covers linkage no FK expresses (an email inside remote\n     * rows) — absent, the record carries no count rather than a fabricated zero. Never used to\n     * delete anything.\n     */\n    subjectLinkLocalField: z.string().trim().min(1).optional(),\n  }),\n]);\n\nexport type HttpApiErasureDeclaration = z.infer<typeof HttpApiErasureDeclarationSchema>;\n\n// --------------------------------\n// The binding declaration\n// --------------------------------\n\nconst httpApiResourceBindingBaseShape = {\n  /**\n   * The external provider whose declared protocol configuration carries the base URL and whose\n   * credentials resolve through `ExternalProvidersRegistryBackendService` (decision D7 — no new\n   * secret store, no connection string on the resource config).\n   */\n  providerRef: z.string().min(1),\n\n  /**\n   * The remote entity addressed by this binding — an OData entity-set name, or a logical name for\n   * a REST_JSON surface. One binding, one remote entity set.\n   */\n  entityRef: z.string().min(1),\n\n  /**\n   * WHOSE ACCOUNT this binding spends, and ON WHOSE BEHALF — the two axes a provider also declares\n   * as `admissibleConnections`, so a binding and the provider it targets are compared in one\n   * vocabulary instead of through an adapter.\n   *\n   * A SHAPE, not a target: the binding says `ORGANIZATION × USER`, and WHICH organization and\n   * WHICH member are supplied per call from the execution that triggered the read. A binding that\n   * named an instance would be a binding per tenant.\n   *\n   * Defaults to the application acting as itself, which is what every binding authored before this\n   * field existed meant.\n   */\n  connection: ExternalProvider_ConnectionShapeSchema.default({\n    ownerScope: ExternalProvider_Connection_OwnerScope.APPLICATION,\n    delegation: ExternalProvider_Connection_DelegationMode.SERVICE,\n  }),\n\n  /** Ordered key declaration — the source of the synthesized engine-facing `_id` (paper A). */\n  keyFields: z.array(HttpApiKeyFieldSchema).min(1),\n\n  /** Non-key field name mappings; unlisted fields map by identity. */\n  fieldMappings: z.array(HttpApiFieldMappingSchema).default([]),\n\n  /** Tenancy stance (R4/R16). */\n  tenancy: HttpApiTenancyDeclarationSchema,\n\n  /** Erasure stance (D6) — required; no silent default. */\n  erasure: HttpApiErasureDeclarationSchema,\n\n  /** Remote-call semantics (D10/R15). */\n  remoteCallSemantics: HttpApiRemoteCallSemanticsSchema.default({\n    timeoutMs: 10_000,\n    retry: { maxAttempts: 2, backoffMs: 500 },\n    maxIdSetSize: 50,\n  }),\n};\n\n/**\n * The HTTP_API resource binding — discriminated on the transport dialect so each dialect carries\n * exactly its own obligations: ODATA is generic (plus an optional `$metadata` probe opt-out for\n * targets that do not serve one); REST_JSON must declare its whole read surface.\n */\n/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */\nexport const HttpApiResourceBindingSchema = z.discriminatedUnion('dialect', [\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.ODATA),\n    ...httpApiResourceBindingBaseShape,\n    /**\n     * Verify the committed declaration against the live `$metadata` at boot (decision D5 —\n     * drift is detected at boot and the fix is re-authoring, never silent adaptation). Opt out\n     * only for targets that genuinely do not serve `$metadata`.\n     */\n    verifyMetadataAtBoot: z.boolean().default(true),\n  }),\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.REST_JSON),\n    ...httpApiResourceBindingBaseShape,\n    /** The declared read surface — absent members are refused, never emulated. */\n    operations: HttpApiRestOperationsSchema,\n  }),\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.ODOO_JSONRPC),\n    ...httpApiResourceBindingBaseShape,\n    // Generic like ODATA — no per-binding operation declarations: `entityRef` is the Odoo model\n    // (e.g. 'res.partner'); read/list/count map onto read/search_read/search_count mechanically.\n    // The single-INTEGER-key constraint is enforced by `assertHttpApiBindingDialectCoherence`\n    // (called by the resource-configuration factory) — a refine here would wrap the union member\n    // in effects, which discriminated unions do not admit.\n  }),\n]);\n\n/**\n * Dialect-specific structural constraints that a discriminated union cannot express member-side.\n * Called by the resource-configuration factory AFTER the schema parse; throws with the offending\n * path named.\n */\nexport function assertHttpApiBindingDialectCoherence(binding: HttpApiResourceBinding): void {\n  if (binding.dialect === HttpApiTransportDialect.ODOO_JSONRPC) {\n    // Odoo row ids are INTEGERS, always — one key field, INTEGER codec, or the synthesized id\n    // could never address a row.\n    if (\n      binding.keyFields.length !== 1\n      || binding.keyFields[0].codec !== HttpApiKeyComponentCodec.INTEGER\n    ) {\n      throw new Error(\n        \"keyFields: an ODOO_JSONRPC binding must declare exactly one key field with the INTEGER codec — Odoo row ids are integers ('id').\",\n      );\n    }\n  }\n\n  // A read member must be ONE form or the other. The union parses an object carrying both as an\n  // INLINE spec (the first branch that matches wins) and drops the reference without a word — an\n  // author who wrote `providerOperationId` beside a `method` believes it does something, so the\n  // ambiguity is refused at authoring rather than resolved by branch order at parse time.\n  if (binding.dialect === HttpApiTransportDialect.REST_JSON) {\n    for (const [member, declaration] of Object.entries(binding.operations)) {\n      if (declaration === undefined) continue;\n      const asAny = declaration as Record<string, unknown>;\n      if (asAny.providerOperationId !== undefined && asAny.method !== undefined) {\n        throw new Error(\n          `operations.${member}: a read member is either stated INLINE (method + pathTemplate) or a REFERENCE `\n          + '(providerOperationId) into the provider\\'s operation catalogue — never both.',\n        );\n      }\n    }\n  }\n\n  // D6 stance 6b — the declared erasure operation's FORM is dialect-specific. The union schema\n  // admits both forms; only the pairing below is executable, so an incoherent pairing must refuse\n  // at authoring rather than on the first subject-erasure request:\n  //   - ODATA        → `useCanonicalDelete` only (the canonical `DELETE /EntitySet(key)`);\n  //   - ODOO_JSONRPC → `useCanonicalDelete` only (compiles to `execute_kw('unlink', [[ids]])`,\n  //                    Odoo's own canonical delete);\n  //   - REST_JSON    → an explicit operation spec only (there IS no canonical delete to rely on —\n  //                    the binding declares the exact call, like every other REST_JSON operation).\n  if (binding.erasure.stance === HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION) {\n    const usesCanonicalDelete = 'useCanonicalDelete' in binding.erasure.operation;\n    if (binding.dialect === HttpApiTransportDialect.REST_JSON && usesCanonicalDelete) {\n      throw new Error(\n        'erasure.operation: a REST_JSON binding has no canonical delete — declare the explicit erasure operation spec (method/path), like its other declared operations.',\n      );\n    }\n    if (binding.dialect !== HttpApiTransportDialect.REST_JSON && !usesCanonicalDelete) {\n      throw new Error(\n        `erasure.operation: a ${binding.dialect} binding executes erasure through its CANONICAL delete (declare { useCanonicalDelete: true }) — an explicit REST operation spec has no translation on this dialect.`,\n      );\n    }\n  }\n}\n\n/** @wildo_source:part:end saas.models.http-api-binding */\nexport type HttpApiResourceBinding = z.infer<typeof HttpApiResourceBindingSchema>;\n\n/**\n * What an APPLICATION AUTHOR writes — the INPUT shape, so defaulted fields (`verifyMetadataAtBoot`,\n * `connection`, the remote-call semantics) are optional to type. Consumers read the parsed shape\n * above. Same split, and same reason, as `ExternalDataPipelineDeclarationAuthored`: a config field\n * typed with the PARSED shape makes every default mandatory for the one person the default exists\n * to serve.\n */\nexport type HttpApiResourceBindingAuthored = z.input<typeof HttpApiResourceBindingSchema>;\n\n// --------------------------------\n// Static binding properties\n// --------------------------------\n\n/**\n * Codecs whose ENTIRE value space stays within the synthesized-id charset law\n * (`^[A-Za-z0-9._~-]+$`, see `http-api-binding-id.shared.utils.ts`). Membership here is what\n * qualifies a single-key binding for the verbatim id form.\n */\nconst VERBATIM_ELIGIBLE_CODECS: readonly HttpApiKeyComponentCodec[] = [\n  HttpApiKeyComponentCodec.INTEGER,\n  HttpApiKeyComponentCodec.GUID,\n];\n\n/**\n * Whether this binding's synthesized `_id` is the single key value VERBATIM (legible ids for\n * Dataverse GUIDs / Odoo integers) versus the encoded composite form. A STATIC property of the\n * declaration — never sniffed per row — which is what keeps decode unambiguous (paper A).\n */\nexport function httpApiBindingUsesVerbatimKey(\n  binding: { keyFields: readonly HttpApiKeyField[] },\n): boolean {\n  return (\n    binding.keyFields.length === 1\n    && VERBATIM_ELIGIBLE_CODECS.includes(binding.keyFields[0].codec)\n  );\n}\n"]}

package/dist/esm/index.d.ts

@@ -7,6 +7,7 @@ export * from './flows-actors/task-continuity-binding.actors.shared.schemas';
 export * from './flows-actors/flows-actors.system.shared.schemas';
 export * from './flows-actors/flows-actors.system.shared.definitions';
 export * from './flows-actors/agents.shared.schemas';
+export * from './flows-actors/mcp-servers.shared.schemas';
 export * from './flows-actors/agent-traceability.shared.schemas';
 export * from './flows-actors/flows-actors.io.shared.schemas';
 export * from './flows-actors/flows-actors.commons.shared.schemas';
@@ -28,7 +29,9 @@ export * from './external-providers/external-providers.shared.schemas';
 export * from './external-providers/engine-capabilities.shared.schemas';
 export * from './external-providers/engine-capability-resolution-mode.shared';
 export * from './external-providers/frontend-bootstrap.shared.schemas';
+export * from './external-providers/provider-frontend-surface.shared.schemas';
 export * from './external-providers/provider-metadata.shared.schemas';
+export * from './external-providers/provider-tier-rule.shared.utils';
 export * from './external-providers/provider-capability.shared.schemas';
 export * from './external-providers/provider-protocol.shared.schemas';
 export * from './external-providers/compose-provider-registry.shared';
@@ -61,6 +64,7 @@ export * from './requests/http-requests.shared';
 export * from './crdt/crdt-merge.shared.utils';
 export * from './requests/rate-limits.shared.schemas';
 export * from './requests/manual-controllers-routes-urls';
+export * from './requests/manual-controllers-routes-documentation';
 export * from './resources/resources-registry.shared.core.definitions';
 export * from './resources/resources.shared.core.definitions';
 export * from './resources/resources.shared.schemas';
@@ -92,6 +96,7 @@ export * from './resources/utils/composition-cascade-deletability.validation';
 export * from './resources/utils/duplicate-relationship-registration.validation';
 export * from './resources/utils/schema-family-builder.utils';
 export * from './resources/utils/schema-variant-resolver.utils';
+export * from './resources/utils/field-value-disclosure.utils';
 export * from './resources/utils/resources-summary.utils';
 export * from './resources/utils/repository-dto-builder.utils';
 export * from './resources/utils/schema-type-utils';
@@ -133,6 +138,7 @@ export * from './config/frontend/onboarding.shared.schemas';
 export * from './compliance/audit-trails/audit-actor.shared.schemas';
 export * from './compliance/audit-trails/auditable-events.shared.schema';
 export * from './compliance/audit-trails/audit-logs.shared.resources-config.schemas';
+export * from './compliance/audit-trails/application-audit-logs.shared.resources-config.schemas';
 export * from './compliance/audit-trails/security-audit-event-envelope.shared.schema';
 export * from './compliance/audit-trails/audit-log-sink.shared.schemas';
 export * from './compliance/audit-trails/audit-trail-config.shared.schemas';
@@ -217,6 +223,9 @@ export * from './organizations/tenant-teardown-config.shared.schemas';
 export * from './security/api-keys/api-keys.shared.schemas';
 export * from './security/api-keys/api-keys-application.shared.resources-config.schemas';
 export * from './security/api-keys/api-keys-organization.shared.resources-config.schemas';
+export * from './security/connected-accounts/provider-credentials.shared.schemas';
+export * from './security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas';
+export * from './security/connected-accounts/provider-credentials-user.shared.resources-config.schemas';
 export * from './security/oauth-clients/oauth-clients.shared.schemas';
 export * from './security/oauth-clients/oauth-resource-server.shared.schemas';
 export * from './security/oauth-clients/oauth-clients-application.shared.resources-config.schemas';

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,yDAAyD,CAAC;AACxE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,qCAAqC,CAAA;AACnD,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8DAA8D,CAAC;AAE7E,cAAc,mDAAmD,CAAC;AAClE,cAAc,uDAAuD,CAAC;AACtE,cAAc,sCAAsC,CAAC;AACrD,cAAc,kDAAkD,CAAC;AACjE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,oDAAoD,CAAC;AACnE,cAAc,qDAAqD,CAAC;AACpE,cAAc,sDAAsD,CAAC;AACrE,cAAc,uEAAuE,CAAC;AACtF,cAAc,iDAAiD,CAAC;AAChE,cAAc,kEAAkE,CAAC;AACjF,cAAc,sDAAsD,CAAC;AACrE,cAAc,uEAAuE,CAAC;AACtF,cAAc,qDAAqD,CAAC;AACpE,cAAc,sEAAsE,CAAC;AACrF,cAAc,yCAAyC,CAAC;AACxD,cAAc,4CAA4C,CAAC;AAE3D,cAAc,4EAA4E,CAAC;AAE3F,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uEAAuE,CAAC;AAsBtF,cAAc,wDAAwD,CAAC;AACvE,cAAc,yDAAyD,CAAC;AACxE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,wDAAwD,CAAC;AACvE,cAAc,uDAAuD,CAAC;AACtE,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,uDAAuD,CAAC;AAMtE,cAAc,qDAAqD,CAAC;AAEpE,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6EAA6E,CAAC;AAC5F,cAAc,qCAAqC,CAAC;AACpD,cAAc,8CAA8C,CAAC;AAE7D,cAAc,oCAAoC,CAAC;AACnD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uDAAuD,CAAC;AACtE,cAAc,iDAAiD,CAAC;AAChE,cAAc,4CAA4C,CAAC;AAE3D,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,0CAA0C,CAAC;AACzD,cAAc,sDAAsD,CAAC;AACrE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,qEAAqE,CAAC;AACpF,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,0DAA0D,CAAC;AACzE,cAAc,oEAAoE,CAAC;AACnF,cAAc,6DAA6D,CAAC;AAC5E,cAAc,8EAA8E,CAAC;AAE7F,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC;AACpD,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAS/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wDAAwD,CAAC;AACvE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,sCAAsC,CAAC;AACrD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,iDAAiD,CAAC;AAChE,cAAc,oCAAoC,CAAC;AACnD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,oDAAoD,CAAC;AACnE,cAAc,oDAAoD,CAAC;AAEnE,cAAc,mEAAmE,CAAC;AAClF,cAAc,0DAA0D,CAAC;AACzE,cAAc,qDAAqD,CAAC;AACpE,cAAc,kEAAkE,CAAC;AACjF,cAAc,kEAAkE,CAAC;AACjF,cAAc,wDAAwD,CAAC;AACvE,cAAc,wEAAwE,CAAC;AACvF,cAAc,iDAAiD,CAAC;AAChE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,iDAAiD,CAAC;AAChE,cAAc,uDAAuD,CAAC;AACtE,cAAc,iDAAiD,CAAC;AAChE,cAAc,wDAAwD,CAAC;AACvE,cAAc,sDAAsD,CAAC;AACrE,cAAc,sDAAsD,CAAC;AACrE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,kEAAkE,CAAC;AACjF,cAAc,+CAA+C,CAAC;AAC9D,cAAc,iDAAiD,CAAC;AAChE,cAAc,2CAA2C,CAAC;AAC1D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,qCAAqC,CAAC;AACpD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,wDAAwD,CAAC;AACvE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,kCAAkC,CAAC;AAGjD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AAGzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8CAA8C,CAAC;AAC7D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0CAA0C,CAAC;AAGzD,cAAc,wCAAwC,CAAC;AAGvD,cAAc,mDAAmD,CAAC;AAClE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,6DAA6D,CAAC;AAC5E,cAAc,qEAAqE,CAAC;AACpF,cAAc,qEAAqE,CAAC;AACpF,cAAc,6CAA6C,CAAC;AAG5D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,uDAAuD,CAAC;AACtE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,kDAAkD,CAAC;AACjE,cAAc,sCAAsC,CAAC;AACrD,cAAc,kDAAkD,CAAC;AACjE,cAAc,oCAAoC,CAAC;AACnD,cAAc,6CAA6C,CAAC;AAI5D,cAAc,mDAAmD,CAAC;AAClE,cAAc,uDAAuD,CAAC;AACtE,cAAc,6CAA6C,CAAC;AAK5D,cAAc,sDAAsD,CAAC;AACrE,cAAc,0DAA0D,CAAC;AACzE,cAAc,sEAAsE,CAAC;AACrF,cAAc,uEAAuE,CAAC;AACtF,cAAc,yDAAyD,CAAC;AACxE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,qEAAqE,CAAC;AACpF,cAAc,0DAA0D,CAAC;AACzE,cAAc,oDAAoD,CAAC;AACnE,cAAc,wDAAwD,CAAC;AACvE,cAAc,oDAAoD,CAAC;AACnE,cAAc,oDAAoD,CAAC;AACnE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,kEAAkE,CAAC;AACjF,cAAc,iEAAiE,CAAC;AAChF,cAAc,uDAAuD,CAAC;AACtE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,qDAAqD,CAAC;AACpE,cAAc,oDAAoD,CAAC;AACnE,cAAc,oCAAoC,CAAC;AACnD,cAAc,kDAAkD,CAAC;AACjE,cAAc,yDAAyD,CAAC;AACxE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAG5D,cAAc,0DAA0D,CAAC;AACzE,cAAc,2EAA2E,CAAC;AAC1F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,+EAA+E,CAAC;AAC9F,cAAc,mEAAmE,CAAC;AAClF,cAAc,oFAAoF,CAAC;AACnG,cAAc,kEAAkE,CAAC;AACjF,cAAc,mFAAmF,CAAC;AAClG,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,uEAAuE,CAAC;AACtF,cAAc,yEAAyE,CAAC;AACxF,cAAc,0FAA0F,CAAC;AAGzG,cAAc,0CAA0C,CAAC;AACzD,cAAc,2DAA2D,CAAC;AAC1E,cAAc,gDAAgD,CAAC;AAC/D,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uDAAuD,CAAC;AACtE,cAAc,sCAAsC,CAAC;AACrD,cAAc,uDAAuD,CAAC;AACtE,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iDAAiD,CAAC;AAChE,cAAc,kCAAkC,CAAC;AACjD,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,qCAAqC,CAAC;AACpD,cAAc,sDAAsD,CAAC;AACrE,cAAc,mCAAmC,CAAC;AAClD,cAAc,oDAAoD,CAAC;AACnE,cAAc,uCAAuC,CAAC;AACtD,cAAc,wDAAwD,CAAC;AACvE,cAAc,uCAAuC,CAAC;AACtD,cAAc,wDAAwD,CAAC;AAGvE,cAAc,sDAAsD,CAAC;AACrE,cAAc,uEAAuE,CAAC;AACtF,cAAc,qDAAqD,CAAC;AACpE,cAAc,sEAAsE,CAAC;AACrF,cAAc,2DAA2D,CAAC;AAC1E,cAAc,4EAA4E,CAAC;AAC3F,cAAc,yDAAyD,CAAC;AACxE,cAAc,0EAA0E,CAAC;AACzF,cAAc,qDAAqD,CAAC;AACpE,cAAc,sEAAsE,CAAC;AACrF,cAAc,mDAAmD,CAAC;AAClE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,0DAA0D,CAAC;AACzE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,2EAA2E,CAAC;AAC1F,cAAc,oEAAoE,CAAC;AACnF,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+DAA+D,CAAC;AAC9E,cAAc,uDAAuD,CAAC;AAGtE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,0EAA0E,CAAC;AACzF,cAAc,2EAA2E,CAAC;AAC1F,cAAc,uDAAuD,CAAC;AACtE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,oFAAoF,CAAC;AACnG,cAAc,qFAAqF,CAAC;AACpG,cAAc,8DAA8D,CAAC;AAC7E,cAAc,+EAA+E,CAAC;AAC9F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,2EAA2E,CAAC;AAC1F,cAAc,wDAAwD,CAAC;AACvE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,gFAAgF,CAAC;AAC/F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,4DAA4D,CAAC;AAC3E,cAAc,oEAAoE,CAAC;AACnF,cAAc,iEAAiE,CAAC;AAChF,cAAc,kFAAkF,CAAC;AACjG,cAAc,iDAAiD,CAAC;AAChE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAIlE,cAAc,yCAAyC,CAAC;AACxD,cAAc,0DAA0D,CAAC;AACzE,cAAc,8BAA8B,CAAC;AAC7C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uDAAuD,CAAC;AACtE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,0DAA0D,CAAC;AACzE,cAAc,mDAAmD,CAAC;AAClE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,+DAA+D,CAAC;AAC9E,cAAc,0DAA0D,CAAC;AACzE,cAAc,uCAAuC,CAAC;AACtD,cAAc,yDAAyD,CAAC;AACxE,cAAc,yCAAyC,CAAC;AACxD,cAAc,0DAA0D,CAAC;AACzE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,6DAA6D,CAAC;AAG5E,cAAc,iDAAiD,CAAC;AAGhE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,oCAAoC,CAAC;AACnD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0DAA0D,CAAC;AACzE,cAAc,iEAAiE,CAAC;AAChF,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,8CAA8C,CAAC;AAG7D,cAAc,oDAAoD,CAAC;AACnE,cAAc,8DAA8D,CAAC;AAC7E,cAAc,mDAAmD,CAAC;AAGlE,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2DAA2D,CAAC;AAE1E,cAAc,gDAAgD,CAAC;AAC/D,cAAc,sCAAsC,CAAC;AACrD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,8DAA8D,CAAC;AAG7E,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4DAA4D,CAAC;AAG3E,cAAc,mDAAmD,CAAC;AAGlE,cAAc,4CAA4C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,yDAAyD,CAAC;AACxE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,qCAAqC,CAAA;AACnD,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8DAA8D,CAAC;AAE7E,cAAc,mDAAmD,CAAC;AAClE,cAAc,uDAAuD,CAAC;AACtE,cAAc,sCAAsC,CAAC;AACrD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,kDAAkD,CAAC;AACjE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,oDAAoD,CAAC;AACnE,cAAc,qDAAqD,CAAC;AACpE,cAAc,sDAAsD,CAAC;AACrE,cAAc,uEAAuE,CAAC;AACtF,cAAc,iDAAiD,CAAC;AAChE,cAAc,kEAAkE,CAAC;AACjF,cAAc,sDAAsD,CAAC;AACrE,cAAc,uEAAuE,CAAC;AACtF,cAAc,qDAAqD,CAAC;AACpE,cAAc,sEAAsE,CAAC;AACrF,cAAc,yCAAyC,CAAC;AACxD,cAAc,4CAA4C,CAAC;AAE3D,cAAc,4EAA4E,CAAC;AAE3F,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uEAAuE,CAAC;AAsBtF,cAAc,wDAAwD,CAAC;AACvE,cAAc,yDAAyD,CAAC;AACxE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,wDAAwD,CAAC;AACvE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,uDAAuD,CAAC;AACtE,cAAc,sDAAsD,CAAC;AACrE,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,uDAAuD,CAAC;AAMtE,cAAc,qDAAqD,CAAC;AAEpE,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6EAA6E,CAAC;AAC5F,cAAc,qCAAqC,CAAC;AACpD,cAAc,8CAA8C,CAAC;AAE7D,cAAc,oCAAoC,CAAC;AACnD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uDAAuD,CAAC;AACtE,cAAc,iDAAiD,CAAC;AAChE,cAAc,4CAA4C,CAAC;AAE3D,cAAc,8BAA8B,CAAC;AAC7C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,0CAA0C,CAAC;AACzD,cAAc,sDAAsD,CAAC;AACrE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,qEAAqE,CAAC;AACpF,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAClE,cAAc,0DAA0D,CAAC;AACzE,cAAc,oEAAoE,CAAC;AACnF,cAAc,6DAA6D,CAAC;AAC5E,cAAc,8EAA8E,CAAC;AAE7F,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC;AACpD,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAS/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,oDAAoD,CAAC;AACnE,cAAc,wDAAwD,CAAC;AACvE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,sCAAsC,CAAC;AACrD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,iDAAiD,CAAC;AAChE,cAAc,oCAAoC,CAAC;AACnD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,oDAAoD,CAAC;AACnE,cAAc,oDAAoD,CAAC;AAEnE,cAAc,mEAAmE,CAAC;AAClF,cAAc,0DAA0D,CAAC;AACzE,cAAc,qDAAqD,CAAC;AACpE,cAAc,kEAAkE,CAAC;AACjF,cAAc,kEAAkE,CAAC;AACjF,cAAc,wDAAwD,CAAC;AACvE,cAAc,wEAAwE,CAAC;AACvF,cAAc,iDAAiD,CAAC;AAChE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,iDAAiD,CAAC;AAChE,cAAc,uDAAuD,CAAC;AACtE,cAAc,iDAAiD,CAAC;AAChE,cAAc,wDAAwD,CAAC;AACvE,cAAc,sDAAsD,CAAC;AACrE,cAAc,sDAAsD,CAAC;AACrE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,kEAAkE,CAAC;AACjF,cAAc,+CAA+C,CAAC;AAC9D,cAAc,iDAAiD,CAAC;AAChE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,qCAAqC,CAAC;AACpD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,wDAAwD,CAAC;AACvE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,kCAAkC,CAAC;AAGjD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AAGzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,8CAA8C,CAAC;AAC7D,cAAc,iDAAiD,CAAC;AAChE,cAAc,0CAA0C,CAAC;AAGzD,cAAc,wCAAwC,CAAC;AAGvD,cAAc,mDAAmD,CAAC;AAClE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,6DAA6D,CAAC;AAC5E,cAAc,qEAAqE,CAAC;AACpF,cAAc,qEAAqE,CAAC;AACpF,cAAc,6CAA6C,CAAC;AAG5D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,gDAAgD,CAAC;AAC/D,cAAc,uDAAuD,CAAC;AACtE,cAAc,8CAA8C,CAAC;AAC7D,cAAc,kDAAkD,CAAC;AACjE,cAAc,sCAAsC,CAAC;AACrD,cAAc,kDAAkD,CAAC;AACjE,cAAc,oCAAoC,CAAC;AACnD,cAAc,6CAA6C,CAAC;AAI5D,cAAc,mDAAmD,CAAC;AAClE,cAAc,uDAAuD,CAAC;AACtE,cAAc,6CAA6C,CAAC;AAK5D,cAAc,sDAAsD,CAAC;AACrE,cAAc,0DAA0D,CAAC;AACzE,cAAc,sEAAsE,CAAC;AACrF,cAAc,kFAAkF,CAAC;AACjG,cAAc,uEAAuE,CAAC;AACtF,cAAc,yDAAyD,CAAC;AACxE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,qEAAqE,CAAC;AACpF,cAAc,0DAA0D,CAAC;AACzE,cAAc,oDAAoD,CAAC;AACnE,cAAc,wDAAwD,CAAC;AACvE,cAAc,oDAAoD,CAAC;AACnE,cAAc,oDAAoD,CAAC;AACnE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,kEAAkE,CAAC;AACjF,cAAc,iEAAiE,CAAC;AAChF,cAAc,uDAAuD,CAAC;AACtE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,qDAAqD,CAAC;AACpE,cAAc,oDAAoD,CAAC;AACnE,cAAc,oCAAoC,CAAC;AACnD,cAAc,kDAAkD,CAAC;AACjE,cAAc,yDAAyD,CAAC;AACxE,cAAc,+CAA+C,CAAC;AAC9D,cAAc,6CAA6C,CAAC;AAC5D,cAAc,6CAA6C,CAAC;AAG5D,cAAc,0DAA0D,CAAC;AACzE,cAAc,2EAA2E,CAAC;AAC1F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,+EAA+E,CAAC;AAC9F,cAAc,mEAAmE,CAAC;AAClF,cAAc,oFAAoF,CAAC;AACnG,cAAc,kEAAkE,CAAC;AACjF,cAAc,mFAAmF,CAAC;AAClG,cAAc,4DAA4D,CAAC;AAC3E,cAAc,6EAA6E,CAAC;AAC5F,cAAc,uEAAuE,CAAC;AACtF,cAAc,yEAAyE,CAAC;AACxF,cAAc,0FAA0F,CAAC;AAGzG,cAAc,0CAA0C,CAAC;AACzD,cAAc,2DAA2D,CAAC;AAC1E,cAAc,gDAAgD,CAAC;AAC/D,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uDAAuD,CAAC;AACtE,cAAc,sCAAsC,CAAC;AACrD,cAAc,uDAAuD,CAAC;AACtE,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iDAAiD,CAAC;AAChE,cAAc,kCAAkC,CAAC;AACjD,cAAc,mDAAmD,CAAC;AAClE,cAAc,kDAAkD,CAAC;AACjE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,qCAAqC,CAAC;AACpD,cAAc,sDAAsD,CAAC;AACrE,cAAc,mCAAmC,CAAC;AAClD,cAAc,oDAAoD,CAAC;AACnE,cAAc,uCAAuC,CAAC;AACtD,cAAc,wDAAwD,CAAC;AACvE,cAAc,uCAAuC,CAAC;AACtD,cAAc,wDAAwD,CAAC;AAGvE,cAAc,sDAAsD,CAAC;AACrE,cAAc,uEAAuE,CAAC;AACtF,cAAc,qDAAqD,CAAC;AACpE,cAAc,sEAAsE,CAAC;AACrF,cAAc,2DAA2D,CAAC;AAC1E,cAAc,4EAA4E,CAAC;AAC3F,cAAc,yDAAyD,CAAC;AACxE,cAAc,0EAA0E,CAAC;AACzF,cAAc,qDAAqD,CAAC;AACpE,cAAc,sEAAsE,CAAC;AACrF,cAAc,mDAAmD,CAAC;AAClE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,0DAA0D,CAAC;AACzE,cAAc,sDAAsD,CAAC;AACrE,cAAc,oDAAoD,CAAC;AACnE,cAAc,6DAA6D,CAAC;AAC5E,cAAc,2EAA2E,CAAC;AAC1F,cAAc,oEAAoE,CAAC;AACnF,cAAc,8CAA8C,CAAC;AAC7D,cAAc,+DAA+D,CAAC;AAC9E,cAAc,uDAAuD,CAAC;AAGtE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,0EAA0E,CAAC;AACzF,cAAc,2EAA2E,CAAC;AAC1F,cAAc,mEAAmE,CAAC;AAClF,cAAc,iGAAiG,CAAC;AAChH,cAAc,yFAAyF,CAAC;AACxG,cAAc,uDAAuD,CAAC;AACtE,cAAc,+DAA+D,CAAC;AAC9E,cAAc,oFAAoF,CAAC;AACnG,cAAc,qFAAqF,CAAC;AACpG,cAAc,8DAA8D,CAAC;AAC7E,cAAc,+EAA+E,CAAC;AAC9F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,0DAA0D,CAAC;AACzE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,2EAA2E,CAAC;AAC1F,cAAc,wDAAwD,CAAC;AACvE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,gFAAgF,CAAC;AAC/F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,4DAA4D,CAAC;AAC3E,cAAc,oEAAoE,CAAC;AACnF,cAAc,iEAAiE,CAAC;AAChF,cAAc,kFAAkF,CAAC;AACjG,cAAc,iDAAiD,CAAC;AAChE,cAAc,gDAAgD,CAAC;AAC/D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,mDAAmD,CAAC;AAIlE,cAAc,yCAAyC,CAAC;AACxD,cAAc,0DAA0D,CAAC;AACzE,cAAc,8BAA8B,CAAC;AAC7C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uDAAuD,CAAC;AACtE,cAAc,6CAA6C,CAAC;AAC5D,cAAc,0DAA0D,CAAC;AACzE,cAAc,mDAAmD,CAAC;AAClE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,+DAA+D,CAAC;AAC9E,cAAc,0DAA0D,CAAC;AACzE,cAAc,uCAAuC,CAAC;AACtD,cAAc,yDAAyD,CAAC;AACxE,cAAc,yCAAyC,CAAC;AACxD,cAAc,0DAA0D,CAAC;AACzE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,6DAA6D,CAAC;AAG5E,cAAc,iDAAiD,CAAC;AAGhE,cAAc,4CAA4C,CAAC;AAC3D,cAAc,oCAAoC,CAAC;AACnD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,0DAA0D,CAAC;AACzE,cAAc,iEAAiE,CAAC;AAChF,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,8CAA8C,CAAC;AAG7D,cAAc,oDAAoD,CAAC;AACnE,cAAc,8DAA8D,CAAC;AAC7E,cAAc,mDAAmD,CAAC;AAGlE,cAAc,yCAAyC,CAAC;AACxD,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2DAA2D,CAAC;AAE1E,cAAc,gDAAgD,CAAC;AAC/D,cAAc,sCAAsC,CAAC;AACrD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,8DAA8D,CAAC;AAG7E,cAAc,2CAA2C,CAAC;AAC1D,cAAc,4CAA4C,CAAC;AAC3D,cAAc,4DAA4D,CAAC;AAG3E,cAAc,mDAAmD,CAAC;AAGlE,cAAc,4CAA4C,CAAC"}

package/dist/esm/index.js

@@ -10,6 +10,7 @@ export * from './flows-actors/task-continuity-binding.actors.shared.schemas.js';
 export * from './flows-actors/flows-actors.system.shared.schemas.js';
 export * from './flows-actors/flows-actors.system.shared.definitions.js';
 export * from './flows-actors/agents.shared.schemas.js';
+export * from './flows-actors/mcp-servers.shared.schemas.js';
 export * from './flows-actors/agent-traceability.shared.schemas.js';
 export * from './flows-actors/flows-actors.io.shared.schemas.js';
 export * from './flows-actors/flows-actors.commons.shared.schemas.js';
@@ -50,7 +51,9 @@ export * from './external-providers/external-providers.shared.schemas.js';
 export * from './external-providers/engine-capabilities.shared.schemas.js';
 export * from './external-providers/engine-capability-resolution-mode.shared.js';
 export * from './external-providers/frontend-bootstrap.shared.schemas.js';
+export * from './external-providers/provider-frontend-surface.shared.schemas.js';
 export * from './external-providers/provider-metadata.shared.schemas.js';
+export * from './external-providers/provider-tier-rule.shared.utils.js';
 export * from './external-providers/provider-capability.shared.schemas.js';
 export * from './external-providers/provider-protocol.shared.schemas.js';
 export * from './external-providers/compose-provider-registry.shared.js';
@@ -93,6 +96,7 @@ export * from './crdt/crdt-merge.shared.utils.js';
 // exists in this package.
 export * from './requests/rate-limits.shared.schemas.js';
 export * from './requests/manual-controllers-routes-urls.js';
+export * from './requests/manual-controllers-routes-documentation.js';
 export * from './resources/resources-registry.shared.core.definitions.js';
 export * from './resources/resources.shared.core.definitions.js';
 export * from './resources/resources.shared.schemas.js';
@@ -125,6 +129,7 @@ export * from './resources/utils/composition-cascade-deletability.validation.js'
 export * from './resources/utils/duplicate-relationship-registration.validation.js';
 export * from './resources/utils/schema-family-builder.utils.js';
 export * from './resources/utils/schema-variant-resolver.utils.js';
+export * from './resources/utils/field-value-disclosure.utils.js';
 export * from './resources/utils/resources-summary.utils.js';
 export * from './resources/utils/repository-dto-builder.utils.js';
 export * from './resources/utils/schema-type-utils.js';
@@ -176,6 +181,7 @@ export * from './config/frontend/onboarding.shared.schemas.js';
 export * from './compliance/audit-trails/audit-actor.shared.schemas.js';
 export * from './compliance/audit-trails/auditable-events.shared.schema.js';
 export * from './compliance/audit-trails/audit-logs.shared.resources-config.schemas.js';
+export * from './compliance/audit-trails/application-audit-logs.shared.resources-config.schemas.js';
 export * from './compliance/audit-trails/security-audit-event-envelope.shared.schema.js';
 export * from './compliance/audit-trails/audit-log-sink.shared.schemas.js';
 export * from './compliance/audit-trails/audit-trail-config.shared.schemas.js';
@@ -264,6 +270,9 @@ export * from './organizations/tenant-teardown-config.shared.schemas.js';
 export * from './security/api-keys/api-keys.shared.schemas.js';
 export * from './security/api-keys/api-keys-application.shared.resources-config.schemas.js';
 export * from './security/api-keys/api-keys-organization.shared.resources-config.schemas.js';
+export * from './security/connected-accounts/provider-credentials.shared.schemas.js';
+export * from './security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js';
+export * from './security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js';
 export * from './security/oauth-clients/oauth-clients.shared.schemas.js';
 export * from './security/oauth-clients/oauth-resource-server.shared.schemas.js';
 export * from './security/oauth-clients/oauth-clients-application.shared.resources-config.schemas.js';