@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-api-binding.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/http-api-binding/http-api-binding.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,0CAA0C,EAC1C,sCAAsC,EAEvC,MAAM,sCAAsC,CAAC;AAM9C;;;;GAIG;AACH,4GAA4G;AAC5G,oBAAY,uBAAuB;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,KAAK,UAAU;IAEf;;;;OAIG;IACH,SAAS,cAAc;IAEvB;;;;;;;;;;;;;OAaG;IACH,YAAY,iBAAiB;CAC9B;AA+BD;;;;;GAKG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,eAAe,oBAAoB;IAEnC;;;;OAIG;IACH,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,mCAAmC,wCAAwC;CAC5E;AAMD;;GAEG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,qBAAqB,0BAA0B;IAE/C;;;;OAIG;IACH,qBAAqB,0BAA0B;CAChD;AAMD;;;;;;;;GAQG;AACH,oBAAY,wBAAwB;IAClC,+FAA+F;IAC/F,MAAM,WAAW;IAEjB,kFAAkF;IAClF,OAAO,YAAY;IAEnB,2EAA2E;IAC3E,IAAI,SAAS;IAEb;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AACD,0DAA0D;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;iBAShC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;iBA2B3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;;;GAMG;AACH,oBAAY,0BAA0B;IACpC,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;iBA6CzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,mCAAmC;IAC9C,2EAA2E;;IAE3E;;;OAGG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH,gGAAgG;;kBAEhG,CAAC;AAEH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;IAnChD,2EAA2E;;IAE3E;;;OAGG;;IAEH;;;;OAIG;;IAEH;;;;OAIG;;IAEH,gGAAgG;;oBAmBhG,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,yDAAyD;AACzD,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,+BAA+B,GAC3C,WAAW,IAAI,6BAA6B,CAE9C;AAED,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;QAlDtC,2EAA2E;;QAE3E;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;QAEH,gGAAgG;;;;;;;;;;;;;;;;;QAnBhG,2EAA2E;;QAE3E;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;QAEH,gGAAgG;;;;;;;;;;;;;;;;;QAnBhG,2EAA2E;;QAE3E;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;QAEH,gGAAgG;;;;;;;;;;;;;;;;;QAnBhG,2EAA2E;;QAE3E;;;WAGG;;QAEH;;;;WAIG;;QAEH;;;;WAIG;;QAEH,gGAAgG;;;iBAsChG,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAMhF,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B;;;;;;6BAW1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;;GAOG;AACH,oBAAY,6BAA6B;IACvC,IAAI,SAAS;IACb,MAAM,WAAW;CAClB;AAED;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;;iBAc5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,qFAAqF;AACrF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;6BAwC1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAyDxF;;;;GAIG;AACH,4GAA4G;AAC5G,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA/NvC,2EAA2E;;YAE3E;;;eAGG;;YAEH;;;;eAIG;;YAEH;;;;eAIG;;YAEH,gGAAgG;;;;;;;;;;;;;;;;;YAnBhG,2EAA2E;;YAE3E;;;eAGG;;YAEH;;;;eAIG;;YAEH;;;;eAIG;;YAEH,gGAAgG;;;;;;;;;;;;;;;;;YAnBhG,2EAA2E;;YAE3E;;;eAGG;;YAEH;;;;eAIG;;YAEH;;;;eAIG;;YAEH,gGAAgG;;;;;;;;;;;;;;;;;YAnBhG,2EAA2E;;YAE3E;;;eAGG;;YAEH;;;;eAIG;;YAEH;;;;eAIG;;YAEH,gGAAgG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAsOhG,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAoD1F;AAED,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAgB1F;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE;IAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GACjD,OAAO,CAKT"}
+{"version":3,"file":"http-api-binding.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-binding.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAM9E,4GAA4G;AAiC5G;;;;;GAKG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,eAAe,oBAAoB;IAEnC;;;;OAIG;IACH,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,mCAAmC,wCAAwC;CAC5E;AA4BD;;;;;;;;GAQG;AACH,oBAAY,wBAAwB;IAClC,+FAA+F;IAC/F,MAAM,WAAW;IAEjB,kFAAkF;IAClF,OAAO,YAAY;IAEnB,2EAA2E;IAC3E,IAAI,SAAS;IAEb;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AACD,0DAA0D;AAE1D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;iBAShC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAM5E;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;iBA+C3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F;;;;;;GAMG;AACH,oBAAY,0BAA0B;IACpC,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,oBAAY,6BAA6B;IACvC;;;;;;;;;OASG;IACH,IAAI,SAAS;IACb;;;;;;;;OAQG;IACH,OAAO,YAAY;CACpB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,+BAA+B;;;;iBAkB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;iBA6EzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAoBtF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;iBAAiC,CAAC;AAEpF,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAMhF;;;;;;;GAOG;AACH,oBAAY,6BAA6B;IACvC,IAAI,SAAS;IACb,MAAM,WAAW;CAClB;AAED;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;;iBAc5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,qFAAqF;AACrF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;6BAwC1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AA8ExF;;;;;;;;GAQG;AACH,4GAA4G;AAC5G,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAgCvC,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CA2D1F;AAED,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAgB1F;;;;GAIG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE;IAAE,SAAS,EAAE,SAAS,eAAe,EAAE,CAAA;CAAE,GACjD,OAAO,CAKT"}

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.js

@@ -10,84 +10,33 @@
  *
  * The binding is a REQUIRED companion declaration on any resource configuration that selects
  * `PersistenceAdapter.HTTP_API`. It answers, statically and per resource:
- * - WHERE the rows live (provider + entity), and in which transport dialect they are queried;
+ * - WHICH declared system of record the rows live in (`system`), and WHICH remote entity inside it;
  * - HOW a row is identified (ordered key components → the synthesized engine-facing `_id`);
- * - WHOSE identity reaches the target system (service principal vs per-user delegation);
- * - HOW tenancy confinement is expressed remotely — or the explicit single-tenant stance;
  * - WHAT the erasure story is (all three stances are first-class; none is silently defaulted);
  * - WHICH remote-call semantics apply (timeout, retry, rate budget, id-set bound).
  *
- * Credentials are NEVER declared here. They resolve at runtime through
- * `ExternalProvidersRegistryBackendService` against the `providerRef`, exactly as email, SMS and
- * billing providers do — the binding carries only the reference (plan decision D7).
+ * ## Three questions this used to answer and no longer does (#1055)
+ *
+ * WHOSE ACCOUNT (`connection`), WHERE the deployment is (`providerRef`) and HOW TENANCY is expressed
+ * remotely (`tenancy`) all left in the same change, and none of them was replaced by a smaller field:
+ *
+ * - WHOSE ACCOUNT has one legal answer for a system of record — the application's own service
+ *   identity (D12). The customer-connection case is case 2 of #1049 and keeps the connector lane.
+ * - WHERE is a property of the declared INSTANCE (`systemsOfRecord.<name>`) and of the ENVIRONMENT,
+ *   not of each resource. That is what lets two instances of one vendor exist at all.
+ * - TENANCY became a STAMP rather than a declaration: the row projector writes the owner
+ *   organization's id onto every remote row, so the per-row gate passes with no exemption.
+ *
+ * Credentials are NEVER declared here. They resolve at runtime through the systems-of-record
+ * registry, from environment variables DERIVED from the instance name — the binding carries only the
+ * name.
  */
 import { z } from 'zod';
-import { ExternalProvider_Connection_DelegationMode, ExternalProvider_Connection_OwnerScope, ExternalProvider_ConnectionShapeSchema, } from '@wildo-ai/external-connectors-models';
+import { HttpApiTransportDialect } from './http-api-transport-dialect.shared.js';
 // --------------------------------
 // Transport dialect
 // --------------------------------
-/**
- * The query dialect the adapter speaks toward the target system. Closed vocabulary (slice 1);
- * SOAP is a possible later member over the same HTTP transport, and a direct-database kind would
- * be a NEW `PersistenceAdapter` member, never a dialect here.
- */
 /** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
-export var HttpApiTransportDialect;
-(function (HttpApiTransportDialect) {
-    /**
-     * OData **v4** — one generic client: mechanical pushdown of
-     * `$filter`/`$select`/`$top`/`$skip`/`$orderby`/`$count`, with a `$metadata` boot-time
-     * verification probe of the committed declaration.
-     *
-     * ⚠ **This member is v4 ONLY, and that excludes SAP's most-used API.** An earlier revision of
-     * this comment named "SAP S/4HANA, Microsoft Dataverse/Dynamics 365" here, which is half right
-     * and was load-bearing — it is why nobody looked:
-     *
-     * | Target | Version | Consumable today |
-     * |---|---|---|
-     * | Microsoft Dataverse / Dynamics 365 Web API (`/api/data/v9.2/`) | v4 | ✅ |
-     * | SAP S/4HANA OData **v4** services (`/sap/opu/odata4/…`) | v4 | ✅ |
-     * | SAP `API_BUSINESS_PARTNER` (`/sap/opu/odata/sap/API_BUSINESS_PARTNER`) | **v2** | ❌ |
-     *
-     * v2 is not a v4 variant with a different header. Its collection envelope is
-     * `{ "d": { "results": [...], "__next": …, "__count": … } }` rather than
-     * `{ "value": [...], "@odata.nextLink": … }`; `Edm.DateTime` serializes as `"/Date(<ticks>)/"`
-     * rather than ISO 8601; `Edm.Decimal` and `Edm.Int64` serialize as JSON STRINGS rather than
-     * numbers; and JSON must be requested (`$format=json`) because v2 defaults to Atom/XML. So it
-     * changes the envelope, the paging property, the count property AND the value encoding — a
-     * reader written for one cannot read the other, and the mapping layer needs coercions the way
-     * Odoo needs `ODOO_FALSE_AS_NULL`.
-     * spec-cite: OData Version 2.0 JSON Format
-     * (https://www.odata.org/documentation/odata-version-2-0/json-format/) — the `d`/`results`/
-     * `__next`/`__count` envelope, the `/Date(<ticks>)/` DateTime literal, and Edm.Decimal /
-     * Edm.Int64 "formatted as a JSON string".
-     *
-     * Supporting v2 is an OPEN decision, not an oversight. Until it lands, point an ODATA binding at
-     * a v4 service: for SAP that means the OData v4 edition of the API where one is published.
-     */
-    HttpApiTransportDialect["ODATA"] = "odata";
-    /**
-     * Declared per-binding REST/JSON operation mapping (bespoke enterprise APIs). Unlike ODATA
-     * there is no generic client: each binding declares how read/list/count/search map onto
-     * concrete HTTP operations.
-     */
-    HttpApiTransportDialect["REST_JSON"] = "rest-json";
-    /**
-     * Odoo's external API (`/jsonrpc` + `execute_kw`). Promoted to its OWN dialect 2026-08-27 —
-     * D0's original "JSON-RPC is a thin envelope variant of REST_JSON" was corrected by measuring
-     * the protocol: it is generic like ODATA (no per-binding operation declarations — the model
-     * name IS `entityRef`, and read/list/count map onto `read`/`search_read`/`search_count`
-     * mechanically), but it speaks POSITIONAL arguments, its own domain filter language
-     * (`[['field','=',value], …]` with polish-notation `'|'` disjunction), and authenticates
-     * INSIDE the RPC args (`execute_kw(db, uid, api_key, …)`) rather than via HTTP headers.
-     * Forcing that through REST_JSON's declared-parameter model would have been the
-     * merge-distinct-concepts failure `design-philosophy.md` forbids.
-     *
-     * Structural constraint (schema-enforced): exactly ONE key field with the `INTEGER` codec —
-     * Odoo row ids are integers, always.
-     */
-    HttpApiTransportDialect["ODOO_JSONRPC"] = "odoo-jsonrpc";
-})(HttpApiTransportDialect || (HttpApiTransportDialect = {}));
 // --------------------------------
 // Whose identity reaches the target
 // --------------------------------
@@ -100,7 +49,9 @@ export var HttpApiTransportDialect;
  * two independent questions with five real answers (`ExternalProvider_ConnectionShape`):
  *
  *   - a user's own personal grant is `USER × SERVICE`;
- *   - a tenant's registration acting for one of its members is `ORGANIZATION × USER`.
+ *   - one member's own account, linked for the whole organization, is `ORGANIZATION × USER`
+ *     (decided on wildo-ai/wildo-ai#18: every member spends it, and the linking member is named in
+ *     the audit trail).
  *
  * Both are "per-user OAuth against the target", they resolve DIFFERENT credentials, and the single
  * field cannot distinguish them. So mapping it onto a target would have silently picked a lane —
@@ -142,27 +93,27 @@ export var HttpApiErasureStance;
      */
     HttpApiErasureStance["CONTROLLER_ACKNOWLEDGED_NON_ERASURE"] = "controller-acknowledged-non-erasure";
 })(HttpApiErasureStance || (HttpApiErasureStance = {}));
-// --------------------------------
-// Tenancy stance
-// --------------------------------
-/**
- * How tenant confinement is enforced against the remote system (requirements R4/R16).
+/*
+ * ─── `HttpApiTenancyStance` was REMOVED here (#1055), and NOT replaced by a narrower vocabulary ──
+ *
+ * It had two members and both were wrong for a system of record.
+ *
+ * `SCOPE_FILTER_PUSHDOWN` pushed the engine's contextual scope predicate into the remote query —
+ * which means sending WILDO's own organization id to a system that has never heard of it, as a
+ * filter value. Nothing on the far side could match it, so the stance could only ever have worked
+ * against a remote that happened to store Wildo ids.
+ *
+ * `SINGLE_TENANT_BINDING` then became the only truth, and a declaration with one legal value is a
+ * question nobody should be asked — plus it carried a `justification` string, which made every
+ * binding restate the same sentence.
+ *
+ * What replaced it is a different MECHANISM rather than a smaller field: the row projector stamps
+ * the owner organization's id onto each remote row, so the per-row tenant gate passes with no
+ * exemption and a request under another organization's URL is refused by the branch that already
+ * existed. Narrowing a system of record BY organization unit is #1058, and it belongs to the
+ * INSTANCE and its vendor facet — one declaration for every resource that reads that system,
+ * rather than one per binding.
  */
-export var HttpApiTenancyStance;
-(function (HttpApiTenancyStance) {
-    /**
-     * The engine's contextual scope predicate is pushed down into every remote query against a
-     * declared remote field. Registration REFUSES a binding whose declared surface cannot express
-     * the scope predicate — a query-time refusal would be a data leak one missed branch away.
-     */
-    HttpApiTenancyStance["SCOPE_FILTER_PUSHDOWN"] = "scope-filter-pushdown";
-    /**
-     * The binding declares the target system serves exactly ONE tenant (the normal case for an
-     * internal tool on one enterprise's IS). Scope pushdown is then N/A by declaration — an
-     * explicit, audited stance, never an inferred one (R16).
-     */
-    HttpApiTenancyStance["SINGLE_TENANT_BINDING"] = "single-tenant-binding";
-})(HttpApiTenancyStance || (HttpApiTenancyStance = {}));
 // --------------------------------
 // Key declaration + component codecs (paper A)
 // --------------------------------
@@ -248,6 +199,25 @@ export const HttpApiRemoteCallSemanticsSchema = z.object({
      * (scope-down paper, shape T2).
      */
     maxIdSetSize: z.number().int().positive().max(500).default(50),
+    /**
+     * Upper bound for the translated PARTITION confinement (#1058 E7) — `key ∈ {every partition this
+     * caller may touch}`, compiled per dialect.
+     *
+     * Its own knob rather than a reuse of `maxIdSetSize`, because the two bound different things and
+     * would be tuned against different facts. An id set is a CALLER's request and its size is a
+     * property of what they asked for; a partition set is a property of the DEPLOYMENT — how many
+     * legal entities live inside one system of record — and of the caller's grant. An operator raising
+     * one for a bulk read has no reason to raise the other, and lowering `maxIdSetSize` to tame a URL
+     * would silently cut the confinement off at the knees: above the bound the adapter REFUSES, so a
+     * confinement that cannot compile is a read that cannot happen.
+     *
+     * The default is deliberately far above `maxIdSetSize`'s. A corporate with more than two hundred
+     * legal entities inside ONE system of record exists, and when it does the honest answer is a
+     * refusal that NAMES the bound rather than a request the target truncates or rejects with a 414.
+     * Refused rather than paged: splitting one read into N requests is a different mechanism, and one
+     * that would make a single `total` impossible to compute.
+     */
+    maxPartitionSetSize: z.number().int().positive().max(1_000).default(200),
 });
 // --------------------------------
 // Dialect-specific declarations
@@ -279,14 +249,80 @@ export var HttpApiRestOperationMethod;
  * — ten exported symbols with zero code readers — was deleted in #331 rather than wired up, so
  * "what a provider can do" has one description instead of two.)
  *
- * The convergence this JSDoc asked to be RECORDED rather than performed implicitly happened in
- * S3a (#331), and it is not the merge that sentence was written to prevent. A member of
- * {@link HttpApiRestOperationsSchema} may now be a {@link HttpApiRestOperationReferenceSchema}
- * naming an operation in the PROVIDER's own `rest.operations` catalogue — the vendor half stated
- * once per provider, the resource half (local-field filter mapping, search parameter, which path
- * token takes the key) still stated here, because a provider has never heard of a local field
- * name. Both forms stay: an inline spec is still the right answer for a target no provider wraps.
+ * The convergence performed in S3a (#331) — a member naming an operation in a PROVIDER's own
+ * catalogue — was UNDONE in #1055. A system of record is not a connector (D10), and a read that
+ * depends on a provider catalogue being loadable is the crossing that decision forbids. An inline
+ * spec is now the only form, which is what every authored binding used anyway.
+ */
+/**
+ * A query LANGUAGE a REST system of record reads through, rather than a set of filter parameters
+ * (#1293).
+ *
+ * Two vendors read this way and neither can be expressed as parameters: Salesforce takes SOQL and
+ * NetSuite takes SuiteQL, each as ONE statement naming the fields, the entity, the predicates and
+ * the order. A `filterParams` map cannot say "SELECT these columns FROM that object", so without this
+ * neither vendor can be declared at all.
+ *
+ * ## Why this is a closed vocabulary and not a template string
+ *
+ * A statement is BUILT, and building means escaping. Each language has its own literal rules and its
+ * own paging spelling, and a template with `{filter}` holes would put the escaping in the author's
+ * hands — an injection surface in a file nobody reviews as one. The engine builds the statement and
+ * the vocabulary names which grammar to build.
+ *
+ * This is the same trade the OData compiler already makes for `$filter`: expressions are composed
+ * here, literals are escaped by one function, and no authored string reaches the wire uninspected.
+ */
+export var HttpApiQueryStatementLanguage;
+(function (HttpApiQueryStatementLanguage) {
+    /**
+     * Salesforce Object Query Language.
+     *
+     * spec-cite: Salesforce Developers, "SOQL and SOSL Reference" —
+     * https://developer.salesforce.com/docs/atlas.en-us.soql_sosl.meta/soql_sosl/
+     *
+     * `SELECT *` does not exist: every field is named, which the binding's `fieldMappings` and key
+     * fields already supply. Paging is by the response's own continuation rather than by `OFFSET`,
+     * which SOQL bounds at 2000 rows.
+     */
+    HttpApiQueryStatementLanguage["SOQL"] = "soql";
+    /**
+     * NetSuite SuiteQL — an SQL-92 dialect over its analytics schema.
+     *
+     * spec-cite: Oracle NetSuite, "SuiteQL" —
+     * https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_156257770590.html
+     *
+     * Paged by `limit` / `offset` QUERY parameters rather than inside the statement, which is why the
+     * statement declaration and `pagingParams` are independent.
+     */
+    HttpApiQueryStatementLanguage["SUITEQL"] = "suiteql";
+})(HttpApiQueryStatementLanguage || (HttpApiQueryStatementLanguage = {}));
+/**
+ * How a read member builds and sends a query STATEMENT (#1293).
+ *
+ * Declared per operation rather than per binding, because a vendor's `read` and `list` genuinely
+ * differ: Salesforce addresses one record at `/sobjects/Account/{key}` and queries collections
+ * through `/query`, and only the second is a statement at all.
  */
+export const HttpApiQueryStatementSpecSchema = z.object({
+    language: z.enum(HttpApiQueryStatementLanguage),
+    /**
+     * The parameter or body member the statement is placed in (`q` for both vendors surveyed).
+     *
+     * WHERE it lands is not declared, because the operation's own `method` already decides: a GET puts
+     * parameters in the query string and a POST puts them in the JSON body, which is what the request
+     * builder has always done. A `placement` field was drafted here and removed before it shipped — it
+     * would have been a second declaration of something the method already says, free to disagree with
+     * it. Salesforce is a GET with `?q=`, NetSuite a POST with `{"q": …}`, and neither needs to be told
+     * twice.
+     */
+    parameterName: z.string().min(1),
+    /**
+     * The object the statement selects FROM. Absent = the binding's `entityRef`, which is the ordinary
+     * case; present when the vendor's query schema names an object differently from its REST resource.
+     */
+    fromEntity: z.string().min(1).optional(),
+});
 export const HttpApiRestOperationSpecSchema = z.object({
     /** HTTP method for this read-family operation. */
     method: z.enum(HttpApiRestOperationMethod),
@@ -326,72 +362,61 @@ export const HttpApiRestOperationSpecSchema = z.object({
         rpcMethod: z.string().min(1),
     })
         .optional(),
-});
-/**
- * A REFERENCE into the PROVIDER's own operation catalogue, instead of restating the operation here
- * (S3a, #331 — the convergence {@link HttpApiRestOperationSpecSchema}'s JSDoc asked to be recorded
- * as a decision rather than performed implicitly).
- *
- * ## The split, and why it is not a merge
- *
- * The two schemas describe different things and both survive. A provider operation is VENDOR-
- * shaped: method, path, result path, how the vendor pages. An ETL read surface is RESOURCE-shaped:
- * which LOCAL field is translatable to which remote filter parameter, which parameter carries the
- * search text, which path token receives this resource's synthesized key. The vendor half is the
- * same for every resource that reads that vendor, and restating it per binding is how ten bindings
- * come to disagree about one API. The resource half cannot live on the provider, because a provider
- * has never heard of a local field name.
- *
- * So a reference carries the resource half and NAMES the vendor half. What it does not do is merge
- * the two concepts: an inline spec is still the right answer for a target no provider wraps.
- *
- * ## What a reference refuses
- *
- * The referenced operation must be a READ (`classification`) and must speak GET or POST. A read
- * surface that could reference a WRITE would let a LIST call delete rows, and the resource
- * repository's whole read-only stance (D3) would rest on nobody having authored it that way.
- */
-export const HttpApiRestOperationReferenceSchema = z.strictObject({
-    /** The `operationId` in the provider's own `rest.operations` catalogue. */
-    providerOperationId: z.string().min(1),
     /**
-     * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-     * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
+     * Read through a query STATEMENT rather than through filter parameters (#1293).
+     *
+     * Mutually exclusive with `filterParams` and `searchParam` in practice rather than by schema: a
+     * statement expresses its own predicates, so a declaration carrying both has said the same thing
+     * twice in two grammars. The compiler refuses that pairing, where it can name which one it was
+     * about to ignore.
      */
-    domain: z.string().min(1).optional(),
+    statement: HttpApiQueryStatementSpecSchema.optional(),
     /**
-     * The referenced operation's PATH parameter that receives this resource's synthesized key.
-     * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-     * collection member, where it is refused rather than ignored.
+     * Dot-path to a CONTINUATION URL in the response — Salesforce's `nextRecordsUrl` (#1293).
+     *
+     * Declared rather than sniffed, for the same reason `resultPath` is: response shapes vary per
+     * target and a wrong guess reads zero rows silently. Absent means the operation pages by
+     * `pagingParams` or not at all.
+     *
+     * A continuation is followed only on the target's OWN origin, exactly as the OData one is — the
+     * link comes from a remote response body and carries this deployment's credentials wherever it
+     * points.
      */
-    keyParameter: z.string().min(1).optional(),
+    cursorPath: z.string().min(1).optional(),
     /**
-     * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-     * spec, because the provider cannot know a local field name. Only fields listed here are
-     * translatable for this operation; everything else is refused at the adapter boundary.
+     * Headers this vendor requires on the request — NetSuite's `Prefer: transient` (#1293).
+     *
+     * VENDOR headers only. A credential never goes here: credentials come from the instance's access,
+     * and a header authored in a binding would be a second credential channel in a file that is
+     * committed. The compiler refuses an `authorization` key by name rather than trusting the author.
      */
-    filterParams: z.record(z.string().min(1), z.string().min(1)).optional(),
-    /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-    searchParam: z.string().min(1).optional(),
+    staticHeaders: z.record(z.string().min(1), z.string().min(1)).optional(),
 });
+/*
+ * ─── The catalogue REFERENCE form was REMOVED here (#1055 D10) ──────────────────────────────────
+ *
+ * A REST_JSON member could name an `operationId` in a PROVIDER's own `rest.operations` catalogue,
+ * so a resource's read surface reached into the connector lane for its shape. That is precisely the
+ * crossing D10 forbids: no runtime object, stored row, route, secret name, audit subject or
+ * specification serves both a system of record and a connector — and this one made a read depend on
+ * a provider's catalogue being loadable at request time.
+ *
+ * Nothing loses a capability. A REST_JSON binding declares its read members INLINE, typed against its
+ * vendor facet, which is what every authored binding does today: no REST_JSON system of record was
+ * ever declared against a catalogue, and the generic-REST simulator proof moves to a facet fixture.
+ *
+ * The convergence recorded above (#331) is what is being undone, and deliberately rather than by
+ * accident: stating the vendor half once per provider is a real saving for a CONNECTOR, and a
+ * category error for a system the application reads its OWN rows out of.
+ */
 /**
- * One read-surface member: the operation stated INLINE, or a REFERENCE into the provider's
- * catalogue.
+ * One read-surface member. An INLINE spec, and now only that.
  *
- * A plain union rather than a `kind`-discriminated one, deliberately: the two shapes are already
- * unambiguous (an inline spec has a required `method` and `pathTemplate`, a reference a required
- * `providerOperationId`, and neither satisfies the other), and adding a discriminator would have
- * meant editing every binding that exists today to say `kind: 'inline'` — churn on working
- * declarations to buy a slightly better parse error.
+ * Kept as a named alias rather than collapsed into {@link HttpApiRestOperationSpecSchema} at every
+ * use site: the members of a read surface are a concept in their own right, and a later form — a
+ * facet-declared operation shape — would arrive HERE rather than at each of its consumers.
  */
-export const HttpApiRestOperationDeclarationSchema = z.union([
-    HttpApiRestOperationSpecSchema,
-    HttpApiRestOperationReferenceSchema,
-]);
-/** Narrow a declared member to a catalogue reference. */
-export function isHttpApiRestOperationReference(declaration) {
-    return typeof declaration.providerOperationId === 'string';
-}
+export const HttpApiRestOperationDeclarationSchema = HttpApiRestOperationSpecSchema;
 /** The REST_JSON read-surface mapping: which lifecycle members exist remotely, and how. */
 export const HttpApiRestOperationsSchema = z.object({
     read: HttpApiRestOperationDeclarationSchema,
@@ -404,19 +429,6 @@ export const HttpApiRestOperationsSchema = z.object({
 // --------------------------------
 // Stance sub-declarations
 // --------------------------------
-/** Tenancy declaration — discriminated so each stance carries exactly its own obligations. */
-export const HttpApiTenancyDeclarationSchema = z.discriminatedUnion('stance', [
-    z.object({
-        stance: z.literal(HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN),
-        /** The remote field the engine's tenant-scope predicate is pushed down against. */
-        remoteScopeField: z.string().min(1),
-    }),
-    z.object({
-        stance: z.literal(HttpApiTenancyStance.SINGLE_TENANT_BINDING),
-        /** Why this binding is single-tenant — recorded, audited justification (R16). */
-        justification: z.string().min(1),
-    }),
-]);
 /**
  * HTTP methods a declared EXPLICIT erasure operation (stance 6b, REST_JSON) may use.
  *
@@ -495,38 +507,58 @@ export const HttpApiErasureDeclarationSchema = z.discriminatedUnion('stance', [
 // --------------------------------
 const httpApiResourceBindingBaseShape = {
     /**
-     * The external provider whose declared protocol configuration carries the base URL and whose
-     * credentials resolve through `ExternalProvidersRegistryBackendService` (decision D7 — no new
-     * secret store, no connection string on the resource config).
+     * The SYSTEM OF RECORD this resource lives in, by the NAME the application declared it under in
+     * `wildo.saas.config.ts` (`systemsOfRecord.<name>`, #1055).
+     *
+     * ## Why a name, and not a provider ref
+     *
+     * `providerRef` named a PROVIDER, and a provider's env-var names live in its module — so one ref
+     * was one deployment, and a second Odoo was unrepresentable. A name here is an INSTANCE: two
+     * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in the environment variables their
+     * names derive. It is also not a provider in any other sense (D10): nothing here is selected
+     * through the capability plane, carries a person's lent credential, or has an operation catalogue.
+     *
+     * ## What validates it, and where
+     *
+     * Not here, and not in the resource factory — the factory runs in the application's `shared-lib`,
+     * where the saas configuration is not in scope. The factory checks SHAPE; the boot registry checks
+     * that this name is DECLARED and that `dialect` below equals the instance's, at the first moment
+     * both are visible. That split is the honest one rather than a compromise.
      */
-    providerRef: z.string().min(1),
+    system: z.string().min(1),
     /**
      * The remote entity addressed by this binding — an OData entity-set name, or a logical name for
      * a REST_JSON surface. One binding, one remote entity set.
      */
     entityRef: z.string().min(1),
-    /**
-     * WHOSE ACCOUNT this binding spends, and ON WHOSE BEHALF — the two axes a provider also declares
-     * as `admissibleConnections`, so a binding and the provider it targets are compared in one
-     * vocabulary instead of through an adapter.
+    /*
+     * `connection` was here, and it is GONE (#1055 D12).
      *
-     * A SHAPE, not a target: the binding says `ORGANIZATION × USER`, and WHICH organization and
-     * WHICH member are supplied per call from the execution that triggered the read. A binding that
-     * named an instance would be a binding per tenant.
+     * It declared WHOSE ACCOUNT a binding spends — `ORGANIZATION × USER` and its siblings — which is a
+     * real question for a CONNECTOR, where a customer connects their own account. A system of record is
+     * not that: it is a deployment the application reads its own business rows out of, with its own
+     * service identity, and the only honest answer was always `APPLICATION × SERVICE`. A field with one
+     * legal value is a question nobody should be asked.
      *
-     * Defaults to the application acting as itself, which is what every binding authored before this
-     * field existed meant.
+     * The customer-connection case is case 2 of #1049 and keeps the connector resolver, untouched.
      */
-    connection: ExternalProvider_ConnectionShapeSchema.default({
-        ownerScope: ExternalProvider_Connection_OwnerScope.APPLICATION,
-        delegation: ExternalProvider_Connection_DelegationMode.SERVICE,
-    }),
     /** Ordered key declaration — the source of the synthesized engine-facing `_id` (paper A). */
     keyFields: z.array(HttpApiKeyFieldSchema).min(1),
     /** Non-key field name mappings; unlisted fields map by identity. */
     fieldMappings: z.array(HttpApiFieldMappingSchema).default([]),
-    /** Tenancy stance (R4/R16). */
-    tenancy: HttpApiTenancyDeclarationSchema,
+    /*
+     * `tenancy` was here, and it is GONE (#1055 §5).
+     *
+     * Both of its stances were wrong for a system of record. `SCOPE_FILTER_PUSHDOWN` sent WILDO's own
+     * organization id to the remote as a filter value — an id the remote has never heard of — and
+     * `SINGLE_TENANT_BINDING` became the only truth, which makes it a declaration with one legal answer.
+     *
+     * What replaced it is not a smaller field but a different mechanism: the row projector STAMPS the
+     * owner organization's id onto every remote row, so the per-row tenant gate passes with no exemption
+     * and a read under another organization's URL is refused by the gate that already existed.
+     * Partitioning a system of record BY organization unit returns in #1058, as a property of the
+     * INSTANCE and its vendor facet rather than of each binding.
+     */
     /** Erasure stance (D6) — required; no silent default. */
     erasure: HttpApiErasureDeclarationSchema,
     /** Remote-call semantics (D10/R15). */
@@ -534,24 +566,35 @@ const httpApiResourceBindingBaseShape = {
         timeoutMs: 10_000,
         retry: { maxAttempts: 2, backoffMs: 500 },
         maxIdSetSize: 50,
+        maxPartitionSetSize: 200,
     }),
 };
 /**
  * The HTTP_API resource binding — discriminated on the transport dialect so each dialect carries
- * exactly its own obligations: ODATA is generic (plus an optional `$metadata` probe opt-out for
- * targets that do not serve one); REST_JSON must declare its whole read surface.
+ * exactly its own obligations: ODATA and ODOO_JSONRPC are generic (the model name IS `entityRef`, and
+ * read/list/count map mechanically); REST_JSON must declare its whole read surface INLINE.
+ *
+ * Every arm carries `system` — the declared instance this resource lives in — and none carries a
+ * provider, a connection shape or a tenancy stance. See the base shape above for what each of those
+ * was and why none was replaced by a smaller field (#1055).
  */
 /** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
 export const HttpApiResourceBindingSchema = z.discriminatedUnion('dialect', [
     z.object({
         dialect: z.literal(HttpApiTransportDialect.ODATA),
         ...httpApiResourceBindingBaseShape,
-        /**
-         * Verify the committed declaration against the live `$metadata` at boot (decision D5 —
-         * drift is detected at boot and the fix is re-authoring, never silent adaptation). Opt out
-         * only for targets that genuinely do not serve `$metadata`.
+        /*
+         * `verifyMetadataAtBoot` was here, and it is GONE (#1055 §5).
+         *
+         * It had ZERO non-test readers — measured, not assumed — so nothing ever probed `$metadata` at
+         * boot whatever it was set to. It also asked for exactly what the registry above it must never
+         * do: dial the remote during startup, where an ERP outage would stop an application booting
+         * (`continuity-drift-and-cas-basis.md` Rule 3).
+         *
+         * The drift probe it promised EXISTS, on the extraction source, reached through the operator door
+         * (`external-data-extraction-source.backend.ts`) — where a human is present and a refusal is
+         * something somebody can act on.
          */
-        verifyMetadataAtBoot: z.boolean().default(true),
     }),
     z.object({
         dialect: z.literal(HttpApiTransportDialect.REST_JSON),
@@ -583,18 +626,25 @@ export function assertHttpApiBindingDialectCoherence(binding) {
             throw new Error("keyFields: an ODOO_JSONRPC binding must declare exactly one key field with the INTEGER codec — Odoo row ids are integers ('id').");
         }
     }
-    // A read member must be ONE form or the other. The union parses an object carrying both as an
-    // INLINE spec (the first branch that matches wins) and drops the reference without a word — an
-    // author who wrote `providerOperationId` beside a `method` believes it does something, so the
-    // ambiguity is refused at authoring rather than resolved by branch order at parse time.
+    /*
+     * A member naming a PROVIDER's catalogue operation is refused, and refused EXPLICITLY (#1055 D10).
+     *
+     * The schema alone would refuse it as an unknown key, with a message about `providerOperationId`
+     * not being expected — true, and useless to an author who reasonably believes the form still
+     * exists, because it did until this slice. So the refusal names what happened and where the shape
+     * went instead of letting the parse error carry it.
+     *
+     * This replaces an ambiguity check that existed for the opposite reason: while BOTH forms were
+     * legal, a member carrying both parsed as the inline one and dropped the reference silently.
+     */
     if (binding.dialect === HttpApiTransportDialect.REST_JSON) {
         for (const [member, declaration] of Object.entries(binding.operations)) {
             if (declaration === undefined)
                 continue;
-            const asAny = declaration;
-            if (asAny.providerOperationId !== undefined && asAny.method !== undefined) {
-                throw new Error(`operations.${member}: a read member is either stated INLINE (method + pathTemplate) or a REFERENCE `
-                    + '(providerOperationId) into the provider\'s operation catalogue — never both.');
+            if (declaration.providerOperationId !== undefined) {
+                throw new Error(`operations.${member}: a read member can no longer REFERENCE a provider's operation catalogue `
+                    + '(`providerOperationId`). A system of record is not a connector, so its read surface is declared '
+                    + 'INLINE here (method + pathTemplate) against the vendor facet.');
             }
         }
     }