@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-api-binding.shared.schemas.js","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-binding.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EACtC,sCAAsC,GACvC,MAAM,sCAAsC,CAAC;AAE9C,mCAAmC;AACnC,oBAAoB;AACpB,mCAAmC;AAEnC;;;;GAIG;AACH,4GAA4G;AAC5G,MAAM,CAAN,IAAY,uBAwDX;AAxDD,WAAY,uBAAuB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,0CAAe,CAAA;IAEf;;;;OAIG;IACH,kDAAuB,CAAA;IAEvB;;;;;;;;;;;;;OAaG;IACH,wDAA6B,CAAA;AAC/B,CAAC,EAxDW,uBAAuB,KAAvB,uBAAuB,QAwDlC;AAED,mCAAmC;AACnC,oCAAoC;AACpC,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,mCAAmC;AACnC,sDAAsD;AACtD,mCAAmC;AAEnC;;;;;GAKG;AACH,MAAM,CAAN,IAAY,oBAsBX;AAtBD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,2DAAmC,CAAA;IAEnC;;;;OAIG;IACH,iFAAyD,CAAA;IAEzD;;;;;OAKG;IACH,mGAA2E,CAAA;AAC7E,CAAC,EAtBW,oBAAoB,KAApB,oBAAoB,QAsB/B;AAED,mCAAmC;AACnC,iBAAiB;AACjB,mCAAmC;AAEnC;;GAEG;AACH,MAAM,CAAN,IAAY,oBAcX;AAdD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,uEAA+C,CAAA;IAE/C;;;;OAIG;IACH,uEAA+C,CAAA;AACjD,CAAC,EAdW,oBAAoB,KAApB,oBAAoB,QAc/B;AAED,mCAAmC;AACnC,+CAA+C;AAC/C,mCAAmC;AAEnC;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,wBAgBX;AAhBD,WAAY,wBAAwB;IAClC,+FAA+F;IAC/F,6CAAiB,CAAA;IAEjB,kFAAkF;IAClF,+CAAmB,CAAA;IAEnB,2EAA2E;IAC3E,yCAAa,CAAA;IAEb;;;;OAIG;IACH,yDAA6B,CAAA;AAC/B,CAAC,EAhBW,wBAAwB,KAAxB,wBAAwB,QAgBnC;AACD,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,+EAA+E;IAC/E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B,4DAA4D;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;CACxC,CAAC,CAAC;AAIH,mCAAmC;AACnC,gBAAgB;AAChB,mCAAmC;AAEnC;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,mCAAmC;AACnC,yDAAyD;AACzD,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,wBAAwB;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEnE;;;OAGG;IACH,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KAChE,CAAC;SACD,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAE9C;;;OAGG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE5D;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/D,CAAC,CAAC;AAIH,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,yCAAW,CAAA;IACX,2CAAa,CAAA;AACf,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,kDAAkD;IAClD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE1C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,iFAAiF;IACjF,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,QAAQ,EAAE;IAEb;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvE;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEzC;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC,2EAA2E;IAC3E,eAAe,EAAE,CAAC;SACf,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,2EAA2E;IAC3E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC;;;OAGG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvE,gGAAgG;IAChG,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC3D,8BAA8B;IAC9B,mCAAmC;CACpC,CAAC,CAAC;AAIH,yDAAyD;AACzD,MAAM,UAAU,+BAA+B,CAC7C,WAA4C;IAE5C,OAAO,OAAQ,WAA6C,CAAC,mBAAmB,KAAK,QAAQ,CAAC;AAChG,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,qCAAqC;IAC3C,2FAA2F;IAC3F,KAAK,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACvD,mDAAmD;IACnD,MAAM,EAAE,qCAAqC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAIH,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC5E,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,qBAAqB,CAAC;QAC7D,mFAAmF;QACnF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACpC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,qBAAqB,CAAC;QAC7D,iFAAiF;QACjF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACjC,CAAC;CACH,CAAC,CAAC;AAIH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,8CAAa,CAAA;IACb,kDAAiB,CAAA;AACnB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAE7C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B;;;OAGG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAIH,qFAAqF;AACrF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC5E,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,eAAe,CAAC;KACxD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC;QAClE;;;;;WAKG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,iCAAiC;SAClC,CAAC;QACF;;;;;;;;;;WAUG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAChD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,mCAAmC,CAAC;QAC3E;;;;;;WAMG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;CACH,CAAC,CAAC;AAIH,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC,MAAM,+BAA+B,GAAG;IACtC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B;;;;;;;;;;;OAWG;IACH,UAAU,EAAE,sCAAsC,CAAC,OAAO,CAAC;QACzD,UAAU,EAAE,sCAAsC,CAAC,WAAW;QAC9D,UAAU,EAAE,0CAA0C,CAAC,OAAO;KAC/D,CAAC;IAEF,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,oEAAoE;IACpE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D,+BAA+B;IAC/B,OAAO,EAAE,+BAA+B;IAExC,yDAAyD;IACzD,OAAO,EAAE,+BAA+B;IAExC,uCAAuC;IACvC,mBAAmB,EAAE,gCAAgC,CAAC,OAAO,CAAC;QAC5D,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACzC,YAAY,EAAE,EAAE;KACjB,CAAC;CACH,CAAC;AAEF;;;;GAIG;AACH,4GAA4G;AAC5G,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC1E,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACjD,GAAG,+BAA+B;QAClC;;;;WAIG;QACH,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAChD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC;QACrD,GAAG,+BAA+B;QAClC,8EAA8E;QAC9E,UAAU,EAAE,2BAA2B;KACxC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,YAAY,CAAC;QACxD,GAAG,+BAA+B;QAClC,4FAA4F;QAC5F,6FAA6F;QAC7F,0FAA0F;QAC1F,6FAA6F;QAC7F,uDAAuD;KACxD,CAAC;CACH,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAA+B;IAClF,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EAAE,CAAC;QAC7D,0FAA0F;QAC1F,6BAA6B;QAC7B,IACE,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;eAC3B,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,wBAAwB,CAAC,OAAO,EAClE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kIAAkI,CACnI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,+FAA+F;IAC/F,8FAA8F;IAC9F,wFAAwF;IACxF,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,IAAI,WAAW,KAAK,SAAS;gBAAE,SAAS;YACxC,MAAM,KAAK,GAAG,WAAsC,CAAC;YACrD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,iFAAiF;sBACnG,8EAA8E,CACjF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,gGAAgG;IAChG,iEAAiE;IACjE,yFAAyF;IACzF,6FAA6F;IAC7F,mDAAmD;IACnD,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,0BAA0B,EAAE,CAAC;QAC/E,MAAM,mBAAmB,GAAG,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9E,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,mBAAmB,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CACb,iKAAiK,CAClK,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,OAAO,qKAAqK,CAC7M,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAcD,mCAAmC;AACnC,4BAA4B;AAC5B,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,wBAAwB,GAAwC;IACpE,wBAAwB,CAAC,OAAO;IAChC,wBAAwB,CAAC,IAAI;CAC9B,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAkD;IAElD,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;WAC3B,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CACjE,CAAC;AACJ,CAAC","sourcesContent":["/**\n * HTTP-API persistence binding — the declaration model for resources whose rows live in a system\n * reached over an authenticated HTTP API (`PersistenceAdapter.HTTP_API`) rather than in a\n * platform-provisioned database.\n *\n * Design source of truth: `.claude/plans/etl-post-repository.md` (decisions D0/D1/D6/D9/D10,\n * requirements R7/R12/R15/R16) plus the two companion papers\n * `.claude/plans/etl-composite-key-synthesis.md` (key declaration + id codec) and\n * `.claude/plans/etl-filter-dialect-scope-down.md` (declared filter/sort/search surface).\n *\n * The binding is a REQUIRED companion declaration on any resource configuration that selects\n * `PersistenceAdapter.HTTP_API`. It answers, statically and per resource:\n * - WHERE the rows live (provider + entity), and in which transport dialect they are queried;\n * - HOW a row is identified (ordered key components → the synthesized engine-facing `_id`);\n * - WHOSE identity reaches the target system (service principal vs per-user delegation);\n * - HOW tenancy confinement is expressed remotely — or the explicit single-tenant stance;\n * - WHAT the erasure story is (all three stances are first-class; none is silently defaulted);\n * - WHICH remote-call semantics apply (timeout, retry, rate budget, id-set bound).\n *\n * Credentials are NEVER declared here. They resolve at runtime through\n * `ExternalProvidersRegistryBackendService` against the `providerRef`, exactly as email, SMS and\n * billing providers do — the binding carries only the reference (plan decision D7).\n */\n\nimport { z } from 'zod';\nimport {\n  ExternalProvider_Connection_DelegationMode,\n  ExternalProvider_Connection_OwnerScope,\n  ExternalProvider_ConnectionShapeSchema,\n} from '@wildo-ai/external-connectors-models';\n\n// --------------------------------\n// Transport dialect\n// --------------------------------\n\n/**\n * The query dialect the adapter speaks toward the target system. Closed vocabulary (slice 1);\n * SOAP is a possible later member over the same HTTP transport, and a direct-database kind would\n * be a NEW `PersistenceAdapter` member, never a dialect here.\n */\n/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */\nexport enum HttpApiTransportDialect {\n  /**\n   * OData **v4** — one generic client: mechanical pushdown of\n   * `$filter`/`$select`/`$top`/`$skip`/`$orderby`/`$count`, with a `$metadata` boot-time\n   * verification probe of the committed declaration.\n   *\n   * ⚠ **This member is v4 ONLY, and that excludes SAP's most-used API.** An earlier revision of\n   * this comment named \"SAP S/4HANA, Microsoft Dataverse/Dynamics 365\" here, which is half right\n   * and was load-bearing — it is why nobody looked:\n   *\n   * | Target | Version | Consumable today |\n   * |---|---|---|\n   * | Microsoft Dataverse / Dynamics 365 Web API (`/api/data/v9.2/`) | v4 | ✅ |\n   * | SAP S/4HANA OData **v4** services (`/sap/opu/odata4/…`) | v4 | ✅ |\n   * | SAP `API_BUSINESS_PARTNER` (`/sap/opu/odata/sap/API_BUSINESS_PARTNER`) | **v2** | ❌ |\n   *\n   * v2 is not a v4 variant with a different header. Its collection envelope is\n   * `{ \"d\": { \"results\": [...], \"__next\": …, \"__count\": … } }` rather than\n   * `{ \"value\": [...], \"@odata.nextLink\": … }`; `Edm.DateTime` serializes as `\"/Date(<ticks>)/\"`\n   * rather than ISO 8601; `Edm.Decimal` and `Edm.Int64` serialize as JSON STRINGS rather than\n   * numbers; and JSON must be requested (`$format=json`) because v2 defaults to Atom/XML. So it\n   * changes the envelope, the paging property, the count property AND the value encoding — a\n   * reader written for one cannot read the other, and the mapping layer needs coercions the way\n   * Odoo needs `ODOO_FALSE_AS_NULL`.\n   * spec-cite: OData Version 2.0 JSON Format\n   * (https://www.odata.org/documentation/odata-version-2-0/json-format/) — the `d`/`results`/\n   * `__next`/`__count` envelope, the `/Date(<ticks>)/` DateTime literal, and Edm.Decimal /\n   * Edm.Int64 \"formatted as a JSON string\".\n   *\n   * Supporting v2 is an OPEN decision, not an oversight. Until it lands, point an ODATA binding at\n   * a v4 service: for SAP that means the OData v4 edition of the API where one is published.\n   */\n  ODATA = 'odata',\n\n  /**\n   * Declared per-binding REST/JSON operation mapping (bespoke enterprise APIs). Unlike ODATA\n   * there is no generic client: each binding declares how read/list/count/search map onto\n   * concrete HTTP operations.\n   */\n  REST_JSON = 'rest-json',\n\n  /**\n   * Odoo's external API (`/jsonrpc` + `execute_kw`). Promoted to its OWN dialect 2026-08-27 —\n   * D0's original \"JSON-RPC is a thin envelope variant of REST_JSON\" was corrected by measuring\n   * the protocol: it is generic like ODATA (no per-binding operation declarations — the model\n   * name IS `entityRef`, and read/list/count map onto `read`/`search_read`/`search_count`\n   * mechanically), but it speaks POSITIONAL arguments, its own domain filter language\n   * (`[['field','=',value], …]` with polish-notation `'|'` disjunction), and authenticates\n   * INSIDE the RPC args (`execute_kw(db, uid, api_key, …)`) rather than via HTTP headers.\n   * Forcing that through REST_JSON's declared-parameter model would have been the\n   * merge-distinct-concepts failure `design-philosophy.md` forbids.\n   *\n   * Structural constraint (schema-enforced): exactly ONE key field with the `INTEGER` codec —\n   * Odoo row ids are integers, always.\n   */\n  ODOO_JSONRPC = 'odoo-jsonrpc',\n}\n\n// --------------------------------\n// Whose identity reaches the target\n// --------------------------------\n\n/*\n * ─── `HttpApiIdentityMode` was REMOVED here (#333), and replaced rather than widened ────────────\n *\n * It had two values — `SERVICE_PRINCIPAL` and `USER_DELEGATED` — and its own docstring said it\n * stayed declared \"so bindings need no reshape when it arrives\". That is the one thing it got\n * wrong. `USER_DELEGATED` names a delegation without naming WHOSE ACCOUNT is spent, and those are\n * two independent questions with five real answers (`ExternalProvider_ConnectionShape`):\n *\n *   - a user's own personal grant is `USER × SERVICE`;\n *   - a tenant's registration acting for one of its members is `ORGANIZATION × USER`.\n *\n * Both are \"per-user OAuth against the target\", they resolve DIFFERENT credentials, and the single\n * field cannot distinguish them. So mapping it onto a target would have silently picked a lane —\n * which is why `connectionTargetForBinding` refused instead of guessing, and why the fix is the\n * richer vocabulary rather than a translation table.\n *\n * The audit contract is unchanged and was never the identity mode's to keep: every row carries the\n * REAL initiating user whatever the connection, so the shared-principal attribution failure\n * documented for Power Platform (\"credential-sharing as a service\") stays closed (requirement R12).\n */\n\n// --------------------------------\n// Erasure stance (GDPR Art. 17 on rows we do not own)\n// --------------------------------\n\n/**\n * The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class\n * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a\n * registration refusal, because `exportSubject` is a fail-closed obligation on every resource and\n * \"we cannot delete rows we do not own\" is not an answer the framework may imply silently.\n */\nexport enum HttpApiErasureStance {\n  /**\n   * (6a) The resource declares it holds NO personal/subject data. Registration verifies the\n   * declaration is coherent (e.g. `exportSubject` posture) and erasure is structurally N/A for\n   * the remote rows.\n   */\n  NO_SUBJECT_DATA = 'no-subject-data',\n\n  /**\n   * (6b) The binding declares HOW erasure reaches the foreign system: one named API operation the\n   * engine invokes on a subject-erasure request. This is a single declared write and does NOT\n   * require general write support (slice 1 stays read-only otherwise).\n   */\n  EXTERNAL_ERASURE_OPERATION = 'external-erasure-operation',\n\n  /**\n   * (6c) Erasure REFUSES by default; an explicit, per-request, audited controller acknowledgement\n   * lets it proceed and records the un-erased remote rows at high severity. Mirrors the existing\n   * administrative-floor acknowledgement shape (`administrative-continuity-floors.md`): the record\n   * is the control. NEVER a standing default — the acknowledgement is per erasure request.\n   */\n  CONTROLLER_ACKNOWLEDGED_NON_ERASURE = 'controller-acknowledged-non-erasure',\n}\n\n// --------------------------------\n// Tenancy stance\n// --------------------------------\n\n/**\n * How tenant confinement is enforced against the remote system (requirements R4/R16).\n */\nexport enum HttpApiTenancyStance {\n  /**\n   * The engine's contextual scope predicate is pushed down into every remote query against a\n   * declared remote field. Registration REFUSES a binding whose declared surface cannot express\n   * the scope predicate — a query-time refusal would be a data leak one missed branch away.\n   */\n  SCOPE_FILTER_PUSHDOWN = 'scope-filter-pushdown',\n\n  /**\n   * The binding declares the target system serves exactly ONE tenant (the normal case for an\n   * internal tool on one enterprise's IS). Scope pushdown is then N/A by declaration — an\n   * explicit, audited stance, never an inferred one (R16).\n   */\n  SINGLE_TENANT_BINDING = 'single-tenant-binding',\n}\n\n// --------------------------------\n// Key declaration + component codecs (paper A)\n// --------------------------------\n\n/**\n * Per-component value normalization for key synthesis. The codec is what makes the synthesized\n * `_id` STABLE: every component must round-trip byte-identically between the remote\n * representation and the encoded id, or the same remote row would answer to different ids.\n *\n * `INTEGER` and `GUID` are the two codecs whose entire value space is URL-unreserved-safe, which\n * is what qualifies a single-key binding for the VERBATIM id form (see\n * `httpApiBindingUsesVerbatimKey`).\n */\nexport enum HttpApiKeyComponentCodec {\n  /** Arbitrary remote string. NOT charset-safe → always participates via the encoded id form. */\n  STRING = 'string',\n\n  /** Integer key (Odoo `id`, SAP numeric keys). Digits only → verbatim-eligible. */\n  INTEGER = 'integer',\n\n  /** GUID/UUID key (Dataverse row ids). Hex + dashes → verbatim-eligible. */\n  GUID = 'guid',\n\n  /**\n   * Date/time key component, normalized to the RFC 3339 / ISO 8601 UTC string form before\n   * encoding. NOT verbatim-eligible (`:` is forbidden in ids — websocket room names are\n   * colon-parsed).\n   */\n  DATETIME_ISO = 'datetime-iso',\n}\n/** @wildo_source:part:end saas.models.http-api-binding */\n\n/**\n * One ordered component of the remote entity's key. `keyFields` order is the ENCODING order —\n * declared, committed, and boot-verified against `$metadata` where the dialect provides one;\n * never inferred at runtime (a silently adopted key change would orphan every stored FK value\n * and bookmark).\n */\nexport const HttpApiKeyFieldSchema = z.object({\n  /** The field name on the Wildo resource schema that carries this component. */\n  localField: z.string().min(1),\n\n  /** The remote entity's property name for this component. */\n  remoteField: z.string().min(1),\n\n  /** Value normalization for stable synthesis. */\n  codec: z.enum(HttpApiKeyComponentCodec),\n});\n\nexport type HttpApiKeyField = z.infer<typeof HttpApiKeyFieldSchema>;\n\n// --------------------------------\n// Field mapping\n// --------------------------------\n\n/**\n * Local-to-remote field name mapping for fields whose names differ. Fields not listed map by\n * identity (same name both sides). Key components are declared in `keyFields`, not here.\n */\nexport const HttpApiFieldMappingSchema = z.object({\n  localField: z.string().min(1),\n  remoteField: z.string().min(1),\n});\n\nexport type HttpApiFieldMapping = z.infer<typeof HttpApiFieldMappingSchema>;\n\n// --------------------------------\n// Remote-call semantics (decision D10 / requirement R15)\n// --------------------------------\n\n/**\n * Declared remote-call semantics. An enterprise API is 100ms–2s, rate-limited, and sometimes\n * down; these are DECISIONS, not inherited pipeline defaults. Defaults are conservative on\n * purpose — a binding that needs more declares more.\n */\nexport const HttpApiRemoteCallSemanticsSchema = z.object({\n  /** Per-call timeout. */\n  timeoutMs: z.number().int().positive().max(120_000).default(10_000),\n\n  /**\n   * Retry policy for idempotent READ-family calls only. Writes (when D4 lands) never retry\n   * implicitly.\n   */\n  retry: z\n    .object({\n      maxAttempts: z.number().int().min(1).max(5).default(2),\n      backoffMs: z.number().int().positive().max(30_000).default(500),\n    })\n    .default({ maxAttempts: 2, backoffMs: 500 }),\n\n  /**\n   * Rate budget toward the target, per process. `undefined` = no local throttle (the target's own\n   * limits still apply and surface as refusals).\n   */\n  maxRequestsPerMinute: z.number().int().positive().optional(),\n\n  /**\n   * Upper bound for translated id-set predicates (`_id ∈ {…}` → key-predicate disjunction /\n   * `in`). Above the bound the adapter REFUSES rather than emitting an unbounded URL\n   * (scope-down paper, shape T2).\n   */\n  maxIdSetSize: z.number().int().positive().max(500).default(50),\n});\n\nexport type HttpApiRemoteCallSemantics = z.infer<typeof HttpApiRemoteCallSemanticsSchema>;\n\n// --------------------------------\n// Dialect-specific declarations\n// --------------------------------\n\n/**\n * HTTP methods a declared read-family operation may use. Deliberately NOT the full HTTP verb set\n * (`API_HttpMethod` in `@wildo-ai/external-connectors-models` describes provider-protocol\n * operations): slice 1 is read-only, so the closed vocabulary is the read-safe verb plus POST —\n * because JSON-RPC (Odoo) and many enterprise search endpoints are POST-shaped even for reads.\n * Write verbs (PUT/PATCH/DELETE) enter only with the D4 write story, as their own decision.\n */\nexport enum HttpApiRestOperationMethod {\n  GET = 'GET',\n  POST = 'POST',\n}\n\n/**\n * REST_JSON per-operation declaration: how one read-family member maps onto a concrete HTTP\n * operation. Deliberately minimal in slice 1 — pagination/filter parameter NAMES are declared,\n * their VALUES are supplied by the adapter from the translated query.\n *\n * Related but distinct: `ProviderRestOperation` on a provider's `rest` runtime contract describes a\n * VENDOR operation — one entry in the catalogue a reference below names. This schema describes a\n * RESOURCE read surface, which is a different thing and stays here.\n *\n * (An earlier revision pointed at `REST_API_OperationSpecSchema` in\n * `@wildo-ai/external-connectors-models` \"for capability transformers\". Both are gone: the\n * transformer layer was retired with `features/` in #327, and that OpenAPI-shaped operations layer\n * — ten exported symbols with zero code readers — was deleted in #331 rather than wired up, so\n * \"what a provider can do\" has one description instead of two.)\n *\n * The convergence this JSDoc asked to be RECORDED rather than performed implicitly happened in\n * S3a (#331), and it is not the merge that sentence was written to prevent. A member of\n * {@link HttpApiRestOperationsSchema} may now be a {@link HttpApiRestOperationReferenceSchema}\n * naming an operation in the PROVIDER's own `rest.operations` catalogue — the vendor half stated\n * once per provider, the resource half (local-field filter mapping, search parameter, which path\n * token takes the key) still stated here, because a provider has never heard of a local field\n * name. Both forms stay: an inline spec is still the right answer for a target no provider wraps.\n */\nexport const HttpApiRestOperationSpecSchema = z.object({\n  /** HTTP method for this read-family operation. */\n  method: z.enum(HttpApiRestOperationMethod),\n\n  /**\n   * Path template relative to the provider's base URL. `{key}` interpolates the synthesized\n   * key's remote addressing form; other `{param}` tokens must be declared parameter names.\n   */\n  pathTemplate: z.string().min(1),\n\n  /** Query/body parameter names for pagination, when the operation supports it. */\n  pagingParams: z\n    .object({\n      limitParam: z.string().min(1),\n      offsetParam: z.string().min(1),\n    })\n    .optional(),\n\n  /**\n   * Declared filter parameter name per LOCAL field. Only fields listed here are translatable for\n   * this operation (scope-down paper, shape T3); everything else is refused at the adapter\n   * boundary.\n   */\n  filterParams: z.record(z.string().min(1), z.string().min(1)).optional(),\n\n  /**\n   * The parameter that receives the SEARCH text (T4), for a `search` operation. Absent =\n   * search is refused for this binding even when the operation exists.\n   */\n  searchParam: z.string().min(1).optional(),\n\n  /**\n   * Dot-path to the payload inside the response body — the rows array (list/search), the entity\n   * object (read), or the number (count). Absent = the body IS the payload. Declared, never\n   * sniffed: response shapes vary per target (`items`, `result`, `value`, raw array) and a wrong\n   * guess would silently read zero rows.\n   */\n  resultPath: z.string().min(1).optional(),\n\n  /** Wrap request/response in a JSON-RPC 2.0 envelope (the Odoo variant). */\n  jsonRpcEnvelope: z\n    .object({\n      rpcMethod: z.string().min(1),\n    })\n    .optional(),\n});\n\nexport type HttpApiRestOperationSpec = z.infer<typeof HttpApiRestOperationSpecSchema>;\n\n/**\n * A REFERENCE into the PROVIDER's own operation catalogue, instead of restating the operation here\n * (S3a, #331 — the convergence {@link HttpApiRestOperationSpecSchema}'s JSDoc asked to be recorded\n * as a decision rather than performed implicitly).\n *\n * ## The split, and why it is not a merge\n *\n * The two schemas describe different things and both survive. A provider operation is VENDOR-\n * shaped: method, path, result path, how the vendor pages. An ETL read surface is RESOURCE-shaped:\n * which LOCAL field is translatable to which remote filter parameter, which parameter carries the\n * search text, which path token receives this resource's synthesized key. The vendor half is the\n * same for every resource that reads that vendor, and restating it per binding is how ten bindings\n * come to disagree about one API. The resource half cannot live on the provider, because a provider\n * has never heard of a local field name.\n *\n * So a reference carries the resource half and NAMES the vendor half. What it does not do is merge\n * the two concepts: an inline spec is still the right answer for a target no provider wraps.\n *\n * ## What a reference refuses\n *\n * The referenced operation must be a READ (`classification`) and must speak GET or POST. A read\n * surface that could reference a WRITE would let a LIST call delete rows, and the resource\n * repository's whole read-only stance (D3) would rest on nobody having authored it that way.\n */\nexport const HttpApiRestOperationReferenceSchema = z.strictObject({\n  /** The `operationId` in the provider's own `rest.operations` catalogue. */\n  providerOperationId: z.string().min(1),\n  /**\n   * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.\n   * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.\n   */\n  domain: z.string().min(1).optional(),\n  /**\n   * The referenced operation's PATH parameter that receives this resource's synthesized key.\n   * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a\n   * collection member, where it is refused rather than ignored.\n   */\n  keyParameter: z.string().min(1).optional(),\n  /**\n   * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline\n   * spec, because the provider cannot know a local field name. Only fields listed here are\n   * translatable for this operation; everything else is refused at the adapter boundary.\n   */\n  filterParams: z.record(z.string().min(1), z.string().min(1)).optional(),\n  /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */\n  searchParam: z.string().min(1).optional(),\n});\n\nexport type HttpApiRestOperationReference = z.infer<typeof HttpApiRestOperationReferenceSchema>;\n\n/**\n * One read-surface member: the operation stated INLINE, or a REFERENCE into the provider's\n * catalogue.\n *\n * A plain union rather than a `kind`-discriminated one, deliberately: the two shapes are already\n * unambiguous (an inline spec has a required `method` and `pathTemplate`, a reference a required\n * `providerOperationId`, and neither satisfies the other), and adding a discriminator would have\n * meant editing every binding that exists today to say `kind: 'inline'` — churn on working\n * declarations to buy a slightly better parse error.\n */\nexport const HttpApiRestOperationDeclarationSchema = z.union([\n  HttpApiRestOperationSpecSchema,\n  HttpApiRestOperationReferenceSchema,\n]);\n\nexport type HttpApiRestOperationDeclaration = z.infer<typeof HttpApiRestOperationDeclarationSchema>;\n\n/** Narrow a declared member to a catalogue reference. */\nexport function isHttpApiRestOperationReference(\n  declaration: HttpApiRestOperationDeclaration,\n): declaration is HttpApiRestOperationReference {\n  return typeof (declaration as HttpApiRestOperationReference).providerOperationId === 'string';\n}\n\n/** The REST_JSON read-surface mapping: which lifecycle members exist remotely, and how. */\nexport const HttpApiRestOperationsSchema = z.object({\n  read: HttpApiRestOperationDeclarationSchema,\n  list: HttpApiRestOperationDeclarationSchema,\n  /** Absent = COUNT is refused for this binding (honest refusal, never an emulated scan). */\n  count: HttpApiRestOperationDeclarationSchema.optional(),\n  /** Absent = SEARCH is refused for this binding. */\n  search: HttpApiRestOperationDeclarationSchema.optional(),\n});\n\nexport type HttpApiRestOperations = z.infer<typeof HttpApiRestOperationsSchema>;\n\n// --------------------------------\n// Stance sub-declarations\n// --------------------------------\n\n/** Tenancy declaration — discriminated so each stance carries exactly its own obligations. */\nexport const HttpApiTenancyDeclarationSchema = z.discriminatedUnion('stance', [\n  z.object({\n    stance: z.literal(HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN),\n    /** The remote field the engine's tenant-scope predicate is pushed down against. */\n    remoteScopeField: z.string().min(1),\n  }),\n  z.object({\n    stance: z.literal(HttpApiTenancyStance.SINGLE_TENANT_BINDING),\n    /** Why this binding is single-tenant — recorded, audited justification (R16). */\n    justification: z.string().min(1),\n  }),\n]);\n\nexport type HttpApiTenancyDeclaration = z.infer<typeof HttpApiTenancyDeclarationSchema>;\n\n/**\n * HTTP methods a declared EXPLICIT erasure operation (stance 6b, REST_JSON) may use.\n *\n * A separate vocabulary from {@link HttpApiRestOperationMethod} on purpose: that enum describes\n * READ-family operations (GET/POST), and reusing it here would let an erasure declare `GET` — a\n * read spelled as a deletion. Deletion is expressed as the resource-oriented `DELETE` or an\n * RPC-style `POST`; nothing else is a deletion on the wire.\n */\nexport enum HttpApiErasureOperationMethod {\n  POST = 'POST',\n  DELETE = 'DELETE',\n}\n\n/**\n * The EXPLICIT erasure call a REST_JSON binding declares for stance 6b. Deliberately narrower\n * than {@link HttpApiRestOperationSpecSchema}: an erasure addresses ONE row by key — it has no\n * pagination, no filter params, no search, no result path to project.\n */\nexport const HttpApiErasureOperationSpecSchema = z.object({\n  method: z.enum(HttpApiErasureOperationMethod),\n\n  /**\n   * Path template relative to the provider base URL. `{key}` interpolates the row's remote key\n   * addressing form, exactly as in the read-family `pathTemplate`.\n   */\n  pathTemplate: z.string().min(1),\n\n  /**\n   * JSON-RPC envelope for RPC-style targets (pairs with `method: POST`), mirroring the\n   * read-family declaration.\n   */\n  jsonRpcEnvelope: z.object({ rpcMethod: z.string().min(1) }).optional(),\n});\n\nexport type HttpApiErasureOperationSpec = z.infer<typeof HttpApiErasureOperationSpecSchema>;\n\n/** Erasure declaration — discriminated; stance 6b names the operation it invokes. */\nexport const HttpApiErasureDeclarationSchema = z.discriminatedUnion('stance', [\n  z.object({\n    stance: z.literal(HttpApiErasureStance.NO_SUBJECT_DATA),\n  }),\n  z.object({\n    stance: z.literal(HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION),\n    /**\n     * The declared erasure call. ODATA and ODOO_JSONRPC bindings rely on their CANONICAL delete\n     * (`DELETE /EntitySet(key)` / `execute_kw('unlink', [[ids]])`) by declaring\n     * `useCanonicalDelete`; REST_JSON bindings declare the operation explicitly. The pairing is\n     * enforced by {@link assertHttpApiBindingDialectCoherence}.\n     */\n    operation: z.union([\n      z.object({ useCanonicalDelete: z.literal(true) }),\n      HttpApiErasureOperationSpecSchema,\n    ]),\n    /**\n     * The LOCAL field naming the DATA SUBJECT whose erasure deletes a remote row — the rows the\n     * declared operation applies to are exactly `{ [subjectLinkLocalField]: <erased subject id> }`.\n     *\n     * DECLARED, never inferred, for the same reason `dataSubjectPolicy` exists on retention: a\n     * foreign key usually names an OWNER or an ACTOR, not the subject — inferring from \"any FK to\n     * the erased user\" would delete a purchase-order row because the erased user merely CREATED\n     * it, destroying a business record no erasure asked for. One field, mirroring\n     * `sessionPrincipalField`'s \"one field names the person\". Registration verifies a declared\n     * relationship carries this field as its FK (so the subject type it links is known).\n     */\n    subjectLinkLocalField: z.string().trim().min(1),\n  }),\n  z.object({\n    stance: z.literal(HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE),\n    /**\n     * Optional evidence link: the LOCAL field naming the data subject, used ONLY to COUNT the\n     * remaining remote rows for the acknowledgement's CRITICAL audit record (`remainingRowCount`).\n     * Optional because 6c legitimately covers linkage no FK expresses (an email inside remote\n     * rows) — absent, the record carries no count rather than a fabricated zero. Never used to\n     * delete anything.\n     */\n    subjectLinkLocalField: z.string().trim().min(1).optional(),\n  }),\n]);\n\nexport type HttpApiErasureDeclaration = z.infer<typeof HttpApiErasureDeclarationSchema>;\n\n// --------------------------------\n// The binding declaration\n// --------------------------------\n\nconst httpApiResourceBindingBaseShape = {\n  /**\n   * The external provider whose declared protocol configuration carries the base URL and whose\n   * credentials resolve through `ExternalProvidersRegistryBackendService` (decision D7 — no new\n   * secret store, no connection string on the resource config).\n   */\n  providerRef: z.string().min(1),\n\n  /**\n   * The remote entity addressed by this binding — an OData entity-set name, or a logical name for\n   * a REST_JSON surface. One binding, one remote entity set.\n   */\n  entityRef: z.string().min(1),\n\n  /**\n   * WHOSE ACCOUNT this binding spends, and ON WHOSE BEHALF — the two axes a provider also declares\n   * as `admissibleConnections`, so a binding and the provider it targets are compared in one\n   * vocabulary instead of through an adapter.\n   *\n   * A SHAPE, not a target: the binding says `ORGANIZATION × USER`, and WHICH organization and\n   * WHICH member are supplied per call from the execution that triggered the read. A binding that\n   * named an instance would be a binding per tenant.\n   *\n   * Defaults to the application acting as itself, which is what every binding authored before this\n   * field existed meant.\n   */\n  connection: ExternalProvider_ConnectionShapeSchema.default({\n    ownerScope: ExternalProvider_Connection_OwnerScope.APPLICATION,\n    delegation: ExternalProvider_Connection_DelegationMode.SERVICE,\n  }),\n\n  /** Ordered key declaration — the source of the synthesized engine-facing `_id` (paper A). */\n  keyFields: z.array(HttpApiKeyFieldSchema).min(1),\n\n  /** Non-key field name mappings; unlisted fields map by identity. */\n  fieldMappings: z.array(HttpApiFieldMappingSchema).default([]),\n\n  /** Tenancy stance (R4/R16). */\n  tenancy: HttpApiTenancyDeclarationSchema,\n\n  /** Erasure stance (D6) — required; no silent default. */\n  erasure: HttpApiErasureDeclarationSchema,\n\n  /** Remote-call semantics (D10/R15). */\n  remoteCallSemantics: HttpApiRemoteCallSemanticsSchema.default({\n    timeoutMs: 10_000,\n    retry: { maxAttempts: 2, backoffMs: 500 },\n    maxIdSetSize: 50,\n  }),\n};\n\n/**\n * The HTTP_API resource binding — discriminated on the transport dialect so each dialect carries\n * exactly its own obligations: ODATA is generic (plus an optional `$metadata` probe opt-out for\n * targets that do not serve one); REST_JSON must declare its whole read surface.\n */\n/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */\nexport const HttpApiResourceBindingSchema = z.discriminatedUnion('dialect', [\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.ODATA),\n    ...httpApiResourceBindingBaseShape,\n    /**\n     * Verify the committed declaration against the live `$metadata` at boot (decision D5 —\n     * drift is detected at boot and the fix is re-authoring, never silent adaptation). Opt out\n     * only for targets that genuinely do not serve `$metadata`.\n     */\n    verifyMetadataAtBoot: z.boolean().default(true),\n  }),\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.REST_JSON),\n    ...httpApiResourceBindingBaseShape,\n    /** The declared read surface — absent members are refused, never emulated. */\n    operations: HttpApiRestOperationsSchema,\n  }),\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.ODOO_JSONRPC),\n    ...httpApiResourceBindingBaseShape,\n    // Generic like ODATA — no per-binding operation declarations: `entityRef` is the Odoo model\n    // (e.g. 'res.partner'); read/list/count map onto read/search_read/search_count mechanically.\n    // The single-INTEGER-key constraint is enforced by `assertHttpApiBindingDialectCoherence`\n    // (called by the resource-configuration factory) — a refine here would wrap the union member\n    // in effects, which discriminated unions do not admit.\n  }),\n]);\n\n/**\n * Dialect-specific structural constraints that a discriminated union cannot express member-side.\n * Called by the resource-configuration factory AFTER the schema parse; throws with the offending\n * path named.\n */\nexport function assertHttpApiBindingDialectCoherence(binding: HttpApiResourceBinding): void {\n  if (binding.dialect === HttpApiTransportDialect.ODOO_JSONRPC) {\n    // Odoo row ids are INTEGERS, always — one key field, INTEGER codec, or the synthesized id\n    // could never address a row.\n    if (\n      binding.keyFields.length !== 1\n      || binding.keyFields[0].codec !== HttpApiKeyComponentCodec.INTEGER\n    ) {\n      throw new Error(\n        \"keyFields: an ODOO_JSONRPC binding must declare exactly one key field with the INTEGER codec — Odoo row ids are integers ('id').\",\n      );\n    }\n  }\n\n  // A read member must be ONE form or the other. The union parses an object carrying both as an\n  // INLINE spec (the first branch that matches wins) and drops the reference without a word — an\n  // author who wrote `providerOperationId` beside a `method` believes it does something, so the\n  // ambiguity is refused at authoring rather than resolved by branch order at parse time.\n  if (binding.dialect === HttpApiTransportDialect.REST_JSON) {\n    for (const [member, declaration] of Object.entries(binding.operations)) {\n      if (declaration === undefined) continue;\n      const asAny = declaration as Record<string, unknown>;\n      if (asAny.providerOperationId !== undefined && asAny.method !== undefined) {\n        throw new Error(\n          `operations.${member}: a read member is either stated INLINE (method + pathTemplate) or a REFERENCE `\n          + '(providerOperationId) into the provider\\'s operation catalogue — never both.',\n        );\n      }\n    }\n  }\n\n  // D6 stance 6b — the declared erasure operation's FORM is dialect-specific. The union schema\n  // admits both forms; only the pairing below is executable, so an incoherent pairing must refuse\n  // at authoring rather than on the first subject-erasure request:\n  //   - ODATA        → `useCanonicalDelete` only (the canonical `DELETE /EntitySet(key)`);\n  //   - ODOO_JSONRPC → `useCanonicalDelete` only (compiles to `execute_kw('unlink', [[ids]])`,\n  //                    Odoo's own canonical delete);\n  //   - REST_JSON    → an explicit operation spec only (there IS no canonical delete to rely on —\n  //                    the binding declares the exact call, like every other REST_JSON operation).\n  if (binding.erasure.stance === HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION) {\n    const usesCanonicalDelete = 'useCanonicalDelete' in binding.erasure.operation;\n    if (binding.dialect === HttpApiTransportDialect.REST_JSON && usesCanonicalDelete) {\n      throw new Error(\n        'erasure.operation: a REST_JSON binding has no canonical delete — declare the explicit erasure operation spec (method/path), like its other declared operations.',\n      );\n    }\n    if (binding.dialect !== HttpApiTransportDialect.REST_JSON && !usesCanonicalDelete) {\n      throw new Error(\n        `erasure.operation: a ${binding.dialect} binding executes erasure through its CANONICAL delete (declare { useCanonicalDelete: true }) — an explicit REST operation spec has no translation on this dialect.`,\n      );\n    }\n  }\n}\n\n/** @wildo_source:part:end saas.models.http-api-binding */\nexport type HttpApiResourceBinding = z.infer<typeof HttpApiResourceBindingSchema>;\n\n/**\n * What an APPLICATION AUTHOR writes — the INPUT shape, so defaulted fields (`verifyMetadataAtBoot`,\n * `connection`, the remote-call semantics) are optional to type. Consumers read the parsed shape\n * above. Same split, and same reason, as `ExternalDataPipelineDeclarationAuthored`: a config field\n * typed with the PARSED shape makes every default mandatory for the one person the default exists\n * to serve.\n */\nexport type HttpApiResourceBindingAuthored = z.input<typeof HttpApiResourceBindingSchema>;\n\n// --------------------------------\n// Static binding properties\n// --------------------------------\n\n/**\n * Codecs whose ENTIRE value space stays within the synthesized-id charset law\n * (`^[A-Za-z0-9._~-]+$`, see `http-api-binding-id.shared.utils.ts`). Membership here is what\n * qualifies a single-key binding for the verbatim id form.\n */\nconst VERBATIM_ELIGIBLE_CODECS: readonly HttpApiKeyComponentCodec[] = [\n  HttpApiKeyComponentCodec.INTEGER,\n  HttpApiKeyComponentCodec.GUID,\n];\n\n/**\n * Whether this binding's synthesized `_id` is the single key value VERBATIM (legible ids for\n * Dataverse GUIDs / Odoo integers) versus the encoded composite form. A STATIC property of the\n * declaration — never sniffed per row — which is what keeps decode unambiguous (paper A).\n */\nexport function httpApiBindingUsesVerbatimKey(\n  binding: { keyFields: readonly HttpApiKeyField[] },\n): boolean {\n  return (\n    binding.keyFields.length === 1\n    && VERBATIM_ELIGIBLE_CODECS.includes(binding.keyFields[0].codec)\n  );\n}\n"]}
+{"version":3,"file":"http-api-binding.shared.schemas.js","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-binding.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,mCAAmC;AACnC,oBAAoB;AACpB,mCAAmC;AAEnC,4GAA4G;AAE5G,mCAAmC;AACnC,oCAAoC;AACpC,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,mCAAmC;AACnC,sDAAsD;AACtD,mCAAmC;AAEnC;;;;;GAKG;AACH,MAAM,CAAN,IAAY,oBAsBX;AAtBD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,2DAAmC,CAAA;IAEnC;;;;OAIG;IACH,iFAAyD,CAAA;IAEzD;;;;;OAKG;IACH,mGAA2E,CAAA;AAC7E,CAAC,EAtBW,oBAAoB,KAApB,oBAAoB,QAsB/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,mCAAmC;AACnC,+CAA+C;AAC/C,mCAAmC;AAEnC;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,wBAgBX;AAhBD,WAAY,wBAAwB;IAClC,+FAA+F;IAC/F,6CAAiB,CAAA;IAEjB,kFAAkF;IAClF,+CAAmB,CAAA;IAEnB,2EAA2E;IAC3E,yCAAa,CAAA;IAEb;;;;OAIG;IACH,yDAA6B,CAAA;AAC/B,CAAC,EAhBW,wBAAwB,KAAxB,wBAAwB,QAgBnC;AACD,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,+EAA+E;IAC/E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B,4DAA4D;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;CACxC,CAAC,CAAC;AAIH,mCAAmC;AACnC,gBAAgB;AAChB,mCAAmC;AAEnC;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,mCAAmC;AACnC,yDAAyD;AACzD,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,wBAAwB;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEnE;;;OAGG;IACH,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KAChE,CAAC;SACD,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAE9C;;;OAGG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE5D;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9D;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CACzE,CAAC,CAAC;AAIH,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,yCAAW,CAAA;IACX,2CAAa,CAAA;AACf,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,6BAsBX;AAtBD,WAAY,6BAA6B;IACvC;;;;;;;;;OASG;IACH,8CAAa,CAAA;IACb;;;;;;;;OAQG;IACH,oDAAmB,CAAA;AACrB,CAAC,EAtBW,6BAA6B,KAA7B,6BAA6B,QAsBxC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAC/C;;;;;;;;;OASG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,kDAAkD;IAClD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE1C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,iFAAiF;IACjF,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,QAAQ,EAAE;IAEb;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvE;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEzC;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC,2EAA2E;IAC3E,eAAe,EAAE,CAAC;SACf,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;SACD,QAAQ,EAAE;IAEb;;;;;;;OAOG;IACH,SAAS,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAErD;;;;;;;;;;OAUG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,8BAA8B,CAAC;AAIpF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,qCAAqC;IAC3C,2FAA2F;IAC3F,KAAK,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACvD,mDAAmD;IACnD,MAAM,EAAE,qCAAqC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAIH,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,8CAAa,CAAA;IACb,kDAAiB,CAAA;AACnB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAE7C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B;;;OAGG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAIH,qFAAqF;AACrF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC5E,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,eAAe,CAAC;KACxD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC;QAClE;;;;;WAKG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,iCAAiC;SAClC,CAAC;QACF;;;;;;;;;;WAUG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAChD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,mCAAmC,CAAC;QAC3E;;;;;;WAMG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;CACH,CAAC,CAAC;AAIH,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC,MAAM,+BAA+B,GAAG;IACtC;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzB;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B;;;;;;;;;;OAUG;IAEH,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,oEAAoE;IACpE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D;;;;;;;;;;;;OAYG;IAEH,yDAAyD;IACzD,OAAO,EAAE,+BAA+B;IAExC,uCAAuC;IACvC,mBAAmB,EAAE,gCAAgC,CAAC,OAAO,CAAC;QAC5D,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACzC,YAAY,EAAE,EAAE;QAChB,mBAAmB,EAAE,GAAG;KACzB,CAAC;CACH,CAAC;AAEF;;;;;;;;GAQG;AACH,4GAA4G;AAC5G,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC1E,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACjD,GAAG,+BAA+B;QAClC;;;;;;;;;;;WAWG;KACJ,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC;QACrD,GAAG,+BAA+B;QAClC,8EAA8E;QAC9E,UAAU,EAAE,2BAA2B;KACxC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,YAAY,CAAC;QACxD,GAAG,+BAA+B;QAClC,4FAA4F;QAC5F,6FAA6F;QAC7F,0FAA0F;QAC1F,6FAA6F;QAC7F,uDAAuD;KACxD,CAAC;CACH,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAA+B;IAClF,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EAAE,CAAC;QAC7D,0FAA0F;QAC1F,6BAA6B;QAC7B,IACE,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;eAC3B,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,wBAAwB,CAAC,OAAO,EAClE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kIAAkI,CACnI,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,IAAI,WAAW,KAAK,SAAS;gBAAE,SAAS;YACxC,IAAK,WAAuC,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;gBAC/E,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,2EAA2E;sBAC7F,kGAAkG;sBAClG,+DAA+D,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,gGAAgG;IAChG,iEAAiE;IACjE,yFAAyF;IACzF,6FAA6F;IAC7F,mDAAmD;IACnD,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,0BAA0B,EAAE,CAAC;QAC/E,MAAM,mBAAmB,GAAG,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9E,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,mBAAmB,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CACb,iKAAiK,CAClK,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,OAAO,qKAAqK,CAC7M,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAcD,mCAAmC;AACnC,4BAA4B;AAC5B,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,wBAAwB,GAAwC;IACpE,wBAAwB,CAAC,OAAO;IAChC,wBAAwB,CAAC,IAAI;CAC9B,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAkD;IAElD,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;WAC3B,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CACjE,CAAC;AACJ,CAAC","sourcesContent":["/**\n * HTTP-API persistence binding — the declaration model for resources whose rows live in a system\n * reached over an authenticated HTTP API (`PersistenceAdapter.HTTP_API`) rather than in a\n * platform-provisioned database.\n *\n * Design source of truth: `.claude/plans/etl-post-repository.md` (decisions D0/D1/D6/D9/D10,\n * requirements R7/R12/R15/R16) plus the two companion papers\n * `.claude/plans/etl-composite-key-synthesis.md` (key declaration + id codec) and\n * `.claude/plans/etl-filter-dialect-scope-down.md` (declared filter/sort/search surface).\n *\n * The binding is a REQUIRED companion declaration on any resource configuration that selects\n * `PersistenceAdapter.HTTP_API`. It answers, statically and per resource:\n * - WHICH declared system of record the rows live in (`system`), and WHICH remote entity inside it;\n * - HOW a row is identified (ordered key components → the synthesized engine-facing `_id`);\n * - WHAT the erasure story is (all three stances are first-class; none is silently defaulted);\n * - WHICH remote-call semantics apply (timeout, retry, rate budget, id-set bound).\n *\n * ## Three questions this used to answer and no longer does (#1055)\n *\n * WHOSE ACCOUNT (`connection`), WHERE the deployment is (`providerRef`) and HOW TENANCY is expressed\n * remotely (`tenancy`) all left in the same change, and none of them was replaced by a smaller field:\n *\n * - WHOSE ACCOUNT has one legal answer for a system of record — the application's own service\n *   identity (D12). The customer-connection case is case 2 of #1049 and keeps the connector lane.\n * - WHERE is a property of the declared INSTANCE (`systemsOfRecord.<name>`) and of the ENVIRONMENT,\n *   not of each resource. That is what lets two instances of one vendor exist at all.\n * - TENANCY became a STAMP rather than a declaration: the row projector writes the owner\n *   organization's id onto every remote row, so the per-row gate passes with no exemption.\n *\n * Credentials are NEVER declared here. They resolve at runtime through the systems-of-record\n * registry, from environment variables DERIVED from the instance name — the binding carries only the\n * name.\n */\n\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from './http-api-transport-dialect.shared';\n\n// --------------------------------\n// Transport dialect\n// --------------------------------\n\n/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */\n\n// --------------------------------\n// Whose identity reaches the target\n// --------------------------------\n\n/*\n * ─── `HttpApiIdentityMode` was REMOVED here (#333), and replaced rather than widened ────────────\n *\n * It had two values — `SERVICE_PRINCIPAL` and `USER_DELEGATED` — and its own docstring said it\n * stayed declared \"so bindings need no reshape when it arrives\". That is the one thing it got\n * wrong. `USER_DELEGATED` names a delegation without naming WHOSE ACCOUNT is spent, and those are\n * two independent questions with five real answers (`ExternalProvider_ConnectionShape`):\n *\n *   - a user's own personal grant is `USER × SERVICE`;\n *   - one member's own account, linked for the whole organization, is `ORGANIZATION × USER`\n *     (decided on wildo-ai/wildo-ai#18: every member spends it, and the linking member is named in\n *     the audit trail).\n *\n * Both are \"per-user OAuth against the target\", they resolve DIFFERENT credentials, and the single\n * field cannot distinguish them. So mapping it onto a target would have silently picked a lane —\n * which is why `connectionTargetForBinding` refused instead of guessing, and why the fix is the\n * richer vocabulary rather than a translation table.\n *\n * The audit contract is unchanged and was never the identity mode's to keep: every row carries the\n * REAL initiating user whatever the connection, so the shared-principal attribution failure\n * documented for Power Platform (\"credential-sharing as a service\") stays closed (requirement R12).\n */\n\n// --------------------------------\n// Erasure stance (GDPR Art. 17 on rows we do not own)\n// --------------------------------\n\n/**\n * The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class\n * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a\n * registration refusal, because `exportSubject` is a fail-closed obligation on every resource and\n * \"we cannot delete rows we do not own\" is not an answer the framework may imply silently.\n */\nexport enum HttpApiErasureStance {\n  /**\n   * (6a) The resource declares it holds NO personal/subject data. Registration verifies the\n   * declaration is coherent (e.g. `exportSubject` posture) and erasure is structurally N/A for\n   * the remote rows.\n   */\n  NO_SUBJECT_DATA = 'no-subject-data',\n\n  /**\n   * (6b) The binding declares HOW erasure reaches the foreign system: one named API operation the\n   * engine invokes on a subject-erasure request. This is a single declared write and does NOT\n   * require general write support (slice 1 stays read-only otherwise).\n   */\n  EXTERNAL_ERASURE_OPERATION = 'external-erasure-operation',\n\n  /**\n   * (6c) Erasure REFUSES by default; an explicit, per-request, audited controller acknowledgement\n   * lets it proceed and records the un-erased remote rows at high severity. Mirrors the existing\n   * administrative-floor acknowledgement shape (`administrative-continuity-floors.md`): the record\n   * is the control. NEVER a standing default — the acknowledgement is per erasure request.\n   */\n  CONTROLLER_ACKNOWLEDGED_NON_ERASURE = 'controller-acknowledged-non-erasure',\n}\n\n/*\n * ─── `HttpApiTenancyStance` was REMOVED here (#1055), and NOT replaced by a narrower vocabulary ──\n *\n * It had two members and both were wrong for a system of record.\n *\n * `SCOPE_FILTER_PUSHDOWN` pushed the engine's contextual scope predicate into the remote query —\n * which means sending WILDO's own organization id to a system that has never heard of it, as a\n * filter value. Nothing on the far side could match it, so the stance could only ever have worked\n * against a remote that happened to store Wildo ids.\n *\n * `SINGLE_TENANT_BINDING` then became the only truth, and a declaration with one legal value is a\n * question nobody should be asked — plus it carried a `justification` string, which made every\n * binding restate the same sentence.\n *\n * What replaced it is a different MECHANISM rather than a smaller field: the row projector stamps\n * the owner organization's id onto each remote row, so the per-row tenant gate passes with no\n * exemption and a request under another organization's URL is refused by the branch that already\n * existed. Narrowing a system of record BY organization unit is #1058, and it belongs to the\n * INSTANCE and its vendor facet — one declaration for every resource that reads that system,\n * rather than one per binding.\n */\n\n// --------------------------------\n// Key declaration + component codecs (paper A)\n// --------------------------------\n\n/**\n * Per-component value normalization for key synthesis. The codec is what makes the synthesized\n * `_id` STABLE: every component must round-trip byte-identically between the remote\n * representation and the encoded id, or the same remote row would answer to different ids.\n *\n * `INTEGER` and `GUID` are the two codecs whose entire value space is URL-unreserved-safe, which\n * is what qualifies a single-key binding for the VERBATIM id form (see\n * `httpApiBindingUsesVerbatimKey`).\n */\nexport enum HttpApiKeyComponentCodec {\n  /** Arbitrary remote string. NOT charset-safe → always participates via the encoded id form. */\n  STRING = 'string',\n\n  /** Integer key (Odoo `id`, SAP numeric keys). Digits only → verbatim-eligible. */\n  INTEGER = 'integer',\n\n  /** GUID/UUID key (Dataverse row ids). Hex + dashes → verbatim-eligible. */\n  GUID = 'guid',\n\n  /**\n   * Date/time key component, normalized to the RFC 3339 / ISO 8601 UTC string form before\n   * encoding. NOT verbatim-eligible (`:` is forbidden in ids — websocket room names are\n   * colon-parsed).\n   */\n  DATETIME_ISO = 'datetime-iso',\n}\n/** @wildo_source:part:end saas.models.http-api-binding */\n\n/**\n * One ordered component of the remote entity's key. `keyFields` order is the ENCODING order —\n * declared, committed, and boot-verified against `$metadata` where the dialect provides one;\n * never inferred at runtime (a silently adopted key change would orphan every stored FK value\n * and bookmark).\n */\nexport const HttpApiKeyFieldSchema = z.object({\n  /** The field name on the Wildo resource schema that carries this component. */\n  localField: z.string().min(1),\n\n  /** The remote entity's property name for this component. */\n  remoteField: z.string().min(1),\n\n  /** Value normalization for stable synthesis. */\n  codec: z.enum(HttpApiKeyComponentCodec),\n});\n\nexport type HttpApiKeyField = z.infer<typeof HttpApiKeyFieldSchema>;\n\n// --------------------------------\n// Field mapping\n// --------------------------------\n\n/**\n * Local-to-remote field name mapping for fields whose names differ. Fields not listed map by\n * identity (same name both sides). Key components are declared in `keyFields`, not here.\n */\nexport const HttpApiFieldMappingSchema = z.object({\n  localField: z.string().min(1),\n  remoteField: z.string().min(1),\n});\n\nexport type HttpApiFieldMapping = z.infer<typeof HttpApiFieldMappingSchema>;\n\n// --------------------------------\n// Remote-call semantics (decision D10 / requirement R15)\n// --------------------------------\n\n/**\n * Declared remote-call semantics. An enterprise API is 100ms–2s, rate-limited, and sometimes\n * down; these are DECISIONS, not inherited pipeline defaults. Defaults are conservative on\n * purpose — a binding that needs more declares more.\n */\nexport const HttpApiRemoteCallSemanticsSchema = z.object({\n  /** Per-call timeout. */\n  timeoutMs: z.number().int().positive().max(120_000).default(10_000),\n\n  /**\n   * Retry policy for idempotent READ-family calls only. Writes (when D4 lands) never retry\n   * implicitly.\n   */\n  retry: z\n    .object({\n      maxAttempts: z.number().int().min(1).max(5).default(2),\n      backoffMs: z.number().int().positive().max(30_000).default(500),\n    })\n    .default({ maxAttempts: 2, backoffMs: 500 }),\n\n  /**\n   * Rate budget toward the target, per process. `undefined` = no local throttle (the target's own\n   * limits still apply and surface as refusals).\n   */\n  maxRequestsPerMinute: z.number().int().positive().optional(),\n\n  /**\n   * Upper bound for translated id-set predicates (`_id ∈ {…}` → key-predicate disjunction /\n   * `in`). Above the bound the adapter REFUSES rather than emitting an unbounded URL\n   * (scope-down paper, shape T2).\n   */\n  maxIdSetSize: z.number().int().positive().max(500).default(50),\n\n  /**\n   * Upper bound for the translated PARTITION confinement (#1058 E7) — `key ∈ {every partition this\n   * caller may touch}`, compiled per dialect.\n   *\n   * Its own knob rather than a reuse of `maxIdSetSize`, because the two bound different things and\n   * would be tuned against different facts. An id set is a CALLER's request and its size is a\n   * property of what they asked for; a partition set is a property of the DEPLOYMENT — how many\n   * legal entities live inside one system of record — and of the caller's grant. An operator raising\n   * one for a bulk read has no reason to raise the other, and lowering `maxIdSetSize` to tame a URL\n   * would silently cut the confinement off at the knees: above the bound the adapter REFUSES, so a\n   * confinement that cannot compile is a read that cannot happen.\n   *\n   * The default is deliberately far above `maxIdSetSize`'s. A corporate with more than two hundred\n   * legal entities inside ONE system of record exists, and when it does the honest answer is a\n   * refusal that NAMES the bound rather than a request the target truncates or rejects with a 414.\n   * Refused rather than paged: splitting one read into N requests is a different mechanism, and one\n   * that would make a single `total` impossible to compute.\n   */\n  maxPartitionSetSize: z.number().int().positive().max(1_000).default(200),\n});\n\nexport type HttpApiRemoteCallSemantics = z.infer<typeof HttpApiRemoteCallSemanticsSchema>;\n\n// --------------------------------\n// Dialect-specific declarations\n// --------------------------------\n\n/**\n * HTTP methods a declared read-family operation may use. Deliberately NOT the full HTTP verb set\n * (`API_HttpMethod` in `@wildo-ai/external-connectors-models` describes provider-protocol\n * operations): slice 1 is read-only, so the closed vocabulary is the read-safe verb plus POST —\n * because JSON-RPC (Odoo) and many enterprise search endpoints are POST-shaped even for reads.\n * Write verbs (PUT/PATCH/DELETE) enter only with the D4 write story, as their own decision.\n */\nexport enum HttpApiRestOperationMethod {\n  GET = 'GET',\n  POST = 'POST',\n}\n\n/**\n * REST_JSON per-operation declaration: how one read-family member maps onto a concrete HTTP\n * operation. Deliberately minimal in slice 1 — pagination/filter parameter NAMES are declared,\n * their VALUES are supplied by the adapter from the translated query.\n *\n * Related but distinct: `ProviderRestOperation` on a provider's `rest` runtime contract describes a\n * VENDOR operation — one entry in the catalogue a reference below names. This schema describes a\n * RESOURCE read surface, which is a different thing and stays here.\n *\n * (An earlier revision pointed at `REST_API_OperationSpecSchema` in\n * `@wildo-ai/external-connectors-models` \"for capability transformers\". Both are gone: the\n * transformer layer was retired with `features/` in #327, and that OpenAPI-shaped operations layer\n * — ten exported symbols with zero code readers — was deleted in #331 rather than wired up, so\n * \"what a provider can do\" has one description instead of two.)\n *\n * The convergence performed in S3a (#331) — a member naming an operation in a PROVIDER's own\n * catalogue — was UNDONE in #1055. A system of record is not a connector (D10), and a read that\n * depends on a provider catalogue being loadable is the crossing that decision forbids. An inline\n * spec is now the only form, which is what every authored binding used anyway.\n */\n/**\n * A query LANGUAGE a REST system of record reads through, rather than a set of filter parameters\n * (#1293).\n *\n * Two vendors read this way and neither can be expressed as parameters: Salesforce takes SOQL and\n * NetSuite takes SuiteQL, each as ONE statement naming the fields, the entity, the predicates and\n * the order. A `filterParams` map cannot say \"SELECT these columns FROM that object\", so without this\n * neither vendor can be declared at all.\n *\n * ## Why this is a closed vocabulary and not a template string\n *\n * A statement is BUILT, and building means escaping. Each language has its own literal rules and its\n * own paging spelling, and a template with `{filter}` holes would put the escaping in the author's\n * hands — an injection surface in a file nobody reviews as one. The engine builds the statement and\n * the vocabulary names which grammar to build.\n *\n * This is the same trade the OData compiler already makes for `$filter`: expressions are composed\n * here, literals are escaped by one function, and no authored string reaches the wire uninspected.\n */\nexport enum HttpApiQueryStatementLanguage {\n  /**\n   * Salesforce Object Query Language.\n   *\n   * spec-cite: Salesforce Developers, \"SOQL and SOSL Reference\" —\n   * https://developer.salesforce.com/docs/atlas.en-us.soql_sosl.meta/soql_sosl/\n   *\n   * `SELECT *` does not exist: every field is named, which the binding's `fieldMappings` and key\n   * fields already supply. Paging is by the response's own continuation rather than by `OFFSET`,\n   * which SOQL bounds at 2000 rows.\n   */\n  SOQL = 'soql',\n  /**\n   * NetSuite SuiteQL — an SQL-92 dialect over its analytics schema.\n   *\n   * spec-cite: Oracle NetSuite, \"SuiteQL\" —\n   * https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_156257770590.html\n   *\n   * Paged by `limit` / `offset` QUERY parameters rather than inside the statement, which is why the\n   * statement declaration and `pagingParams` are independent.\n   */\n  SUITEQL = 'suiteql',\n}\n\n/**\n * How a read member builds and sends a query STATEMENT (#1293).\n *\n * Declared per operation rather than per binding, because a vendor's `read` and `list` genuinely\n * differ: Salesforce addresses one record at `/sobjects/Account/{key}` and queries collections\n * through `/query`, and only the second is a statement at all.\n */\nexport const HttpApiQueryStatementSpecSchema = z.object({\n  language: z.enum(HttpApiQueryStatementLanguage),\n  /**\n   * The parameter or body member the statement is placed in (`q` for both vendors surveyed).\n   *\n   * WHERE it lands is not declared, because the operation's own `method` already decides: a GET puts\n   * parameters in the query string and a POST puts them in the JSON body, which is what the request\n   * builder has always done. A `placement` field was drafted here and removed before it shipped — it\n   * would have been a second declaration of something the method already says, free to disagree with\n   * it. Salesforce is a GET with `?q=`, NetSuite a POST with `{\"q\": …}`, and neither needs to be told\n   * twice.\n   */\n  parameterName: z.string().min(1),\n  /**\n   * The object the statement selects FROM. Absent = the binding's `entityRef`, which is the ordinary\n   * case; present when the vendor's query schema names an object differently from its REST resource.\n   */\n  fromEntity: z.string().min(1).optional(),\n});\nexport type HttpApiQueryStatementSpec = z.infer<typeof HttpApiQueryStatementSpecSchema>;\n\nexport const HttpApiRestOperationSpecSchema = z.object({\n  /** HTTP method for this read-family operation. */\n  method: z.enum(HttpApiRestOperationMethod),\n\n  /**\n   * Path template relative to the provider's base URL. `{key}` interpolates the synthesized\n   * key's remote addressing form; other `{param}` tokens must be declared parameter names.\n   */\n  pathTemplate: z.string().min(1),\n\n  /** Query/body parameter names for pagination, when the operation supports it. */\n  pagingParams: z\n    .object({\n      limitParam: z.string().min(1),\n      offsetParam: z.string().min(1),\n    })\n    .optional(),\n\n  /**\n   * Declared filter parameter name per LOCAL field. Only fields listed here are translatable for\n   * this operation (scope-down paper, shape T3); everything else is refused at the adapter\n   * boundary.\n   */\n  filterParams: z.record(z.string().min(1), z.string().min(1)).optional(),\n\n  /**\n   * The parameter that receives the SEARCH text (T4), for a `search` operation. Absent =\n   * search is refused for this binding even when the operation exists.\n   */\n  searchParam: z.string().min(1).optional(),\n\n  /**\n   * Dot-path to the payload inside the response body — the rows array (list/search), the entity\n   * object (read), or the number (count). Absent = the body IS the payload. Declared, never\n   * sniffed: response shapes vary per target (`items`, `result`, `value`, raw array) and a wrong\n   * guess would silently read zero rows.\n   */\n  resultPath: z.string().min(1).optional(),\n\n  /** Wrap request/response in a JSON-RPC 2.0 envelope (the Odoo variant). */\n  jsonRpcEnvelope: z\n    .object({\n      rpcMethod: z.string().min(1),\n    })\n    .optional(),\n\n  /**\n   * Read through a query STATEMENT rather than through filter parameters (#1293).\n   *\n   * Mutually exclusive with `filterParams` and `searchParam` in practice rather than by schema: a\n   * statement expresses its own predicates, so a declaration carrying both has said the same thing\n   * twice in two grammars. The compiler refuses that pairing, where it can name which one it was\n   * about to ignore.\n   */\n  statement: HttpApiQueryStatementSpecSchema.optional(),\n\n  /**\n   * Dot-path to a CONTINUATION URL in the response — Salesforce's `nextRecordsUrl` (#1293).\n   *\n   * Declared rather than sniffed, for the same reason `resultPath` is: response shapes vary per\n   * target and a wrong guess reads zero rows silently. Absent means the operation pages by\n   * `pagingParams` or not at all.\n   *\n   * A continuation is followed only on the target's OWN origin, exactly as the OData one is — the\n   * link comes from a remote response body and carries this deployment's credentials wherever it\n   * points.\n   */\n  cursorPath: z.string().min(1).optional(),\n\n  /**\n   * Headers this vendor requires on the request — NetSuite's `Prefer: transient` (#1293).\n   *\n   * VENDOR headers only. A credential never goes here: credentials come from the instance's access,\n   * and a header authored in a binding would be a second credential channel in a file that is\n   * committed. The compiler refuses an `authorization` key by name rather than trusting the author.\n   */\n  staticHeaders: z.record(z.string().min(1), z.string().min(1)).optional(),\n});\n\nexport type HttpApiRestOperationSpec = z.infer<typeof HttpApiRestOperationSpecSchema>;\n\n/*\n * ─── The catalogue REFERENCE form was REMOVED here (#1055 D10) ──────────────────────────────────\n *\n * A REST_JSON member could name an `operationId` in a PROVIDER's own `rest.operations` catalogue,\n * so a resource's read surface reached into the connector lane for its shape. That is precisely the\n * crossing D10 forbids: no runtime object, stored row, route, secret name, audit subject or\n * specification serves both a system of record and a connector — and this one made a read depend on\n * a provider's catalogue being loadable at request time.\n *\n * Nothing loses a capability. A REST_JSON binding declares its read members INLINE, typed against its\n * vendor facet, which is what every authored binding does today: no REST_JSON system of record was\n * ever declared against a catalogue, and the generic-REST simulator proof moves to a facet fixture.\n *\n * The convergence recorded above (#331) is what is being undone, and deliberately rather than by\n * accident: stating the vendor half once per provider is a real saving for a CONNECTOR, and a\n * category error for a system the application reads its OWN rows out of.\n */\n\n/**\n * One read-surface member. An INLINE spec, and now only that.\n *\n * Kept as a named alias rather than collapsed into {@link HttpApiRestOperationSpecSchema} at every\n * use site: the members of a read surface are a concept in their own right, and a later form — a\n * facet-declared operation shape — would arrive HERE rather than at each of its consumers.\n */\nexport const HttpApiRestOperationDeclarationSchema = HttpApiRestOperationSpecSchema;\n\nexport type HttpApiRestOperationDeclaration = z.infer<typeof HttpApiRestOperationDeclarationSchema>;\n\n/** The REST_JSON read-surface mapping: which lifecycle members exist remotely, and how. */\nexport const HttpApiRestOperationsSchema = z.object({\n  read: HttpApiRestOperationDeclarationSchema,\n  list: HttpApiRestOperationDeclarationSchema,\n  /** Absent = COUNT is refused for this binding (honest refusal, never an emulated scan). */\n  count: HttpApiRestOperationDeclarationSchema.optional(),\n  /** Absent = SEARCH is refused for this binding. */\n  search: HttpApiRestOperationDeclarationSchema.optional(),\n});\n\nexport type HttpApiRestOperations = z.infer<typeof HttpApiRestOperationsSchema>;\n\n// --------------------------------\n// Stance sub-declarations\n// --------------------------------\n\n/**\n * HTTP methods a declared EXPLICIT erasure operation (stance 6b, REST_JSON) may use.\n *\n * A separate vocabulary from {@link HttpApiRestOperationMethod} on purpose: that enum describes\n * READ-family operations (GET/POST), and reusing it here would let an erasure declare `GET` — a\n * read spelled as a deletion. Deletion is expressed as the resource-oriented `DELETE` or an\n * RPC-style `POST`; nothing else is a deletion on the wire.\n */\nexport enum HttpApiErasureOperationMethod {\n  POST = 'POST',\n  DELETE = 'DELETE',\n}\n\n/**\n * The EXPLICIT erasure call a REST_JSON binding declares for stance 6b. Deliberately narrower\n * than {@link HttpApiRestOperationSpecSchema}: an erasure addresses ONE row by key — it has no\n * pagination, no filter params, no search, no result path to project.\n */\nexport const HttpApiErasureOperationSpecSchema = z.object({\n  method: z.enum(HttpApiErasureOperationMethod),\n\n  /**\n   * Path template relative to the provider base URL. `{key}` interpolates the row's remote key\n   * addressing form, exactly as in the read-family `pathTemplate`.\n   */\n  pathTemplate: z.string().min(1),\n\n  /**\n   * JSON-RPC envelope for RPC-style targets (pairs with `method: POST`), mirroring the\n   * read-family declaration.\n   */\n  jsonRpcEnvelope: z.object({ rpcMethod: z.string().min(1) }).optional(),\n});\n\nexport type HttpApiErasureOperationSpec = z.infer<typeof HttpApiErasureOperationSpecSchema>;\n\n/** Erasure declaration — discriminated; stance 6b names the operation it invokes. */\nexport const HttpApiErasureDeclarationSchema = z.discriminatedUnion('stance', [\n  z.object({\n    stance: z.literal(HttpApiErasureStance.NO_SUBJECT_DATA),\n  }),\n  z.object({\n    stance: z.literal(HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION),\n    /**\n     * The declared erasure call. ODATA and ODOO_JSONRPC bindings rely on their CANONICAL delete\n     * (`DELETE /EntitySet(key)` / `execute_kw('unlink', [[ids]])`) by declaring\n     * `useCanonicalDelete`; REST_JSON bindings declare the operation explicitly. The pairing is\n     * enforced by {@link assertHttpApiBindingDialectCoherence}.\n     */\n    operation: z.union([\n      z.object({ useCanonicalDelete: z.literal(true) }),\n      HttpApiErasureOperationSpecSchema,\n    ]),\n    /**\n     * The LOCAL field naming the DATA SUBJECT whose erasure deletes a remote row — the rows the\n     * declared operation applies to are exactly `{ [subjectLinkLocalField]: <erased subject id> }`.\n     *\n     * DECLARED, never inferred, for the same reason `dataSubjectPolicy` exists on retention: a\n     * foreign key usually names an OWNER or an ACTOR, not the subject — inferring from \"any FK to\n     * the erased user\" would delete a purchase-order row because the erased user merely CREATED\n     * it, destroying a business record no erasure asked for. One field, mirroring\n     * `sessionPrincipalField`'s \"one field names the person\". Registration verifies a declared\n     * relationship carries this field as its FK (so the subject type it links is known).\n     */\n    subjectLinkLocalField: z.string().trim().min(1),\n  }),\n  z.object({\n    stance: z.literal(HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE),\n    /**\n     * Optional evidence link: the LOCAL field naming the data subject, used ONLY to COUNT the\n     * remaining remote rows for the acknowledgement's CRITICAL audit record (`remainingRowCount`).\n     * Optional because 6c legitimately covers linkage no FK expresses (an email inside remote\n     * rows) — absent, the record carries no count rather than a fabricated zero. Never used to\n     * delete anything.\n     */\n    subjectLinkLocalField: z.string().trim().min(1).optional(),\n  }),\n]);\n\nexport type HttpApiErasureDeclaration = z.infer<typeof HttpApiErasureDeclarationSchema>;\n\n// --------------------------------\n// The binding declaration\n// --------------------------------\n\nconst httpApiResourceBindingBaseShape = {\n  /**\n   * The SYSTEM OF RECORD this resource lives in, by the NAME the application declared it under in\n   * `wildo.saas.config.ts` (`systemsOfRecord.<name>`, #1055).\n   *\n   * ## Why a name, and not a provider ref\n   *\n   * `providerRef` named a PROVIDER, and a provider's env-var names live in its module — so one ref\n   * was one deployment, and a second Odoo was unrepresentable. A name here is an INSTANCE: two\n   * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in the environment variables their\n   * names derive. It is also not a provider in any other sense (D10): nothing here is selected\n   * through the capability plane, carries a person's lent credential, or has an operation catalogue.\n   *\n   * ## What validates it, and where\n   *\n   * Not here, and not in the resource factory — the factory runs in the application's `shared-lib`,\n   * where the saas configuration is not in scope. The factory checks SHAPE; the boot registry checks\n   * that this name is DECLARED and that `dialect` below equals the instance's, at the first moment\n   * both are visible. That split is the honest one rather than a compromise.\n   */\n  system: z.string().min(1),\n\n  /**\n   * The remote entity addressed by this binding — an OData entity-set name, or a logical name for\n   * a REST_JSON surface. One binding, one remote entity set.\n   */\n  entityRef: z.string().min(1),\n\n  /*\n   * `connection` was here, and it is GONE (#1055 D12).\n   *\n   * It declared WHOSE ACCOUNT a binding spends — `ORGANIZATION × USER` and its siblings — which is a\n   * real question for a CONNECTOR, where a customer connects their own account. A system of record is\n   * not that: it is a deployment the application reads its own business rows out of, with its own\n   * service identity, and the only honest answer was always `APPLICATION × SERVICE`. A field with one\n   * legal value is a question nobody should be asked.\n   *\n   * The customer-connection case is case 2 of #1049 and keeps the connector resolver, untouched.\n   */\n\n  /** Ordered key declaration — the source of the synthesized engine-facing `_id` (paper A). */\n  keyFields: z.array(HttpApiKeyFieldSchema).min(1),\n\n  /** Non-key field name mappings; unlisted fields map by identity. */\n  fieldMappings: z.array(HttpApiFieldMappingSchema).default([]),\n\n  /*\n   * `tenancy` was here, and it is GONE (#1055 §5).\n   *\n   * Both of its stances were wrong for a system of record. `SCOPE_FILTER_PUSHDOWN` sent WILDO's own\n   * organization id to the remote as a filter value — an id the remote has never heard of — and\n   * `SINGLE_TENANT_BINDING` became the only truth, which makes it a declaration with one legal answer.\n   *\n   * What replaced it is not a smaller field but a different mechanism: the row projector STAMPS the\n   * owner organization's id onto every remote row, so the per-row tenant gate passes with no exemption\n   * and a read under another organization's URL is refused by the gate that already existed.\n   * Partitioning a system of record BY organization unit returns in #1058, as a property of the\n   * INSTANCE and its vendor facet rather than of each binding.\n   */\n\n  /** Erasure stance (D6) — required; no silent default. */\n  erasure: HttpApiErasureDeclarationSchema,\n\n  /** Remote-call semantics (D10/R15). */\n  remoteCallSemantics: HttpApiRemoteCallSemanticsSchema.default({\n    timeoutMs: 10_000,\n    retry: { maxAttempts: 2, backoffMs: 500 },\n    maxIdSetSize: 50,\n    maxPartitionSetSize: 200,\n  }),\n};\n\n/**\n * The HTTP_API resource binding — discriminated on the transport dialect so each dialect carries\n * exactly its own obligations: ODATA and ODOO_JSONRPC are generic (the model name IS `entityRef`, and\n * read/list/count map mechanically); REST_JSON must declare its whole read surface INLINE.\n *\n * Every arm carries `system` — the declared instance this resource lives in — and none carries a\n * provider, a connection shape or a tenancy stance. See the base shape above for what each of those\n * was and why none was replaced by a smaller field (#1055).\n */\n/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */\nexport const HttpApiResourceBindingSchema = z.discriminatedUnion('dialect', [\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.ODATA),\n    ...httpApiResourceBindingBaseShape,\n    /*\n     * `verifyMetadataAtBoot` was here, and it is GONE (#1055 §5).\n     *\n     * It had ZERO non-test readers — measured, not assumed — so nothing ever probed `$metadata` at\n     * boot whatever it was set to. It also asked for exactly what the registry above it must never\n     * do: dial the remote during startup, where an ERP outage would stop an application booting\n     * (`continuity-drift-and-cas-basis.md` Rule 3).\n     *\n     * The drift probe it promised EXISTS, on the extraction source, reached through the operator door\n     * (`external-data-extraction-source.backend.ts`) — where a human is present and a refusal is\n     * something somebody can act on.\n     */\n  }),\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.REST_JSON),\n    ...httpApiResourceBindingBaseShape,\n    /** The declared read surface — absent members are refused, never emulated. */\n    operations: HttpApiRestOperationsSchema,\n  }),\n  z.object({\n    dialect: z.literal(HttpApiTransportDialect.ODOO_JSONRPC),\n    ...httpApiResourceBindingBaseShape,\n    // Generic like ODATA — no per-binding operation declarations: `entityRef` is the Odoo model\n    // (e.g. 'res.partner'); read/list/count map onto read/search_read/search_count mechanically.\n    // The single-INTEGER-key constraint is enforced by `assertHttpApiBindingDialectCoherence`\n    // (called by the resource-configuration factory) — a refine here would wrap the union member\n    // in effects, which discriminated unions do not admit.\n  }),\n]);\n\n/**\n * Dialect-specific structural constraints that a discriminated union cannot express member-side.\n * Called by the resource-configuration factory AFTER the schema parse; throws with the offending\n * path named.\n */\nexport function assertHttpApiBindingDialectCoherence(binding: HttpApiResourceBinding): void {\n  if (binding.dialect === HttpApiTransportDialect.ODOO_JSONRPC) {\n    // Odoo row ids are INTEGERS, always — one key field, INTEGER codec, or the synthesized id\n    // could never address a row.\n    if (\n      binding.keyFields.length !== 1\n      || binding.keyFields[0].codec !== HttpApiKeyComponentCodec.INTEGER\n    ) {\n      throw new Error(\n        \"keyFields: an ODOO_JSONRPC binding must declare exactly one key field with the INTEGER codec — Odoo row ids are integers ('id').\",\n      );\n    }\n  }\n\n  /*\n   * A member naming a PROVIDER's catalogue operation is refused, and refused EXPLICITLY (#1055 D10).\n   *\n   * The schema alone would refuse it as an unknown key, with a message about `providerOperationId`\n   * not being expected — true, and useless to an author who reasonably believes the form still\n   * exists, because it did until this slice. So the refusal names what happened and where the shape\n   * went instead of letting the parse error carry it.\n   *\n   * This replaces an ambiguity check that existed for the opposite reason: while BOTH forms were\n   * legal, a member carrying both parsed as the inline one and dropped the reference silently.\n   */\n  if (binding.dialect === HttpApiTransportDialect.REST_JSON) {\n    for (const [member, declaration] of Object.entries(binding.operations)) {\n      if (declaration === undefined) continue;\n      if ((declaration as Record<string, unknown>).providerOperationId !== undefined) {\n        throw new Error(\n          `operations.${member}: a read member can no longer REFERENCE a provider's operation catalogue `\n          + '(`providerOperationId`). A system of record is not a connector, so its read surface is declared '\n          + 'INLINE here (method + pathTemplate) against the vendor facet.',\n        );\n      }\n    }\n  }\n\n  // D6 stance 6b — the declared erasure operation's FORM is dialect-specific. The union schema\n  // admits both forms; only the pairing below is executable, so an incoherent pairing must refuse\n  // at authoring rather than on the first subject-erasure request:\n  //   - ODATA        → `useCanonicalDelete` only (the canonical `DELETE /EntitySet(key)`);\n  //   - ODOO_JSONRPC → `useCanonicalDelete` only (compiles to `execute_kw('unlink', [[ids]])`,\n  //                    Odoo's own canonical delete);\n  //   - REST_JSON    → an explicit operation spec only (there IS no canonical delete to rely on —\n  //                    the binding declares the exact call, like every other REST_JSON operation).\n  if (binding.erasure.stance === HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION) {\n    const usesCanonicalDelete = 'useCanonicalDelete' in binding.erasure.operation;\n    if (binding.dialect === HttpApiTransportDialect.REST_JSON && usesCanonicalDelete) {\n      throw new Error(\n        'erasure.operation: a REST_JSON binding has no canonical delete — declare the explicit erasure operation spec (method/path), like its other declared operations.',\n      );\n    }\n    if (binding.dialect !== HttpApiTransportDialect.REST_JSON && !usesCanonicalDelete) {\n      throw new Error(\n        `erasure.operation: a ${binding.dialect} binding executes erasure through its CANONICAL delete (declare { useCanonicalDelete: true }) — an explicit REST operation spec has no translation on this dialect.`,\n      );\n    }\n  }\n}\n\n/** @wildo_source:part:end saas.models.http-api-binding */\nexport type HttpApiResourceBinding = z.infer<typeof HttpApiResourceBindingSchema>;\n\n/**\n * What an APPLICATION AUTHOR writes — the INPUT shape, so defaulted fields (`verifyMetadataAtBoot`,\n * `connection`, the remote-call semantics) are optional to type. Consumers read the parsed shape\n * above. Same split, and same reason, as `ExternalDataPipelineDeclarationAuthored`: a config field\n * typed with the PARSED shape makes every default mandatory for the one person the default exists\n * to serve.\n */\nexport type HttpApiResourceBindingAuthored = z.input<typeof HttpApiResourceBindingSchema>;\n\n// --------------------------------\n// Static binding properties\n// --------------------------------\n\n/**\n * Codecs whose ENTIRE value space stays within the synthesized-id charset law\n * (`^[A-Za-z0-9._~-]+$`, see `http-api-binding-id.shared.utils.ts`). Membership here is what\n * qualifies a single-key binding for the verbatim id form.\n */\nconst VERBATIM_ELIGIBLE_CODECS: readonly HttpApiKeyComponentCodec[] = [\n  HttpApiKeyComponentCodec.INTEGER,\n  HttpApiKeyComponentCodec.GUID,\n];\n\n/**\n * Whether this binding's synthesized `_id` is the single key value VERBATIM (legible ids for\n * Dataverse GUIDs / Odoo integers) versus the encoded composite form. A STATIC property of the\n * declaration — never sniffed per row — which is what keeps decode unambiguous (paper A).\n */\nexport function httpApiBindingUsesVerbatimKey(\n  binding: { keyFields: readonly HttpApiKeyField[] },\n): boolean {\n  return (\n    binding.keyFields.length === 1\n    && VERBATIM_ELIGIBLE_CODECS.includes(binding.keyFields[0].codec)\n  );\n}\n"]}

package/dist/esm/http-api-binding/http-api-transport-dialect.shared.d.ts

@@ -0,0 +1,107 @@
+/**
+ * `HttpApiTransportDialect` — how the engine SPEAKS to a system of record.
+ *
+ * A boundary module, and the reason it is one is a package-contract rule rather than taste.
+ *
+ * ## Why this is not in `http-api-binding.shared.schemas.ts` any more (#1055, R3)
+ *
+ * That module is published ONLY through the `@wildo-ai/saas-models/external-data` subpath. The enum
+ * is about to be named by the ROOT-exported application-configuration contract (`systemsOfRecord`
+ * declares a dialect per instance), and a TypeScript `enum` is NOMINAL: a root-only consumer that
+ * cannot name it through a public specifier gets `TS2742`/`TS2883` — "the inferred type cannot be
+ * named without a reference to …/node_modules/…" — which is
+ * `.claude/rules/package-public-entrypoints.md`'s "root barrel must not DEPEND on a subpath-only
+ * surface", exactly.
+ *
+ * The rule's prescribed fix is to MOVE THE BOUNDARY, never to re-export across it: adding this module
+ * to the subpath barrel as well would be `root-barrel-overlap` (a second door onto one room), which
+ * `pnpm check:package-entrypoints` rule 1 refuses. So the enum lives here, the root exports it, the
+ * binding schema imports it, and the subpath does NOT re-export it.
+ *
+ * Three root-reachable modules already cross into that subpath under `entrypoint-closure-waiver`.
+ * This is the fourth crossing avoided rather than waived — and it is the one that would have put a
+ * nominal enum into the most re-derived contract in the repository.
+ *
+ * ## What belongs here, and what does not
+ *
+ * ONLY the closed vocabulary. The per-dialect binding arms, the compilers and the key codecs stay
+ * with the binding schema: they are the SHAPE of a declaration, not its name, and nothing
+ * root-exported needs to name them.
+ *
+ * ## The root-only probe, measured 2026-09-15
+ *
+ * `package-public-entrypoints.md` asks for a measurement rather than a category judgement, so here is
+ * the result. A consumer importing ONLY the package root, deriving values from this enum and emitting
+ * with `declaration: true`:
+ *
+ * ```
+ * export declare const declaredDialect = HttpApiTransportDialect.ODOO_JSONRPC;
+ * export declare function pickDialect(): { dialect: HttpApiTransportDialect };
+ * ```
+ *
+ * Zero errors, and the emitted declaration NAMES the enum through the root specifier rather than
+ * reaching into a `node_modules/.../dist/esm/...` path. The same probe run before this module reached
+ * the root barrel emitted `dialect: any` and `TS2305` — so the measurement has both halves, and the
+ * enum is safe in a root-exported contract.
+ */
+/**
+ * The query dialect the adapter speaks toward the target system. Closed vocabulary (slice 1);
+ * SOAP is a possible later member over the same HTTP transport, and a direct-database kind would
+ * be a NEW `PersistenceAdapter` member, never a dialect here.
+ */
+export declare enum HttpApiTransportDialect {
+    /**
+     * OData **v4** — one generic client: mechanical pushdown of
+     * `$filter`/`$select`/`$top`/`$skip`/`$orderby`/`$count`, with a `$metadata` boot-time
+     * verification probe of the committed declaration.
+     *
+     * ⚠ **This member is v4 ONLY, and that excludes SAP's most-used API.** An earlier revision of
+     * this comment named "SAP S/4HANA, Microsoft Dataverse/Dynamics 365" here, which is half right
+     * and was load-bearing — it is why nobody looked:
+     *
+     * | Target | Version | Consumable today |
+     * |---|---|---|
+     * | Microsoft Dataverse / Dynamics 365 Web API (`/api/data/v9.2/`) | v4 | ✅ |
+     * | SAP S/4HANA OData **v4** services (`/sap/opu/odata4/…`) | v4 | ✅ |
+     * | SAP `API_BUSINESS_PARTNER` (`/sap/opu/odata/sap/API_BUSINESS_PARTNER`) | **v2** | ❌ |
+     *
+     * v2 is not a v4 variant with a different header. Its collection envelope is
+     * `{ "d": { "results": [...], "__next": …, "__count": … } }` rather than
+     * `{ "value": [...], "@odata.nextLink": … }`; `Edm.DateTime` serializes as `"/Date(<ticks>)/"`
+     * rather than ISO 8601; `Edm.Decimal` and `Edm.Int64` serialize as JSON STRINGS rather than
+     * numbers; and JSON must be requested (`$format=json`) because v2 defaults to Atom/XML. So it
+     * changes the envelope, the paging property, the count property AND the value encoding — a
+     * reader written for one cannot read the other, and the mapping layer needs coercions the way
+     * Odoo needs `ODOO_FALSE_AS_NULL`.
+     * spec-cite: OData Version 2.0 JSON Format
+     * (https://www.odata.org/documentation/odata-version-2-0/json-format/) — the `d`/`results`/
+     * `__next`/`__count` envelope, the `/Date(<ticks>)/` DateTime literal, and Edm.Decimal /
+     * Edm.Int64 "formatted as a JSON string".
+     *
+     * Supporting v2 is an OPEN decision, not an oversight. Until it lands, point an ODATA binding at
+     * a v4 service: for SAP that means the OData v4 edition of the API where one is published.
+     */
+    ODATA = "odata",
+    /**
+     * Declared per-binding REST/JSON operation mapping (bespoke enterprise APIs). Unlike ODATA
+     * there is no generic client: each binding declares how read/list/count/search map onto
+     * concrete HTTP operations.
+     */
+    REST_JSON = "rest-json",
+    /**
+     * Odoo's external API (`/jsonrpc` + `execute_kw`). Promoted to its OWN dialect 2026-08-27 —
+     * D0's original "JSON-RPC is a thin envelope variant of REST_JSON" was corrected by measuring
+     * the protocol: it is generic like ODATA (no per-binding operation declarations — the model
+     * name IS `entityRef`, and read/list/count map onto `read`/`search_read`/`search_count`
+     * mechanically), but it speaks POSITIONAL arguments, its own domain filter language
+     * (`[['field','=',value], …]` with polish-notation `'|'` disjunction), and authenticates
+     * INSIDE the RPC args (`execute_kw(db, uid, api_key, …)`) rather than via HTTP headers.
+     * Forcing that through REST_JSON's declared-parameter model would have been the
+     * merge-distinct-concepts failure `design-philosophy.md` forbids.
+     *
+     * Structural constraint (schema-enforced): exactly ONE key field with the `INTEGER` codec —
+     * Odoo row ids are integers, always.
+     */
+    ODOO_JSONRPC = "odoo-jsonrpc"
+}
+//# sourceMappingURL=http-api-transport-dialect.shared.d.ts.map

package/dist/esm/http-api-binding/http-api-transport-dialect.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-transport-dialect.shared.d.ts","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-transport-dialect.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH;;;;GAIG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,KAAK,UAAU;IAEf;;;;OAIG;IACH,SAAS,cAAc;IAEvB;;;;;;;;;;;;;OAaG;IACH,YAAY,iBAAiB;CAC9B"}

package/dist/esm/http-api-binding/http-api-transport-dialect.shared.js

@@ -0,0 +1,108 @@
+/**
+ * `HttpApiTransportDialect` — how the engine SPEAKS to a system of record.
+ *
+ * A boundary module, and the reason it is one is a package-contract rule rather than taste.
+ *
+ * ## Why this is not in `http-api-binding.shared.schemas.ts` any more (#1055, R3)
+ *
+ * That module is published ONLY through the `@wildo-ai/saas-models/external-data` subpath. The enum
+ * is about to be named by the ROOT-exported application-configuration contract (`systemsOfRecord`
+ * declares a dialect per instance), and a TypeScript `enum` is NOMINAL: a root-only consumer that
+ * cannot name it through a public specifier gets `TS2742`/`TS2883` — "the inferred type cannot be
+ * named without a reference to …/node_modules/…" — which is
+ * `.claude/rules/package-public-entrypoints.md`'s "root barrel must not DEPEND on a subpath-only
+ * surface", exactly.
+ *
+ * The rule's prescribed fix is to MOVE THE BOUNDARY, never to re-export across it: adding this module
+ * to the subpath barrel as well would be `root-barrel-overlap` (a second door onto one room), which
+ * `pnpm check:package-entrypoints` rule 1 refuses. So the enum lives here, the root exports it, the
+ * binding schema imports it, and the subpath does NOT re-export it.
+ *
+ * Three root-reachable modules already cross into that subpath under `entrypoint-closure-waiver`.
+ * This is the fourth crossing avoided rather than waived — and it is the one that would have put a
+ * nominal enum into the most re-derived contract in the repository.
+ *
+ * ## What belongs here, and what does not
+ *
+ * ONLY the closed vocabulary. The per-dialect binding arms, the compilers and the key codecs stay
+ * with the binding schema: they are the SHAPE of a declaration, not its name, and nothing
+ * root-exported needs to name them.
+ *
+ * ## The root-only probe, measured 2026-09-15
+ *
+ * `package-public-entrypoints.md` asks for a measurement rather than a category judgement, so here is
+ * the result. A consumer importing ONLY the package root, deriving values from this enum and emitting
+ * with `declaration: true`:
+ *
+ * ```
+ * export declare const declaredDialect = HttpApiTransportDialect.ODOO_JSONRPC;
+ * export declare function pickDialect(): { dialect: HttpApiTransportDialect };
+ * ```
+ *
+ * Zero errors, and the emitted declaration NAMES the enum through the root specifier rather than
+ * reaching into a `node_modules/.../dist/esm/...` path. The same probe run before this module reached
+ * the root barrel emitted `dialect: any` and `TS2305` — so the measurement has both halves, and the
+ * enum is safe in a root-exported contract.
+ */
+/**
+ * The query dialect the adapter speaks toward the target system. Closed vocabulary (slice 1);
+ * SOAP is a possible later member over the same HTTP transport, and a direct-database kind would
+ * be a NEW `PersistenceAdapter` member, never a dialect here.
+ */
+export var HttpApiTransportDialect;
+(function (HttpApiTransportDialect) {
+    /**
+     * OData **v4** — one generic client: mechanical pushdown of
+     * `$filter`/`$select`/`$top`/`$skip`/`$orderby`/`$count`, with a `$metadata` boot-time
+     * verification probe of the committed declaration.
+     *
+     * ⚠ **This member is v4 ONLY, and that excludes SAP's most-used API.** An earlier revision of
+     * this comment named "SAP S/4HANA, Microsoft Dataverse/Dynamics 365" here, which is half right
+     * and was load-bearing — it is why nobody looked:
+     *
+     * | Target | Version | Consumable today |
+     * |---|---|---|
+     * | Microsoft Dataverse / Dynamics 365 Web API (`/api/data/v9.2/`) | v4 | ✅ |
+     * | SAP S/4HANA OData **v4** services (`/sap/opu/odata4/…`) | v4 | ✅ |
+     * | SAP `API_BUSINESS_PARTNER` (`/sap/opu/odata/sap/API_BUSINESS_PARTNER`) | **v2** | ❌ |
+     *
+     * v2 is not a v4 variant with a different header. Its collection envelope is
+     * `{ "d": { "results": [...], "__next": …, "__count": … } }` rather than
+     * `{ "value": [...], "@odata.nextLink": … }`; `Edm.DateTime` serializes as `"/Date(<ticks>)/"`
+     * rather than ISO 8601; `Edm.Decimal` and `Edm.Int64` serialize as JSON STRINGS rather than
+     * numbers; and JSON must be requested (`$format=json`) because v2 defaults to Atom/XML. So it
+     * changes the envelope, the paging property, the count property AND the value encoding — a
+     * reader written for one cannot read the other, and the mapping layer needs coercions the way
+     * Odoo needs `ODOO_FALSE_AS_NULL`.
+     * spec-cite: OData Version 2.0 JSON Format
+     * (https://www.odata.org/documentation/odata-version-2-0/json-format/) — the `d`/`results`/
+     * `__next`/`__count` envelope, the `/Date(<ticks>)/` DateTime literal, and Edm.Decimal /
+     * Edm.Int64 "formatted as a JSON string".
+     *
+     * Supporting v2 is an OPEN decision, not an oversight. Until it lands, point an ODATA binding at
+     * a v4 service: for SAP that means the OData v4 edition of the API where one is published.
+     */
+    HttpApiTransportDialect["ODATA"] = "odata";
+    /**
+     * Declared per-binding REST/JSON operation mapping (bespoke enterprise APIs). Unlike ODATA
+     * there is no generic client: each binding declares how read/list/count/search map onto
+     * concrete HTTP operations.
+     */
+    HttpApiTransportDialect["REST_JSON"] = "rest-json";
+    /**
+     * Odoo's external API (`/jsonrpc` + `execute_kw`). Promoted to its OWN dialect 2026-08-27 —
+     * D0's original "JSON-RPC is a thin envelope variant of REST_JSON" was corrected by measuring
+     * the protocol: it is generic like ODATA (no per-binding operation declarations — the model
+     * name IS `entityRef`, and read/list/count map onto `read`/`search_read`/`search_count`
+     * mechanically), but it speaks POSITIONAL arguments, its own domain filter language
+     * (`[['field','=',value], …]` with polish-notation `'|'` disjunction), and authenticates
+     * INSIDE the RPC args (`execute_kw(db, uid, api_key, …)`) rather than via HTTP headers.
+     * Forcing that through REST_JSON's declared-parameter model would have been the
+     * merge-distinct-concepts failure `design-philosophy.md` forbids.
+     *
+     * Structural constraint (schema-enforced): exactly ONE key field with the `INTEGER` codec —
+     * Odoo row ids are integers, always.
+     */
+    HttpApiTransportDialect["ODOO_JSONRPC"] = "odoo-jsonrpc";
+})(HttpApiTransportDialect || (HttpApiTransportDialect = {}));
+//# sourceMappingURL=http-api-transport-dialect.shared.js.map

package/dist/esm/http-api-binding/http-api-transport-dialect.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api-transport-dialect.shared.js","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-transport-dialect.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH;;;;GAIG;AACH,MAAM,CAAN,IAAY,uBAwDX;AAxDD,WAAY,uBAAuB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,0CAAe,CAAA;IAEf;;;;OAIG;IACH,kDAAuB,CAAA;IAEvB;;;;;;;;;;;;;OAaG;IACH,wDAA6B,CAAA;AAC/B,CAAC,EAxDW,uBAAuB,KAAvB,uBAAuB,QAwDlC","sourcesContent":["/**\n * `HttpApiTransportDialect` — how the engine SPEAKS to a system of record.\n *\n * A boundary module, and the reason it is one is a package-contract rule rather than taste.\n *\n * ## Why this is not in `http-api-binding.shared.schemas.ts` any more (#1055, R3)\n *\n * That module is published ONLY through the `@wildo-ai/saas-models/external-data` subpath. The enum\n * is about to be named by the ROOT-exported application-configuration contract (`systemsOfRecord`\n * declares a dialect per instance), and a TypeScript `enum` is NOMINAL: a root-only consumer that\n * cannot name it through a public specifier gets `TS2742`/`TS2883` — \"the inferred type cannot be\n * named without a reference to …/node_modules/…\" — which is\n * `.claude/rules/package-public-entrypoints.md`'s \"root barrel must not DEPEND on a subpath-only\n * surface\", exactly.\n *\n * The rule's prescribed fix is to MOVE THE BOUNDARY, never to re-export across it: adding this module\n * to the subpath barrel as well would be `root-barrel-overlap` (a second door onto one room), which\n * `pnpm check:package-entrypoints` rule 1 refuses. So the enum lives here, the root exports it, the\n * binding schema imports it, and the subpath does NOT re-export it.\n *\n * Three root-reachable modules already cross into that subpath under `entrypoint-closure-waiver`.\n * This is the fourth crossing avoided rather than waived — and it is the one that would have put a\n * nominal enum into the most re-derived contract in the repository.\n *\n * ## What belongs here, and what does not\n *\n * ONLY the closed vocabulary. The per-dialect binding arms, the compilers and the key codecs stay\n * with the binding schema: they are the SHAPE of a declaration, not its name, and nothing\n * root-exported needs to name them.\n *\n * ## The root-only probe, measured 2026-09-15\n *\n * `package-public-entrypoints.md` asks for a measurement rather than a category judgement, so here is\n * the result. A consumer importing ONLY the package root, deriving values from this enum and emitting\n * with `declaration: true`:\n *\n * ```\n * export declare const declaredDialect = HttpApiTransportDialect.ODOO_JSONRPC;\n * export declare function pickDialect(): { dialect: HttpApiTransportDialect };\n * ```\n *\n * Zero errors, and the emitted declaration NAMES the enum through the root specifier rather than\n * reaching into a `node_modules/.../dist/esm/...` path. The same probe run before this module reached\n * the root barrel emitted `dialect: any` and `TS2305` — so the measurement has both halves, and the\n * enum is safe in a root-exported contract.\n */\n\n/**\n * The query dialect the adapter speaks toward the target system. Closed vocabulary (slice 1);\n * SOAP is a possible later member over the same HTTP transport, and a direct-database kind would\n * be a NEW `PersistenceAdapter` member, never a dialect here.\n */\nexport enum HttpApiTransportDialect {\n  /**\n   * OData **v4** — one generic client: mechanical pushdown of\n   * `$filter`/`$select`/`$top`/`$skip`/`$orderby`/`$count`, with a `$metadata` boot-time\n   * verification probe of the committed declaration.\n   *\n   * ⚠ **This member is v4 ONLY, and that excludes SAP's most-used API.** An earlier revision of\n   * this comment named \"SAP S/4HANA, Microsoft Dataverse/Dynamics 365\" here, which is half right\n   * and was load-bearing — it is why nobody looked:\n   *\n   * | Target | Version | Consumable today |\n   * |---|---|---|\n   * | Microsoft Dataverse / Dynamics 365 Web API (`/api/data/v9.2/`) | v4 | ✅ |\n   * | SAP S/4HANA OData **v4** services (`/sap/opu/odata4/…`) | v4 | ✅ |\n   * | SAP `API_BUSINESS_PARTNER` (`/sap/opu/odata/sap/API_BUSINESS_PARTNER`) | **v2** | ❌ |\n   *\n   * v2 is not a v4 variant with a different header. Its collection envelope is\n   * `{ \"d\": { \"results\": [...], \"__next\": …, \"__count\": … } }` rather than\n   * `{ \"value\": [...], \"@odata.nextLink\": … }`; `Edm.DateTime` serializes as `\"/Date(<ticks>)/\"`\n   * rather than ISO 8601; `Edm.Decimal` and `Edm.Int64` serialize as JSON STRINGS rather than\n   * numbers; and JSON must be requested (`$format=json`) because v2 defaults to Atom/XML. So it\n   * changes the envelope, the paging property, the count property AND the value encoding — a\n   * reader written for one cannot read the other, and the mapping layer needs coercions the way\n   * Odoo needs `ODOO_FALSE_AS_NULL`.\n   * spec-cite: OData Version 2.0 JSON Format\n   * (https://www.odata.org/documentation/odata-version-2-0/json-format/) — the `d`/`results`/\n   * `__next`/`__count` envelope, the `/Date(<ticks>)/` DateTime literal, and Edm.Decimal /\n   * Edm.Int64 \"formatted as a JSON string\".\n   *\n   * Supporting v2 is an OPEN decision, not an oversight. Until it lands, point an ODATA binding at\n   * a v4 service: for SAP that means the OData v4 edition of the API where one is published.\n   */\n  ODATA = 'odata',\n\n  /**\n   * Declared per-binding REST/JSON operation mapping (bespoke enterprise APIs). Unlike ODATA\n   * there is no generic client: each binding declares how read/list/count/search map onto\n   * concrete HTTP operations.\n   */\n  REST_JSON = 'rest-json',\n\n  /**\n   * Odoo's external API (`/jsonrpc` + `execute_kw`). Promoted to its OWN dialect 2026-08-27 —\n   * D0's original \"JSON-RPC is a thin envelope variant of REST_JSON\" was corrected by measuring\n   * the protocol: it is generic like ODATA (no per-binding operation declarations — the model\n   * name IS `entityRef`, and read/list/count map onto `read`/`search_read`/`search_count`\n   * mechanically), but it speaks POSITIONAL arguments, its own domain filter language\n   * (`[['field','=',value], …]` with polish-notation `'|'` disjunction), and authenticates\n   * INSIDE the RPC args (`execute_kw(db, uid, api_key, …)`) rather than via HTTP headers.\n   * Forcing that through REST_JSON's declared-parameter model would have been the\n   * merge-distinct-concepts failure `design-philosophy.md` forbids.\n   *\n   * Structural constraint (schema-enforced): exactly ONE key field with the `INTEGER` codec —\n   * Odoo row ids are integers, always.\n   */\n  ODOO_JSONRPC = 'odoo-jsonrpc',\n}\n"]}

package/dist/esm/http-api-binding/read-through-engine-anchors.shared.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The two fields the ENGINE puts on a read-through row, which nothing remote supplies.
+ *
+ * A VIRTUAL resource's schema describes the REMOTE entity: every field in it comes from the target,
+ * and there is no local row to carry anything of ours. But two facts have to travel with each row
+ * anyway, because the engine's own gates read them:
+ *
+ *  - the OWNER organization, which the per-row tenant gate compares against the caller's (#1055 §6);
+ *  - the ORGANIZATION UNIT owning the row's remote PARTITION, which organization-unit narrowing
+ *    filters on (#1058 §3).
+ *
+ * Both are read from the field-identifier map rather than written out, because that is what each
+ * value IS — the row points at an organization and at a unit, so the fields are those resources'
+ * foreign-key spellings. Named here, in one module, because they are written and read in places
+ * that are far apart and must agree: the HTTP_API projector STAMPS them per row, the resource
+ * factory DECLARES them on the schema, and the resources registry names the second one as a
+ * read-through resource's derived `unitFieldName`. A literal in any one of those is a second
+ * declaration of a name the others must match — and the failure is silent, because a narrowing
+ * declaration naming a field the projector does not write confines every caller to nothing.
+ */
+/** The field the engine's per-row tenant gate reads on a projected row. */
+export declare const HTTP_API_TENANT_ANCHOR_FIELD: string;
+/**
+ * The field a READ-THROUGH resource is narrowed on (#1058 R7).
+ *
+ * The same name the resources registry DERIVES as `unitFieldName` for any resource bound to a
+ * partitioned system of record, and the same name the projector stamps.
+ */
+export declare const READ_THROUGH_ORGANIZATION_UNIT_FIELD_NAME: string;
+/**
+ * Both, as the resource factory walks them — the injection, the reserved-name collision check, and
+ * the binding-target refusals all run over this one list.
+ *
+ * A list rather than three separate checks per field, so that a third anchor added tomorrow is
+ * guarded by every rule that guards these two rather than by whichever ones somebody remembers.
+ */
+export declare const HTTP_API_ENGINE_INJECTED_FIELDS: readonly string[];
+//# sourceMappingURL=read-through-engine-anchors.shared.d.ts.map

package/dist/esm/http-api-binding/read-through-engine-anchors.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-through-engine-anchors.shared.d.ts","sourceRoot":"","sources":["../../../../src/http-api-binding/read-through-engine-anchors.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,2EAA2E;AAC3E,eAAO,MAAM,4BAA4B,EAAE,MACyB,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC,EAAE,MACiB,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B,EAAE,SAAS,MAAM,EAG5D,CAAC"}

package/dist/esm/http-api-binding/read-through-engine-anchors.shared.js

@@ -0,0 +1,42 @@
+/**
+ * The two fields the ENGINE puts on a read-through row, which nothing remote supplies.
+ *
+ * A VIRTUAL resource's schema describes the REMOTE entity: every field in it comes from the target,
+ * and there is no local row to carry anything of ours. But two facts have to travel with each row
+ * anyway, because the engine's own gates read them:
+ *
+ *  - the OWNER organization, which the per-row tenant gate compares against the caller's (#1055 §6);
+ *  - the ORGANIZATION UNIT owning the row's remote PARTITION, which organization-unit narrowing
+ *    filters on (#1058 §3).
+ *
+ * Both are read from the field-identifier map rather than written out, because that is what each
+ * value IS — the row points at an organization and at a unit, so the fields are those resources'
+ * foreign-key spellings. Named here, in one module, because they are written and read in places
+ * that are far apart and must agree: the HTTP_API projector STAMPS them per row, the resource
+ * factory DECLARES them on the schema, and the resources registry names the second one as a
+ * read-through resource's derived `unitFieldName`. A literal in any one of those is a second
+ * declaration of a name the others must match — and the failure is silent, because a narrowing
+ * declaration naming a field the projector does not write confines every caller to nothing.
+ */
+import { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
+/** The field the engine's per-row tenant gate reads on a projected row. */
+export const HTTP_API_TENANT_ANCHOR_FIELD = coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS];
+/**
+ * The field a READ-THROUGH resource is narrowed on (#1058 R7).
+ *
+ * The same name the resources registry DERIVES as `unitFieldName` for any resource bound to a
+ * partitioned system of record, and the same name the projector stamps.
+ */
+export const READ_THROUGH_ORGANIZATION_UNIT_FIELD_NAME = coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_UNITS];
+/**
+ * Both, as the resource factory walks them — the injection, the reserved-name collision check, and
+ * the binding-target refusals all run over this one list.
+ *
+ * A list rather than three separate checks per field, so that a third anchor added tomorrow is
+ * guarded by every rule that guards these two rather than by whichever ones somebody remembers.
+ */
+export const HTTP_API_ENGINE_INJECTED_FIELDS = [
+    HTTP_API_TENANT_ANCHOR_FIELD,
+    READ_THROUGH_ORGANIZATION_UNIT_FIELD_NAME,
+];
+//# sourceMappingURL=read-through-engine-anchors.shared.js.map

package/dist/esm/http-api-binding/read-through-engine-anchors.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-through-engine-anchors.shared.js","sourceRoot":"","sources":["../../../../src/http-api-binding/read-through-engine-anchors.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAEtH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,4BAA4B,GACvC,kCAAkC,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yCAAyC,GACpD,kCAAkC,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAsB;IAChE,4BAA4B;IAC5B,yCAAyC;CAC1C,CAAC","sourcesContent":["/**\n * The two fields the ENGINE puts on a read-through row, which nothing remote supplies.\n *\n * A VIRTUAL resource's schema describes the REMOTE entity: every field in it comes from the target,\n * and there is no local row to carry anything of ours. But two facts have to travel with each row\n * anyway, because the engine's own gates read them:\n *\n *  - the OWNER organization, which the per-row tenant gate compares against the caller's (#1055 §6);\n *  - the ORGANIZATION UNIT owning the row's remote PARTITION, which organization-unit narrowing\n *    filters on (#1058 §3).\n *\n * Both are read from the field-identifier map rather than written out, because that is what each\n * value IS — the row points at an organization and at a unit, so the fields are those resources'\n * foreign-key spellings. Named here, in one module, because they are written and read in places\n * that are far apart and must agree: the HTTP_API projector STAMPS them per row, the resource\n * factory DECLARES them on the schema, and the resources registry names the second one as a\n * read-through resource's derived `unitFieldName`. A literal in any one of those is a second\n * declaration of a name the others must match — and the failure is silent, because a narrowing\n * declaration naming a field the projector does not write confines every caller to nothing.\n */\n\nimport { CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\n\n/** The field the engine's per-row tenant gate reads on a projected row. */\nexport const HTTP_API_TENANT_ANCHOR_FIELD: string =\n  coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATIONS];\n\n/**\n * The field a READ-THROUGH resource is narrowed on (#1058 R7).\n *\n * The same name the resources registry DERIVES as `unitFieldName` for any resource bound to a\n * partitioned system of record, and the same name the projector stamps.\n */\nexport const READ_THROUGH_ORGANIZATION_UNIT_FIELD_NAME: string =\n  coreResourceShared_FieldIdentifier[CoreResourceType.ORGANIZATION_UNITS];\n\n/**\n * Both, as the resource factory walks them — the injection, the reserved-name collision check, and\n * the binding-target refusals all run over this one list.\n *\n * A list rather than three separate checks per field, so that a third anchor added tomorrow is\n * guarded by every rule that guards these two rather than by whichever ones somebody remembers.\n */\nexport const HTTP_API_ENGINE_INJECTED_FIELDS: readonly string[] = [\n  HTTP_API_TENANT_ANCHOR_FIELD,\n  READ_THROUGH_ORGANIZATION_UNIT_FIELD_NAME,\n];\n"]}