@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.d.ts

@@ -10,80 +10,30 @@
  *
  * The binding is a REQUIRED companion declaration on any resource configuration that selects
  * `PersistenceAdapter.HTTP_API`. It answers, statically and per resource:
- * - WHERE the rows live (provider + entity), and in which transport dialect they are queried;
+ * - WHICH declared system of record the rows live in (`system`), and WHICH remote entity inside it;
  * - HOW a row is identified (ordered key components → the synthesized engine-facing `_id`);
- * - WHOSE identity reaches the target system (service principal vs per-user delegation);
- * - HOW tenancy confinement is expressed remotely — or the explicit single-tenant stance;
  * - WHAT the erasure story is (all three stances are first-class; none is silently defaulted);
  * - WHICH remote-call semantics apply (timeout, retry, rate budget, id-set bound).
  *
- * Credentials are NEVER declared here. They resolve at runtime through
- * `ExternalProvidersRegistryBackendService` against the `providerRef`, exactly as email, SMS and
- * billing providers do — the binding carries only the reference (plan decision D7).
+ * ## Three questions this used to answer and no longer does (#1055)
+ *
+ * WHOSE ACCOUNT (`connection`), WHERE the deployment is (`providerRef`) and HOW TENANCY is expressed
+ * remotely (`tenancy`) all left in the same change, and none of them was replaced by a smaller field:
+ *
+ * - WHOSE ACCOUNT has one legal answer for a system of record — the application's own service
+ *   identity (D12). The customer-connection case is case 2 of #1049 and keeps the connector lane.
+ * - WHERE is a property of the declared INSTANCE (`systemsOfRecord.<name>`) and of the ENVIRONMENT,
+ *   not of each resource. That is what lets two instances of one vendor exist at all.
+ * - TENANCY became a STAMP rather than a declaration: the row projector writes the owner
+ *   organization's id onto every remote row, so the per-row gate passes with no exemption.
+ *
+ * Credentials are NEVER declared here. They resolve at runtime through the systems-of-record
+ * registry, from environment variables DERIVED from the instance name — the binding carries only the
+ * name.
  */
 import { z } from 'zod';
-import { ExternalProvider_Connection_DelegationMode, ExternalProvider_Connection_OwnerScope } from '@wildo-ai/external-connectors-models';
-/**
- * The query dialect the adapter speaks toward the target system. Closed vocabulary (slice 1);
- * SOAP is a possible later member over the same HTTP transport, and a direct-database kind would
- * be a NEW `PersistenceAdapter` member, never a dialect here.
- */
+import { HttpApiTransportDialect } from './http-api-transport-dialect.shared';
 /** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
-export declare enum HttpApiTransportDialect {
-    /**
-     * OData **v4** — one generic client: mechanical pushdown of
-     * `$filter`/`$select`/`$top`/`$skip`/`$orderby`/`$count`, with a `$metadata` boot-time
-     * verification probe of the committed declaration.
-     *
-     * ⚠ **This member is v4 ONLY, and that excludes SAP's most-used API.** An earlier revision of
-     * this comment named "SAP S/4HANA, Microsoft Dataverse/Dynamics 365" here, which is half right
-     * and was load-bearing — it is why nobody looked:
-     *
-     * | Target | Version | Consumable today |
-     * |---|---|---|
-     * | Microsoft Dataverse / Dynamics 365 Web API (`/api/data/v9.2/`) | v4 | ✅ |
-     * | SAP S/4HANA OData **v4** services (`/sap/opu/odata4/…`) | v4 | ✅ |
-     * | SAP `API_BUSINESS_PARTNER` (`/sap/opu/odata/sap/API_BUSINESS_PARTNER`) | **v2** | ❌ |
-     *
-     * v2 is not a v4 variant with a different header. Its collection envelope is
-     * `{ "d": { "results": [...], "__next": …, "__count": … } }` rather than
-     * `{ "value": [...], "@odata.nextLink": … }`; `Edm.DateTime` serializes as `"/Date(<ticks>)/"`
-     * rather than ISO 8601; `Edm.Decimal` and `Edm.Int64` serialize as JSON STRINGS rather than
-     * numbers; and JSON must be requested (`$format=json`) because v2 defaults to Atom/XML. So it
-     * changes the envelope, the paging property, the count property AND the value encoding — a
-     * reader written for one cannot read the other, and the mapping layer needs coercions the way
-     * Odoo needs `ODOO_FALSE_AS_NULL`.
-     * spec-cite: OData Version 2.0 JSON Format
-     * (https://www.odata.org/documentation/odata-version-2-0/json-format/) — the `d`/`results`/
-     * `__next`/`__count` envelope, the `/Date(<ticks>)/` DateTime literal, and Edm.Decimal /
-     * Edm.Int64 "formatted as a JSON string".
-     *
-     * Supporting v2 is an OPEN decision, not an oversight. Until it lands, point an ODATA binding at
-     * a v4 service: for SAP that means the OData v4 edition of the API where one is published.
-     */
-    ODATA = "odata",
-    /**
-     * Declared per-binding REST/JSON operation mapping (bespoke enterprise APIs). Unlike ODATA
-     * there is no generic client: each binding declares how read/list/count/search map onto
-     * concrete HTTP operations.
-     */
-    REST_JSON = "rest-json",
-    /**
-     * Odoo's external API (`/jsonrpc` + `execute_kw`). Promoted to its OWN dialect 2026-08-27 —
-     * D0's original "JSON-RPC is a thin envelope variant of REST_JSON" was corrected by measuring
-     * the protocol: it is generic like ODATA (no per-binding operation declarations — the model
-     * name IS `entityRef`, and read/list/count map onto `read`/`search_read`/`search_count`
-     * mechanically), but it speaks POSITIONAL arguments, its own domain filter language
-     * (`[['field','=',value], …]` with polish-notation `'|'` disjunction), and authenticates
-     * INSIDE the RPC args (`execute_kw(db, uid, api_key, …)`) rather than via HTTP headers.
-     * Forcing that through REST_JSON's declared-parameter model would have been the
-     * merge-distinct-concepts failure `design-philosophy.md` forbids.
-     *
-     * Structural constraint (schema-enforced): exactly ONE key field with the `INTEGER` codec —
-     * Odoo row ids are integers, always.
-     */
-    ODOO_JSONRPC = "odoo-jsonrpc"
-}
 /**
  * The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class
  * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a
@@ -111,23 +61,6 @@ export declare enum HttpApiErasureStance {
      */
     CONTROLLER_ACKNOWLEDGED_NON_ERASURE = "controller-acknowledged-non-erasure"
 }
-/**
- * How tenant confinement is enforced against the remote system (requirements R4/R16).
- */
-export declare enum HttpApiTenancyStance {
-    /**
-     * The engine's contextual scope predicate is pushed down into every remote query against a
-     * declared remote field. Registration REFUSES a binding whose declared surface cannot express
-     * the scope predicate — a query-time refusal would be a data leak one missed branch away.
-     */
-    SCOPE_FILTER_PUSHDOWN = "scope-filter-pushdown",
-    /**
-     * The binding declares the target system serves exactly ONE tenant (the normal case for an
-     * internal tool on one enterprise's IS). Scope pushdown is then N/A by declaration — an
-     * explicit, audited stance, never an inferred one (R16).
-     */
-    SINGLE_TENANT_BINDING = "single-tenant-binding"
-}
 /**
  * Per-component value normalization for key synthesis. The codec is what makes the synthesized
  * `_id` STABLE: every component must round-trip byte-identically between the remote
@@ -186,6 +119,7 @@ export declare const HttpApiRemoteCallSemanticsSchema: z.ZodObject<{
     }, z.core.$strip>>;
     maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
     maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+    maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strip>;
 export type HttpApiRemoteCallSemantics = z.infer<typeof HttpApiRemoteCallSemanticsSchema>;
 /**
@@ -214,14 +148,66 @@ export declare enum HttpApiRestOperationMethod {
  * — ten exported symbols with zero code readers — was deleted in #331 rather than wired up, so
  * "what a provider can do" has one description instead of two.)
  *
- * The convergence this JSDoc asked to be RECORDED rather than performed implicitly happened in
- * S3a (#331), and it is not the merge that sentence was written to prevent. A member of
- * {@link HttpApiRestOperationsSchema} may now be a {@link HttpApiRestOperationReferenceSchema}
- * naming an operation in the PROVIDER's own `rest.operations` catalogue — the vendor half stated
- * once per provider, the resource half (local-field filter mapping, search parameter, which path
- * token takes the key) still stated here, because a provider has never heard of a local field
- * name. Both forms stay: an inline spec is still the right answer for a target no provider wraps.
+ * The convergence performed in S3a (#331) — a member naming an operation in a PROVIDER's own
+ * catalogue — was UNDONE in #1055. A system of record is not a connector (D10), and a read that
+ * depends on a provider catalogue being loadable is the crossing that decision forbids. An inline
+ * spec is now the only form, which is what every authored binding used anyway.
+ */
+/**
+ * A query LANGUAGE a REST system of record reads through, rather than a set of filter parameters
+ * (#1293).
+ *
+ * Two vendors read this way and neither can be expressed as parameters: Salesforce takes SOQL and
+ * NetSuite takes SuiteQL, each as ONE statement naming the fields, the entity, the predicates and
+ * the order. A `filterParams` map cannot say "SELECT these columns FROM that object", so without this
+ * neither vendor can be declared at all.
+ *
+ * ## Why this is a closed vocabulary and not a template string
+ *
+ * A statement is BUILT, and building means escaping. Each language has its own literal rules and its
+ * own paging spelling, and a template with `{filter}` holes would put the escaping in the author's
+ * hands — an injection surface in a file nobody reviews as one. The engine builds the statement and
+ * the vocabulary names which grammar to build.
+ *
+ * This is the same trade the OData compiler already makes for `$filter`: expressions are composed
+ * here, literals are escaped by one function, and no authored string reaches the wire uninspected.
  */
+export declare enum HttpApiQueryStatementLanguage {
+    /**
+     * Salesforce Object Query Language.
+     *
+     * spec-cite: Salesforce Developers, "SOQL and SOSL Reference" —
+     * https://developer.salesforce.com/docs/atlas.en-us.soql_sosl.meta/soql_sosl/
+     *
+     * `SELECT *` does not exist: every field is named, which the binding's `fieldMappings` and key
+     * fields already supply. Paging is by the response's own continuation rather than by `OFFSET`,
+     * which SOQL bounds at 2000 rows.
+     */
+    SOQL = "soql",
+    /**
+     * NetSuite SuiteQL — an SQL-92 dialect over its analytics schema.
+     *
+     * spec-cite: Oracle NetSuite, "SuiteQL" —
+     * https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_156257770590.html
+     *
+     * Paged by `limit` / `offset` QUERY parameters rather than inside the statement, which is why the
+     * statement declaration and `pagingParams` are independent.
+     */
+    SUITEQL = "suiteql"
+}
+/**
+ * How a read member builds and sends a query STATEMENT (#1293).
+ *
+ * Declared per operation rather than per binding, because a vendor's `read` and `list` genuinely
+ * differ: Salesforce addresses one record at `/sobjects/Account/{key}` and queries collections
+ * through `/query`, and only the second is a statement at all.
+ */
+export declare const HttpApiQueryStatementSpecSchema: z.ZodObject<{
+    language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+    parameterName: z.ZodString;
+    fromEntity: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type HttpApiQueryStatementSpec = z.infer<typeof HttpApiQueryStatementSpecSchema>;
 export declare const HttpApiRestOperationSpecSchema: z.ZodObject<{
     method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
     pathTemplate: z.ZodString;
@@ -235,67 +221,23 @@ export declare const HttpApiRestOperationSpecSchema: z.ZodObject<{
     jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
         rpcMethod: z.ZodString;
     }, z.core.$strip>>;
+    statement: z.ZodOptional<z.ZodObject<{
+        language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+        parameterName: z.ZodString;
+        fromEntity: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    cursorPath: z.ZodOptional<z.ZodString>;
+    staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;
 export type HttpApiRestOperationSpec = z.infer<typeof HttpApiRestOperationSpecSchema>;
 /**
- * A REFERENCE into the PROVIDER's own operation catalogue, instead of restating the operation here
- * (S3a, #331 — the convergence {@link HttpApiRestOperationSpecSchema}'s JSDoc asked to be recorded
- * as a decision rather than performed implicitly).
- *
- * ## The split, and why it is not a merge
- *
- * The two schemas describe different things and both survive. A provider operation is VENDOR-
- * shaped: method, path, result path, how the vendor pages. An ETL read surface is RESOURCE-shaped:
- * which LOCAL field is translatable to which remote filter parameter, which parameter carries the
- * search text, which path token receives this resource's synthesized key. The vendor half is the
- * same for every resource that reads that vendor, and restating it per binding is how ten bindings
- * come to disagree about one API. The resource half cannot live on the provider, because a provider
- * has never heard of a local field name.
- *
- * So a reference carries the resource half and NAMES the vendor half. What it does not do is merge
- * the two concepts: an inline spec is still the right answer for a target no provider wraps.
- *
- * ## What a reference refuses
- *
- * The referenced operation must be a READ (`classification`) and must speak GET or POST. A read
- * surface that could reference a WRITE would let a LIST call delete rows, and the resource
- * repository's whole read-only stance (D3) would rest on nobody having authored it that way.
- */
-export declare const HttpApiRestOperationReferenceSchema: z.ZodObject<{
-    /** The `operationId` in the provider's own `rest.operations` catalogue. */
-    providerOperationId: z.ZodString;
-    /**
-     * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-     * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-     */
-    domain: z.ZodOptional<z.ZodString>;
-    /**
-     * The referenced operation's PATH parameter that receives this resource's synthesized key.
-     * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-     * collection member, where it is refused rather than ignored.
-     */
-    keyParameter: z.ZodOptional<z.ZodString>;
-    /**
-     * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-     * spec, because the provider cannot know a local field name. Only fields listed here are
-     * translatable for this operation; everything else is refused at the adapter boundary.
-     */
-    filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-    searchParam: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-export type HttpApiRestOperationReference = z.infer<typeof HttpApiRestOperationReferenceSchema>;
-/**
- * One read-surface member: the operation stated INLINE, or a REFERENCE into the provider's
- * catalogue.
+ * One read-surface member. An INLINE spec, and now only that.
  *
- * A plain union rather than a `kind`-discriminated one, deliberately: the two shapes are already
- * unambiguous (an inline spec has a required `method` and `pathTemplate`, a reference a required
- * `providerOperationId`, and neither satisfies the other), and adding a discriminator would have
- * meant editing every binding that exists today to say `kind: 'inline'` — churn on working
- * declarations to buy a slightly better parse error.
+ * Kept as a named alias rather than collapsed into {@link HttpApiRestOperationSpecSchema} at every
+ * use site: the members of a read surface are a concept in their own right, and a later form — a
+ * facet-declared operation shape — would arrive HERE rather than at each of its consumers.
  */
-export declare const HttpApiRestOperationDeclarationSchema: z.ZodUnion<readonly [z.ZodObject<{
+export declare const HttpApiRestOperationDeclarationSchema: z.ZodObject<{
     method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
     pathTemplate: z.ZodString;
     pagingParams: z.ZodOptional<z.ZodObject<{
@@ -308,35 +250,18 @@ export declare const HttpApiRestOperationDeclarationSchema: z.ZodUnion<readonly
     jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
         rpcMethod: z.ZodString;
     }, z.core.$strip>>;
-}, z.core.$strip>, z.ZodObject<{
-    /** The `operationId` in the provider's own `rest.operations` catalogue. */
-    providerOperationId: z.ZodString;
-    /**
-     * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-     * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-     */
-    domain: z.ZodOptional<z.ZodString>;
-    /**
-     * The referenced operation's PATH parameter that receives this resource's synthesized key.
-     * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-     * collection member, where it is refused rather than ignored.
-     */
-    keyParameter: z.ZodOptional<z.ZodString>;
-    /**
-     * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-     * spec, because the provider cannot know a local field name. Only fields listed here are
-     * translatable for this operation; everything else is refused at the adapter boundary.
-     */
-    filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-    searchParam: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>]>;
+    statement: z.ZodOptional<z.ZodObject<{
+        language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+        parameterName: z.ZodString;
+        fromEntity: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    cursorPath: z.ZodOptional<z.ZodString>;
+    staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
 export type HttpApiRestOperationDeclaration = z.infer<typeof HttpApiRestOperationDeclarationSchema>;
-/** Narrow a declared member to a catalogue reference. */
-export declare function isHttpApiRestOperationReference(declaration: HttpApiRestOperationDeclaration): declaration is HttpApiRestOperationReference;
 /** The REST_JSON read-surface mapping: which lifecycle members exist remotely, and how. */
 export declare const HttpApiRestOperationsSchema: z.ZodObject<{
-    read: z.ZodUnion<readonly [z.ZodObject<{
+    read: z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
@@ -349,30 +274,15 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>, z.ZodObject<{
-        /** The `operationId` in the provider's own `rest.operations` catalogue. */
-        providerOperationId: z.ZodString;
-        /**
-         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-         */
-        domain: z.ZodOptional<z.ZodString>;
-        /**
-         * The referenced operation's PATH parameter that receives this resource's synthesized key.
-         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-         * collection member, where it is refused rather than ignored.
-         */
-        keyParameter: z.ZodOptional<z.ZodString>;
-        /**
-         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-         * spec, because the provider cannot know a local field name. Only fields listed here are
-         * translatable for this operation; everything else is refused at the adapter boundary.
-         */
-        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-        searchParam: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>]>;
-    list: z.ZodUnion<readonly [z.ZodObject<{
+        statement: z.ZodOptional<z.ZodObject<{
+            language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+            parameterName: z.ZodString;
+            fromEntity: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        cursorPath: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>;
+    list: z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
@@ -385,30 +295,15 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>, z.ZodObject<{
-        /** The `operationId` in the provider's own `rest.operations` catalogue. */
-        providerOperationId: z.ZodString;
-        /**
-         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-         */
-        domain: z.ZodOptional<z.ZodString>;
-        /**
-         * The referenced operation's PATH parameter that receives this resource's synthesized key.
-         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-         * collection member, where it is refused rather than ignored.
-         */
-        keyParameter: z.ZodOptional<z.ZodString>;
-        /**
-         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-         * spec, because the provider cannot know a local field name. Only fields listed here are
-         * translatable for this operation; everything else is refused at the adapter boundary.
-         */
-        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-        searchParam: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>]>;
-    count: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        statement: z.ZodOptional<z.ZodObject<{
+            language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+            parameterName: z.ZodString;
+            fromEntity: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        cursorPath: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>;
+    count: z.ZodOptional<z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
@@ -421,30 +316,15 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>, z.ZodObject<{
-        /** The `operationId` in the provider's own `rest.operations` catalogue. */
-        providerOperationId: z.ZodString;
-        /**
-         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-         */
-        domain: z.ZodOptional<z.ZodString>;
-        /**
-         * The referenced operation's PATH parameter that receives this resource's synthesized key.
-         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-         * collection member, where it is refused rather than ignored.
-         */
-        keyParameter: z.ZodOptional<z.ZodString>;
-        /**
-         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-         * spec, because the provider cannot know a local field name. Only fields listed here are
-         * translatable for this operation; everything else is refused at the adapter boundary.
-         */
-        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-        searchParam: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>]>>;
-    search: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        statement: z.ZodOptional<z.ZodObject<{
+            language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+            parameterName: z.ZodString;
+            fromEntity: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        cursorPath: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    search: z.ZodOptional<z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
@@ -457,40 +337,16 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>, z.ZodObject<{
-        /** The `operationId` in the provider's own `rest.operations` catalogue. */
-        providerOperationId: z.ZodString;
-        /**
-         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-         */
-        domain: z.ZodOptional<z.ZodString>;
-        /**
-         * The referenced operation's PATH parameter that receives this resource's synthesized key.
-         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-         * collection member, where it is refused rather than ignored.
-         */
-        keyParameter: z.ZodOptional<z.ZodString>;
-        /**
-         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-         * spec, because the provider cannot know a local field name. Only fields listed here are
-         * translatable for this operation; everything else is refused at the adapter boundary.
-         */
-        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-        searchParam: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>]>>;
+        statement: z.ZodOptional<z.ZodObject<{
+            language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+            parameterName: z.ZodString;
+            fromEntity: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        cursorPath: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type HttpApiRestOperations = z.infer<typeof HttpApiRestOperationsSchema>;
-/** Tenancy declaration — discriminated so each stance carries exactly its own obligations. */
-export declare const HttpApiTenancyDeclarationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
-    remoteScopeField: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
-    justification: z.ZodString;
-}, z.core.$strip>], "stance">;
-export type HttpApiTenancyDeclaration = z.infer<typeof HttpApiTenancyDeclarationSchema>;
 /**
  * HTTP methods a declared EXPLICIT erasure operation (stance 6b, REST_JSON) may use.
  *
@@ -538,18 +394,17 @@ export declare const HttpApiErasureDeclarationSchema: z.ZodDiscriminatedUnion<[z
 export type HttpApiErasureDeclaration = z.infer<typeof HttpApiErasureDeclarationSchema>;
 /**
  * The HTTP_API resource binding — discriminated on the transport dialect so each dialect carries
- * exactly its own obligations: ODATA is generic (plus an optional `$metadata` probe opt-out for
- * targets that do not serve one); REST_JSON must declare its whole read surface.
+ * exactly its own obligations: ODATA and ODOO_JSONRPC are generic (the model name IS `entityRef`, and
+ * read/list/count map mechanically); REST_JSON must declare its whole read surface INLINE.
+ *
+ * Every arm carries `system` — the declared instance this resource lives in — and none carries a
+ * provider, a connection shape or a tenancy stance. See the base shape above for what each of those
+ * was and why none was replaced by a smaller field (#1055).
  */
 /** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
 export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    verifyMetadataAtBoot: z.ZodDefault<z.ZodBoolean>;
-    providerRef: z.ZodString;
+    system: z.ZodString;
     entityRef: z.ZodString;
-    connection: z.ZodDefault<z.ZodObject<{
-        ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
-        delegation: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
-    }, z.core.$strip>>;
     keyFields: z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
@@ -559,13 +414,6 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         localField: z.ZodString;
         remoteField: z.ZodString;
     }, z.core.$strip>>>;
-    tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
-        remoteScopeField: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
-        justification: z.ZodString;
-    }, z.core.$strip>], "stance">;
     erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
         stance: z.ZodLiteral<HttpApiErasureStance.NO_SUBJECT_DATA>;
     }, z.core.$strip>, z.ZodObject<{
@@ -592,11 +440,12 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         }, z.core.$strip>>;
         maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
         maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+        maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
     dialect: z.ZodLiteral<HttpApiTransportDialect.ODATA>;
 }, z.core.$strip>, z.ZodObject<{
     operations: z.ZodObject<{
-        read: z.ZodUnion<readonly [z.ZodObject<{
+        read: z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
@@ -609,30 +458,15 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>, z.ZodObject<{
-            /** The `operationId` in the provider's own `rest.operations` catalogue. */
-            providerOperationId: z.ZodString;
-            /**
-             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-             */
-            domain: z.ZodOptional<z.ZodString>;
-            /**
-             * The referenced operation's PATH parameter that receives this resource's synthesized key.
-             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-             * collection member, where it is refused rather than ignored.
-             */
-            keyParameter: z.ZodOptional<z.ZodString>;
-            /**
-             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-             * spec, because the provider cannot know a local field name. Only fields listed here are
-             * translatable for this operation; everything else is refused at the adapter boundary.
-             */
-            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-            searchParam: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>;
-        list: z.ZodUnion<readonly [z.ZodObject<{
+            statement: z.ZodOptional<z.ZodObject<{
+                language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+                parameterName: z.ZodString;
+                fromEntity: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            cursorPath: z.ZodOptional<z.ZodString>;
+            staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>;
+        list: z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
@@ -645,30 +479,15 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>, z.ZodObject<{
-            /** The `operationId` in the provider's own `rest.operations` catalogue. */
-            providerOperationId: z.ZodString;
-            /**
-             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-             */
-            domain: z.ZodOptional<z.ZodString>;
-            /**
-             * The referenced operation's PATH parameter that receives this resource's synthesized key.
-             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-             * collection member, where it is refused rather than ignored.
-             */
-            keyParameter: z.ZodOptional<z.ZodString>;
-            /**
-             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-             * spec, because the provider cannot know a local field name. Only fields listed here are
-             * translatable for this operation; everything else is refused at the adapter boundary.
-             */
-            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-            searchParam: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>;
-        count: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            statement: z.ZodOptional<z.ZodObject<{
+                language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+                parameterName: z.ZodString;
+                fromEntity: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            cursorPath: z.ZodOptional<z.ZodString>;
+            staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>;
+        count: z.ZodOptional<z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
@@ -681,30 +500,15 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>, z.ZodObject<{
-            /** The `operationId` in the provider's own `rest.operations` catalogue. */
-            providerOperationId: z.ZodString;
-            /**
-             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-             */
-            domain: z.ZodOptional<z.ZodString>;
-            /**
-             * The referenced operation's PATH parameter that receives this resource's synthesized key.
-             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-             * collection member, where it is refused rather than ignored.
-             */
-            keyParameter: z.ZodOptional<z.ZodString>;
-            /**
-             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-             * spec, because the provider cannot know a local field name. Only fields listed here are
-             * translatable for this operation; everything else is refused at the adapter boundary.
-             */
-            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-            searchParam: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>>;
-        search: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            statement: z.ZodOptional<z.ZodObject<{
+                language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+                parameterName: z.ZodString;
+                fromEntity: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            cursorPath: z.ZodOptional<z.ZodString>;
+            staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>>;
+        search: z.ZodOptional<z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
@@ -717,36 +521,17 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>, z.ZodObject<{
-            /** The `operationId` in the provider's own `rest.operations` catalogue. */
-            providerOperationId: z.ZodString;
-            /**
-             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-             */
-            domain: z.ZodOptional<z.ZodString>;
-            /**
-             * The referenced operation's PATH parameter that receives this resource's synthesized key.
-             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-             * collection member, where it is refused rather than ignored.
-             */
-            keyParameter: z.ZodOptional<z.ZodString>;
-            /**
-             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-             * spec, because the provider cannot know a local field name. Only fields listed here are
-             * translatable for this operation; everything else is refused at the adapter boundary.
-             */
-            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-            searchParam: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>>;
+            statement: z.ZodOptional<z.ZodObject<{
+                language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+                parameterName: z.ZodString;
+                fromEntity: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            cursorPath: z.ZodOptional<z.ZodString>;
+            staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>;
-    providerRef: z.ZodString;
+    system: z.ZodString;
     entityRef: z.ZodString;
-    connection: z.ZodDefault<z.ZodObject<{
-        ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
-        delegation: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
-    }, z.core.$strip>>;
     keyFields: z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
@@ -756,13 +541,6 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         localField: z.ZodString;
         remoteField: z.ZodString;
     }, z.core.$strip>>>;
-    tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
-        remoteScopeField: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
-        justification: z.ZodString;
-    }, z.core.$strip>], "stance">;
     erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
         stance: z.ZodLiteral<HttpApiErasureStance.NO_SUBJECT_DATA>;
     }, z.core.$strip>, z.ZodObject<{
@@ -789,15 +567,12 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         }, z.core.$strip>>;
         maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
         maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+        maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
     dialect: z.ZodLiteral<HttpApiTransportDialect.REST_JSON>;
 }, z.core.$strip>, z.ZodObject<{
-    providerRef: z.ZodString;
+    system: z.ZodString;
     entityRef: z.ZodString;
-    connection: z.ZodDefault<z.ZodObject<{
-        ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
-        delegation: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
-    }, z.core.$strip>>;
     keyFields: z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
@@ -807,13 +582,6 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         localField: z.ZodString;
         remoteField: z.ZodString;
     }, z.core.$strip>>>;
-    tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
-        remoteScopeField: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
-        justification: z.ZodString;
-    }, z.core.$strip>], "stance">;
     erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
         stance: z.ZodLiteral<HttpApiErasureStance.NO_SUBJECT_DATA>;
     }, z.core.$strip>, z.ZodObject<{
@@ -840,6 +608,7 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         }, z.core.$strip>>;
         maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
         maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+        maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
     dialect: z.ZodLiteral<HttpApiTransportDialect.ODOO_JSONRPC>;
 }, z.core.$strip>], "dialect">;