@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/systems-of-record/system-of-record-declaration.shared.schemas.js

@@ -0,0 +1,229 @@
+/**
+ * `systemsOfRecord` — the application's declared INSTANCES of the systems it reads its own business
+ * rows out of.
+ *
+ * ```ts
+ * systemsOfRecord: {
+ *   odoo: { vendor: 'odoo', dialect: HttpApiTransportDialect.ODOO_JSONRPC },
+ * }
+ * ```
+ *
+ * ## The name is the whole point
+ *
+ * Before this, a resource addressed a remote system by `httpApiBinding.providerRef` — a free string
+ * naming a PROVIDER whose env-var names were literals inside its module, so one ref was one
+ * deployment and a second Odoo could not be expressed at all. A name here is an INSTANCE: two
+ * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in their addresses and secrets.
+ *
+ * The name is also the stem of every environment variable the instance needs —
+ * `WILDO_SOR_<NAME>__<SLOT>` — which is why it is capped at 32 characters and admits only
+ * lower-kebab-case. Renaming an instance therefore renames its variables, and there is deliberately
+ * no rename door for secrets: `wildo config sync` reports every now-missing slot and an operator
+ * re-authors them (#1055 E6).
+ *
+ * ## What is validated HERE, and what is not
+ *
+ * Here: the SHAPE, and only what a single configuration file can see. That `vendor` names a facet
+ * the deployment actually ships, and that `dialect` is one the facet speaks, are checked at BOOT by
+ * the systems-of-record registry — the earliest place where the declaration and the facet map are in
+ * the same scope. Splitting it that way is the same honest split `httpApiBinding` already makes:
+ * the factory checks shape, the registry checks agreement.
+ *
+ * Also not here: that the environment actually supplies each slot. The saas config and the infra env
+ * config parse independently, so cross-file coherence is checked at the seams where both are in
+ * scope — `wildo config sync` and the backend startup validator.
+ *
+ * ## Why declaring one requires an owner organization (#1054)
+ *
+ * A system of record is read with the APPLICATION's own service identity, and its rows are stamped
+ * with the owning organization's id so the per-row tenant gate passes without an exemption. An
+ * application that declares no organization type carrying `ownsApplication` has no organization to
+ * stamp with, so every read of every bound resource would refuse at request time. That refusal is
+ * a statement about two top-level blocks, so it lives in `WildoSaasConfigSchema`'s own refinement,
+ * where both are visible.
+ */
+import { z } from 'zod';
+import { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared.js';
+import { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared.js';
+/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */
+/**
+ * The charset law for an instance name, exported because the environment-variable derivation and
+ * every tool that parses a derived name back into a `(name, slot)` pair depend on it: a name may
+ * not contain `_`, so the `__` delimiter is unambiguous (#1055 R4).
+ */
+export const SYSTEM_OF_RECORD_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+/** 32 characters, because the name is a stem of an environment-variable name rather than a label. */
+export const SYSTEM_OF_RECORD_NAME_MAX_LENGTH = 32;
+/**
+ * Whether the personal data held in a system-of-record INSTANCE can have originated from publicly
+ * accessible sources (#1745) — the half of GDPR Art. 14(2)(f) nothing else in an application can
+ * derive.
+ *
+ * A privacy notice owes, for personal data not collected from the person, "from which source the
+ * personal data originate, and if applicable, whether it came from publicly accessible sources".
+ * spec-cite: GDPR Art. 14(2)(f), https://gdpr-info.eu/art-14-gdpr/.
+ * The binding already makes the first half true: the source is this instance, a deployment the
+ * operator runs. The second half is about how records got INTO that deployment — an ERP contact
+ * may have been typed in from a public register, a website or a bought list — and only the
+ * operator knows. So the operator states it here, once per instance, as a typed value a reviewer
+ * can diff, rather than answering a question or leaving it to a drafter's guess.
+ *
+ * Omitting it is legitimate and is NOT read as "no": the notice's source statement then marks the
+ * public-origin half owed for every resource read from the instance.
+ */
+export var SystemOfRecordPersonalDataOrigin;
+(function (SystemOfRecordPersonalDataOrigin) {
+    /** Every person's data in this instance was collected by the operator — from the person, their organisation or the operator's own dealings with them — and none from a publicly accessible source. */
+    SystemOfRecordPersonalDataOrigin["NO_PUBLICLY_ACCESSIBLE_SOURCES"] = "no-publicly-accessible-sources";
+    /** Some of it may come from publicly accessible sources: company registers, websites, social profiles, enrichment services. The notice says so. */
+    SystemOfRecordPersonalDataOrigin["INCLUDES_PUBLICLY_ACCESSIBLE_SOURCES"] = "includes-publicly-accessible-sources";
+})(SystemOfRecordPersonalDataOrigin || (SystemOfRecordPersonalDataOrigin = {}));
+export const SystemOfRecordNameSchema = z
+    .string()
+    .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')
+    .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH);
+/**
+ * The i18n bucket holding every instance's display words — the first segment of
+ * {@link buildSystemOfRecordDisplayNameLabelKey}'s keys.
+ */
+export const SYSTEM_OF_RECORD_LABEL_BUCKET = 'systems_of_record';
+/**
+ * The label key naming ONE declared instance to a person: `systems_of_record.<name>.displayName` (#1997).
+ *
+ * An instance NAME is an environment-variable stem (`odoo`, `sap-fr`), not words: it cannot be translated, and the
+ * words a reader recognises ("Odoo", "SAP France") are not derivable from it. So a surface that names an instance —
+ * the provenance cue on a field a pipeline wrote, "synced from Odoo" — resolves this key, and the labelling pipeline
+ * plans it for every declared instance, total over `systemsOfRecord`. There is deliberately no `displayName` on the
+ * declaration: display text comes from the i18n tree, never from configuration. A key nobody generated renders the
+ * raw name, which is the missing label looking missing.
+ */
+export function buildSystemOfRecordDisplayNameLabelKey(name) {
+    return `${SYSTEM_OF_RECORD_LABEL_BUCKET}.${name}.displayName`;
+}
+/** ONE declared instance. */
+export const SystemOfRecordDeclarationSchema = z.strictObject({
+    /**
+     * Which vendor this is an instance of — the `vendor` of a facet the deployment ships: the framework's facets
+     * come from the opt-in library `@wildo-ai/systems-of-record`, which `wildo config sync` declares on the backend
+     * as soon as an instance is declared (#2013). Refused at boot when no facet answers to it, rather than here,
+     * because the facet map is not in scope in `wildo.saas.config.ts`.
+     */
+    vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),
+    /**
+     * How this instance is READ. Declared per instance rather than taken from the facet because a
+     * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST
+     * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong
+     * to, checked at boot.
+     *
+     * ## One instance per SERVICE ROOT — so a system serving OData v2 and v4 is two instances (#1687)
+     *
+     * An instance has ONE dialect and ONE base URL, and for OData that URL is a service root: an SAP
+     * system's `/sap/opu/odata/sap/API_BUSINESS_PARTNER` (v2) and `/sap/opu/odata4/sap/<service>/…` (v4)
+     * are different roots, as two v4 services of the same system already are. So a system reached over
+     * both versions is declared as two instances, one per root, each with its own dialect, credential
+     * and `maxRequestsPerMinute`.
+     *
+     * Decided rather than asked, because the model already answered it: an instance naming several roots
+     * would need a root per binding, which is what two instances are, and a budget SHARED across
+     * instances would be a new cross-instance ledger for a ceiling the operator can already honour by
+     * splitting it between the instances' `maxRequestsPerMinute`. Both were rejected on that ground.
+     * The cost, stated: two instances against one vendor account are paced separately, so their sum —
+     * not either one — is what must stay under the vendor's allowance.
+     */
+    dialect: z.enum(HttpApiTransportDialect),
+    /**
+     * How the engine proves who it is.
+     *
+     * OPTIONAL, and the absence is DERIVED rather than defaulted: when the instance's facet offers
+     * exactly one credential kind there is nothing for an author to decide, so the registry takes it;
+     * when a facet offers more than one and the instance names none, boot refuses and lists them.
+     * The framework derives before it asks: a declaration with one legal value is a question whose
+     * answer the mechanism already holds.
+     *
+     * This stays additive when #1056 widens the facet set: an instance that omitted the field is
+     * refused on the day its facet gains a second kind, which is exactly the day its author acquires a
+     * real decision.
+     */
+    credential: z.strictObject({ kind: z.enum(SystemOfRecordCredentialKind) }).optional(),
+    /**
+     * The pace this deployment may call the instance at, across EVERY resource bound to it (#1056 §3).
+     *
+     * Per INSTANCE because that is the unit the vendor accounts for: two resources bound to one
+     * Dataverse are one application user to Dataverse, so two independent per-binding budgets would
+     * each believe they were within a limit the pair together exceeds.
+     *
+     * A binding's own `remoteCallSemantics.maxRequestsPerMinute` stays, and becomes a CEILING UNDER
+     * this one: it answers a different question — how much of the shared allowance may ONE resource
+     * take — which matters when a pipeline load and an interactive read share an instance. Both are
+     * consumed for every call, and a call proceeds only if both have room.
+     *
+     * Omitted means unlimited HERE, which is the honest default: the framework does not know the
+     * vendor's contract, and inventing a number would either throttle a deployment that paid for more
+     * or fail to protect one that has less.
+     */
+    maxRequestsPerMinute: z.number().int().min(1).max(600_000).optional(),
+    /**
+     * Whether THIS deployment's data is partitioned, and its rows therefore confined to organization
+     * units of the owner organization (#1058).
+     *
+     * ## The reservation this replaces
+     *
+     * #1055 declared this field `z.never()` and refused it by name, because accepting a declaration the
+     * mechanism could not honour would let an author believe their rows were narrowed while every
+     * member still saw every row. That refusal did its job and is now lifted.
+     *
+     * ## Why the VENDOR says how and the INSTANCE says whether
+     *
+     * How a vendor partitions — which field, what shape, what codec — is a property of the vendor and
+     * lives on its facet. Whether a given deployment's data is partitioned is a property of the
+     * deployment: a single-company Odoo has a `company_id` on every row and nothing to confine, and
+     * asking its operator to restate the field name would be asking a question the facet answers.
+     *
+     * Opting in against a facet that declares no partitioning is refused at boot, naming the vendor —
+     * the alternative is a `true` that does nothing, which is the shape the reservation existed to
+     * prevent in the first place.
+     */
+    partition: z.boolean().optional(),
+    /**
+     * The PACKAGES whose facet augmentation applies to this instance (#1675) — npm package names, each of which
+     * must ship an augmentation for this instance's vendor from its `./systems-of-record` export.
+     *
+     * An explicit opt-in per INSTANCE, never implied by installation, because what an augmentation adds can be a
+     * partition declaration, and the facet is the single authority on how a tenant's rows are confined. Two
+     * instances of one vendor may therefore differ: one opts a package's partition in, the other does not.
+     * A package named here that ships no augmentation for the vendor refuses at startup, naming it.
+     *
+     * Naming a package here is also what ADMITS its `./systems-of-record` module to discovery (#2013): apart from the
+     * framework library `@wildo-ai/systems-of-record`, a facet module is recorded only from a package some instance
+     * names. The package must still be walked — named `<scope>/provider-*`, or listed in `providers.packages`.
+     */
+    facetAugmentations: z.array(z.string().min(1).max(214)).min(1).refine((packages) => new Set(packages).size === packages.length, 'A package is named twice in facetAugmentations.').optional(),
+    /**
+     * Whether the personal data in THIS deployment can have come from publicly accessible sources — see
+     * {@link SystemOfRecordPersonalDataOrigin}. A property of the deployment, not the vendor: two Odoo
+     * instances may be fed differently. Optional; omitted, the privacy notice marks that statement owed
+     * for every resource read from this instance, and never states "not from public sources" by default.
+     */
+    personalDataOrigin: z.enum(SystemOfRecordPersonalDataOrigin).optional(),
+});
+/**
+ * Every instance this application declares, keyed by name.
+ *
+ * Optional as a whole: an application that reads nothing out of another system declares nothing, and
+ * declaring this block is what ENABLES the external-data lane (#1055 D3) rather than an engine
+ * capability flag — the lane has no meaning without an instance to point at.
+ */
+export const SystemsOfRecordConfigSchema = z
+    .record(SystemOfRecordNameSchema, SystemOfRecordDeclarationSchema)
+    .superRefine((systemsOfRecord, ctx) => {
+    if (Object.keys(systemsOfRecord).length === 0) {
+        ctx.addIssue({
+            code: 'custom',
+            path: [],
+            message: 'An empty `systemsOfRecord` declares nothing and enables nothing. Omit the block entirely, or declare the '
+                + 'instance the application reads.',
+        });
+    }
+});
+/** @wildo_source:part:end saas.models.systems-of-record */
+//# sourceMappingURL=system-of-record-declaration.shared.schemas.js.map

package/dist/esm/systems-of-record/system-of-record-declaration.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-declaration.shared.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-declaration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,6GAA6G;AAE7G;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE,qGAAqG;AACrG,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,gCAKX;AALD,WAAY,gCAAgC;IAC1C,sMAAsM;IACtM,qGAAiE,CAAA;IACjE,mJAAmJ;IACnJ,iHAA6E,CAAA;AAC/E,CAAC,EALW,gCAAgC,KAAhC,gCAAgC,QAK3C;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,EAAE;KACR,KAAK,CAAC,6BAA6B,EAAE,sEAAsE,CAAC;KAC5G,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,UAAU,sCAAsC,CAAC,IAAY;IACjE,OAAO,GAAG,6BAA6B,IAAI,IAAI,cAAc,CAAC;AAChE,CAAC;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAExC;;;;;;;;;;;;OAYG;IACH,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErF;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAErE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC;;;;;;;;;;;;OAYG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CACnE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EACxD,iDAAiD,CAClD,CAAC,QAAQ,EAAE;IAEZ;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC,wBAAwB,EAAE,+BAA+B,CAAC;KACjE,WAAW,CAAC,CAAC,eAAe,EAAE,GAAG,EAAE,EAAE;IACpC,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,2GAA2G;kBACzG,iCAAiC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,2DAA2D","sourcesContent":["/**\n * `systemsOfRecord` — the application's declared INSTANCES of the systems it reads its own business\n * rows out of.\n *\n * ```ts\n * systemsOfRecord: {\n *   odoo: { vendor: 'odoo', dialect: HttpApiTransportDialect.ODOO_JSONRPC },\n * }\n * ```\n *\n * ## The name is the whole point\n *\n * Before this, a resource addressed a remote system by `httpApiBinding.providerRef` — a free string\n * naming a PROVIDER whose env-var names were literals inside its module, so one ref was one\n * deployment and a second Odoo could not be expressed at all. A name here is an INSTANCE: two\n * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in their addresses and secrets.\n *\n * The name is also the stem of every environment variable the instance needs —\n * `WILDO_SOR_<NAME>__<SLOT>` — which is why it is capped at 32 characters and admits only\n * lower-kebab-case. Renaming an instance therefore renames its variables, and there is deliberately\n * no rename door for secrets: `wildo config sync` reports every now-missing slot and an operator\n * re-authors them (#1055 E6).\n *\n * ## What is validated HERE, and what is not\n *\n * Here: the SHAPE, and only what a single configuration file can see. That `vendor` names a facet\n * the deployment actually ships, and that `dialect` is one the facet speaks, are checked at BOOT by\n * the systems-of-record registry — the earliest place where the declaration and the facet map are in\n * the same scope. Splitting it that way is the same honest split `httpApiBinding` already makes:\n * the factory checks shape, the registry checks agreement.\n *\n * Also not here: that the environment actually supplies each slot. The saas config and the infra env\n * config parse independently, so cross-file coherence is checked at the seams where both are in\n * scope — `wildo config sync` and the backend startup validator.\n *\n * ## Why declaring one requires an owner organization (#1054)\n *\n * A system of record is read with the APPLICATION's own service identity, and its rows are stamped\n * with the owning organization's id so the per-row tenant gate passes without an exemption. An\n * application that declares no organization type carrying `ownsApplication` has no organization to\n * stamp with, so every read of every bound resource would refuse at request time. That refusal is\n * a statement about two top-level blocks, so it lives in `WildoSaasConfigSchema`'s own refinement,\n * where both are visible.\n */\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\nimport { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';\n\n/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */\n\n/**\n * The charset law for an instance name, exported because the environment-variable derivation and\n * every tool that parses a derived name back into a `(name, slot)` pair depend on it: a name may\n * not contain `_`, so the `__` delimiter is unambiguous (#1055 R4).\n */\nexport const SYSTEM_OF_RECORD_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;\n\n/** 32 characters, because the name is a stem of an environment-variable name rather than a label. */\nexport const SYSTEM_OF_RECORD_NAME_MAX_LENGTH = 32;\n\n/**\n * Whether the personal data held in a system-of-record INSTANCE can have originated from publicly\n * accessible sources (#1745) — the half of GDPR Art. 14(2)(f) nothing else in an application can\n * derive.\n *\n * A privacy notice owes, for personal data not collected from the person, \"from which source the\n * personal data originate, and if applicable, whether it came from publicly accessible sources\".\n * spec-cite: GDPR Art. 14(2)(f), https://gdpr-info.eu/art-14-gdpr/.\n * The binding already makes the first half true: the source is this instance, a deployment the\n * operator runs. The second half is about how records got INTO that deployment — an ERP contact\n * may have been typed in from a public register, a website or a bought list — and only the\n * operator knows. So the operator states it here, once per instance, as a typed value a reviewer\n * can diff, rather than answering a question or leaving it to a drafter's guess.\n *\n * Omitting it is legitimate and is NOT read as \"no\": the notice's source statement then marks the\n * public-origin half owed for every resource read from the instance.\n */\nexport enum SystemOfRecordPersonalDataOrigin {\n  /** Every person's data in this instance was collected by the operator — from the person, their organisation or the operator's own dealings with them — and none from a publicly accessible source. */\n  NO_PUBLICLY_ACCESSIBLE_SOURCES = 'no-publicly-accessible-sources',\n  /** Some of it may come from publicly accessible sources: company registers, websites, social profiles, enrichment services. The notice says so. */\n  INCLUDES_PUBLICLY_ACCESSIBLE_SOURCES = 'includes-publicly-accessible-sources',\n}\n\nexport const SystemOfRecordNameSchema = z\n  .string()\n  .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')\n  .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH);\n\n/**\n * The i18n bucket holding every instance's display words — the first segment of\n * {@link buildSystemOfRecordDisplayNameLabelKey}'s keys.\n */\nexport const SYSTEM_OF_RECORD_LABEL_BUCKET = 'systems_of_record';\n\n/**\n * The label key naming ONE declared instance to a person: `systems_of_record.<name>.displayName` (#1997).\n *\n * An instance NAME is an environment-variable stem (`odoo`, `sap-fr`), not words: it cannot be translated, and the\n * words a reader recognises (\"Odoo\", \"SAP France\") are not derivable from it. So a surface that names an instance —\n * the provenance cue on a field a pipeline wrote, \"synced from Odoo\" — resolves this key, and the labelling pipeline\n * plans it for every declared instance, total over `systemsOfRecord`. There is deliberately no `displayName` on the\n * declaration: display text comes from the i18n tree, never from configuration. A key nobody generated renders the\n * raw name, which is the missing label looking missing.\n */\nexport function buildSystemOfRecordDisplayNameLabelKey(name: string): string {\n  return `${SYSTEM_OF_RECORD_LABEL_BUCKET}.${name}.displayName`;\n}\n\n/** ONE declared instance. */\nexport const SystemOfRecordDeclarationSchema = z.strictObject({\n  /**\n   * Which vendor this is an instance of — the `vendor` of a facet the deployment ships: the framework's facets\n   * come from the opt-in library `@wildo-ai/systems-of-record`, which `wildo config sync` declares on the backend\n   * as soon as an instance is declared (#2013). Refused at boot when no facet answers to it, rather than here,\n   * because the facet map is not in scope in `wildo.saas.config.ts`.\n   */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n\n  /**\n   * How this instance is READ. Declared per instance rather than taken from the facet because a\n   * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST\n   * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong\n   * to, checked at boot.\n   *\n   * ## One instance per SERVICE ROOT — so a system serving OData v2 and v4 is two instances (#1687)\n   *\n   * An instance has ONE dialect and ONE base URL, and for OData that URL is a service root: an SAP\n   * system's `/sap/opu/odata/sap/API_BUSINESS_PARTNER` (v2) and `/sap/opu/odata4/sap/<service>/…` (v4)\n   * are different roots, as two v4 services of the same system already are. So a system reached over\n   * both versions is declared as two instances, one per root, each with its own dialect, credential\n   * and `maxRequestsPerMinute`.\n   *\n   * Decided rather than asked, because the model already answered it: an instance naming several roots\n   * would need a root per binding, which is what two instances are, and a budget SHARED across\n   * instances would be a new cross-instance ledger for a ceiling the operator can already honour by\n   * splitting it between the instances' `maxRequestsPerMinute`. Both were rejected on that ground.\n   * The cost, stated: two instances against one vendor account are paced separately, so their sum —\n   * not either one — is what must stay under the vendor's allowance.\n   */\n  dialect: z.enum(HttpApiTransportDialect),\n\n  /**\n   * How the engine proves who it is.\n   *\n   * OPTIONAL, and the absence is DERIVED rather than defaulted: when the instance's facet offers\n   * exactly one credential kind there is nothing for an author to decide, so the registry takes it;\n   * when a facet offers more than one and the instance names none, boot refuses and lists them.\n   * The framework derives before it asks: a declaration with one legal value is a question whose\n   * answer the mechanism already holds.\n   *\n   * This stays additive when #1056 widens the facet set: an instance that omitted the field is\n   * refused on the day its facet gains a second kind, which is exactly the day its author acquires a\n   * real decision.\n   */\n  credential: z.strictObject({ kind: z.enum(SystemOfRecordCredentialKind) }).optional(),\n\n  /**\n   * The pace this deployment may call the instance at, across EVERY resource bound to it (#1056 §3).\n   *\n   * Per INSTANCE because that is the unit the vendor accounts for: two resources bound to one\n   * Dataverse are one application user to Dataverse, so two independent per-binding budgets would\n   * each believe they were within a limit the pair together exceeds.\n   *\n   * A binding's own `remoteCallSemantics.maxRequestsPerMinute` stays, and becomes a CEILING UNDER\n   * this one: it answers a different question — how much of the shared allowance may ONE resource\n   * take — which matters when a pipeline load and an interactive read share an instance. Both are\n   * consumed for every call, and a call proceeds only if both have room.\n   *\n   * Omitted means unlimited HERE, which is the honest default: the framework does not know the\n   * vendor's contract, and inventing a number would either throttle a deployment that paid for more\n   * or fail to protect one that has less.\n   */\n  maxRequestsPerMinute: z.number().int().min(1).max(600_000).optional(),\n\n  /**\n   * Whether THIS deployment's data is partitioned, and its rows therefore confined to organization\n   * units of the owner organization (#1058).\n   *\n   * ## The reservation this replaces\n   *\n   * #1055 declared this field `z.never()` and refused it by name, because accepting a declaration the\n   * mechanism could not honour would let an author believe their rows were narrowed while every\n   * member still saw every row. That refusal did its job and is now lifted.\n   *\n   * ## Why the VENDOR says how and the INSTANCE says whether\n   *\n   * How a vendor partitions — which field, what shape, what codec — is a property of the vendor and\n   * lives on its facet. Whether a given deployment's data is partitioned is a property of the\n   * deployment: a single-company Odoo has a `company_id` on every row and nothing to confine, and\n   * asking its operator to restate the field name would be asking a question the facet answers.\n   *\n   * Opting in against a facet that declares no partitioning is refused at boot, naming the vendor —\n   * the alternative is a `true` that does nothing, which is the shape the reservation existed to\n   * prevent in the first place.\n   */\n  partition: z.boolean().optional(),\n\n  /**\n   * The PACKAGES whose facet augmentation applies to this instance (#1675) — npm package names, each of which\n   * must ship an augmentation for this instance's vendor from its `./systems-of-record` export.\n   *\n   * An explicit opt-in per INSTANCE, never implied by installation, because what an augmentation adds can be a\n   * partition declaration, and the facet is the single authority on how a tenant's rows are confined. Two\n   * instances of one vendor may therefore differ: one opts a package's partition in, the other does not.\n   * A package named here that ships no augmentation for the vendor refuses at startup, naming it.\n   *\n   * Naming a package here is also what ADMITS its `./systems-of-record` module to discovery (#2013): apart from the\n   * framework library `@wildo-ai/systems-of-record`, a facet module is recorded only from a package some instance\n   * names. The package must still be walked — named `<scope>/provider-*`, or listed in `providers.packages`.\n   */\n  facetAugmentations: z.array(z.string().min(1).max(214)).min(1).refine(\n    (packages) => new Set(packages).size === packages.length,\n    'A package is named twice in facetAugmentations.',\n  ).optional(),\n\n  /**\n   * Whether the personal data in THIS deployment can have come from publicly accessible sources — see\n   * {@link SystemOfRecordPersonalDataOrigin}. A property of the deployment, not the vendor: two Odoo\n   * instances may be fed differently. Optional; omitted, the privacy notice marks that statement owed\n   * for every resource read from this instance, and never states \"not from public sources\" by default.\n   */\n  personalDataOrigin: z.enum(SystemOfRecordPersonalDataOrigin).optional(),\n});\nexport type SystemOfRecordDeclaration = z.infer<typeof SystemOfRecordDeclarationSchema>;\n\n/**\n * Every instance this application declares, keyed by name.\n *\n * Optional as a whole: an application that reads nothing out of another system declares nothing, and\n * declaring this block is what ENABLES the external-data lane (#1055 D3) rather than an engine\n * capability flag — the lane has no meaning without an instance to point at.\n */\nexport const SystemsOfRecordConfigSchema = z\n  .record(SystemOfRecordNameSchema, SystemOfRecordDeclarationSchema)\n  .superRefine((systemsOfRecord, ctx) => {\n    if (Object.keys(systemsOfRecord).length === 0) {\n      ctx.addIssue({\n        code: 'custom',\n        path: [],\n        message:\n          'An empty `systemsOfRecord` declares nothing and enables nothing. Omit the block entirely, or declare the '\n          + 'instance the application reads.',\n      });\n    }\n  });\nexport type SystemsOfRecordConfig = z.infer<typeof SystemsOfRecordConfigSchema>;\n/** @wildo_source:part:end saas.models.systems-of-record */\n"]}

package/dist/esm/systems-of-record/system-of-record-env.shared.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `WILDO_SOR_<NAME>__<SLOT>` — the ONE derivation of a system-of-record environment-variable name.
+ *
+ * ## Derived, never authored, and why that is the whole design
+ *
+ * The lane this replaces put the variable NAMES in the vendor's module — `ODOO_BASE_URL`,
+ * `ODOO_DB`, `ODOO_LOGIN`, `ODOO_API_KEY` — so a second Odoo was unrepresentable: the name space was
+ * the vendor's, not the instance's. Deriving from the instance NAME instead means two instances of
+ * one vendor cost nothing (`WILDO_SOR_ODOO_FR__BASE_URL` beside `WILDO_SOR_ODOO_DE__BASE_URL`), and
+ * an author never invents a variable name that some other layer then has to guess.
+ *
+ * ## Why the delimiter is a DOUBLE underscore (#1055 R4)
+ *
+ * The pair must be RECOVERABLE — the secrets section is a flat map keyed by variable name (R5), and
+ * per-instance structure is recovered by parsing the key back. With a single underscore,
+ * `odoo-api` + `key` and `odoo` + `apiKey` both derive `WILDO_SOR_ODOO_API_KEY` and nothing could
+ * tell them apart. `__` cannot be produced by either half: an instance name admits only
+ * `[a-z0-9-]` and a slot slug only `[a-zA-Z0-9]`, so neither can emit an underscore at all, and the
+ * only `__` in a derived name is the delimiter. The collision is impossible by construction rather
+ * than checked for.
+ *
+ * That property is load-bearing, so the two charset laws are not cosmetic: widening either one
+ * silently reintroduces the ambiguity. `SYSTEM_OF_RECORD_NAME_PATTERN` and the slot-slug regex are
+ * pinned against this file's round trip for that reason.
+ *
+ * ## Four readers, one authority
+ *
+ * The backend `.env` writer, the k8s secrets generator, the CI secret collector and the backend
+ * registry all need the same name, and three of them live in different packages. Re-deriving it at
+ * each would be the enumeration failure `invariant-call-site-enumeration.md` records — so this module
+ * is the authority and every one of them imports it.
+ */
+/** Every system-of-record variable starts here, which is what makes a prefix scan possible. */
+export declare const SYSTEM_OF_RECORD_ENV_PREFIX = "WILDO_SOR_";
+/** The delimiter between the instance name and the slot. See the module header for why it is two. */
+export declare const SYSTEM_OF_RECORD_ENV_DELIMITER = "__";
+/** The charset law for a slot slug, shared with the facet schema so the two cannot drift apart. */
+export declare const SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN: RegExp;
+/**
+ * The slot slug an instance may never declare, because the environment builder emits it itself.
+ *
+ * `WILDO_SOR_<NAME>__ENABLED=false` is how an environment says it has NO access to this system —
+ * a developer laptop, a staging with no ERP (#1055 E3, R6). A facet declaring a slot named `enabled`
+ * would produce the same variable and make "declared absent" indistinguishable from "an address slot
+ * whose value happens to be false", so the name is reserved and the facet schema refuses it.
+ */
+export declare const SYSTEM_OF_RECORD_ENABLED_SLOT = "enabled";
+/**
+ * The name of the environment variable carrying one slot of one instance.
+ *
+ * Throws on a name or slug outside its charset law rather than emitting a name that cannot be parsed
+ * back: both halves are validated where they are authored, so reaching here with a bad one means a
+ * caller skipped a schema, and a silently unparseable variable is worse than a loud refusal.
+ */
+export declare function deriveSystemOfRecordEnvVarName(instanceName: string, slotSlug: string): string;
+/**
+ * `WILDO_SOR_<NAME>__ENABLED` — present and `false` when an environment declares it has no access to
+ * this instance (E3). Its ABSENCE, with required slots missing, is the different and louder case:
+ * an environment that simply forgot (E4). Silence is never a declaration, which is why the two are
+ * distinguishable at all.
+ */
+export declare function deriveSystemOfRecordEnabledEnvVarName(instanceName: string): string;
+/** What a derived variable name was made of. */
+export interface SystemOfRecordEnvVarParts {
+    readonly instanceName: string;
+    readonly slotSlug: string;
+}
+/**
+ * Recover the `(instance, slot)` pair from a derived variable name, or `null` when the name is not
+ * one of ours.
+ *
+ * `null` rather than a throw because the callers scan a MIXED environment — every variable a
+ * deployment carries goes past this function, and most of them are not system-of-record variables.
+ * A name that starts with the prefix and still does not parse is also `null`: it is not ours either,
+ * and refusing an operator's unrelated `WILDO_SOR_SOMETHING` would be this module deciding what an
+ * environment may contain.
+ */
+export declare function parseSystemOfRecordEnvVarName(envVarName: string): SystemOfRecordEnvVarParts | null;
+//# sourceMappingURL=system-of-record-env.shared.d.ts.map

package/dist/esm/systems-of-record/system-of-record-env.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-env.shared.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,+FAA+F;AAC/F,eAAO,MAAM,2BAA2B,eAAe,CAAC;AAExD,qGAAqG;AACrG,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,mGAAmG;AACnG,eAAO,MAAM,kCAAkC,QAAwB,CAAC;AAExE;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,YAAY,CAAC;AAYvD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ7F;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElF;AAQD,gDAAgD;AAChD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAgBlG"}

package/dist/esm/systems-of-record/system-of-record-env.shared.js

@@ -0,0 +1,116 @@
+/**
+ * `WILDO_SOR_<NAME>__<SLOT>` — the ONE derivation of a system-of-record environment-variable name.
+ *
+ * ## Derived, never authored, and why that is the whole design
+ *
+ * The lane this replaces put the variable NAMES in the vendor's module — `ODOO_BASE_URL`,
+ * `ODOO_DB`, `ODOO_LOGIN`, `ODOO_API_KEY` — so a second Odoo was unrepresentable: the name space was
+ * the vendor's, not the instance's. Deriving from the instance NAME instead means two instances of
+ * one vendor cost nothing (`WILDO_SOR_ODOO_FR__BASE_URL` beside `WILDO_SOR_ODOO_DE__BASE_URL`), and
+ * an author never invents a variable name that some other layer then has to guess.
+ *
+ * ## Why the delimiter is a DOUBLE underscore (#1055 R4)
+ *
+ * The pair must be RECOVERABLE — the secrets section is a flat map keyed by variable name (R5), and
+ * per-instance structure is recovered by parsing the key back. With a single underscore,
+ * `odoo-api` + `key` and `odoo` + `apiKey` both derive `WILDO_SOR_ODOO_API_KEY` and nothing could
+ * tell them apart. `__` cannot be produced by either half: an instance name admits only
+ * `[a-z0-9-]` and a slot slug only `[a-zA-Z0-9]`, so neither can emit an underscore at all, and the
+ * only `__` in a derived name is the delimiter. The collision is impossible by construction rather
+ * than checked for.
+ *
+ * That property is load-bearing, so the two charset laws are not cosmetic: widening either one
+ * silently reintroduces the ambiguity. `SYSTEM_OF_RECORD_NAME_PATTERN` and the slot-slug regex are
+ * pinned against this file's round trip for that reason.
+ *
+ * ## Four readers, one authority
+ *
+ * The backend `.env` writer, the k8s secrets generator, the CI secret collector and the backend
+ * registry all need the same name, and three of them live in different packages. Re-deriving it at
+ * each would be the enumeration failure `invariant-call-site-enumeration.md` records — so this module
+ * is the authority and every one of them imports it.
+ */
+import { SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas.js';
+/** Every system-of-record variable starts here, which is what makes a prefix scan possible. */
+export const SYSTEM_OF_RECORD_ENV_PREFIX = 'WILDO_SOR_';
+/** The delimiter between the instance name and the slot. See the module header for why it is two. */
+export const SYSTEM_OF_RECORD_ENV_DELIMITER = '__';
+/** The charset law for a slot slug, shared with the facet schema so the two cannot drift apart. */
+export const SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
+/**
+ * The slot slug an instance may never declare, because the environment builder emits it itself.
+ *
+ * `WILDO_SOR_<NAME>__ENABLED=false` is how an environment says it has NO access to this system —
+ * a developer laptop, a staging with no ERP (#1055 E3, R6). A facet declaring a slot named `enabled`
+ * would produce the same variable and make "declared absent" indistinguishable from "an address slot
+ * whose value happens to be false", so the name is reserved and the facet schema refuses it.
+ */
+export const SYSTEM_OF_RECORD_ENABLED_SLOT = 'enabled';
+/** `odoo-fr` → `ODOO_FR`. The only transformation a name undergoes. */
+function encodeInstanceName(instanceName) {
+    return instanceName.toUpperCase().replaceAll('-', '_');
+}
+/** `apiKey` → `API_KEY`, `baseUrl` → `BASE_URL`. lowerCamelCase to UPPER_SNAKE, and back below. */
+function encodeSlotSlug(slotSlug) {
+    return slotSlug.replace(/([A-Z])/g, '_$1').toUpperCase();
+}
+/**
+ * The name of the environment variable carrying one slot of one instance.
+ *
+ * Throws on a name or slug outside its charset law rather than emitting a name that cannot be parsed
+ * back: both halves are validated where they are authored, so reaching here with a bad one means a
+ * caller skipped a schema, and a silently unparseable variable is worse than a loud refusal.
+ */
+export function deriveSystemOfRecordEnvVarName(instanceName, slotSlug) {
+    if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName)) {
+        throw new Error(`"${instanceName}" is not a valid system-of-record instance name (lower-kebab-case, starting with a letter).`);
+    }
+    if (!SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) {
+        throw new Error(`"${slotSlug}" is not a valid system-of-record slot slug (lowerCamelCase, no separators).`);
+    }
+    return `${SYSTEM_OF_RECORD_ENV_PREFIX}${encodeInstanceName(instanceName)}${SYSTEM_OF_RECORD_ENV_DELIMITER}${encodeSlotSlug(slotSlug)}`;
+}
+/**
+ * `WILDO_SOR_<NAME>__ENABLED` — present and `false` when an environment declares it has no access to
+ * this instance (E3). Its ABSENCE, with required slots missing, is the different and louder case:
+ * an environment that simply forgot (E4). Silence is never a declaration, which is why the two are
+ * distinguishable at all.
+ */
+export function deriveSystemOfRecordEnabledEnvVarName(instanceName) {
+    return deriveSystemOfRecordEnvVarName(instanceName, SYSTEM_OF_RECORD_ENABLED_SLOT);
+}
+/** `API_KEY` → `apiKey`. The inverse of `encodeSlotSlug`, exact because a slug carries no separator. */
+function decodeSlotSlug(encoded) {
+    const [head, ...rest] = encoded.toLowerCase().split('_');
+    return [head, ...rest.map((part) => (part.length === 0 ? part : part[0].toUpperCase() + part.slice(1)))].join('');
+}
+/**
+ * Recover the `(instance, slot)` pair from a derived variable name, or `null` when the name is not
+ * one of ours.
+ *
+ * `null` rather than a throw because the callers scan a MIXED environment — every variable a
+ * deployment carries goes past this function, and most of them are not system-of-record variables.
+ * A name that starts with the prefix and still does not parse is also `null`: it is not ours either,
+ * and refusing an operator's unrelated `WILDO_SOR_SOMETHING` would be this module deciding what an
+ * environment may contain.
+ */
+export function parseSystemOfRecordEnvVarName(envVarName) {
+    if (!envVarName.startsWith(SYSTEM_OF_RECORD_ENV_PREFIX))
+        return null;
+    const body = envVarName.slice(SYSTEM_OF_RECORD_ENV_PREFIX.length);
+    const delimiterIndex = body.indexOf(SYSTEM_OF_RECORD_ENV_DELIMITER);
+    if (delimiterIndex <= 0)
+        return null;
+    const instanceName = body.slice(0, delimiterIndex).toLowerCase().replaceAll('_', '-');
+    const encodedSlot = body.slice(delimiterIndex + SYSTEM_OF_RECORD_ENV_DELIMITER.length);
+    if (encodedSlot.length === 0)
+        return null;
+    // A second delimiter means the name was not produced here: neither half can emit `__`.
+    if (encodedSlot.includes(SYSTEM_OF_RECORD_ENV_DELIMITER))
+        return null;
+    const slotSlug = decodeSlotSlug(encodedSlot);
+    if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName) || !SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug))
+        return null;
+    return { instanceName, slotSlug };
+}
+//# sourceMappingURL=system-of-record-env.shared.js.map

package/dist/esm/systems-of-record/system-of-record-env.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-env.shared.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAE9F,+FAA+F;AAC/F,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AAExD,qGAAqG;AACrG,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,mGAAmG;AACnG,MAAM,CAAC,MAAM,kCAAkC,GAAG,qBAAqB,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC;AAEvD,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,mGAAmG;AACnG,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,YAAoB,EAAE,QAAgB;IACnF,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,IAAI,YAAY,6FAA6F,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,IAAI,QAAQ,8EAA8E,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,GAAG,2BAA2B,GAAG,kBAAkB,CAAC,YAAY,CAAC,GAAG,8BAA8B,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzI,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB;IACxE,OAAO,8BAA8B,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;AACrF,CAAC;AAED,wGAAwG;AACxG,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrH,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAAkB;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACpE,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,uFAAuF;IACvF,IAAI,WAAW,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC","sourcesContent":["/**\n * `WILDO_SOR_<NAME>__<SLOT>` — the ONE derivation of a system-of-record environment-variable name.\n *\n * ## Derived, never authored, and why that is the whole design\n *\n * The lane this replaces put the variable NAMES in the vendor's module — `ODOO_BASE_URL`,\n * `ODOO_DB`, `ODOO_LOGIN`, `ODOO_API_KEY` — so a second Odoo was unrepresentable: the name space was\n * the vendor's, not the instance's. Deriving from the instance NAME instead means two instances of\n * one vendor cost nothing (`WILDO_SOR_ODOO_FR__BASE_URL` beside `WILDO_SOR_ODOO_DE__BASE_URL`), and\n * an author never invents a variable name that some other layer then has to guess.\n *\n * ## Why the delimiter is a DOUBLE underscore (#1055 R4)\n *\n * The pair must be RECOVERABLE — the secrets section is a flat map keyed by variable name (R5), and\n * per-instance structure is recovered by parsing the key back. With a single underscore,\n * `odoo-api` + `key` and `odoo` + `apiKey` both derive `WILDO_SOR_ODOO_API_KEY` and nothing could\n * tell them apart. `__` cannot be produced by either half: an instance name admits only\n * `[a-z0-9-]` and a slot slug only `[a-zA-Z0-9]`, so neither can emit an underscore at all, and the\n * only `__` in a derived name is the delimiter. The collision is impossible by construction rather\n * than checked for.\n *\n * That property is load-bearing, so the two charset laws are not cosmetic: widening either one\n * silently reintroduces the ambiguity. `SYSTEM_OF_RECORD_NAME_PATTERN` and the slot-slug regex are\n * pinned against this file's round trip for that reason.\n *\n * ## Four readers, one authority\n *\n * The backend `.env` writer, the k8s secrets generator, the CI secret collector and the backend\n * registry all need the same name, and three of them live in different packages. Re-deriving it at\n * each would be the enumeration failure `invariant-call-site-enumeration.md` records — so this module\n * is the authority and every one of them imports it.\n */\n\nimport { SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas';\n\n/** Every system-of-record variable starts here, which is what makes a prefix scan possible. */\nexport const SYSTEM_OF_RECORD_ENV_PREFIX = 'WILDO_SOR_';\n\n/** The delimiter between the instance name and the slot. See the module header for why it is two. */\nexport const SYSTEM_OF_RECORD_ENV_DELIMITER = '__';\n\n/** The charset law for a slot slug, shared with the facet schema so the two cannot drift apart. */\nexport const SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN = /^[a-z][a-zA-Z0-9]*$/;\n\n/**\n * The slot slug an instance may never declare, because the environment builder emits it itself.\n *\n * `WILDO_SOR_<NAME>__ENABLED=false` is how an environment says it has NO access to this system —\n * a developer laptop, a staging with no ERP (#1055 E3, R6). A facet declaring a slot named `enabled`\n * would produce the same variable and make \"declared absent\" indistinguishable from \"an address slot\n * whose value happens to be false\", so the name is reserved and the facet schema refuses it.\n */\nexport const SYSTEM_OF_RECORD_ENABLED_SLOT = 'enabled';\n\n/** `odoo-fr` → `ODOO_FR`. The only transformation a name undergoes. */\nfunction encodeInstanceName(instanceName: string): string {\n  return instanceName.toUpperCase().replaceAll('-', '_');\n}\n\n/** `apiKey` → `API_KEY`, `baseUrl` → `BASE_URL`. lowerCamelCase to UPPER_SNAKE, and back below. */\nfunction encodeSlotSlug(slotSlug: string): string {\n  return slotSlug.replace(/([A-Z])/g, '_$1').toUpperCase();\n}\n\n/**\n * The name of the environment variable carrying one slot of one instance.\n *\n * Throws on a name or slug outside its charset law rather than emitting a name that cannot be parsed\n * back: both halves are validated where they are authored, so reaching here with a bad one means a\n * caller skipped a schema, and a silently unparseable variable is worse than a loud refusal.\n */\nexport function deriveSystemOfRecordEnvVarName(instanceName: string, slotSlug: string): string {\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName)) {\n    throw new Error(`\"${instanceName}\" is not a valid system-of-record instance name (lower-kebab-case, starting with a letter).`);\n  }\n  if (!SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) {\n    throw new Error(`\"${slotSlug}\" is not a valid system-of-record slot slug (lowerCamelCase, no separators).`);\n  }\n  return `${SYSTEM_OF_RECORD_ENV_PREFIX}${encodeInstanceName(instanceName)}${SYSTEM_OF_RECORD_ENV_DELIMITER}${encodeSlotSlug(slotSlug)}`;\n}\n\n/**\n * `WILDO_SOR_<NAME>__ENABLED` — present and `false` when an environment declares it has no access to\n * this instance (E3). Its ABSENCE, with required slots missing, is the different and louder case:\n * an environment that simply forgot (E4). Silence is never a declaration, which is why the two are\n * distinguishable at all.\n */\nexport function deriveSystemOfRecordEnabledEnvVarName(instanceName: string): string {\n  return deriveSystemOfRecordEnvVarName(instanceName, SYSTEM_OF_RECORD_ENABLED_SLOT);\n}\n\n/** `API_KEY` → `apiKey`. The inverse of `encodeSlotSlug`, exact because a slug carries no separator. */\nfunction decodeSlotSlug(encoded: string): string {\n  const [head, ...rest] = encoded.toLowerCase().split('_');\n  return [head, ...rest.map((part) => (part.length === 0 ? part : part[0]!.toUpperCase() + part.slice(1)))].join('');\n}\n\n/** What a derived variable name was made of. */\nexport interface SystemOfRecordEnvVarParts {\n  readonly instanceName: string;\n  readonly slotSlug: string;\n}\n\n/**\n * Recover the `(instance, slot)` pair from a derived variable name, or `null` when the name is not\n * one of ours.\n *\n * `null` rather than a throw because the callers scan a MIXED environment — every variable a\n * deployment carries goes past this function, and most of them are not system-of-record variables.\n * A name that starts with the prefix and still does not parse is also `null`: it is not ours either,\n * and refusing an operator's unrelated `WILDO_SOR_SOMETHING` would be this module deciding what an\n * environment may contain.\n */\nexport function parseSystemOfRecordEnvVarName(envVarName: string): SystemOfRecordEnvVarParts | null {\n  if (!envVarName.startsWith(SYSTEM_OF_RECORD_ENV_PREFIX)) return null;\n  const body = envVarName.slice(SYSTEM_OF_RECORD_ENV_PREFIX.length);\n  const delimiterIndex = body.indexOf(SYSTEM_OF_RECORD_ENV_DELIMITER);\n  if (delimiterIndex <= 0) return null;\n\n  const instanceName = body.slice(0, delimiterIndex).toLowerCase().replaceAll('_', '-');\n  const encodedSlot = body.slice(delimiterIndex + SYSTEM_OF_RECORD_ENV_DELIMITER.length);\n  if (encodedSlot.length === 0) return null;\n  // A second delimiter means the name was not produced here: neither half can emit `__`.\n  if (encodedSlot.includes(SYSTEM_OF_RECORD_ENV_DELIMITER)) return null;\n\n  const slotSlug = decodeSlotSlug(encodedSlot);\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName) || !SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) return null;\n\n  return { instanceName, slotSlug };\n}\n"]}