npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.5 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1032) hide show

package/dist/esm/external-data/external-data-pipeline.shared.schemas.d.ts CHANGED Viewed

@@ -14,7 +14,7 @@
  * these members, and the paper's ledger rows (PR-…) are cited per surface.
  */
 import { z } from 'zod';
-import { HttpApiTenancyStance, HttpApiTransportDialect } from '../http-api-binding/http-api-binding.shared.schemas';
+import { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';
 /**
  * Pipeline direction (PR-19). A SINGLE-member enum on purpose: reverse ETL (local→remote) and
  * bidirectional sync belong to the outbound-writes gate (ETL plan Step 5, concurrency contract),
@@ -115,13 +115,8 @@ export type ExternalDataFieldMappingEntry = z.infer<typeof ExternalDataFieldMapp
 export declare const ExternalDataPipelineDeclarationSchema: z.ZodObject<{
     direction: z.ZodDefault<z.ZodEnum<typeof ExternalDataPipelineDirection>>;
     binding: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        verifyMetadataAtBoot: z.ZodDefault<z.ZodBoolean>;
-        providerRef: z.ZodString;
+        system: z.ZodString;
         entityRef: z.ZodString;
-        connection: z.ZodDefault<z.ZodObject<{
-            ownerScope: z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ExternalProvider_Connection_OwnerScope>;
-            delegation: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ExternalProvider_Connection_DelegationMode>>;
-        }, z.core.$strip>>;
         keyFields: z.ZodArray<z.ZodObject<{
             localField: z.ZodString;
             remoteField: z.ZodString;
@@ -131,13 +126,6 @@ export declare const ExternalDataPipelineDeclarationSchema: z.ZodObject<{
             localField: z.ZodString;
             remoteField: z.ZodString;
         }, z.core.$strip>>>;
-        tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
-            stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
-            remoteScopeField: z.ZodString;
-        }, z.core.$strip>, z.ZodObject<{
-            stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
-            justification: z.ZodString;
-        }, z.core.$strip>], "stance">;
         erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
             stance: z.ZodLiteral<import("../external-data.exports").HttpApiErasureStance.NO_SUBJECT_DATA>;
         }, z.core.$strip>, z.ZodObject<{
@@ -164,11 +152,12 @@ export declare const ExternalDataPipelineDeclarationSchema: z.ZodObject<{
             }, z.core.$strip>>;
             maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
             maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+            maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
         dialect: z.ZodLiteral<HttpApiTransportDialect.ODATA>;
     }, z.core.$strip>, z.ZodObject<{
         operations: z.ZodObject<{
-            read: z.ZodUnion<readonly [z.ZodObject<{
+            read: z.ZodObject<{
                 method: z.ZodEnum<typeof import("../external-data.exports").HttpApiRestOperationMethod>;
                 pathTemplate: z.ZodString;
                 pagingParams: z.ZodOptional<z.ZodObject<{
@@ -181,14 +170,15 @@ export declare const ExternalDataPipelineDeclarationSchema: z.ZodObject<{
                 jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                     rpcMethod: z.ZodString;
                 }, z.core.$strip>>;
-            }, z.core.$strip>, z.ZodObject<{
-                providerOperationId: z.ZodString;
-                domain: z.ZodOptional<z.ZodString>;
-                keyParameter: z.ZodOptional<z.ZodString>;
-                filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-                searchParam: z.ZodOptional<z.ZodString>;
-            }, z.core.$strict>]>;
-            list: z.ZodUnion<readonly [z.ZodObject<{
+                statement: z.ZodOptional<z.ZodObject<{
+                    language: z.ZodEnum<typeof import("../external-data.exports").HttpApiQueryStatementLanguage>;
+                    parameterName: z.ZodString;
+                    fromEntity: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+                cursorPath: z.ZodOptional<z.ZodString>;
+                staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strip>;
+            list: z.ZodObject<{
                 method: z.ZodEnum<typeof import("../external-data.exports").HttpApiRestOperationMethod>;
                 pathTemplate: z.ZodString;
                 pagingParams: z.ZodOptional<z.ZodObject<{
@@ -201,14 +191,15 @@ export declare const ExternalDataPipelineDeclarationSchema: z.ZodObject<{
                 jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                     rpcMethod: z.ZodString;
                 }, z.core.$strip>>;
-            }, z.core.$strip>, z.ZodObject<{
-                providerOperationId: z.ZodString;
-                domain: z.ZodOptional<z.ZodString>;
-                keyParameter: z.ZodOptional<z.ZodString>;
-                filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-                searchParam: z.ZodOptional<z.ZodString>;
-            }, z.core.$strict>]>;
-            count: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                statement: z.ZodOptional<z.ZodObject<{
+                    language: z.ZodEnum<typeof import("../external-data.exports").HttpApiQueryStatementLanguage>;
+                    parameterName: z.ZodString;
+                    fromEntity: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+                cursorPath: z.ZodOptional<z.ZodString>;
+                staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strip>;
+            count: z.ZodOptional<z.ZodObject<{
                 method: z.ZodEnum<typeof import("../external-data.exports").HttpApiRestOperationMethod>;
                 pathTemplate: z.ZodString;
                 pagingParams: z.ZodOptional<z.ZodObject<{
@@ -221,14 +212,15 @@ export declare const ExternalDataPipelineDeclarationSchema: z.ZodObject<{
                 jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                     rpcMethod: z.ZodString;
                 }, z.core.$strip>>;
-            }, z.core.$strip>, z.ZodObject<{
-                providerOperationId: z.ZodString;
-                domain: z.ZodOptional<z.ZodString>;
-                keyParameter: z.ZodOptional<z.ZodString>;
-                filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-                searchParam: z.ZodOptional<z.ZodString>;
-            }, z.core.$strict>]>>;
-            search: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                statement: z.ZodOptional<z.ZodObject<{
+                    language: z.ZodEnum<typeof import("../external-data.exports").HttpApiQueryStatementLanguage>;
+                    parameterName: z.ZodString;
+                    fromEntity: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+                cursorPath: z.ZodOptional<z.ZodString>;
+                staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strip>>;
+            search: z.ZodOptional<z.ZodObject<{
                 method: z.ZodEnum<typeof import("../external-data.exports").HttpApiRestOperationMethod>;
                 pathTemplate: z.ZodString;
                 pagingParams: z.ZodOptional<z.ZodObject<{
@@ -241,20 +233,17 @@ export declare const ExternalDataPipelineDeclarationSchema: z.ZodObject<{
                 jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                     rpcMethod: z.ZodString;
                 }, z.core.$strip>>;
-            }, z.core.$strip>, z.ZodObject<{
-                providerOperationId: z.ZodString;
-                domain: z.ZodOptional<z.ZodString>;
-                keyParameter: z.ZodOptional<z.ZodString>;
-                filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-                searchParam: z.ZodOptional<z.ZodString>;
-            }, z.core.$strict>]>>;
+                statement: z.ZodOptional<z.ZodObject<{
+                    language: z.ZodEnum<typeof import("../external-data.exports").HttpApiQueryStatementLanguage>;
+                    parameterName: z.ZodString;
+                    fromEntity: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+                cursorPath: z.ZodOptional<z.ZodString>;
+                staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strip>>;
         }, z.core.$strip>;
-        providerRef: z.ZodString;
+        system: z.ZodString;
         entityRef: z.ZodString;
-        connection: z.ZodDefault<z.ZodObject<{
-            ownerScope: z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ExternalProvider_Connection_OwnerScope>;
-            delegation: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ExternalProvider_Connection_DelegationMode>>;
-        }, z.core.$strip>>;
         keyFields: z.ZodArray<z.ZodObject<{
             localField: z.ZodString;
             remoteField: z.ZodString;
@@ -264,13 +253,6 @@ export declare const ExternalDataPipelineDeclarationSchema: z.ZodObject<{
             localField: z.ZodString;
             remoteField: z.ZodString;
         }, z.core.$strip>>>;
-        tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
-            stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
-            remoteScopeField: z.ZodString;
-        }, z.core.$strip>, z.ZodObject<{
-            stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
-            justification: z.ZodString;
-        }, z.core.$strip>], "stance">;
         erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
             stance: z.ZodLiteral<import("../external-data.exports").HttpApiErasureStance.NO_SUBJECT_DATA>;
         }, z.core.$strip>, z.ZodObject<{
@@ -297,15 +279,12 @@ export declare const ExternalDataPipelineDeclarationSchema: z.ZodObject<{
             }, z.core.$strip>>;
             maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
             maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+            maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
         dialect: z.ZodLiteral<HttpApiTransportDialect.REST_JSON>;
     }, z.core.$strip>, z.ZodObject<{
-        providerRef: z.ZodString;
+        system: z.ZodString;
         entityRef: z.ZodString;
-        connection: z.ZodDefault<z.ZodObject<{
-            ownerScope: z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ExternalProvider_Connection_OwnerScope>;
-            delegation: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/external-connectors-models").ExternalProvider_Connection_DelegationMode>>;
-        }, z.core.$strip>>;
         keyFields: z.ZodArray<z.ZodObject<{
             localField: z.ZodString;
             remoteField: z.ZodString;
@@ -315,13 +294,6 @@ export declare const ExternalDataPipelineDeclarationSchema: z.ZodObject<{
             localField: z.ZodString;
             remoteField: z.ZodString;
         }, z.core.$strip>>>;
-        tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
-            stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
-            remoteScopeField: z.ZodString;
-        }, z.core.$strip>, z.ZodObject<{
-            stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
-            justification: z.ZodString;
-        }, z.core.$strip>], "stance">;
         erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
             stance: z.ZodLiteral<import("../external-data.exports").HttpApiErasureStance.NO_SUBJECT_DATA>;
         }, z.core.$strip>, z.ZodObject<{
@@ -348,10 +320,13 @@ export declare const ExternalDataPipelineDeclarationSchema: z.ZodObject<{
             }, z.core.$strip>>;
             maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
             maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+            maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
         dialect: z.ZodLiteral<HttpApiTransportDialect.ODOO_JSONRPC>;
     }, z.core.$strip>], "dialect">;
     remoteKeyLocalField: z.ZodString;
+    partitionUnitLocalField: z.ZodOptional<z.ZodString>;
+    partitionKeyLocalField: z.ZodOptional<z.ZodString>;
     mapping: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<ExternalDataMappingEntryKind.REMOTE_FIELD>;
         remoteField: z.ZodString;
@@ -377,9 +352,9 @@ export type ExternalDataPipelineDeclaration = z.infer<typeof ExternalDataPipelin
  * are guaranteed present.
  *
  * The distinction is not cosmetic, and the first dogfood proved it: typing the resource-config
- * field with the PARSED shape forced an author to spell out `verifyMetadataAtBoot`,
- * `connection`, and a `coercion` + `required` on every mapping entry — values the schema exists
- * to supply. `DataSeedDefinitionAuthored` records the identical lesson for seeds ("authors may omit
+ * field with the PARSED shape forced an author to spell out a `coercion` + `required` on every
+ * mapping entry, and the two binding defaults that existed at the time (`verifyMetadataAtBoot` and
+ * `connection`, both since removed by #1055) — values the schema exists to supply. `DataSeedDefinitionAuthored` records the identical lesson for seeds ("authors may omit
  * this field and the dispatcher still reads a guaranteed `string[]`"); this is the same split, and
  * it was missed here because nothing had authored a pipeline by hand yet.
  */

package/dist/esm/external-data/external-data-pipeline.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"external-data-pipeline.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/external-data/external-data-pipeline.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;~~AAExB~~,OAAO,~~EAEL~~,~~oBAAoB,EACpB,~~uBAAuB,~~EACxB~~,MAAM,~~qDAAqD~~,CAAC;~~AAE7D~~;;;;;GAKG;AACH,kHAAkH;AAClH,oBAAY,6BAA6B;IACvC,OAAO,YAAY;CACpB;AAED;;;;;;GAMG;AACH,oBAAY,iCAAiC;IAC3C;;;;OAIG;IACH,MAAM,WAAW;IACjB;;;;;OAKG;IACH,IAAI,SAAS;CACd;AAED;;;;;;;;;GASG;AACH,oBAAY,wBAAwB;IAClC,uGAAuG;IACvG,MAAM,WAAW;IACjB,mGAAmG;IACnG,SAAS,cAAc;IACvB,uFAAuF;IACvF,MAAM,WAAW;CAClB;AAED,kGAAkG;AAClG,oBAAY,4BAA4B;IACtC,+DAA+D;IAC/D,YAAY,iBAAiB;IAC7B,yGAAyG;IACzG,QAAQ,aAAa;CACtB;AAED;;;;GAIG;AACH,oBAAY,yBAAyB;IACnC,+EAA+E;IAC/E,IAAI,SAAS;IACb;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC,mFAAmF;IACnF,kBAAkB,uBAAuB;CAC1C;AAED,+FAA+F;AAC/F,eAAO,MAAM,mCAAmC;;;;;;;;;;2BAkB9C,CAAC;AAEH,gEAAgE;AAChE,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAKhG;;;;;;;GAOG;AACH,kHAAkH;AAClH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoDhD,CAAC;AAEH,gEAAgE;AAChE,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAE5G;;;;GAIG;AACH,wBAAgB,8CAA8C,CAAC,WAAW,EAAE,+BAA+B,GAAG,IAAI,~~CAyCjH~~"}
1	+ {"version":3,"file":"external-data-pipeline.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-data/external-data-pipeline.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAEhG;;;;;GAKG;AACH,kHAAkH;AAClH,oBAAY,6BAA6B;IACvC,OAAO,YAAY;CACpB;AAED;;;;;;GAMG;AACH,oBAAY,iCAAiC;IAC3C;;;;OAIG;IACH,MAAM,WAAW;IACjB;;;;;OAKG;IACH,IAAI,SAAS;CACd;AAED;;;;;;;;;GASG;AACH,oBAAY,wBAAwB;IAClC,uGAAuG;IACvG,MAAM,WAAW;IACjB,mGAAmG;IACnG,SAAS,cAAc;IACvB,uFAAuF;IACvF,MAAM,WAAW;CAClB;AAED,kGAAkG;AAClG,oBAAY,4BAA4B;IACtC,+DAA+D;IAC/D,YAAY,iBAAiB;IAC7B,yGAAyG;IACzG,QAAQ,aAAa;CACtB;AAED;;;;GAIG;AACH,oBAAY,yBAAyB;IACnC,+EAA+E;IAC/E,IAAI,SAAS;IACb;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC,mFAAmF;IACnF,kBAAkB,uBAAuB;CAC1C;AAED,+FAA+F;AAC/F,eAAO,MAAM,mCAAmC;;;;;;;;;;2BAkB9C,CAAC;AAEH,gEAAgE;AAChE,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAKhG;;;;;;;GAOG;AACH,kHAAkH;AAClH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2FhD,CAAC;AAEH,gEAAgE;AAChE,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAE5G;;;;GAIG;AACH,wBAAgB,8CAA8C,CAAC,WAAW,EAAE,+BAA+B,GAAG,IAAI,CA0GjH"}

package/dist/esm/external-data/external-data-pipeline.shared.schemas.js CHANGED Viewed

@@ -14,7 +14,8 @@
  * these members, and the paper's ledger rows (PR-…) are cited per surface.
  */
 import { z } from 'zod';
-import { HttpApiResourceBindingSchema, HttpApiTenancyStance, HttpApiTransportDialect, } from '../http-api-binding/http-api-binding.shared.schemas.js';
+import { HttpApiResourceBindingSchema } from '../http-api-binding/http-api-binding.shared.schemas.js';
+import { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared.js';
 /**
  * Pipeline direction (PR-19). A SINGLE-member enum on purpose: reverse ETL (local→remote) and
  * bidirectional sync belong to the outbound-writes gate (ETL plan Step 5, concurrency contract),
@@ -128,10 +129,14 @@ const externalDataPipelineFilterScalarSchema = z.union([z.string(), z.number(),
 export const ExternalDataPipelineDeclarationSchema = z.object({
     direction: z.enum(ExternalDataPipelineDirection).default(ExternalDataPipelineDirection.INBOUND),
     /**
-     * The source half — the SAME binding declaration the VIRTUAL mode uses (provider, entity,
-     * dialect, key fields + codecs, remote-call semantics, erasure stance, tenancy). Slice 1
-     * confines pipelines to SINGLE_TENANT_BINDING sources (W-TENANCY records the widening — a
-     * wrong remote-scope→org mapping is a cross-tenant leak, so it is designed, not improvised).
+     * The source half — the SAME binding declaration the VIRTUAL mode uses (the system of record it
+     * reads, entity, dialect, key fields + codecs, remote-call semantics, erasure stance).
+     *
+     * Every source is a SYSTEM OF RECORD: a deployment the OPERATOR runs, read with the application's
+     * own service identity, with ONE owner organization. There is no per-tenant variant to confine
+     * (that was `tenancy`, removed in #1055 — a customer's own connected account is a CONNECTOR, a
+     * different thing that no binding names), so a pipeline extracts the operator's rows and the
+     * destination's own scope declaration decides who may then read them.
      *
      * ⚠ OPERATIONAL HAZARD (PR-16): changing `keyFields` or a component CODEC after rows exist
      * re-keys EVERY business key — the whole destination population orphans and re-creates on the
@@ -149,6 +154,40 @@ export const ExternalDataPipelineDeclarationSchema = z.object({
      * move it.
      */
     remoteKeyLocalField: z.string().trim().min(1),
+    /**
+     * Where a row's remote PARTITION lands, when the source instance is partitioned (#1058 E4).
+     *
+     * Declared TOGETHER or not at all, and only for a partitioned source. The resources registry —
+     * which is the first place the pipeline declaration and the systems-of-record registry are both
+     * in scope — refuses a partitioned source that declares neither, and refuses either field on an
+     * unpartitioned one.
+     *
+     * ## Why TWO fields rather than one
+     *
+     * They hold different things, and collapsing them is the mistake #1058 R5 was written to record.
+     *
+     * `partitionUnitLocalField` carries the Wildo ORGANIZATION UNIT that owns the row's partition. It
+     * is what organization-unit narrowing filters on, so it is what confines a member of one
+     * subsidiary to their own company's rows. Declare the destination narrowable on this field.
+     *
+     * `partitionKeyLocalField` carries the REMOTE key verbatim — Odoo's `company_id`, NetSuite's
+     * `subsidiary`. It exists because the unit id CANNOT answer the question the orphan walk asks.
+     * When an operator unassigns a partition, the unit still exists and other rows still point at it;
+     * only the partition→unit edge is gone. A row loaded before the unassignment therefore still
+     * carries a perfectly valid unit id, and nothing about it says "this row's partition is no longer
+     * mapped". Without the remote key stored per row, the next pass sees those rows absent from the
+     * extraction and an orphan policy of DELETE erases them — an operator's unassignment becoming a
+     * mass delete.
+     *
+     * Both are ENGINE-WRITTEN: the transform stamps them from the assignment map, so a mapping entry
+     * targeting either is refused, as is a caller write (the factory requires both
+     * `.excludeFromCreate()` and `.excludeFromUpdate()`).
+     *
+     * Both must ACCEPT ABSENCE. A row whose partition field is unset is SHARED (E2 — an Odoo product
+     * belonging to no company); it belongs to every caller and to no unit, and both fields land null.
+     */
+    partitionUnitLocalField: z.string().trim().min(1).optional(),
+    partitionKeyLocalField: z.string().trim().min(1).optional(),
     /** The declared T — at least one entry; targets validated against `mainSchema` by the factory. */
     mapping: z.array(ExternalDataFieldMappingEntrySchema).min(1),
     /**
@@ -176,10 +215,16 @@ export const ExternalDataPipelineDeclarationSchema = z.object({
  * mirroring `assertHttpApiBindingDialectCoherence`'s contract.
  */
 export function assertExternalDataPipelineDeclarationCoherence(declaration) {
-    // S1 tenancy confinement (v3.1 §2 / W-TENANCY).
-    if (declaration.binding.tenancy.stance !== HttpApiTenancyStance.SINGLE_TENANT_BINDING) {
-        throw new Error("binding.tenancy: slice 1 confines pipelines to SINGLE_TENANT_BINDING sources — a pushdown-tenancy source needs the declared remote-scope→organization mapping (widening W-TENANCY), because a wrong org assignment is a cross-tenant leak.");
-    }
+    /*
+     * The S1 tenancy confinement was REMOVED here with `tenancy` itself (#1055).
+     *
+     * It refused any source that was not `SINGLE_TENANT_BINDING`, because a pushdown-tenancy source
+     * would have needed a declared remote-scope→organization mapping and a wrong assignment is a
+     * cross-tenant leak. That reasoning is intact; what changed is that the state it refused can no
+     * longer be declared. A pipeline's source is a system of record, a system of record has one owner
+     * organization, and the rows a LOAD writes are stamped with it (#868) rather than mapped from a
+     * remote scope field.
+     */
     // D-P10: extraction uses drift-safe paging ONLY (`@odata.nextLink` / the Odoo id-keyset
     // cursor). REST_JSON declares offset paging, which skips or doubles rows whenever the remote
     // set shifts mid-run — so a REST_JSON pipeline SOURCE is refused until a declared cursor
@@ -196,11 +241,60 @@ export function assertExternalDataPipelineDeclarationCoherence(declaration) {
         if (entry.localField === declaration.remoteKeyLocalField) {
             throw new Error(`mapping: local field '${entry.localField}' is the remoteKeyLocalField — the remote identity is written by the pipeline's L from the synthesized id, never by a mapping entry.`);
         }
+        /*
+         * Same rule, one field over (#1058 E4): both partition fields are ENGINE-written, stamped by the
+         * transform from the assignment map. A mapping entry targeting one would be the second writer of
+         * a field whose value decides who may see the row — and, because the stamp runs after the
+         * mapping, an INERT one. An authoring mistake that silently does nothing is worse than one that
+         * fails: the author reads a declaration that looks like it decides the unit, and no run ever
+         * disagrees with them.
+         */
+        for (const [label, partitionField] of [
+            ['partitionUnitLocalField', declaration.partitionUnitLocalField],
+            ['partitionKeyLocalField', declaration.partitionKeyLocalField],
+        ]) {
+            if (partitionField !== undefined && entry.localField === partitionField) {
+                throw new Error(`mapping: local field '${entry.localField}' is the ${label} — the partition stamp is written by the pipeline's T from the assignment map, never by a mapping entry.`);
+            }
+        }
         if (entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD
             && entry.coercion === ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL
             && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC) {
             throw new Error(`mapping('${entry.localField}').coercion: '${ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL}' names Odoo's absent-as-false semantics and is refused on a ${declaration.binding.dialect} source.`);
         }
     }
+    /*
+     * TOGETHER or not at all (#1058 E4).
+     *
+     * Declaring only the unit field loses the orphan walk's protection — a row whose partition is
+     * later unassigned still carries a valid unit id, nothing says the edge is gone, and a DELETE
+     * orphan policy erases it. Declaring only the key field loses the confinement: the rows carry
+     * their remote partition and no unit, so narrowing has nothing to filter on and every member of
+     * the owner organization reads every subsidiary's rows. Neither half is useful alone, and both
+     * failures are silent.
+     */
+    const declaredPartitionFields = [
+        ['partitionUnitLocalField', declaration.partitionUnitLocalField],
+        ['partitionKeyLocalField', declaration.partitionKeyLocalField],
+    ].filter(([, value]) => value !== undefined);
+    if (declaredPartitionFields.length === 1) {
+        const [declaredLabel] = declaredPartitionFields[0];
+        const missingLabel = declaredLabel === 'partitionUnitLocalField' ? 'partitionKeyLocalField' : 'partitionUnitLocalField';
+        throw new Error(`${declaredLabel} is declared without ${missingLabel} — the two partition fields answer different questions and neither is useful alone. `
+            + 'The unit is what narrowing confines a caller by; the remote key is what keeps an unassigned partition out of the orphan comparison, '
+            + 'because after an unassignment the unit id still resolves and says nothing.');
+    }
+    if (declaration.partitionUnitLocalField !== undefined
+        && declaration.partitionUnitLocalField === declaration.partitionKeyLocalField) {
+        throw new Error('partitionUnitLocalField and partitionKeyLocalField name the same field — one would overwrite the other, and which survived would decide either who sees the row or whether it is deleted.');
+    }
+    for (const [label, partitionField] of [
+        ['partitionUnitLocalField', declaration.partitionUnitLocalField],
+        ['partitionKeyLocalField', declaration.partitionKeyLocalField],
+    ]) {
+        if (partitionField !== undefined && partitionField === declaration.remoteKeyLocalField) {
+            throw new Error(`${label} names the remoteKeyLocalField — the row's IDENTITY and its PARTITION are different facts, and sharing a field would make the business key change when a row moves company.`);
+        }
+    }
 }
 //# sourceMappingURL=external-data-pipeline.shared.schemas.js.map

package/dist/esm/external-data/external-data-pipeline.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"external-data-pipeline.shared.schemas.js","sourceRoot":"","sources":["../../../src/external-data/external-data-pipeline.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,qDAAqD,CAAC;AAE7D;;;;;GAKG;AACH,kHAAkH;AAClH,MAAM,CAAN,IAAY,6BAEX;AAFD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;AACrB,CAAC,EAFW,6BAA6B,KAA7B,6BAA6B,QAExC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAcX;AAdD,WAAY,iCAAiC;IAC3C;;;;OAIG;IACH,sDAAiB,CAAA;IACjB;;;;;OAKG;IACH,kDAAa,CAAA;AACf,CAAC,EAdW,iCAAiC,KAAjC,iCAAiC,QAc5C;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,uGAAuG;IACvG,6CAAiB,CAAA;IACjB,mGAAmG;IACnG,mDAAuB,CAAA;IACvB,uFAAuF;IACvF,6CAAiB,CAAA;AACnB,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,kGAAkG;AAClG,MAAM,CAAN,IAAY,4BAKX;AALD,WAAY,4BAA4B;IACtC,+DAA+D;IAC/D,6DAA6B,CAAA;IAC7B,yGAAyG;IACzG,qDAAqB,CAAA;AACvB,CAAC,EALW,4BAA4B,KAA5B,4BAA4B,QAKvC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,yBAWX;AAXD,WAAY,yBAAyB;IACnC,+EAA+E;IAC/E,0CAAa,CAAA;IACb;;;;OAIG;IACH,sEAAyC,CAAA;IACzC,mFAAmF;IACnF,sEAAyC,CAAA;AAC3C,CAAC,EAXW,yBAAyB,KAAzB,yBAAyB,QAWpC;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,YAAY,CAAC;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC;QACnF;;;;WAIG;QACH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,QAAQ,CAAC;QACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KACzD,CAAC;CACH,CAAC,CAAC;AAKH,iGAAiG;AACjG,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAE9F;;;;;;;GAOG;AACH,kHAAkH;AAClH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAE/F;;;;;;;;;;;;;OAaG;IACH,OAAO,EAAE,4BAA4B;IAErC;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7C,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5D;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAC,QAAQ,EAAE;IAEnG,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,MAAM,CAAC;IAEvG,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC;IAEvF;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CAC3D,CAAC,CAAC;AAmBH;;;;GAIG;AACH,MAAM,UAAU,8CAA8C,CAAC,WAA4C;IACzG,gDAAgD;IAChD,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,qBAAqB,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CACb,4OAA4O,CAC7O,CAAC;IACJ,CAAC;IAED,wFAAwF;IACxF,6FAA6F;IAC7F,yFAAyF;IACzF,8FAA8F;IAC9F,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,wTAAwT,CACzT,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,UAAU,8DAA8D,CAAC,CAAC;QAC3H,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEnC,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,CAAC,UAAU,sIAAsI,CAChL,CAAC;QACJ,CAAC;QAED,IACE,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,YAAY;eACrD,KAAK,CAAC,QAAQ,KAAK,yBAAyB,CAAC,kBAAkB;eAC/D,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EACvE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,YAAY,KAAK,CAAC,UAAU,iBAAiB,yBAAyB,CAAC,kBAAkB,gEAAgE,WAAW,CAAC,OAAO,CAAC,OAAO,UAAU,CAC/L,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/*\n The ETL PIPELINE declaration (`externalDataPipeline`) — partial-resource coverage, model v3\n * (`.claude/plans/etl-partial-resource-coverage.md`, PR-3/PR-19; decisions D-P1…D-P10).\n \n \"Some resources local, some remote, ETL between them\": an ordinary LOCAL resource may declare\n * ONE inbound pipeline from a remote HTTP-API entity. The declaration reuses the whole\n * {@link HttpApiResourceBindingSchema} as its source half (provider, entity, dialect, key\n * fields, remote-call semantics — the E is the same adapter plumbing the VIRTUAL mode runs on),\n * adds the T (a declared field mapping) and the L/refresh contract (population posture, orphan\n * policy, schedule, run bounds). The destination stays a FULL local resource — files, RAG,\n * retention/erasure, charts and the read-only UI chain are all inherited, never re-built.\n \n Everything here is a CLOSED vocabulary with one named source; the runtime seams (P-2) consume\n * these members, and the paper's ledger rows (PR-…) are cited per surface.\n /\n\nimport { z } from 'zod';\n\nimport {\n HttpApiResourceBindingSchema,\n HttpApiTenancyStance,\n HttpApiTransportDialect,\n} from '../http-api-binding/http-api-binding.shared.schemas';\n\n/\n Pipeline direction (PR-19). A SINGLE-member enum on purpose: reverse ETL (local→remote) and\n * bidirectional sync belong to the outbound-writes gate (ETL plan Step 5, concurrency contract),\n * but the DECLARATION is direction-extensible NOW so those arrive as new members instead of a\n * schema reshape — the immutability-needs-a-paired-path lesson applied to a vocabulary.\n /\n/* @wildo_source:part:start saas.models.external-data-pipeline facet:layer:shared facet:audience:app-developer /\nexport enum ExternalDataPipelineDirection {\n INBOUND = 'inbound',\n}\n\n/\n Who owns the destination's row population (D-P8, v3.1 §1).\n \n The declared answer to the question the orphan sweep MUST have: \"is a row the pipeline did not\n * create a USER row, or a VANISHED remote row?\" — undeclared mixed populations are how an orphan\n * pass deletes user data.\n /\nexport enum ExternalDataDestinationPopulation {\n /\n Every row comes from the pipeline. Caller CREATE is refused at declaration time, and orphan\n * detection may consider the whole population. The default: safest, and the honest description\n * of a synced master-data table.\n /\n CLOSED = 'closed',\n /\n Mixed rows: users may create rows the pipeline does not own. Pipeline rows are identified by\n * the remote-key field being present, and orphan detection is CONFINED to that population. A\n * user row that later matches an incoming remote key is ADOPTED by the upsert (documented\n * collision semantics, not an accident).\n /\n OPEN = 'open',\n}\n\n/\n What happens to a destination row whose remote counterpart disappeared (D-P9).\n \n MIRRORS `DataSeedSyncOrphanPolicy` (saas-backend-lib, data-seeding) member-for-member, and the\n * P-2 pipeline→SYNC seam maps the two 1:1. A separate enum EXISTS ONLY because of dependency\n * direction: this declaration lives in saas-models, the data-seeding models live in\n * saas-backend-lib, and models cannot import backend. If the data-seeding vocabulary ever moves\n * down to saas-models, collapse this enum into it — do not let the two drift meanwhile (the\n * seam's mapping is exhaustive and compile-forced, so a new member on either side reddens P-2).\n /\nexport enum ExternalDataOrphanPolicy {\n /* Hard-delete the orphan row — flows through ordinary lifecycle (cascades, file teardown). Opt-in. /\n DELETE = 'delete',\n /* Mark the row deprecated and keep it; a re-appearing remote key REVIVES it (v3.1 §4). Opt-in. /\n DEPRECATE = 'deprecate',\n /* Touch nothing; surface the diff in the run ledger. The DEFAULT — least surprise. /\n REPORT = 'report',\n}\n\n/* The two shapes a mapping entry can take — a closed discriminator, never inferred from keys. /\nexport enum ExternalDataMappingEntryKind {\n /* Copy (and coerce) one remote field into one local field. /\n REMOTE_FIELD = 'remote-field',\n /* Fill one local field with a declared constant (destination-required fields with no remote source). /\n CONSTANT = 'constant',\n}\n\n/\n Built-in, closed coercion vocabulary for REMOTE_FIELD entries (v3.1 §3 / PR-8). Slice 1 ships\n * exactly the coercions the two generic dialects force; arbitrary transforms are the recorded\n * widenings (W-FK resolution, W-AGENT authored transforms) — never an open function slot here.\n /\nexport enum ExternalDataFieldCoercion {\n /* Value lands as extracted (after the destination schema's own Zod parse). /\n NONE = 'none',\n /\n Odoo spells an ABSENT value as boolean `false` — a mapped string field would otherwise store\n * literal `false`. Applied by DEFAULT for ODOO_JSONRPC sources; declaring it on another dialect\n * is refused (the name is Odoo's semantics, not a generic null-coalesce).\n /\n ODOO_FALSE_AS_NULL = 'odoo-false-as-null',\n /* Parse a strict-ISO datetime string into a Date for a date-typed local field. /\n ISO_STRING_TO_DATE = 'iso-string-to-date',\n}\n\n/* One declared T-step: remote field → local field with a built-in coercion, or a constant. /\nexport const ExternalDataFieldMappingEntrySchema = z.discriminatedUnion('kind', [\n z.object({\n kind: z.literal(ExternalDataMappingEntryKind.REMOTE_FIELD),\n remoteField: z.string().trim().min(1),\n localField: z.string().trim().min(1),\n coercion: z.enum(ExternalDataFieldCoercion).default(ExternalDataFieldCoercion.NONE),\n /\n `true`: a row whose extracted value is ABSENT is REJECTED (reported per row in the run\n * ledger; its previous local version survives). `false` (default): absent lands as null,\n * which the declaration coherence requires the local field to accept.\n /\n required: z.boolean().default(false),\n }),\n z.object({\n kind: z.literal(ExternalDataMappingEntryKind.CONSTANT),\n localField: z.string().trim().min(1),\n constant: z.union([z.string(), z.number(), z.boolean()]),\n }),\n]);\n\n/* @wildo_source:part:end saas.models.external-data-pipeline /\nexport type ExternalDataFieldMappingEntry = z.infer<typeof ExternalDataFieldMappingEntrySchema>;\n\n/* Scalar values admissible in the declared source filter (T-set equality conjunctions only). /\nconst externalDataPipelineFilterScalarSchema = z.union([z.string(), z.number(), z.boolean()]);\n\n/\n The inbound pipeline declaration an ordinary LOCAL resource carries as `externalDataPipeline`.\n \n NOT legal on an HTTP_API-adapter resource (a virtual resource IS the remote side); the\n * resource-configuration factory enforces that plus every mainSchema-dependent coherence rule —\n * see `validateExternalDataPipelineDeclarationAgainstSchema` there. This module owns only the\n * schema-independent shape and coherence.\n /\n/* @wildo_source:part:start saas.models.external-data-pipeline facet:layer:shared facet:audience:app-developer /\nexport const ExternalDataPipelineDeclarationSchema = z.object({\n direction: z.enum(ExternalDataPipelineDirection).default(ExternalDataPipelineDirection.INBOUND),\n\n /\n The source half — the SAME binding declaration the VIRTUAL mode uses (provider, entity,\n * dialect, key fields + codecs, remote-call semantics, erasure stance, tenancy). Slice 1\n * confines pipelines to SINGLE_TENANT_BINDING sources (W-TENANCY records the widening — a\n * wrong remote-scope→org mapping is a cross-tenant leak, so it is designed, not improvised).\n \n ⚠ OPERATIONAL HAZARD (PR-16): changing `keyFields` or a component CODEC after rows exist\n * re-keys EVERY business key — the whole destination population orphans and re-creates on the\n * next full pass, detaching local annotations (extension fields, files, chunks) from the rows\n * that replace them. Treat a key/codec change as a MIGRATION EVENT, never a config tweak. Not\n * mechanically detectable at authoring (no row access here). Relatedly: a remote system that\n * RECYCLES ids hands the recycled row the OLD row's local annotations — the upsert cannot tell\n * a revived entity from a new one wearing its key.\n /\n binding: HttpApiResourceBindingSchema,\n\n /\n The LOCAL field holding the row's remote identity — the synthesized id (paper A codec) as a\n * plain STRING business key. The factory requires it declared `.isBusinessKey()` +\n * `excludeFromCreate/Update`: SYNC's idempotent upsert keys on it, and no caller may mint or\n * move it.\n /\n remoteKeyLocalField: z.string().trim().min(1),\n\n /* The declared T — at least one entry; targets validated against `mainSchema` by the factory. /\n mapping: z.array(ExternalDataFieldMappingEntrySchema).min(1),\n\n /\n Optional remote-side subset (v3.1 §2): equality conjunctions over REMOTE fields, exactly the\n * T-set's T3 shape — anything richer is a widening, not an improvisation.\n /\n sourceFilter: z.record(z.string().trim().min(1), externalDataPipelineFilterScalarSchema).optional(),\n\n population: z.enum(ExternalDataDestinationPopulation).default(ExternalDataDestinationPopulation.CLOSED),\n\n orphanPolicy: z.enum(ExternalDataOrphanPolicy).default(ExternalDataOrphanPolicy.REPORT),\n\n /\n Cron expression for the scheduled refresh (crontabs machinery). Absent = on-demand only —\n * legal, and honest for a manually-driven backfill.\n /\n scheduleCron: z.string().trim().min(1).optional(),\n\n /\n Extraction bound per run (v3.1 §2): a big backfill progresses across runs via the ledger's\n * resumable cursor instead of owning one unbounded run. The default matches the rate-budget\n * era's \"bounded by construction\" posture.\n /\n maxRowsPerRun: z.number().int().positive().default(10_000),\n});\n\n/* @wildo_source:part:end saas.models.external-data-pipeline /\nexport type ExternalDataPipelineDeclaration = z.infer<typeof ExternalDataPipelineDeclarationSchema>;\n\n/\n What an APPLICATION AUTHOR writes — the schema's INPUT shape, so every field carrying a\n * `.default()` is optional to type. Consumers read the parsed shape above, where those same fields\n * are guaranteed present.\n \n The distinction is not cosmetic, and the first dogfood proved it: typing the resource-config\n * field with the PARSED shape forced an author to spell out `verifyMetadataAtBoot`,\n * `connection`, and a `coercion` + `required` on every mapping entry — values the schema exists\n * to supply. `DataSeedDefinitionAuthored` records the identical lesson for seeds (\"authors may omit\n * this field and the dispatcher still reads a guaranteed `string[]`\"); this is the same split, and\n * it was missed here because nothing had authored a pipeline by hand yet.\n /\nexport type ExternalDataPipelineDeclarationAuthored = z.input<typeof ExternalDataPipelineDeclarationSchema>;\n\n/\n Schema-INDEPENDENT coherence of a parsed declaration — the mainSchema-dependent half lives in\n * the resource-configuration factory (it needs the shape). Throws with the offending path named,\n * mirroring `assertHttpApiBindingDialectCoherence`'s contract.\n */\nexport function assertExternalDataPipelineDeclarationCoherence(declaration: ExternalDataPipelineDeclaration): void {\n // S1 tenancy confinement (v3.1 §2 / W-TENANCY).\n if (declaration.binding.tenancy.stance !== HttpApiTenancyStance.SINGLE_TENANT_BINDING) {\n throw new Error(\n \"binding.tenancy: slice 1 confines pipelines to SINGLE_TENANT_BINDING sources — a pushdown-tenancy source needs the declared remote-scope→organization mapping (widening W-TENANCY), because a wrong org assignment is a cross-tenant leak.\",\n );\n }\n\n // D-P10: extraction uses drift-safe paging ONLY (`@odata.nextLink` / the Odoo id-keyset\n // cursor). REST_JSON declares offset paging, which skips or doubles rows whenever the remote\n // set shifts mid-run — so a REST_JSON pipeline SOURCE is refused until a declared cursor\n // contract exists for the dialect (a recorded widening beside W-DELTA, not an improvisation).\n if (declaration.binding.dialect === HttpApiTransportDialect.REST_JSON) {\n throw new Error(\n 'binding.dialect: REST_JSON pipeline sources are refused in slice 1 — the dialect declares offset paging, which drifts under concurrent remote change (rows skipped or doubled). ODATA (@odata.nextLink) and ODOO_JSONRPC (id cursor) sources are drift-safe; a declared REST cursor contract is the recorded widening.',\n );\n }\n\n const localTargets = new Set<string>();\n for (const entry of declaration.mapping) {\n if (localTargets.has(entry.localField)) {\n throw new Error(`mapping: local field '${entry.localField}' is targeted by more than one entry — one writer per field.`);\n }\n localTargets.add(entry.localField);\n\n if (entry.localField === declaration.remoteKeyLocalField) {\n throw new Error(\n `mapping: local field '${entry.localField}' is the remoteKeyLocalField — the remote identity is written by the pipeline's L from the synthesized id, never by a mapping entry.`,\n );\n }\n\n if (\n entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD\n && entry.coercion === ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL\n && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC\n ) {\n throw new Error(\n `mapping('${entry.localField}').coercion: '${ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL}' names Odoo's absent-as-false semantics and is refused on a ${declaration.binding.dialect} source.`,\n );\n }\n }\n}\n"]}
1	+ {"version":3,"file":"external-data-pipeline.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-data/external-data-pipeline.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAEhG;;;;;GAKG;AACH,kHAAkH;AAClH,MAAM,CAAN,IAAY,6BAEX;AAFD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;AACrB,CAAC,EAFW,6BAA6B,KAA7B,6BAA6B,QAExC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAcX;AAdD,WAAY,iCAAiC;IAC3C;;;;OAIG;IACH,sDAAiB,CAAA;IACjB;;;;;OAKG;IACH,kDAAa,CAAA;AACf,CAAC,EAdW,iCAAiC,KAAjC,iCAAiC,QAc5C;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,uGAAuG;IACvG,6CAAiB,CAAA;IACjB,mGAAmG;IACnG,mDAAuB,CAAA;IACvB,uFAAuF;IACvF,6CAAiB,CAAA;AACnB,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,kGAAkG;AAClG,MAAM,CAAN,IAAY,4BAKX;AALD,WAAY,4BAA4B;IACtC,+DAA+D;IAC/D,6DAA6B,CAAA;IAC7B,yGAAyG;IACzG,qDAAqB,CAAA;AACvB,CAAC,EALW,4BAA4B,KAA5B,4BAA4B,QAKvC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,yBAWX;AAXD,WAAY,yBAAyB;IACnC,+EAA+E;IAC/E,0CAAa,CAAA;IACb;;;;OAIG;IACH,sEAAyC,CAAA;IACzC,mFAAmF;IACnF,sEAAyC,CAAA;AAC3C,CAAC,EAXW,yBAAyB,KAAzB,yBAAyB,QAWpC;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,YAAY,CAAC;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC;QACnF;;;;WAIG;QACH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,QAAQ,CAAC;QACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KACzD,CAAC;CACH,CAAC,CAAC;AAKH,iGAAiG;AACjG,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAE9F;;;;;;;GAOG;AACH,kHAAkH;AAClH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAE/F;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,EAAE,4BAA4B;IAErC;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE3D,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5D;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAC,QAAQ,EAAE;IAEnG,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,MAAM,CAAC;IAEvG,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC;IAEvF;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CAC3D,CAAC,CAAC;AAmBH;;;;GAIG;AACH,MAAM,UAAU,8CAA8C,CAAC,WAA4C;IACzG;;;;;;;;;OASG;IAEH,wFAAwF;IACxF,6FAA6F;IAC7F,yFAAyF;IACzF,8FAA8F;IAC9F,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,wTAAwT,CACzT,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,UAAU,8DAA8D,CAAC,CAAC;QAC3H,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEnC,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,CAAC,UAAU,sIAAsI,CAChL,CAAC;QACJ,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI;YACpC,CAAC,yBAAyB,EAAE,WAAW,CAAC,uBAAuB,CAAC;YAChE,CAAC,wBAAwB,EAAE,WAAW,CAAC,sBAAsB,CAAC;SACtD,EAAE,CAAC;YACX,IAAI,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,CAAC,UAAU,YAAY,KAAK,0GAA0G,CACrK,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IACE,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,YAAY;eACrD,KAAK,CAAC,QAAQ,KAAK,yBAAyB,CAAC,kBAAkB;eAC/D,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EACvE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,YAAY,KAAK,CAAC,UAAU,iBAAiB,yBAAyB,CAAC,kBAAkB,gEAAgE,WAAW,CAAC,OAAO,CAAC,OAAO,UAAU,CAC/L,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,uBAAuB,GAAG;QAC9B,CAAC,yBAAyB,EAAE,WAAW,CAAC,uBAAuB,CAAU;QACzE,CAAC,wBAAwB,EAAE,WAAW,CAAC,sBAAsB,CAAU;KACxE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7C,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,aAAa,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAE,CAAC;QACpD,MAAM,YAAY,GAAG,aAAa,KAAK,yBAAyB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACxH,MAAM,IAAI,KAAK,CACb,GAAG,aAAa,wBAAwB,YAAY,sFAAsF;cACxI,sIAAsI;cACtI,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,IACE,WAAW,CAAC,uBAAuB,KAAK,SAAS;WAC9C,WAAW,CAAC,uBAAuB,KAAK,WAAW,CAAC,sBAAsB,EAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2LAA2L,CAC5L,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI;QACpC,CAAC,yBAAyB,EAAE,WAAW,CAAC,uBAAuB,CAAC;QAChE,CAAC,wBAAwB,EAAE,WAAW,CAAC,sBAAsB,CAAC;KACtD,EAAE,CAAC;QACX,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6KAA6K,CACtL,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/*\n The ETL PIPELINE declaration (`externalDataPipeline`) — partial-resource coverage, model v3\n * (`.claude/plans/etl-partial-resource-coverage.md`, PR-3/PR-19; decisions D-P1…D-P10).\n \n \"Some resources local, some remote, ETL between them\": an ordinary LOCAL resource may declare\n * ONE inbound pipeline from a remote HTTP-API entity. The declaration reuses the whole\n * {@link HttpApiResourceBindingSchema} as its source half (provider, entity, dialect, key\n * fields, remote-call semantics — the E is the same adapter plumbing the VIRTUAL mode runs on),\n * adds the T (a declared field mapping) and the L/refresh contract (population posture, orphan\n * policy, schedule, run bounds). The destination stays a FULL local resource — files, RAG,\n * retention/erasure, charts and the read-only UI chain are all inherited, never re-built.\n \n Everything here is a CLOSED vocabulary with one named source; the runtime seams (P-2) consume\n * these members, and the paper's ledger rows (PR-…) are cited per surface.\n /\n\nimport { z } from 'zod';\n\nimport { HttpApiResourceBindingSchema } from '../http-api-binding/http-api-binding.shared.schemas';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\n\n/\n Pipeline direction (PR-19). A SINGLE-member enum on purpose: reverse ETL (local→remote) and\n * bidirectional sync belong to the outbound-writes gate (ETL plan Step 5, concurrency contract),\n * but the DECLARATION is direction-extensible NOW so those arrive as new members instead of a\n * schema reshape — the immutability-needs-a-paired-path lesson applied to a vocabulary.\n /\n/* @wildo_source:part:start saas.models.external-data-pipeline facet:layer:shared facet:audience:app-developer /\nexport enum ExternalDataPipelineDirection {\n INBOUND = 'inbound',\n}\n\n/\n Who owns the destination's row population (D-P8, v3.1 §1).\n \n The declared answer to the question the orphan sweep MUST have: \"is a row the pipeline did not\n * create a USER row, or a VANISHED remote row?\" — undeclared mixed populations are how an orphan\n * pass deletes user data.\n /\nexport enum ExternalDataDestinationPopulation {\n /\n Every row comes from the pipeline. Caller CREATE is refused at declaration time, and orphan\n * detection may consider the whole population. The default: safest, and the honest description\n * of a synced master-data table.\n /\n CLOSED = 'closed',\n /\n Mixed rows: users may create rows the pipeline does not own. Pipeline rows are identified by\n * the remote-key field being present, and orphan detection is CONFINED to that population. A\n * user row that later matches an incoming remote key is ADOPTED by the upsert (documented\n * collision semantics, not an accident).\n /\n OPEN = 'open',\n}\n\n/\n What happens to a destination row whose remote counterpart disappeared (D-P9).\n \n MIRRORS `DataSeedSyncOrphanPolicy` (saas-backend-lib, data-seeding) member-for-member, and the\n * P-2 pipeline→SYNC seam maps the two 1:1. A separate enum EXISTS ONLY because of dependency\n * direction: this declaration lives in saas-models, the data-seeding models live in\n * saas-backend-lib, and models cannot import backend. If the data-seeding vocabulary ever moves\n * down to saas-models, collapse this enum into it — do not let the two drift meanwhile (the\n * seam's mapping is exhaustive and compile-forced, so a new member on either side reddens P-2).\n /\nexport enum ExternalDataOrphanPolicy {\n /* Hard-delete the orphan row — flows through ordinary lifecycle (cascades, file teardown). Opt-in. /\n DELETE = 'delete',\n /* Mark the row deprecated and keep it; a re-appearing remote key REVIVES it (v3.1 §4). Opt-in. /\n DEPRECATE = 'deprecate',\n /* Touch nothing; surface the diff in the run ledger. The DEFAULT — least surprise. /\n REPORT = 'report',\n}\n\n/* The two shapes a mapping entry can take — a closed discriminator, never inferred from keys. /\nexport enum ExternalDataMappingEntryKind {\n /* Copy (and coerce) one remote field into one local field. /\n REMOTE_FIELD = 'remote-field',\n /* Fill one local field with a declared constant (destination-required fields with no remote source). /\n CONSTANT = 'constant',\n}\n\n/\n Built-in, closed coercion vocabulary for REMOTE_FIELD entries (v3.1 §3 / PR-8). Slice 1 ships\n * exactly the coercions the two generic dialects force; arbitrary transforms are the recorded\n * widenings (W-FK resolution, W-AGENT authored transforms) — never an open function slot here.\n /\nexport enum ExternalDataFieldCoercion {\n /* Value lands as extracted (after the destination schema's own Zod parse). /\n NONE = 'none',\n /\n Odoo spells an ABSENT value as boolean `false` — a mapped string field would otherwise store\n * literal `false`. Applied by DEFAULT for ODOO_JSONRPC sources; declaring it on another dialect\n * is refused (the name is Odoo's semantics, not a generic null-coalesce).\n /\n ODOO_FALSE_AS_NULL = 'odoo-false-as-null',\n /* Parse a strict-ISO datetime string into a Date for a date-typed local field. /\n ISO_STRING_TO_DATE = 'iso-string-to-date',\n}\n\n/* One declared T-step: remote field → local field with a built-in coercion, or a constant. /\nexport const ExternalDataFieldMappingEntrySchema = z.discriminatedUnion('kind', [\n z.object({\n kind: z.literal(ExternalDataMappingEntryKind.REMOTE_FIELD),\n remoteField: z.string().trim().min(1),\n localField: z.string().trim().min(1),\n coercion: z.enum(ExternalDataFieldCoercion).default(ExternalDataFieldCoercion.NONE),\n /\n `true`: a row whose extracted value is ABSENT is REJECTED (reported per row in the run\n * ledger; its previous local version survives). `false` (default): absent lands as null,\n * which the declaration coherence requires the local field to accept.\n /\n required: z.boolean().default(false),\n }),\n z.object({\n kind: z.literal(ExternalDataMappingEntryKind.CONSTANT),\n localField: z.string().trim().min(1),\n constant: z.union([z.string(), z.number(), z.boolean()]),\n }),\n]);\n\n/* @wildo_source:part:end saas.models.external-data-pipeline /\nexport type ExternalDataFieldMappingEntry = z.infer<typeof ExternalDataFieldMappingEntrySchema>;\n\n/* Scalar values admissible in the declared source filter (T-set equality conjunctions only). /\nconst externalDataPipelineFilterScalarSchema = z.union([z.string(), z.number(), z.boolean()]);\n\n/\n The inbound pipeline declaration an ordinary LOCAL resource carries as `externalDataPipeline`.\n \n NOT legal on an HTTP_API-adapter resource (a virtual resource IS the remote side); the\n * resource-configuration factory enforces that plus every mainSchema-dependent coherence rule —\n * see `validateExternalDataPipelineDeclarationAgainstSchema` there. This module owns only the\n * schema-independent shape and coherence.\n /\n/* @wildo_source:part:start saas.models.external-data-pipeline facet:layer:shared facet:audience:app-developer /\nexport const ExternalDataPipelineDeclarationSchema = z.object({\n direction: z.enum(ExternalDataPipelineDirection).default(ExternalDataPipelineDirection.INBOUND),\n\n /\n The source half — the SAME binding declaration the VIRTUAL mode uses (the system of record it\n * reads, entity, dialect, key fields + codecs, remote-call semantics, erasure stance).\n \n Every source is a SYSTEM OF RECORD: a deployment the OPERATOR runs, read with the application's\n * own service identity, with ONE owner organization. There is no per-tenant variant to confine\n * (that was `tenancy`, removed in #1055 — a customer's own connected account is a CONNECTOR, a\n * different thing that no binding names), so a pipeline extracts the operator's rows and the\n * destination's own scope declaration decides who may then read them.\n \n ⚠ OPERATIONAL HAZARD (PR-16): changing `keyFields` or a component CODEC after rows exist\n * re-keys EVERY business key — the whole destination population orphans and re-creates on the\n * next full pass, detaching local annotations (extension fields, files, chunks) from the rows\n * that replace them. Treat a key/codec change as a MIGRATION EVENT, never a config tweak. Not\n * mechanically detectable at authoring (no row access here). Relatedly: a remote system that\n * RECYCLES ids hands the recycled row the OLD row's local annotations — the upsert cannot tell\n * a revived entity from a new one wearing its key.\n /\n binding: HttpApiResourceBindingSchema,\n\n /\n The LOCAL field holding the row's remote identity — the synthesized id (paper A codec) as a\n * plain STRING business key. The factory requires it declared `.isBusinessKey()` +\n * `excludeFromCreate/Update`: SYNC's idempotent upsert keys on it, and no caller may mint or\n * move it.\n /\n remoteKeyLocalField: z.string().trim().min(1),\n\n /\n Where a row's remote PARTITION lands, when the source instance is partitioned (#1058 E4).\n \n Declared TOGETHER or not at all, and only for a partitioned source. The resources registry —\n * which is the first place the pipeline declaration and the systems-of-record registry are both\n * in scope — refuses a partitioned source that declares neither, and refuses either field on an\n * unpartitioned one.\n \n ## Why TWO fields rather than one\n \n They hold different things, and collapsing them is the mistake #1058 R5 was written to record.\n \n `partitionUnitLocalField` carries the Wildo ORGANIZATION UNIT that owns the row's partition. It\n * is what organization-unit narrowing filters on, so it is what confines a member of one\n * subsidiary to their own company's rows. Declare the destination narrowable on this field.\n \n `partitionKeyLocalField` carries the REMOTE key verbatim — Odoo's `company_id`, NetSuite's\n * `subsidiary`. It exists because the unit id CANNOT answer the question the orphan walk asks.\n * When an operator unassigns a partition, the unit still exists and other rows still point at it;\n * only the partition→unit edge is gone. A row loaded before the unassignment therefore still\n * carries a perfectly valid unit id, and nothing about it says \"this row's partition is no longer\n * mapped\". Without the remote key stored per row, the next pass sees those rows absent from the\n * extraction and an orphan policy of DELETE erases them — an operator's unassignment becoming a\n * mass delete.\n \n Both are ENGINE-WRITTEN: the transform stamps them from the assignment map, so a mapping entry\n * targeting either is refused, as is a caller write (the factory requires both\n * `.excludeFromCreate()` and `.excludeFromUpdate()`).\n \n Both must ACCEPT ABSENCE. A row whose partition field is unset is SHARED (E2 — an Odoo product\n * belonging to no company); it belongs to every caller and to no unit, and both fields land null.\n /\n partitionUnitLocalField: z.string().trim().min(1).optional(),\n partitionKeyLocalField: z.string().trim().min(1).optional(),\n\n /* The declared T — at least one entry; targets validated against `mainSchema` by the factory. /\n mapping: z.array(ExternalDataFieldMappingEntrySchema).min(1),\n\n /\n Optional remote-side subset (v3.1 §2): equality conjunctions over REMOTE fields, exactly the\n * T-set's T3 shape — anything richer is a widening, not an improvisation.\n /\n sourceFilter: z.record(z.string().trim().min(1), externalDataPipelineFilterScalarSchema).optional(),\n\n population: z.enum(ExternalDataDestinationPopulation).default(ExternalDataDestinationPopulation.CLOSED),\n\n orphanPolicy: z.enum(ExternalDataOrphanPolicy).default(ExternalDataOrphanPolicy.REPORT),\n\n /\n Cron expression for the scheduled refresh (crontabs machinery). Absent = on-demand only —\n * legal, and honest for a manually-driven backfill.\n /\n scheduleCron: z.string().trim().min(1).optional(),\n\n /\n Extraction bound per run (v3.1 §2): a big backfill progresses across runs via the ledger's\n * resumable cursor instead of owning one unbounded run. The default matches the rate-budget\n * era's \"bounded by construction\" posture.\n /\n maxRowsPerRun: z.number().int().positive().default(10_000),\n});\n\n/* @wildo_source:part:end saas.models.external-data-pipeline /\nexport type ExternalDataPipelineDeclaration = z.infer<typeof ExternalDataPipelineDeclarationSchema>;\n\n/\n What an APPLICATION AUTHOR writes — the schema's INPUT shape, so every field carrying a\n * `.default()` is optional to type. Consumers read the parsed shape above, where those same fields\n * are guaranteed present.\n \n The distinction is not cosmetic, and the first dogfood proved it: typing the resource-config\n * field with the PARSED shape forced an author to spell out a `coercion` + `required` on every\n * mapping entry, and the two binding defaults that existed at the time (`verifyMetadataAtBoot` and\n * `connection`, both since removed by #1055) — values the schema exists to supply. `DataSeedDefinitionAuthored` records the identical lesson for seeds (\"authors may omit\n * this field and the dispatcher still reads a guaranteed `string[]`\"); this is the same split, and\n * it was missed here because nothing had authored a pipeline by hand yet.\n /\nexport type ExternalDataPipelineDeclarationAuthored = z.input<typeof ExternalDataPipelineDeclarationSchema>;\n\n/\n Schema-INDEPENDENT coherence of a parsed declaration — the mainSchema-dependent half lives in\n * the resource-configuration factory (it needs the shape). Throws with the offending path named,\n * mirroring `assertHttpApiBindingDialectCoherence`'s contract.\n /\nexport function assertExternalDataPipelineDeclarationCoherence(declaration: ExternalDataPipelineDeclaration): void {\n /\n * The S1 tenancy confinement was REMOVED here with `tenancy` itself (#1055).\n \n It refused any source that was not `SINGLE_TENANT_BINDING`, because a pushdown-tenancy source\n * would have needed a declared remote-scope→organization mapping and a wrong assignment is a\n * cross-tenant leak. That reasoning is intact; what changed is that the state it refused can no\n * longer be declared. A pipeline's source is a system of record, a system of record has one owner\n * organization, and the rows a LOAD writes are stamped with it (#868) rather than mapped from a\n * remote scope field.\n /\n\n // D-P10: extraction uses drift-safe paging ONLY (`@odata.nextLink` / the Odoo id-keyset\n // cursor). REST_JSON declares offset paging, which skips or doubles rows whenever the remote\n // set shifts mid-run — so a REST_JSON pipeline SOURCE is refused until a declared cursor\n // contract exists for the dialect (a recorded widening beside W-DELTA, not an improvisation).\n if (declaration.binding.dialect === HttpApiTransportDialect.REST_JSON) {\n throw new Error(\n 'binding.dialect: REST_JSON pipeline sources are refused in slice 1 — the dialect declares offset paging, which drifts under concurrent remote change (rows skipped or doubled). ODATA (@odata.nextLink) and ODOO_JSONRPC (id cursor) sources are drift-safe; a declared REST cursor contract is the recorded widening.',\n );\n }\n\n const localTargets = new Set<string>();\n for (const entry of declaration.mapping) {\n if (localTargets.has(entry.localField)) {\n throw new Error(`mapping: local field '${entry.localField}' is targeted by more than one entry — one writer per field.`);\n }\n localTargets.add(entry.localField);\n\n if (entry.localField === declaration.remoteKeyLocalField) {\n throw new Error(\n `mapping: local field '${entry.localField}' is the remoteKeyLocalField — the remote identity is written by the pipeline's L from the synthesized id, never by a mapping entry.`,\n );\n }\n\n /\n * Same rule, one field over (#1058 E4): both partition fields are ENGINE-written, stamped by the\n * transform from the assignment map. A mapping entry targeting one would be the second writer of\n * a field whose value decides who may see the row — and, because the stamp runs after the\n * mapping, an INERT one. An authoring mistake that silently does nothing is worse than one that\n * fails: the author reads a declaration that looks like it decides the unit, and no run ever\n * disagrees with them.\n /\n for (const [label, partitionField] of [\n ['partitionUnitLocalField', declaration.partitionUnitLocalField],\n ['partitionKeyLocalField', declaration.partitionKeyLocalField],\n ] as const) {\n if (partitionField !== undefined && entry.localField === partitionField) {\n throw new Error(\n `mapping: local field '${entry.localField}' is the ${label} — the partition stamp is written by the pipeline's T from the assignment map, never by a mapping entry.`,\n );\n }\n }\n\n if (\n entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD\n && entry.coercion === ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL\n && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC\n ) {\n throw new Error(\n `mapping('${entry.localField}').coercion: '${ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL}' names Odoo's absent-as-false semantics and is refused on a ${declaration.binding.dialect} source.`,\n );\n }\n }\n\n /\n * TOGETHER or not at all (#1058 E4).\n \n Declaring only the unit field loses the orphan walk's protection — a row whose partition is\n * later unassigned still carries a valid unit id, nothing says the edge is gone, and a DELETE\n * orphan policy erases it. Declaring only the key field loses the confinement: the rows carry\n * their remote partition and no unit, so narrowing has nothing to filter on and every member of\n * the owner organization reads every subsidiary's rows. Neither half is useful alone, and both\n * failures are silent.\n */\n const declaredPartitionFields = [\n ['partitionUnitLocalField', declaration.partitionUnitLocalField] as const,\n ['partitionKeyLocalField', declaration.partitionKeyLocalField] as const,\n ].filter(([, value]) => value !== undefined);\n if (declaredPartitionFields.length === 1) {\n const [declaredLabel] = declaredPartitionFields[0]!;\n const missingLabel = declaredLabel === 'partitionUnitLocalField' ? 'partitionKeyLocalField' : 'partitionUnitLocalField';\n throw new Error(\n `${declaredLabel} is declared without ${missingLabel} — the two partition fields answer different questions and neither is useful alone. `\n + 'The unit is what narrowing confines a caller by; the remote key is what keeps an unassigned partition out of the orphan comparison, '\n + 'because after an unassignment the unit id still resolves and says nothing.',\n );\n }\n if (\n declaration.partitionUnitLocalField !== undefined\n && declaration.partitionUnitLocalField === declaration.partitionKeyLocalField\n ) {\n throw new Error(\n 'partitionUnitLocalField and partitionKeyLocalField name the same field — one would overwrite the other, and which survived would decide either who sees the row or whether it is deleted.',\n );\n }\n for (const [label, partitionField] of [\n ['partitionUnitLocalField', declaration.partitionUnitLocalField],\n ['partitionKeyLocalField', declaration.partitionKeyLocalField],\n ] as const) {\n if (partitionField !== undefined && partitionField === declaration.remoteKeyLocalField) {\n throw new Error(\n `${label} names the remoteKeyLocalField — the row's IDENTITY and its PARTITION are different facts, and sharing a field would make the business key change when a row moves company.`,\n );\n }\n }\n}\n"]}

package/dist/esm/external-data.exports.d.ts CHANGED Viewed

@@ -26,5 +26,6 @@
  * it from shared code. Identity is not an integration concern.
  */
 export * from './http-api-binding/http-api-binding.shared.schemas';
+export * from './systems-of-record/system-of-record-facet.shared.schemas';
 export * from './external-data/external-data-pipeline.shared.schemas';
 //# sourceMappingURL=external-data.exports.d.ts.map

package/dist/esm/external-data.exports.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"external-data.exports.d.ts","sourceRoot":"","sources":["~~../../~~src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC"}
1	+ {"version":3,"file":"external-data.exports.d.ts","sourceRoot":"","sources":["../../../src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AACnE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,uDAAuD,CAAC"}

package/dist/esm/external-data.exports.js CHANGED Viewed

@@ -26,5 +26,6 @@
  * it from shared code. Identity is not an integration concern.
  */
 export * from './http-api-binding/http-api-binding.shared.schemas.js';
+export * from './systems-of-record/system-of-record-facet.shared.schemas.js';
 export * from './external-data/external-data-pipeline.shared.schemas.js';
 //# sourceMappingURL=external-data.exports.js.map

package/dist/esm/external-data.exports.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"external-data.exports.js","sourceRoot":"","sources":["../../../src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AACnE,cAAc,uDAAuD,CAAC","sourcesContent":["/*\n `@wildo-ai/saas-models/external-data` — the AUTHORING contract for data that lives in another\n * system: the read-through VIRTUAL binding (`httpApiBinding`) and the copy-in PIPELINE\n * (`externalDataPipeline`).\n \n ## Why this is a subpath rather than root, and why it is not in `saas-backend-lib`\n \n Both questions were measured on 2026-08-29 rather than argued.\n \n It is NOT backend-lib, even though only the backend has a runtime for it, because an application\n * author writes these declarations in `.resources-config.ts` — which lives in the app's\n `shared-lib`, a package that depends on `@wildo-ai/saas-models` and deliberately NOT on\n * `@wildo-ai/saas-backend-lib` (the frontend imports `shared-lib`, so a backend dependency there\n * would drag the backend graph browser-ward). Nothing in these modules is runtime: every symbol —\n * dialects, tenancy, erasure, key fields, population, orphan policy, coercions — is typed by a\n * human in a schema file. The runtime that consumes them (read client, extraction source,\n * transform, run service, batch) is already backend-only.\n \n It IS a subpath rather than the root barrel because only two audiences need it — the app author\n * declaring a resource, and the backend executing it — while the root is imported by every\n * consumer of the resource model, including packages that will never speak to a remote system.\n * Keeping it out of the root shrinks what they see without moving where it lives.\n \n ROW IDENTITY deliberately stays in the ROOT (`http-api-binding-id.shared.utils`): a synthesized\n * id appears in URLs and frontend routing, and `ResourcesConfigUtils.isHttpApiSynthesizedId` reads\n * it from shared code. Identity is not an integration concern.\n /\nexport from './http-api-binding/http-api-binding.shared.schemas';\nexport * from './external-data/external-data-pipeline.shared.schemas';\n"]}
1	+ {"version":3,"file":"external-data.exports.js","sourceRoot":"","sources":["../../../src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AACnE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,uDAAuD,CAAC","sourcesContent":["/*\n `@wildo-ai/saas-models/external-data` — the AUTHORING contract for data that lives in another\n * system: the read-through VIRTUAL binding (`httpApiBinding`) and the copy-in PIPELINE\n * (`externalDataPipeline`).\n \n ## Why this is a subpath rather than root, and why it is not in `saas-backend-lib`\n \n Both questions were measured on 2026-08-29 rather than argued.\n \n It is NOT backend-lib, even though only the backend has a runtime for it, because an application\n * author writes these declarations in `.resources-config.ts` — which lives in the app's\n `shared-lib`, a package that depends on `@wildo-ai/saas-models` and deliberately NOT on\n * `@wildo-ai/saas-backend-lib` (the frontend imports `shared-lib`, so a backend dependency there\n * would drag the backend graph browser-ward). Nothing in these modules is runtime: every symbol —\n * dialects, tenancy, erasure, key fields, population, orphan policy, coercions — is typed by a\n * human in a schema file. The runtime that consumes them (read client, extraction source,\n * transform, run service, batch) is already backend-only.\n \n It IS a subpath rather than the root barrel because only two audiences need it — the app author\n * declaring a resource, and the backend executing it — while the root is imported by every\n * consumer of the resource model, including packages that will never speak to a remote system.\n * Keeping it out of the root shrinks what they see without moving where it lives.\n \n ROW IDENTITY deliberately stays in the ROOT (`http-api-binding-id.shared.utils`): a synthesized\n * id appears in URLs and frontend routing, and `ResourcesConfigUtils.isHttpApiSynthesizedId` reads\n * it from shared code. Identity is not an integration concern.\n /\nexport from './http-api-binding/http-api-binding.shared.schemas';\nexport * from './systems-of-record/system-of-record-facet.shared.schemas';\nexport * from './external-data/external-data-pipeline.shared.schemas';\n"]}

package/dist/esm/external-providers/compose-provider-registry.shared.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"compose-provider-registry.shared.d.ts","sourceRoot":"","sources":["~~../../../~~src/external-providers/compose-provider-registry.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE/E,MAAM,WAAW,wBAAwB,CACvC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE;IAEpF,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB,CACvC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE;IAEpF,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,gBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IACjD,gCAAgC,CAC9B,kBAAkB,EAAE,kBAAkB,GACrC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1B,gCAAgC,CAC9B,kBAAkB,EAAE,kBAAkB,GACrC,OAAO,GAAG,SAAS,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B,CAAC,IAAI,SAAS,MAAM;IAC9D,GAAG,EAAE,IAAI,CAAC;IACV,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,qBAAa,gCAAgC,CAAC,IAAI,SAAS,MAAM,CAAE,SAAQ,KAAK;IAC9E,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,SAAS,EAAE,aAAa,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;gBAG1E,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,aAAa,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;CAc9D;AAED,wBAAgB,uBAAuB,CACrC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE,EAEpF,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,aAAa,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAChE,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAsDzC"}
1	+ {"version":3,"file":"compose-provider-registry.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/compose-provider-registry.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE/E,MAAM,WAAW,wBAAwB,CACvC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE;IAEpF,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB,CACvC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE;IAEpF,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,gBAAgB,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;IACjD,gCAAgC,CAC9B,kBAAkB,EAAE,kBAAkB,GACrC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1B,gCAAgC,CAC9B,kBAAkB,EAAE,kBAAkB,GACrC,OAAO,GAAG,SAAS,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B,CAAC,IAAI,SAAS,MAAM;IAC9D,GAAG,EAAE,IAAI,CAAC;IACV,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAED,qBAAa,gCAAgC,CAAC,IAAI,SAAS,MAAM,CAAE,SAAQ,KAAK;IAC9E,SAAgB,KAAK,EAAE,MAAM,CAAC;IAC9B,SAAgB,SAAS,EAAE,aAAa,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;gBAG1E,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,aAAa,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;CAc9D;AAED,wBAAgB,uBAAuB,CACrC,IAAI,SAAS,MAAM,EACnB,OAAO,SAAS;IAAE,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAA;CAAE,EAEpF,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,aAAa,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,GAChE,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,CAsDzC"}

package/dist/esm/external-providers/engine-capabilities.shared.schemas.d.ts CHANGED Viewed

@@ -16,16 +16,15 @@ export declare enum EngineCapability {
     BILLING = "BILLING",
     MULTI_LANGUAGE = "MULTI_LANGUAGE",
     /**
-     * Durable, provider-backed audit trail — and the capability with the widest reach into what the
-     * application is able to CLAIM about itself.
+     * Durable, provider-backed audit trail: every audit event the application records is ALSO sent to
+     * each configured audit provider (an immutable ledger, a SIEM).
      *
-     * Leaving it out is a legitimate choice, but it is not a small one, and the cost is invisible
-     * until much later. The assurance surface attests roughly half its control objectives through the
-     * audit trail: with this capability absent, about a third of them cannot be claimed AT ALL — every
-     * objective whose only attesting capability is the audit trail — and several more resolve to
-     * "undetermined", meaning the application may genuinely operate the control while being unable to
-     * evidence it. Enabling it typically moves an application from partial to complete coverage in one
-     * step.
+     * Whether to enable it is a question of where the trail must live, not of what the application may
+     * claim. The assurance surface attests roughly half its control objectives through audit rows, and
+     * those rows are read from the application's OWN audit store, which exists whether or not this
+     * capability is on. So leaving it out removes no control objective an application can claim. Until
+     * 2026-09-14 the assurance basis wrongly treated this capability as the precondition for those
+     * claims, and this comment said leaving it out left about a third of them unclaimable.
      *
      * Two things this does NOT mean, because both are easy to assume:
      *
@@ -37,9 +36,9 @@ export declare enum EngineCapability {
      *   furnish evidence for the period it was off, and a control's evidence cannot begin before its
      *   evidence store does.
      *
-     * So decide it with the compliance posture rather than as an infrastructure detail: if the
-     * application intends to claim access, audit, identity or privacy control objectives to anyone
-     * outside itself, this is the capability those claims rest on.
+     * So decide it with the compliance posture rather than as an infrastructure detail: enable it when
+     * the trail must also exist OUTSIDE the application — a store its own operators cannot rewrite, or a
+     * security team's SIEM. The application's own store stays the authoritative record either way.
      */
     COMPLIANCE_AUDIT_TRAIL = "COMPLIANCE_AUDIT_TRAIL",
     EMAIL_TRANSACTIONAL = "EMAIL_TRANSACTIONAL",

package/dist/esm/external-providers/engine-capabilities.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"engine-capabilities.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../~~src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC~~;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG~~;IACH,sBAAsB,2BAA2B;IAEjD,mBAAmB,wBAAwB;IAC3C,eAAe,oBAAoB;IACnC,GAAG,QAAQ;IAEX,MAAM,WAAW;IACjB,mBAAmB,wBAAwB;IAC3C;;;;;;;;OAQG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;;;;;OAcG;IACH,eAAe,oBAAoB;IAyDnC,yBAAyB,8BAA8B;IACvD,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,iBAAiB,sBAAsB;IAEvC;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;CACpD;AAkGD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wCAAwC,EAAE,OAAO,CAC5D,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CACD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,+CAA+C,4EAYZ,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,eAAO,MAAM,qDAAqD,EAAE,WAAW,CAAC,gBAAgB,CAI9F,CAAC;AACH,qFAAqF"}
1	+ {"version":3,"file":"engine-capabilities.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/external-providers/engine-capabilities.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,oBAAY,gBAAgB;IAC1B,aAAa,kBAAkB;IAC/B,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,sBAAsB,2BAA2B;IAEjD,mBAAmB,wBAAwB;IAC3C,eAAe,oBAAoB;IACnC,GAAG,QAAQ;IAEX,MAAM,WAAW;IACjB,mBAAmB,wBAAwB;IAC3C;;;;;;;;OAQG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;;;;;;;OAcG;IACH,eAAe,oBAAoB;IAyDnC,yBAAyB,8BAA8B;IACvD,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,iBAAiB,sBAAsB;IAEvC;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;CACpD;AAkGD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wCAAwC,EAAE,OAAO,CAC5D,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CACD,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,+CAA+C,4EAYZ,CAAC;AA8CjD,uIAAuI;AACvI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,eAAO,MAAM,qDAAqD,EAAE,WAAW,CAAC,gBAAgB,CAI9F,CAAC;AACH,qFAAqF"}