@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.d.ts

@@ -10,124 +10,32 @@
  *
  * The binding is a REQUIRED companion declaration on any resource configuration that selects
  * `PersistenceAdapter.HTTP_API`. It answers, statically and per resource:
- * - WHERE the rows live (provider + entity), and in which transport dialect they are queried;
+ * - WHICH declared system of record the rows live in (`system`), and WHICH remote entity inside it;
  * - HOW a row is identified (ordered key components → the synthesized engine-facing `_id`);
- * - WHOSE identity reaches the target system (service principal vs per-user delegation);
- * - HOW tenancy confinement is expressed remotely — or the explicit single-tenant stance;
  * - WHAT the erasure story is (all three stances are first-class; none is silently defaulted);
  * - WHICH remote-call semantics apply (timeout, retry, rate budget, id-set bound).
  *
- * Credentials are NEVER declared here. They resolve at runtime through
- * `ExternalProvidersRegistryBackendService` against the `providerRef`, exactly as email, SMS and
- * billing providers do — the binding carries only the reference (plan decision D7).
+ * ## Three questions this used to answer and no longer does (#1055)
+ *
+ * WHOSE ACCOUNT (`connection`), WHERE the deployment is (`providerRef`) and HOW TENANCY is expressed
+ * remotely (`tenancy`) all left in the same change, and none of them was replaced by a smaller field:
+ *
+ * - WHOSE ACCOUNT has one legal answer for a system of record — the application's own service
+ *   identity (D12). The customer-connection case is case 2 of #1049 and keeps the connector lane.
+ * - WHERE is a property of the declared INSTANCE (`systemsOfRecord.<name>`) and of the ENVIRONMENT,
+ *   not of each resource. That is what lets two instances of one vendor exist at all.
+ * - TENANCY became a STAMP rather than a declaration: the row projector writes the owner
+ *   organization's id onto every remote row, so the per-row gate passes with no exemption.
+ *
+ * Credentials are NEVER declared here. They resolve at runtime through the systems-of-record
+ * registry, from environment variables DERIVED from the instance name — the binding carries only the
+ * name.
  */
 import { z } from 'zod';
-import { ExternalProvider_Connection_DelegationMode, ExternalProvider_Connection_OwnerScope } from '@wildo-ai/external-connectors-models';
-/**
- * The query dialect the adapter speaks toward the target system. Closed vocabulary (slice 1);
- * SOAP is a possible later member over the same HTTP transport, and a direct-database kind would
- * be a NEW `PersistenceAdapter` member, never a dialect here.
- */
+import { HttpApiTransportDialect } from './http-api-transport-dialect.shared';
+import { HttpApiErasureStance } from './http-api-erasure-stance.shared';
+import { HttpApiRestWriteMethod } from './http-api-rest-write-operations.shared.schemas';
 /** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
-export declare enum HttpApiTransportDialect {
-    /**
-     * OData **v4** — one generic client: mechanical pushdown of
-     * `$filter`/`$select`/`$top`/`$skip`/`$orderby`/`$count`, with a `$metadata` boot-time
-     * verification probe of the committed declaration.
-     *
-     * ⚠ **This member is v4 ONLY, and that excludes SAP's most-used API.** An earlier revision of
-     * this comment named "SAP S/4HANA, Microsoft Dataverse/Dynamics 365" here, which is half right
-     * and was load-bearing — it is why nobody looked:
-     *
-     * | Target | Version | Consumable today |
-     * |---|---|---|
-     * | Microsoft Dataverse / Dynamics 365 Web API (`/api/data/v9.2/`) | v4 | ✅ |
-     * | SAP S/4HANA OData **v4** services (`/sap/opu/odata4/…`) | v4 | ✅ |
-     * | SAP `API_BUSINESS_PARTNER` (`/sap/opu/odata/sap/API_BUSINESS_PARTNER`) | **v2** | ❌ |
-     *
-     * v2 is not a v4 variant with a different header. Its collection envelope is
-     * `{ "d": { "results": [...], "__next": …, "__count": … } }` rather than
-     * `{ "value": [...], "@odata.nextLink": … }`; `Edm.DateTime` serializes as `"/Date(<ticks>)/"`
-     * rather than ISO 8601; `Edm.Decimal` and `Edm.Int64` serialize as JSON STRINGS rather than
-     * numbers; and JSON must be requested (`$format=json`) because v2 defaults to Atom/XML. So it
-     * changes the envelope, the paging property, the count property AND the value encoding — a
-     * reader written for one cannot read the other, and the mapping layer needs coercions the way
-     * Odoo needs `ODOO_FALSE_AS_NULL`.
-     * spec-cite: OData Version 2.0 JSON Format
-     * (https://www.odata.org/documentation/odata-version-2-0/json-format/) — the `d`/`results`/
-     * `__next`/`__count` envelope, the `/Date(<ticks>)/` DateTime literal, and Edm.Decimal /
-     * Edm.Int64 "formatted as a JSON string".
-     *
-     * Supporting v2 is an OPEN decision, not an oversight. Until it lands, point an ODATA binding at
-     * a v4 service: for SAP that means the OData v4 edition of the API where one is published.
-     */
-    ODATA = "odata",
-    /**
-     * Declared per-binding REST/JSON operation mapping (bespoke enterprise APIs). Unlike ODATA
-     * there is no generic client: each binding declares how read/list/count/search map onto
-     * concrete HTTP operations.
-     */
-    REST_JSON = "rest-json",
-    /**
-     * Odoo's external API (`/jsonrpc` + `execute_kw`). Promoted to its OWN dialect 2026-08-27 —
-     * D0's original "JSON-RPC is a thin envelope variant of REST_JSON" was corrected by measuring
-     * the protocol: it is generic like ODATA (no per-binding operation declarations — the model
-     * name IS `entityRef`, and read/list/count map onto `read`/`search_read`/`search_count`
-     * mechanically), but it speaks POSITIONAL arguments, its own domain filter language
-     * (`[['field','=',value], …]` with polish-notation `'|'` disjunction), and authenticates
-     * INSIDE the RPC args (`execute_kw(db, uid, api_key, …)`) rather than via HTTP headers.
-     * Forcing that through REST_JSON's declared-parameter model would have been the
-     * merge-distinct-concepts failure `design-philosophy.md` forbids.
-     *
-     * Structural constraint (schema-enforced): exactly ONE key field with the `INTEGER` codec —
-     * Odoo row ids are integers, always.
-     */
-    ODOO_JSONRPC = "odoo-jsonrpc"
-}
-/**
- * The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class
- * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a
- * registration refusal, because `exportSubject` is a fail-closed obligation on every resource and
- * "we cannot delete rows we do not own" is not an answer the framework may imply silently.
- */
-export declare enum HttpApiErasureStance {
-    /**
-     * (6a) The resource declares it holds NO personal/subject data. Registration verifies the
-     * declaration is coherent (e.g. `exportSubject` posture) and erasure is structurally N/A for
-     * the remote rows.
-     */
-    NO_SUBJECT_DATA = "no-subject-data",
-    /**
-     * (6b) The binding declares HOW erasure reaches the foreign system: one named API operation the
-     * engine invokes on a subject-erasure request. This is a single declared write and does NOT
-     * require general write support (slice 1 stays read-only otherwise).
-     */
-    EXTERNAL_ERASURE_OPERATION = "external-erasure-operation",
-    /**
-     * (6c) Erasure REFUSES by default; an explicit, per-request, audited controller acknowledgement
-     * lets it proceed and records the un-erased remote rows at high severity. Mirrors the existing
-     * administrative-floor acknowledgement shape (`administrative-continuity-floors.md`): the record
-     * is the control. NEVER a standing default — the acknowledgement is per erasure request.
-     */
-    CONTROLLER_ACKNOWLEDGED_NON_ERASURE = "controller-acknowledged-non-erasure"
-}
-/**
- * How tenant confinement is enforced against the remote system (requirements R4/R16).
- */
-export declare enum HttpApiTenancyStance {
-    /**
-     * The engine's contextual scope predicate is pushed down into every remote query against a
-     * declared remote field. Registration REFUSES a binding whose declared surface cannot express
-     * the scope predicate — a query-time refusal would be a data leak one missed branch away.
-     */
-    SCOPE_FILTER_PUSHDOWN = "scope-filter-pushdown",
-    /**
-     * The binding declares the target system serves exactly ONE tenant (the normal case for an
-     * internal tool on one enterprise's IS). Scope pushdown is then N/A by declaration — an
-     * explicit, audited stance, never an inferred one (R16).
-     */
-    SINGLE_TENANT_BINDING = "single-tenant-binding"
-}
 /**
  * Per-component value normalization for key synthesis. The codec is what makes the synthesized
  * `_id` STABLE: every component must round-trip byte-identically between the remote
@@ -151,6 +59,77 @@ export declare enum HttpApiKeyComponentCodec {
      */
     DATETIME_ISO = "datetime-iso"
 }
+/**
+ * A row-level write a read-through resource may send to its system of record.
+ *
+ * Three members and no bulk ones, deliberately. A bulk write against a system the platform does not
+ * own has no atomicity to offer — ten rows are ten remote calls, any of which can fail after the ones
+ * before it landed — so the engine opens single-row create, update and delete by key, and nothing
+ * else. `createMany`, `updateMany`, `deleteMany`, the guarded atomic primitives and the raw-filter
+ * doors stay refused by name on the repository.
+ *
+ * ## Why the binding declares them at all, when the resource already lists its operations
+ *
+ * Because opening a write door into somebody else's ERP is a decision of its own, taken where the
+ * remote contract is written. The resource's operation list says which HTTP routes exist; this says
+ * the binding may WRITE through them. The resource factory refuses the two disagreeing in EITHER
+ * direction — a write operation whose verb the binding does not open, and an opened verb no operation
+ * uses — so the second declaration can never drift from the first into an inert door or an open one.
+ *
+ * Absent is empty: every binding written before #1679 stays read-only without a change.
+ */
+export declare enum HttpApiWriteVerb {
+    /** A new remote row. The engine derives its partition from the caller's organization unit. */
+    CREATE = "create",
+    /** A change to one remote row, addressed by its synthesized id. Read first, then written. */
+    UPDATE = "update",
+    /** The removal of one remote row, addressed by its synthesized id. Read first, then deleted. */
+    DELETE = "delete"
+}
+/**
+ * What protects an UPDATE against overwriting a change made since its author read the row (#1724, #1726, #1728) —
+ * declared by every binding that opens UPDATE, whatever its dialect (ODOO_JSONRPC, ODATA, REST_JSON).
+ *
+ * ## Why a binding must say this at all
+ *
+ * An update that carries no version is last-writer-wins, whatever the vendor could have offered: Odoo's external API
+ * applies `write(ids, vals)` unconditionally, a REST_JSON write is sent with no precondition, and an OData service
+ * applies a `PATCH` whose `If-Match` matches — which a caller who never read the row cannot make match anything but
+ * `*`. A default nobody chose is a lost update nobody expects, so a binding that opens UPDATE states which of the two it
+ * accepts, and the factory refuses the omission.
+ *
+ * ## What VERSION_CHECKED is, honestly — it depends on the dialect
+ *
+ * The caller sends the row version it read (the local field named by `versionField`, mapped onto the vendor's
+ * `rowVersionField` — Odoo `write_date`, an OData service's `@odata.etag`). The engine reads the row just before
+ * writing it — the read it already makes to check the partition — and refuses the update when the versions differ,
+ * before anything is sent. Then:
+ *
+ * - **Odoo: best-effort.** Odoo takes no precondition, so the comparison and the write are two calls. That NARROWS the
+ *   race to the gap between them; it does NOT close it. A change landing inside that gap is overwritten, and a vendor
+ *   that serves its version coarsely (Odoo: to the second) cannot tell two changes in the same second apart.
+ * - **REST_JSON: best-effort, as on Odoo** — the write is sent as declared, with no precondition. It is available only
+ *   where the vendor facet declares a `rowVersionField`; neither the Salesforce nor the NetSuite facet does, so a
+ *   binding against them states LAST_WRITER_WINS (startup refuses VERSION_CHECKED there).
+ * - **OData: atomic.** The version is also sent as `If-Match`, so the SERVICE compares it with the row it is about to
+ *   change and answers `412 Precondition Failed` without applying anything when it moved — the gap is closed by the
+ *   vendor, not narrowed by the engine.
+ *   spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match).
+ */
+export declare enum HttpApiWriteConcurrencyMode {
+    /**
+     * Every UPDATE carries the version its author read, and a stale one is refused before sending. Best-effort on Odoo
+     * and REST_JSON; atomic on OData, where the version also travels as `If-Match`.
+     */
+    VERSION_CHECKED = "version-checked",
+    /**
+     * No check against the version the CALLER read: the last update sent wins. Stated, so it is a decision rather than an
+     * accident. On OData the engine still sends the entity tag of the row it read first (or `*` when the row carries
+     * none), so a row that moved between that read and the write is refused, and a row deleted in between is never
+     * re-created by an upsert.
+     */
+    LAST_WRITER_WINS = "last-writer-wins"
+}
 /** @wildo_source:part:end saas.models.http-api-binding */
 /**
  * One ordered component of the remote entity's key. `keyFields` order is the ENCODING order —
@@ -164,14 +143,52 @@ export declare const HttpApiKeyFieldSchema: z.ZodObject<{
     codec: z.ZodEnum<typeof HttpApiKeyComponentCodec>;
 }, z.core.$strip>;
 export type HttpApiKeyField = z.infer<typeof HttpApiKeyFieldSchema>;
+/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
+/**
+ * What kind of TEMPORAL value a remote field holds, when a query statement compares it (#1972).
+ *
+ * A statement language spells a date and a date-time differently, and neither accepts a quoted string:
+ *
+ * | language | `DATE` | `DATE_TIME` |
+ * |---|---|---|
+ * | SOQL | `2026-01-05` (unquoted) | `2026-01-05T10:00:00Z` (unquoted, whole seconds) |
+ * | SuiteQL | `TO_DATE('2026-01-05', 'YYYY-MM-DD')` ¹ | `TO_DATE('2026-01-05 10:00:00', 'YYYY-MM-DD HH24:MI:SS')` |
+ *
+ * ¹ spec-cite: N/A — the date-only mask is Oracle SQL's `TO_DATE` convention (SuiteQL is SQL-92 / Oracle SQL);
+ * NetSuite's page shows only the date-time mask cited below.
+ *
+ * Which one a field needs is a fact about the REMOTE column that nothing in a local `Date` carries, so a
+ * statement read that filters a date field DECLARES it; a date compared with an undeclared field is refused
+ * rather than guessed, because the wrong form is refused by the vendor or silently compares as text.
+ * spec-cite: Salesforce, "SOQL and SOSL Reference" v68.0, WHERE › "Date Formats and Date Literals in WHERE" —
+ * `WHERE CreatedDate > 2005-10-08T01:02:03Z`; `date YYYY-MM-DD`; `dateTime YYYY-MM-DDThh:mm:ss+hh:mm,
+ * YYYY-MM-DDThh:mm:ss-hh:mm, or YYYY-MM-DDThh:mm:ssZ`.
+ * spec-cite: Oracle NetSuite, "SuiteQL Performance and Best Practices" (article_0824094533) — "You can't use date
+ * literals. You must encapsulate dates using the `to_date()` function."; "Do not use plain string values for date
+ * comparisons."; `where lastmodifieddate >= TO_DATE('2024-01-01 00:00:00', 'yyyy-mm-dd hh24:mi:ss')`.
+ *
+ * Read by the REST_JSON STATEMENT compilers only; declared on another dialect, or on a REST_JSON binding none of
+ * whose read members is a statement, it would change nothing, so the binding coherence refuses it there.
+ */
+export declare enum HttpApiRemoteTemporalKind {
+    /** A calendar date with no time — SOQL `date`, a NetSuite date column. */
+    DATE = "date",
+    /** An instant — SOQL `dateTime`, a NetSuite datetime column. */
+    DATE_TIME = "date-time"
+}
 /**
  * Local-to-remote field name mapping for fields whose names differ. Fields not listed map by
  * identity (same name both sides). Key components are declared in `keyFields`, not here.
+ *
+ * A REST_JSON statement read that FILTERS a temporal field lists it here — with the same name on both sides
+ * when they agree — to declare its `temporalKind`.
  */
 export declare const HttpApiFieldMappingSchema: z.ZodObject<{
     localField: z.ZodString;
     remoteField: z.ZodString;
+    temporalKind: z.ZodOptional<z.ZodEnum<typeof HttpApiRemoteTemporalKind>>;
 }, z.core.$strip>;
+/** @wildo_source:part:end saas.models.http-api-binding */
 export type HttpApiFieldMapping = z.infer<typeof HttpApiFieldMappingSchema>;
 /**
  * Declared remote-call semantics. An enterprise API is 100ms–2s, rate-limited, and sometimes
@@ -186,19 +203,33 @@ export declare const HttpApiRemoteCallSemanticsSchema: z.ZodObject<{
     }, z.core.$strip>>;
     maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
     maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+    maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strip>;
 export type HttpApiRemoteCallSemantics = z.infer<typeof HttpApiRemoteCallSemanticsSchema>;
 /**
  * HTTP methods a declared read-family operation may use. Deliberately NOT the full HTTP verb set
  * (`API_HttpMethod` in `@wildo-ai/external-connectors-models` describes provider-protocol
- * operations): slice 1 is read-only, so the closed vocabulary is the read-safe verb plus POST —
+ * operations): these are READ members, so the closed vocabulary is the read-safe verb plus POST —
  * because JSON-RPC (Odoo) and many enterprise search endpoints are POST-shaped even for reads.
- * Write verbs (PUT/PATCH/DELETE) enter only with the D4 write story, as their own decision.
+ * Row writes are opened by `writableVerbs` (#1679) and framed by each dialect's write compiler; a
+ * REST_JSON write surface is its own declaration (#1728), never a widening of this enum.
  */
 export declare enum HttpApiRestOperationMethod {
     GET = "GET",
     POST = "POST"
 }
+/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
+/**
+ * Where a declared REST parameter is placed on the request, when the method's own answer is wrong for it (#1686).
+ */
+export declare enum HttpApiRestParameterPlacement {
+    /**
+     * The URL query string, whatever the method — NetSuite's SuiteQL `limit` and `offset` on a POST.
+     * spec-cite: Oracle NetSuite, "Executing SuiteQL Queries Through REST Web Services" (section_157909186990) — the
+     * statement is POSTed as `{"q": …}` and paged by `?limit=10&offset=10` on the request URL.
+     */
+    QUERY_STRING = "query-string"
+}
 /**
  * REST_JSON per-operation declaration: how one read-family member maps onto a concrete HTTP
  * operation. Deliberately minimal in slice 1 — pagination/filter parameter NAMES are declared,
@@ -214,20 +245,165 @@ export declare enum HttpApiRestOperationMethod {
  * — ten exported symbols with zero code readers — was deleted in #331 rather than wired up, so
  * "what a provider can do" has one description instead of two.)
  *
- * The convergence this JSDoc asked to be RECORDED rather than performed implicitly happened in
- * S3a (#331), and it is not the merge that sentence was written to prevent. A member of
- * {@link HttpApiRestOperationsSchema} may now be a {@link HttpApiRestOperationReferenceSchema}
- * naming an operation in the PROVIDER's own `rest.operations` catalogue — the vendor half stated
- * once per provider, the resource half (local-field filter mapping, search parameter, which path
- * token takes the key) still stated here, because a provider has never heard of a local field
- * name. Both forms stay: an inline spec is still the right answer for a target no provider wraps.
+ * The convergence performed in S3a (#331) — a member naming an operation in a PROVIDER's own
+ * catalogue — was UNDONE in #1055. A system of record is not a connector (D10), and a read that
+ * depends on a provider catalogue being loadable is the crossing that decision forbids. An inline
+ * spec is now the only form, which is what every authored binding used anyway.
  */
+/**
+ * A query LANGUAGE a REST system of record reads through, rather than a set of filter parameters
+ * (#1293).
+ *
+ * Two vendors read this way and neither can be expressed as parameters: Salesforce takes SOQL and
+ * NetSuite takes SuiteQL, each as ONE statement naming the fields, the entity, the predicates and
+ * the order. A `filterParams` map cannot say "SELECT these columns FROM that object", so without this
+ * neither vendor can be declared at all.
+ *
+ * ## Why this is a closed vocabulary and not a template string
+ *
+ * A statement is BUILT, and building means escaping. Each language has its own literal rules and its
+ * own paging spelling, and a template with `{filter}` holes would put the escaping in the author's
+ * hands — an injection surface in a file nobody reviews as one. The engine builds the statement and
+ * the vocabulary names which grammar to build.
+ *
+ * This is the same trade the OData compiler already makes for `$filter`: expressions are composed
+ * here, literals are escaped by one function, and no authored string reaches the wire uninspected.
+ */
+export declare enum HttpApiQueryStatementLanguage {
+    /**
+     * Salesforce Object Query Language.
+     *
+     * spec-cite: Salesforce Developers, "SOQL and SOSL Reference" —
+     * https://developer.salesforce.com/docs/atlas.en-us.soql_sosl.meta/soql_sosl/
+     *
+     * `SELECT *` does not exist: every field is named, which the binding's `fieldMappings` and key
+     * fields already supply. Paging is by the response's own continuation rather than by `OFFSET`,
+     * which SOQL bounds at 2000 rows.
+     */
+    SOQL = "soql",
+    /**
+     * NetSuite SuiteQL — an SQL-92 dialect over its analytics schema.
+     *
+     * spec-cite: Oracle NetSuite, "SuiteQL" —
+     * https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_156257770590.html
+     *
+     * Paged by `limit` / `offset` QUERY parameters rather than inside the statement, which is why the
+     * statement declaration and `pagingParams` are independent.
+     */
+    SUITEQL = "suiteql"
+}
+/**
+ * Where a KEYSET page's size bound goes, per statement language (#1686).
+ *
+ * A keyset page is "the next N rows after the last key", so the statement's predicate and order are
+ * the same in every language — `<key> > <last key> … ORDER BY <key> ASC` — and only the size bound
+ * differs. Decided by the LANGUAGE, never declared by an author: it is a fact about the grammar.
+ */
+export declare enum HttpApiKeysetPageBound {
+    /**
+     * The statement carries `LIMIT <n>` itself — SOQL, which has no size parameter on `/query`.
+     *
+     * The vendor may still split the limited result into several BATCHES and answer the first one with
+     * a continuation (`nextRecordsUrl`), so a keyset page on this bound follows the operation's declared
+     * `cursorPath` inside the page until the result is exhausted — which is why the bound requires one.
+     * Without it, a batch shorter than the limit would read as the end of the pass and every row after
+     * it would go unread, and a DELETE orphan policy would then delete them.
+     * spec-cite: Salesforce REST API Developer Guide v68.0, "Query" — "up to 2,000 records can be returned
+     * at a time … the returned batch can include fewer records than the limit or what's set in the
+     * request … If the total number of results exceeds the limit or the requested number of results, the
+     * response contains the first batch of records, a false value for done, and a query locator."
+     */
+    STATEMENT_LIMIT_CLAUSE = "statement-limit-clause",
+    /**
+     * The operation's declared `pagingParams.limitParam` carries the size, and its `offsetParam` is sent
+     * as 0 on every page — SuiteQL, which pages by `limit`/`offset` query parameters.
+     *
+     * Offset 0 always: each page is a NEW query that starts after the last key, so no offset is ever
+     * needed, and none of the offset rules (an offset divisible by the limit, the result ceiling) is
+     * ever reached.
+     * spec-cite: Oracle NetSuite, "Collection Paging" (section_156414087576) — "You can only set offset
+     * and limit values in a way that the offset is divisible by the limit"; "Executing SuiteQL Queries
+     * Through REST Web Services" (section_157909186990) — "Using SuiteQL queries, you can return a
+     * maximum of 100,000 results."
+     */
+    LIMIT_PARAMETER = "limit-parameter"
+}
+/** The page bound of each statement language. A `Record` over the enum, so a new language is a compile error until it has one. */
+export declare const HTTP_API_KEYSET_PAGE_BOUND: Readonly<Record<HttpApiQueryStatementLanguage, HttpApiKeysetPageBound>>;
+/**
+ * The key codecs a keyset may walk (#1686): an INTEGER compares as a number and a STRING by code
+ * unit, and the engine CHECKS every served page against that order before trusting its last key.
+ *
+ * GUID and DATETIME_ISO are refused. A GUID has no order the vendors agree on — SQL Server sorts a
+ * `uniqueidentifier` by its last bytes first — so a page could never be checked; a datetime is not
+ * unique, and a keyset on a non-unique column skips the rows that share the boundary value.
+ */
+export declare const HTTP_API_KEYSET_ELIGIBLE_CODECS: readonly HttpApiKeyComponentCodec[];
+/**
+ * A declared KEYSET on a statement read (#1686) — what lets a REST system of record feed a pipeline.
+ *
+ * ## What it makes the engine build
+ *
+ * For the pipeline's extraction, the `list` member's statement becomes
+ *
+ * ```
+ * SELECT <mapped fields> FROM <entity> WHERE <sourceFilter> AND <key> > <last key> ORDER BY <key> ASC
+ * ```
+ *
+ * with the page size bounded per {@link HttpApiKeysetPageBound} (SOQL `LIMIT <n>`; SuiteQL
+ * `limit=<n>&offset=0`). The last key of each page is the pipeline's persisted cursor, and a page
+ * shorter than asked ends the pass — the Odoo id-keyset discipline, drift-safe for the same reason: a
+ * row inserted or deleted mid-pass never shifts the rows after the cursor, so none is skipped or read
+ * twice. Offset paging has neither property, which is why a REST source without a keyset stays
+ * refused.
+ *
+ * ## Why there is no cursor PLACEHOLDER to write
+ *
+ * The statement is BUILT by the engine (#1293), never templated by an author, so there is nowhere for a
+ * `:cursor` placeholder to go and no ORDER BY an author could forget: declaring the keyset is what puts
+ * both into the statement, and the engine writes them itself. What an author declares is only which
+ * column the walk runs on.
+ *
+ * ## Which column
+ *
+ * The binding's ONE key field — unique and immutable, which is what a keyset needs. Named by its
+ * remote field; its codec is the key field's own, so the two cannot disagree. A composite key is
+ * refused: one component of it is not unique.
+ *
+ * ## A vendor continuation is followed INSIDE a page, never persisted
+ *
+ * Salesforce's `nextRecordsUrl` names a server-side query locator. How long a locator lives is not
+ * stated in the REST API guide (UNVERIFIED), so it is never the cross-run cursor: the key is.
+ */
+export declare const HttpApiQueryStatementKeysetSchema: z.ZodObject<{
+    /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+    keyRemoteField: z.ZodString;
+}, z.core.$strict>;
+export type HttpApiQueryStatementKeyset = z.infer<typeof HttpApiQueryStatementKeysetSchema>;
+/**
+ * How a read member builds and sends a query STATEMENT (#1293).
+ *
+ * Declared per operation rather than per binding, because a vendor's `read` and `list` genuinely
+ * differ: Salesforce addresses one record at `/sobjects/Account/{key}` and queries collections
+ * through `/query`, and only the second is a statement at all.
+ */
+export declare const HttpApiQueryStatementSpecSchema: z.ZodObject<{
+    language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+    parameterName: z.ZodString;
+    fromEntity: z.ZodOptional<z.ZodString>;
+    keyset: z.ZodOptional<z.ZodObject<{
+        /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+        keyRemoteField: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strip>;
+export type HttpApiQueryStatementSpec = z.infer<typeof HttpApiQueryStatementSpecSchema>;
 export declare const HttpApiRestOperationSpecSchema: z.ZodObject<{
     method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
     pathTemplate: z.ZodString;
     pagingParams: z.ZodOptional<z.ZodObject<{
         limitParam: z.ZodString;
         offsetParam: z.ZodString;
+        placement: z.ZodOptional<z.ZodEnum<typeof HttpApiRestParameterPlacement>>;
     }, z.core.$strip>>;
     filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     searchParam: z.ZodOptional<z.ZodString>;
@@ -235,72 +411,34 @@ export declare const HttpApiRestOperationSpecSchema: z.ZodObject<{
     jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
         rpcMethod: z.ZodString;
     }, z.core.$strip>>;
+    statement: z.ZodOptional<z.ZodObject<{
+        language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+        parameterName: z.ZodString;
+        fromEntity: z.ZodOptional<z.ZodString>;
+        keyset: z.ZodOptional<z.ZodObject<{
+            /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+            keyRemoteField: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strip>>;
+    cursorPath: z.ZodOptional<z.ZodString>;
+    staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;
 export type HttpApiRestOperationSpec = z.infer<typeof HttpApiRestOperationSpecSchema>;
+/** @wildo_source:part:end saas.models.http-api-binding */
 /**
- * A REFERENCE into the PROVIDER's own operation catalogue, instead of restating the operation here
- * (S3a, #331 — the convergence {@link HttpApiRestOperationSpecSchema}'s JSDoc asked to be recorded
- * as a decision rather than performed implicitly).
- *
- * ## The split, and why it is not a merge
- *
- * The two schemas describe different things and both survive. A provider operation is VENDOR-
- * shaped: method, path, result path, how the vendor pages. An ETL read surface is RESOURCE-shaped:
- * which LOCAL field is translatable to which remote filter parameter, which parameter carries the
- * search text, which path token receives this resource's synthesized key. The vendor half is the
- * same for every resource that reads that vendor, and restating it per binding is how ten bindings
- * come to disagree about one API. The resource half cannot live on the provider, because a provider
- * has never heard of a local field name.
- *
- * So a reference carries the resource half and NAMES the vendor half. What it does not do is merge
- * the two concepts: an inline spec is still the right answer for a target no provider wraps.
+ * One read-surface member. An INLINE spec, and now only that.
  *
- * ## What a reference refuses
- *
- * The referenced operation must be a READ (`classification`) and must speak GET or POST. A read
- * surface that could reference a WRITE would let a LIST call delete rows, and the resource
- * repository's whole read-only stance (D3) would rest on nobody having authored it that way.
- */
-export declare const HttpApiRestOperationReferenceSchema: z.ZodObject<{
-    /** The `operationId` in the provider's own `rest.operations` catalogue. */
-    providerOperationId: z.ZodString;
-    /**
-     * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-     * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-     */
-    domain: z.ZodOptional<z.ZodString>;
-    /**
-     * The referenced operation's PATH parameter that receives this resource's synthesized key.
-     * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-     * collection member, where it is refused rather than ignored.
-     */
-    keyParameter: z.ZodOptional<z.ZodString>;
-    /**
-     * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-     * spec, because the provider cannot know a local field name. Only fields listed here are
-     * translatable for this operation; everything else is refused at the adapter boundary.
-     */
-    filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-    searchParam: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-export type HttpApiRestOperationReference = z.infer<typeof HttpApiRestOperationReferenceSchema>;
-/**
- * One read-surface member: the operation stated INLINE, or a REFERENCE into the provider's
- * catalogue.
- *
- * A plain union rather than a `kind`-discriminated one, deliberately: the two shapes are already
- * unambiguous (an inline spec has a required `method` and `pathTemplate`, a reference a required
- * `providerOperationId`, and neither satisfies the other), and adding a discriminator would have
- * meant editing every binding that exists today to say `kind: 'inline'` — churn on working
- * declarations to buy a slightly better parse error.
+ * Kept as a named alias rather than collapsed into {@link HttpApiRestOperationSpecSchema} at every
+ * use site: the members of a read surface are a concept in their own right, and a later form — a
+ * facet-declared operation shape — would arrive HERE rather than at each of its consumers.
  */
-export declare const HttpApiRestOperationDeclarationSchema: z.ZodUnion<readonly [z.ZodObject<{
+export declare const HttpApiRestOperationDeclarationSchema: z.ZodObject<{
     method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
     pathTemplate: z.ZodString;
     pagingParams: z.ZodOptional<z.ZodObject<{
         limitParam: z.ZodString;
         offsetParam: z.ZodString;
+        placement: z.ZodOptional<z.ZodEnum<typeof HttpApiRestParameterPlacement>>;
     }, z.core.$strip>>;
     filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     searchParam: z.ZodOptional<z.ZodString>;
@@ -308,40 +446,28 @@ export declare const HttpApiRestOperationDeclarationSchema: z.ZodUnion<readonly
     jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
         rpcMethod: z.ZodString;
     }, z.core.$strip>>;
-}, z.core.$strip>, z.ZodObject<{
-    /** The `operationId` in the provider's own `rest.operations` catalogue. */
-    providerOperationId: z.ZodString;
-    /**
-     * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-     * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-     */
-    domain: z.ZodOptional<z.ZodString>;
-    /**
-     * The referenced operation's PATH parameter that receives this resource's synthesized key.
-     * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-     * collection member, where it is refused rather than ignored.
-     */
-    keyParameter: z.ZodOptional<z.ZodString>;
-    /**
-     * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-     * spec, because the provider cannot know a local field name. Only fields listed here are
-     * translatable for this operation; everything else is refused at the adapter boundary.
-     */
-    filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-    searchParam: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>]>;
+    statement: z.ZodOptional<z.ZodObject<{
+        language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+        parameterName: z.ZodString;
+        fromEntity: z.ZodOptional<z.ZodString>;
+        keyset: z.ZodOptional<z.ZodObject<{
+            /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+            keyRemoteField: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strip>>;
+    cursorPath: z.ZodOptional<z.ZodString>;
+    staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
 export type HttpApiRestOperationDeclaration = z.infer<typeof HttpApiRestOperationDeclarationSchema>;
-/** Narrow a declared member to a catalogue reference. */
-export declare function isHttpApiRestOperationReference(declaration: HttpApiRestOperationDeclaration): declaration is HttpApiRestOperationReference;
-/** The REST_JSON read-surface mapping: which lifecycle members exist remotely, and how. */
+/** The REST_JSON operation mapping: which read members and opened row writes exist remotely, and how each is sent. */
 export declare const HttpApiRestOperationsSchema: z.ZodObject<{
-    read: z.ZodUnion<readonly [z.ZodObject<{
+    read: z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
             limitParam: z.ZodString;
             offsetParam: z.ZodString;
+            placement: z.ZodOptional<z.ZodEnum<typeof HttpApiRestParameterPlacement>>;
         }, z.core.$strip>>;
         filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         searchParam: z.ZodOptional<z.ZodString>;
@@ -349,35 +475,25 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>, z.ZodObject<{
-        /** The `operationId` in the provider's own `rest.operations` catalogue. */
-        providerOperationId: z.ZodString;
-        /**
-         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-         */
-        domain: z.ZodOptional<z.ZodString>;
-        /**
-         * The referenced operation's PATH parameter that receives this resource's synthesized key.
-         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-         * collection member, where it is refused rather than ignored.
-         */
-        keyParameter: z.ZodOptional<z.ZodString>;
-        /**
-         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-         * spec, because the provider cannot know a local field name. Only fields listed here are
-         * translatable for this operation; everything else is refused at the adapter boundary.
-         */
-        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-        searchParam: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>]>;
-    list: z.ZodUnion<readonly [z.ZodObject<{
+        statement: z.ZodOptional<z.ZodObject<{
+            language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+            parameterName: z.ZodString;
+            fromEntity: z.ZodOptional<z.ZodString>;
+            keyset: z.ZodOptional<z.ZodObject<{
+                /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+                keyRemoteField: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strip>>;
+        cursorPath: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>;
+    list: z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
             limitParam: z.ZodString;
             offsetParam: z.ZodString;
+            placement: z.ZodOptional<z.ZodEnum<typeof HttpApiRestParameterPlacement>>;
         }, z.core.$strip>>;
         filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         searchParam: z.ZodOptional<z.ZodString>;
@@ -385,35 +501,25 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>, z.ZodObject<{
-        /** The `operationId` in the provider's own `rest.operations` catalogue. */
-        providerOperationId: z.ZodString;
-        /**
-         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-         */
-        domain: z.ZodOptional<z.ZodString>;
-        /**
-         * The referenced operation's PATH parameter that receives this resource's synthesized key.
-         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-         * collection member, where it is refused rather than ignored.
-         */
-        keyParameter: z.ZodOptional<z.ZodString>;
-        /**
-         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-         * spec, because the provider cannot know a local field name. Only fields listed here are
-         * translatable for this operation; everything else is refused at the adapter boundary.
-         */
-        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-        searchParam: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>]>;
-    count: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        statement: z.ZodOptional<z.ZodObject<{
+            language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+            parameterName: z.ZodString;
+            fromEntity: z.ZodOptional<z.ZodString>;
+            keyset: z.ZodOptional<z.ZodObject<{
+                /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+                keyRemoteField: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strip>>;
+        cursorPath: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>;
+    count: z.ZodOptional<z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
             limitParam: z.ZodString;
             offsetParam: z.ZodString;
+            placement: z.ZodOptional<z.ZodEnum<typeof HttpApiRestParameterPlacement>>;
         }, z.core.$strip>>;
         filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         searchParam: z.ZodOptional<z.ZodString>;
@@ -421,35 +527,25 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>, z.ZodObject<{
-        /** The `operationId` in the provider's own `rest.operations` catalogue. */
-        providerOperationId: z.ZodString;
-        /**
-         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-         */
-        domain: z.ZodOptional<z.ZodString>;
-        /**
-         * The referenced operation's PATH parameter that receives this resource's synthesized key.
-         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-         * collection member, where it is refused rather than ignored.
-         */
-        keyParameter: z.ZodOptional<z.ZodString>;
-        /**
-         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-         * spec, because the provider cannot know a local field name. Only fields listed here are
-         * translatable for this operation; everything else is refused at the adapter boundary.
-         */
-        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-        searchParam: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>]>>;
-    search: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        statement: z.ZodOptional<z.ZodObject<{
+            language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+            parameterName: z.ZodString;
+            fromEntity: z.ZodOptional<z.ZodString>;
+            keyset: z.ZodOptional<z.ZodObject<{
+                /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+                keyRemoteField: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strip>>;
+        cursorPath: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    search: z.ZodOptional<z.ZodObject<{
         method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
         pathTemplate: z.ZodString;
         pagingParams: z.ZodOptional<z.ZodObject<{
             limitParam: z.ZodString;
             offsetParam: z.ZodString;
+            placement: z.ZodOptional<z.ZodEnum<typeof HttpApiRestParameterPlacement>>;
         }, z.core.$strip>>;
         filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         searchParam: z.ZodOptional<z.ZodString>;
@@ -457,40 +553,53 @@ export declare const HttpApiRestOperationsSchema: z.ZodObject<{
         jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
             rpcMethod: z.ZodString;
         }, z.core.$strip>>;
-    }, z.core.$strip>, z.ZodObject<{
-        /** The `operationId` in the provider's own `rest.operations` catalogue. */
-        providerOperationId: z.ZodString;
-        /**
-         * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-         * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-         */
-        domain: z.ZodOptional<z.ZodString>;
-        /**
-         * The referenced operation's PATH parameter that receives this resource's synthesized key.
-         * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-         * collection member, where it is refused rather than ignored.
-         */
-        keyParameter: z.ZodOptional<z.ZodString>;
-        /**
-         * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-         * spec, because the provider cannot know a local field name. Only fields listed here are
-         * translatable for this operation; everything else is refused at the adapter boundary.
-         */
-        filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-        searchParam: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>]>>;
+        statement: z.ZodOptional<z.ZodObject<{
+            language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+            parameterName: z.ZodString;
+            fromEntity: z.ZodOptional<z.ZodString>;
+            keyset: z.ZodOptional<z.ZodObject<{
+                /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+                keyRemoteField: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strip>>;
+        cursorPath: z.ZodOptional<z.ZodString>;
+        staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    create: z.ZodOptional<z.ZodObject<{
+        method: z.ZodEnum<typeof HttpApiRestWriteMethod>;
+        pathTemplate: z.ZodString;
+        createdKey: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.RESPONSE_BODY>;
+            path: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.LOCATION_HEADER>;
+        }, z.core.$strip>], "source">>;
+        staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    update: z.ZodOptional<z.ZodObject<{
+        method: z.ZodEnum<typeof HttpApiRestWriteMethod>;
+        pathTemplate: z.ZodString;
+        createdKey: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.RESPONSE_BODY>;
+            path: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.LOCATION_HEADER>;
+        }, z.core.$strip>], "source">>;
+        staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    delete: z.ZodOptional<z.ZodObject<{
+        method: z.ZodEnum<typeof HttpApiRestWriteMethod>;
+        pathTemplate: z.ZodString;
+        createdKey: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.RESPONSE_BODY>;
+            path: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.LOCATION_HEADER>;
+        }, z.core.$strip>], "source">>;
+        staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type HttpApiRestOperations = z.infer<typeof HttpApiRestOperationsSchema>;
-/** Tenancy declaration — discriminated so each stance carries exactly its own obligations. */
-export declare const HttpApiTenancyDeclarationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
-    remoteScopeField: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
-    justification: z.ZodString;
-}, z.core.$strip>], "stance">;
-export type HttpApiTenancyDeclaration = z.infer<typeof HttpApiTenancyDeclarationSchema>;
 /**
  * HTTP methods a declared EXPLICIT erasure operation (stance 6b, REST_JSON) may use.
  *
@@ -536,20 +645,20 @@ export declare const HttpApiErasureDeclarationSchema: z.ZodDiscriminatedUnion<[z
     subjectLinkLocalField: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>], "stance">;
 export type HttpApiErasureDeclaration = z.infer<typeof HttpApiErasureDeclarationSchema>;
+/** @wildo_source:part:end saas.models.http-api-binding */
 /**
  * The HTTP_API resource binding — discriminated on the transport dialect so each dialect carries
- * exactly its own obligations: ODATA is generic (plus an optional `$metadata` probe opt-out for
- * targets that do not serve one); REST_JSON must declare its whole read surface.
+ * exactly its own obligations: ODATA and ODOO_JSONRPC are generic (the model name IS `entityRef`, and
+ * read/list/count map mechanically); REST_JSON must declare its whole read surface INLINE.
+ *
+ * Every arm carries `system` — the declared instance this resource lives in — and none carries a
+ * provider, a connection shape or a tenancy stance. See the base shape above for what each of those
+ * was and why none was replaced by a smaller field (#1055).
  */
 /** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
 export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    verifyMetadataAtBoot: z.ZodDefault<z.ZodBoolean>;
-    providerRef: z.ZodString;
+    system: z.ZodString;
     entityRef: z.ZodString;
-    connection: z.ZodDefault<z.ZodObject<{
-        ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
-        delegation: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
-    }, z.core.$strip>>;
     keyFields: z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
@@ -558,14 +667,92 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
     fieldMappings: z.ZodDefault<z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
+        temporalKind: z.ZodOptional<z.ZodEnum<typeof HttpApiRemoteTemporalKind>>;
     }, z.core.$strip>>>;
-    tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
-        remoteScopeField: z.ZodString;
+    erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiErasureStance.NO_SUBJECT_DATA>;
+    }, z.core.$strip>, z.ZodObject<{
+        stance: z.ZodLiteral<HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION>;
+        operation: z.ZodUnion<readonly [z.ZodObject<{
+            useCanonicalDelete: z.ZodLiteral<true>;
+        }, z.core.$strip>, z.ZodObject<{
+            method: z.ZodEnum<typeof HttpApiErasureOperationMethod>;
+            pathTemplate: z.ZodString;
+            jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
+                rpcMethod: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>]>;
+        subjectLinkLocalField: z.ZodString;
     }, z.core.$strip>, z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
-        justification: z.ZodString;
+        stance: z.ZodLiteral<HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE>;
+        subjectLinkLocalField: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>], "stance">;
+    purposeRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    writableVerbs: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof HttpApiWriteVerb>>>;
+    writeConcurrency: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<HttpApiWriteConcurrencyMode.VERSION_CHECKED>;
+        /** The LOCAL field carrying the row version the caller read — never written to the remote. */
+        versionField: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<HttpApiWriteConcurrencyMode.LAST_WRITER_WINS>;
+    }, z.core.$strict>], "mode">>;
+    actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        target: z.ZodEnum<typeof import("../external-data.exports").SystemOfRecordActionTarget>;
+        call: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODOO_EXECUTE_KW>;
+            method: z.ZodString;
+            model: z.ZodOptional<z.ZodString>;
+            inputPlacement: z.ZodDefault<z.ZodEnum<typeof import("../external-data.exports").SystemOfRecordOdooActionInputPlacement>>;
+        }, z.core.$strict>, z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODATA_BOUND_ACTION>;
+            qualifiedName: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION>;
+            actionImport: z.ZodString;
+        }, z.core.$strict>], "shape">;
+        input: z.ZodCustom<z.ZodObject<Readonly<{
+            [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+        }>, z.core.$strip>, z.ZodObject<Readonly<{
+            [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+        }>, z.core.$strip>>;
+        output: z.ZodOptional<z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+        writes: z.ZodBoolean;
+        retrySafe: z.ZodDefault<z.ZodBoolean>;
+        roles: z.ZodArray<z.ZodString>;
+        admitsSystemInitiation: z.ZodDefault<z.ZodBoolean>;
+        partitionStance: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionPartitionStanceKind.PARTITION_NEUTRAL>;
+            reason: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionPartitionStanceKind.MEMBER_UNIT_PARTITION>;
+            parameter: z.ZodString;
+        }, z.core.$strict>], "kind">>;
+        operation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    remoteCallSemantics: z.ZodDefault<z.ZodObject<{
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        retry: z.ZodDefault<z.ZodObject<{
+            maxAttempts: z.ZodDefault<z.ZodNumber>;
+            backoffMs: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
+        maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+        maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>>;
+    dialect: z.ZodLiteral<HttpApiTransportDialect.ODATA>;
+}, z.core.$strip>, z.ZodObject<{
+    system: z.ZodString;
+    entityRef: z.ZodString;
+    keyFields: z.ZodArray<z.ZodObject<{
+        localField: z.ZodString;
+        remoteField: z.ZodString;
+        codec: z.ZodEnum<typeof HttpApiKeyComponentCodec>;
+    }, z.core.$strip>>;
+    fieldMappings: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        localField: z.ZodString;
+        remoteField: z.ZodString;
+        temporalKind: z.ZodOptional<z.ZodEnum<typeof HttpApiRemoteTemporalKind>>;
+    }, z.core.$strip>>>;
     erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
         stance: z.ZodLiteral<HttpApiErasureStance.NO_SUBJECT_DATA>;
     }, z.core.$strip>, z.ZodObject<{
@@ -584,6 +771,48 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         stance: z.ZodLiteral<HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE>;
         subjectLinkLocalField: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>], "stance">;
+    purposeRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    writableVerbs: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof HttpApiWriteVerb>>>;
+    writeConcurrency: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<HttpApiWriteConcurrencyMode.VERSION_CHECKED>;
+        /** The LOCAL field carrying the row version the caller read — never written to the remote. */
+        versionField: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<HttpApiWriteConcurrencyMode.LAST_WRITER_WINS>;
+    }, z.core.$strict>], "mode">>;
+    actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        target: z.ZodEnum<typeof import("../external-data.exports").SystemOfRecordActionTarget>;
+        call: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODOO_EXECUTE_KW>;
+            method: z.ZodString;
+            model: z.ZodOptional<z.ZodString>;
+            inputPlacement: z.ZodDefault<z.ZodEnum<typeof import("../external-data.exports").SystemOfRecordOdooActionInputPlacement>>;
+        }, z.core.$strict>, z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODATA_BOUND_ACTION>;
+            qualifiedName: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION>;
+            actionImport: z.ZodString;
+        }, z.core.$strict>], "shape">;
+        input: z.ZodCustom<z.ZodObject<Readonly<{
+            [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+        }>, z.core.$strip>, z.ZodObject<Readonly<{
+            [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+        }>, z.core.$strip>>;
+        output: z.ZodOptional<z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+        writes: z.ZodBoolean;
+        retrySafe: z.ZodDefault<z.ZodBoolean>;
+        roles: z.ZodArray<z.ZodString>;
+        admitsSystemInitiation: z.ZodDefault<z.ZodBoolean>;
+        partitionStance: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionPartitionStanceKind.PARTITION_NEUTRAL>;
+            reason: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionPartitionStanceKind.MEMBER_UNIT_PARTITION>;
+            parameter: z.ZodString;
+        }, z.core.$strict>], "kind">>;
+        operation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
     remoteCallSemantics: z.ZodDefault<z.ZodObject<{
         timeoutMs: z.ZodDefault<z.ZodNumber>;
         retry: z.ZodDefault<z.ZodObject<{
@@ -592,16 +821,18 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         }, z.core.$strip>>;
         maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
         maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+        maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
-    dialect: z.ZodLiteral<HttpApiTransportDialect.ODATA>;
+    dialect: z.ZodLiteral<HttpApiTransportDialect.ODATA_V2>;
 }, z.core.$strip>, z.ZodObject<{
     operations: z.ZodObject<{
-        read: z.ZodUnion<readonly [z.ZodObject<{
+        read: z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
                 limitParam: z.ZodString;
                 offsetParam: z.ZodString;
+                placement: z.ZodOptional<z.ZodEnum<typeof HttpApiRestParameterPlacement>>;
             }, z.core.$strip>>;
             filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             searchParam: z.ZodOptional<z.ZodString>;
@@ -609,35 +840,25 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>, z.ZodObject<{
-            /** The `operationId` in the provider's own `rest.operations` catalogue. */
-            providerOperationId: z.ZodString;
-            /**
-             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-             */
-            domain: z.ZodOptional<z.ZodString>;
-            /**
-             * The referenced operation's PATH parameter that receives this resource's synthesized key.
-             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-             * collection member, where it is refused rather than ignored.
-             */
-            keyParameter: z.ZodOptional<z.ZodString>;
-            /**
-             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-             * spec, because the provider cannot know a local field name. Only fields listed here are
-             * translatable for this operation; everything else is refused at the adapter boundary.
-             */
-            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-            searchParam: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>;
-        list: z.ZodUnion<readonly [z.ZodObject<{
+            statement: z.ZodOptional<z.ZodObject<{
+                language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+                parameterName: z.ZodString;
+                fromEntity: z.ZodOptional<z.ZodString>;
+                keyset: z.ZodOptional<z.ZodObject<{
+                    /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+                    keyRemoteField: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strip>>;
+            cursorPath: z.ZodOptional<z.ZodString>;
+            staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>;
+        list: z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
                 limitParam: z.ZodString;
                 offsetParam: z.ZodString;
+                placement: z.ZodOptional<z.ZodEnum<typeof HttpApiRestParameterPlacement>>;
             }, z.core.$strip>>;
             filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             searchParam: z.ZodOptional<z.ZodString>;
@@ -645,35 +866,25 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>, z.ZodObject<{
-            /** The `operationId` in the provider's own `rest.operations` catalogue. */
-            providerOperationId: z.ZodString;
-            /**
-             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-             */
-            domain: z.ZodOptional<z.ZodString>;
-            /**
-             * The referenced operation's PATH parameter that receives this resource's synthesized key.
-             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-             * collection member, where it is refused rather than ignored.
-             */
-            keyParameter: z.ZodOptional<z.ZodString>;
-            /**
-             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-             * spec, because the provider cannot know a local field name. Only fields listed here are
-             * translatable for this operation; everything else is refused at the adapter boundary.
-             */
-            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-            searchParam: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>;
-        count: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            statement: z.ZodOptional<z.ZodObject<{
+                language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+                parameterName: z.ZodString;
+                fromEntity: z.ZodOptional<z.ZodString>;
+                keyset: z.ZodOptional<z.ZodObject<{
+                    /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+                    keyRemoteField: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strip>>;
+            cursorPath: z.ZodOptional<z.ZodString>;
+            staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>;
+        count: z.ZodOptional<z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
                 limitParam: z.ZodString;
                 offsetParam: z.ZodString;
+                placement: z.ZodOptional<z.ZodEnum<typeof HttpApiRestParameterPlacement>>;
             }, z.core.$strip>>;
             filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             searchParam: z.ZodOptional<z.ZodString>;
@@ -681,35 +892,25 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>, z.ZodObject<{
-            /** The `operationId` in the provider's own `rest.operations` catalogue. */
-            providerOperationId: z.ZodString;
-            /**
-             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-             */
-            domain: z.ZodOptional<z.ZodString>;
-            /**
-             * The referenced operation's PATH parameter that receives this resource's synthesized key.
-             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-             * collection member, where it is refused rather than ignored.
-             */
-            keyParameter: z.ZodOptional<z.ZodString>;
-            /**
-             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-             * spec, because the provider cannot know a local field name. Only fields listed here are
-             * translatable for this operation; everything else is refused at the adapter boundary.
-             */
-            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-            searchParam: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>>;
-        search: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            statement: z.ZodOptional<z.ZodObject<{
+                language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+                parameterName: z.ZodString;
+                fromEntity: z.ZodOptional<z.ZodString>;
+                keyset: z.ZodOptional<z.ZodObject<{
+                    /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+                    keyRemoteField: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strip>>;
+            cursorPath: z.ZodOptional<z.ZodString>;
+            staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>>;
+        search: z.ZodOptional<z.ZodObject<{
             method: z.ZodEnum<typeof HttpApiRestOperationMethod>;
             pathTemplate: z.ZodString;
             pagingParams: z.ZodOptional<z.ZodObject<{
                 limitParam: z.ZodString;
                 offsetParam: z.ZodString;
+                placement: z.ZodOptional<z.ZodEnum<typeof HttpApiRestParameterPlacement>>;
             }, z.core.$strip>>;
             filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             searchParam: z.ZodOptional<z.ZodString>;
@@ -717,36 +918,54 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
             jsonRpcEnvelope: z.ZodOptional<z.ZodObject<{
                 rpcMethod: z.ZodString;
             }, z.core.$strip>>;
-        }, z.core.$strip>, z.ZodObject<{
-            /** The `operationId` in the provider's own `rest.operations` catalogue. */
-            providerOperationId: z.ZodString;
-            /**
-             * The catalogue DOMAIN, so the provider's loader can answer one domain instead of every one.
-             * Absent, the whole catalogue is loaded — correct, and wasteful for a vendor with hundreds.
-             */
-            domain: z.ZodOptional<z.ZodString>;
-            /**
-             * The referenced operation's PATH parameter that receives this resource's synthesized key.
-             * Required on `read` (a key-addressed read has a hole only the key fills) and meaningless on a
-             * collection member, where it is refused rather than ignored.
-             */
-            keyParameter: z.ZodOptional<z.ZodString>;
-            /**
-             * Declared filter parameter name per LOCAL field — resource-shaped, exactly as on an inline
-             * spec, because the provider cannot know a local field name. Only fields listed here are
-             * translatable for this operation; everything else is refused at the adapter boundary.
-             */
-            filterParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-            /** The parameter that receives the SEARCH text. Absent = search is refused for this binding. */
-            searchParam: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>>;
+            statement: z.ZodOptional<z.ZodObject<{
+                language: z.ZodEnum<typeof HttpApiQueryStatementLanguage>;
+                parameterName: z.ZodString;
+                fromEntity: z.ZodOptional<z.ZodString>;
+                keyset: z.ZodOptional<z.ZodObject<{
+                    /** The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. */
+                    keyRemoteField: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strip>>;
+            cursorPath: z.ZodOptional<z.ZodString>;
+            staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>>;
+        create: z.ZodOptional<z.ZodObject<{
+            method: z.ZodEnum<typeof HttpApiRestWriteMethod>;
+            pathTemplate: z.ZodString;
+            createdKey: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.RESPONSE_BODY>;
+                path: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.LOCATION_HEADER>;
+            }, z.core.$strip>], "source">>;
+            staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>>;
+        update: z.ZodOptional<z.ZodObject<{
+            method: z.ZodEnum<typeof HttpApiRestWriteMethod>;
+            pathTemplate: z.ZodString;
+            createdKey: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.RESPONSE_BODY>;
+                path: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.LOCATION_HEADER>;
+            }, z.core.$strip>], "source">>;
+            staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>>;
+        delete: z.ZodOptional<z.ZodObject<{
+            method: z.ZodEnum<typeof HttpApiRestWriteMethod>;
+            pathTemplate: z.ZodString;
+            createdKey: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.RESPONSE_BODY>;
+                path: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                source: z.ZodLiteral<import("./http-api-rest-write-operations.shared.schemas").HttpApiRestCreatedKeySource.LOCATION_HEADER>;
+            }, z.core.$strip>], "source">>;
+            staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>;
-    providerRef: z.ZodString;
+    system: z.ZodString;
     entityRef: z.ZodString;
-    connection: z.ZodDefault<z.ZodObject<{
-        ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
-        delegation: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
-    }, z.core.$strip>>;
     keyFields: z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
@@ -755,14 +974,8 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
     fieldMappings: z.ZodDefault<z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
+        temporalKind: z.ZodOptional<z.ZodEnum<typeof HttpApiRemoteTemporalKind>>;
     }, z.core.$strip>>>;
-    tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
-        remoteScopeField: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
-        justification: z.ZodString;
-    }, z.core.$strip>], "stance">;
     erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
         stance: z.ZodLiteral<HttpApiErasureStance.NO_SUBJECT_DATA>;
     }, z.core.$strip>, z.ZodObject<{
@@ -781,6 +994,48 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         stance: z.ZodLiteral<HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE>;
         subjectLinkLocalField: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>], "stance">;
+    purposeRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    writableVerbs: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof HttpApiWriteVerb>>>;
+    writeConcurrency: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<HttpApiWriteConcurrencyMode.VERSION_CHECKED>;
+        /** The LOCAL field carrying the row version the caller read — never written to the remote. */
+        versionField: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<HttpApiWriteConcurrencyMode.LAST_WRITER_WINS>;
+    }, z.core.$strict>], "mode">>;
+    actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        target: z.ZodEnum<typeof import("../external-data.exports").SystemOfRecordActionTarget>;
+        call: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODOO_EXECUTE_KW>;
+            method: z.ZodString;
+            model: z.ZodOptional<z.ZodString>;
+            inputPlacement: z.ZodDefault<z.ZodEnum<typeof import("../external-data.exports").SystemOfRecordOdooActionInputPlacement>>;
+        }, z.core.$strict>, z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODATA_BOUND_ACTION>;
+            qualifiedName: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION>;
+            actionImport: z.ZodString;
+        }, z.core.$strict>], "shape">;
+        input: z.ZodCustom<z.ZodObject<Readonly<{
+            [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+        }>, z.core.$strip>, z.ZodObject<Readonly<{
+            [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+        }>, z.core.$strip>>;
+        output: z.ZodOptional<z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+        writes: z.ZodBoolean;
+        retrySafe: z.ZodDefault<z.ZodBoolean>;
+        roles: z.ZodArray<z.ZodString>;
+        admitsSystemInitiation: z.ZodDefault<z.ZodBoolean>;
+        partitionStance: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionPartitionStanceKind.PARTITION_NEUTRAL>;
+            reason: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionPartitionStanceKind.MEMBER_UNIT_PARTITION>;
+            parameter: z.ZodString;
+        }, z.core.$strict>], "kind">>;
+        operation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
     remoteCallSemantics: z.ZodDefault<z.ZodObject<{
         timeoutMs: z.ZodDefault<z.ZodNumber>;
         retry: z.ZodDefault<z.ZodObject<{
@@ -789,15 +1044,12 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         }, z.core.$strip>>;
         maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
         maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+        maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
     dialect: z.ZodLiteral<HttpApiTransportDialect.REST_JSON>;
 }, z.core.$strip>, z.ZodObject<{
-    providerRef: z.ZodString;
+    system: z.ZodString;
     entityRef: z.ZodString;
-    connection: z.ZodDefault<z.ZodObject<{
-        ownerScope: z.ZodEnum<typeof ExternalProvider_Connection_OwnerScope>;
-        delegation: z.ZodDefault<z.ZodEnum<typeof ExternalProvider_Connection_DelegationMode>>;
-    }, z.core.$strip>>;
     keyFields: z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
@@ -806,14 +1058,8 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
     fieldMappings: z.ZodDefault<z.ZodArray<z.ZodObject<{
         localField: z.ZodString;
         remoteField: z.ZodString;
+        temporalKind: z.ZodOptional<z.ZodEnum<typeof HttpApiRemoteTemporalKind>>;
     }, z.core.$strip>>>;
-    tenancy: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SCOPE_FILTER_PUSHDOWN>;
-        remoteScopeField: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        stance: z.ZodLiteral<HttpApiTenancyStance.SINGLE_TENANT_BINDING>;
-        justification: z.ZodString;
-    }, z.core.$strip>], "stance">;
     erasure: z.ZodDiscriminatedUnion<[z.ZodObject<{
         stance: z.ZodLiteral<HttpApiErasureStance.NO_SUBJECT_DATA>;
     }, z.core.$strip>, z.ZodObject<{
@@ -832,6 +1078,48 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         stance: z.ZodLiteral<HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE>;
         subjectLinkLocalField: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>], "stance">;
+    purposeRefs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    writableVerbs: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof HttpApiWriteVerb>>>;
+    writeConcurrency: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<HttpApiWriteConcurrencyMode.VERSION_CHECKED>;
+        /** The LOCAL field carrying the row version the caller read — never written to the remote. */
+        versionField: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<HttpApiWriteConcurrencyMode.LAST_WRITER_WINS>;
+    }, z.core.$strict>], "mode">>;
+    actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        target: z.ZodEnum<typeof import("../external-data.exports").SystemOfRecordActionTarget>;
+        call: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODOO_EXECUTE_KW>;
+            method: z.ZodString;
+            model: z.ZodOptional<z.ZodString>;
+            inputPlacement: z.ZodDefault<z.ZodEnum<typeof import("../external-data.exports").SystemOfRecordOdooActionInputPlacement>>;
+        }, z.core.$strict>, z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODATA_BOUND_ACTION>;
+            qualifiedName: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            shape: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionCallShape.ODATA_UNBOUND_ACTION>;
+            actionImport: z.ZodString;
+        }, z.core.$strict>], "shape">;
+        input: z.ZodCustom<z.ZodObject<Readonly<{
+            [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+        }>, z.core.$strip>, z.ZodObject<Readonly<{
+            [k: string]: z.core.$ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+        }>, z.core.$strip>>;
+        output: z.ZodOptional<z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+        writes: z.ZodBoolean;
+        retrySafe: z.ZodDefault<z.ZodBoolean>;
+        roles: z.ZodArray<z.ZodString>;
+        admitsSystemInitiation: z.ZodDefault<z.ZodBoolean>;
+        partitionStance: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionPartitionStanceKind.PARTITION_NEUTRAL>;
+            reason: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<import("../external-data.exports").SystemOfRecordActionPartitionStanceKind.MEMBER_UNIT_PARTITION>;
+            parameter: z.ZodString;
+        }, z.core.$strict>], "kind">>;
+        operation: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
     remoteCallSemantics: z.ZodDefault<z.ZodObject<{
         timeoutMs: z.ZodDefault<z.ZodNumber>;
         retry: z.ZodDefault<z.ZodObject<{
@@ -840,6 +1128,7 @@ export declare const HttpApiResourceBindingSchema: z.ZodDiscriminatedUnion<[z.Zo
         }, z.core.$strip>>;
         maxRequestsPerMinute: z.ZodOptional<z.ZodNumber>;
         maxIdSetSize: z.ZodDefault<z.ZodNumber>;
+        maxPartitionSetSize: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>;
     dialect: z.ZodLiteral<HttpApiTransportDialect.ODOO_JSONRPC>;
 }, z.core.$strip>], "dialect">;