@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/systems-of-record/system-of-record-facet.shared.schemas.d.ts

@@ -0,0 +1,788 @@
+/**
+ * `SystemOfRecordVendorFacet` — what a VENDOR is, as a system of record.
+ *
+ * Four concepts carry one job each in this lane (#1049 §4.1, #1055): the **external-data lane** (the
+ * engine runtime), a **dialect adapter** (how to speak — `HttpApiTransportDialect`), a **vendor
+ * facet** (this module: what the vendor needs to be addressed and believed), and a **system of
+ * record** — a named, declared INSTANCE that resources bind by name.
+ *
+ * ## What a facet is NOT
+ *
+ * It is not a provider. A provider is selected through a capability plane, may carry a person's
+ * lent credential, and has an operation catalogue; a system of record is a named deployment the
+ * application reads its own business rows out of, spending its own service identity (D10, D12).
+ * Nothing in this module may reach the provider registry, and the reverse import is what
+ * `pnpm check:systems-of-record-separation` refuses.
+ *
+ * It is also not an INSTANCE. The facet says "an Odoo needs a base URL, a database and a login, and
+ * offers the in-args API-key credential"; it never says WHICH Odoo. Two instances of one vendor
+ * (`odoo-fr`, `odoo-de`) share this facet and differ only in their addresses and secrets — which is
+ * the whole reason the instance is a separate concept from the vendor.
+ *
+ * ## Why this lives in `@wildo-ai/saas-models/external-data` (#1055 R2)
+ *
+ * The obvious home looks like `external-connectors-models`, beside the provider contracts. It
+ * cannot be: that package depends only on `zod-decorators` and its own header forbids reaching
+ * saas-models, while a facet is typed against `HttpApiTransportDialect`, which lives here. It is
+ * also not `ProviderMetadata`-shaped, which is bundle-fenced. So the facet sits beside the binding
+ * schema it serves, on the subpath whose two audiences — the app author and the backend — are
+ * exactly the audiences a facet has.
+ *
+ * Note the split with the two VOCABULARIES it names: `HttpApiTransportDialect` and
+ * `SystemOfRecordCredentialKind` are root-exported boundary modules, because the root-exported
+ * `systemsOfRecord` declaration names them. The SHAPES here are subpath-only, because nothing
+ * root-exported names a slot.
+ *
+ * ## Slots, and why their slugs are lowerCamelCase with nothing else in them
+ *
+ * A slot's slug becomes half of a derived environment-variable name, `WILDO_SOR_<NAME>__<SLOT>`
+ * (#1055 R4). The instance name admits `-` and the slug admits neither `-` nor `_`, so the DOUBLE
+ * underscore between them is a delimiter neither half can produce: the pair is recoverable from
+ * the variable name, and `odoo-api` + `key` can never collide with `odoo` + `apiKey`. That property
+ * is the reason for the regex, so widening it would silently reintroduce the collision.
+ *
+ * ## Partitioning LANDED in #1058, and was held back until it had a reader
+ *
+ * The facet is the single partition authority — which remote field carries the tenant, how it is
+ * encoded — and that vocabulary arrived with the slice that first READS it. It is `partition`
+ * below, and the INSTANCE-side opt-in is now honoured rather than refused at declaration.
+ *
+ * It was withheld until then on purpose, and the reasoning is kept because it is the general rule:
+ * shipping a four-member vocabulary with no reader is the "declared surface with nothing behind
+ * it" shape this repository keeps paying for. It landed additively, as an OPTIONAL field, so every
+ * facet written against the earlier shape still parses.
+ */
+import '@wildo-ai/zod-decorators';
+import { z } from 'zod';
+import { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';
+import { HttpApiKeyComponentCodec } from '../http-api-binding/http-api-binding.shared.schemas';
+import { ExternalDataIncrementalExtractionMode } from '../external-data/external-data-pipeline.shared.schemas';
+import { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';
+import { SystemOfRecordActionCallShape } from './system-of-record-actions.shared.schemas';
+import { SystemOfRecordErrorCode } from './system-of-record-error-codes.shared';
+/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */
+/**
+ * One input an instance must supply — an address slot (non-secret, authored in the infra env
+ * config) or a secret slot (authored in `secrets.json`). Both halves share this shape because both
+ * derive an environment-variable name the same way; what differs is WHERE the value is authored and
+ * whether it is ever printed.
+ */
+export declare const SystemOfRecordSlotSchema: z.ZodObject<{
+    /**
+     * lowerCamelCase, and nothing else — see the module header. Becomes the `<SLOT>` half of
+     * `WILDO_SOR_<NAME>__<SLOT>` by upper-snake-casing.
+     */
+    slug: z.ZodString;
+    /**
+     * Whether an instance MUST supply it. A missing required slot refuses at `wildo config sync` and
+     * again at boot (#1055 E4) — the remedy is authoring a value, which needs no running companion,
+     * so refusing is legitimate there.
+     */
+    required: z.ZodBoolean;
+    /** What an operator must put in it. Printed by sync and by the secrets report. */
+    description: z.ZodString;
+}, z.core.$strict>;
+export type SystemOfRecordSlot = z.infer<typeof SystemOfRecordSlotSchema>;
+/**
+ * What ONE credential kind needs, independent of vendor (#1055 R15).
+ *
+ * The kind owns its secrets and any address slot that exists only because the kind was chosen — a
+ * future `OAUTH2_CLIENT_CREDENTIALS` owns `tokenUrl`, which no vendor would declare if it were
+ * reached with a static key. `ODOO_API_KEY_IN_ARGS` needs no address slot of its own, and that is
+ * the seam rather than an omission: its `database` and `login` inputs identify WHICH Odoo and WHICH
+ * user, so they belong to the vendor and would survive a second Odoo credential kind.
+ */
+export declare const SystemOfRecordCredentialKindContractSchema: z.ZodObject<{
+    addressSlots: z.ZodArray<z.ZodObject<{
+        /**
+         * lowerCamelCase, and nothing else — see the module header. Becomes the `<SLOT>` half of
+         * `WILDO_SOR_<NAME>__<SLOT>` by upper-snake-casing.
+         */
+        slug: z.ZodString;
+        /**
+         * Whether an instance MUST supply it. A missing required slot refuses at `wildo config sync` and
+         * again at boot (#1055 E4) — the remedy is authoring a value, which needs no running companion,
+         * so refusing is legitimate there.
+         */
+        required: z.ZodBoolean;
+        /** What an operator must put in it. Printed by sync and by the secrets report. */
+        description: z.ZodString;
+    }, z.core.$strict>>;
+    secretSlots: z.ZodArray<z.ZodObject<{
+        /**
+         * lowerCamelCase, and nothing else — see the module header. Becomes the `<SLOT>` half of
+         * `WILDO_SOR_<NAME>__<SLOT>` by upper-snake-casing.
+         */
+        slug: z.ZodString;
+        /**
+         * Whether an instance MUST supply it. A missing required slot refuses at `wildo config sync` and
+         * again at boot (#1055 E4) — the remedy is authoring a value, which needs no running companion,
+         * so refusing is legitimate there.
+         */
+        required: z.ZodBoolean;
+        /** What an operator must put in it. Printed by sync and by the secrets report. */
+        description: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type SystemOfRecordCredentialKindContract = z.infer<typeof SystemOfRecordCredentialKindContractSchema>;
+/**
+ * Every credential kind's inputs. Engine-owned and CLOSED, keyed by the enum so a member added
+ * without a contract is a compile error rather than a boot surprise.
+ *
+ * ## Which half a slot lands in, since the answer is not "is it secret"
+ *
+ * The split follows the precedent #1055 set with Odoo's `login`: **an identity slot is an ADDRESS
+ * slot and a proof slot is a SECRET slot.** A `clientId` and a BASIC `username` are not
+ * confidential — they name WHICH client and WHICH user — and putting them in `secrets.json` would
+ * hide, from every diff and every environment review, the one thing an operator most often needs to
+ * check. What must never be printed is the half that PROVES the identity.
+ *
+ * The consequence is that a credential's two halves are authored in two files. That is deliberate
+ * and it is the same shape Odoo already has (`login` in the infra config, `apiKey` in the secrets),
+ * so an operator meets one convention rather than two.
+ *
+ * ## Required-ness that a static list cannot express
+ *
+ * Three slots are declared `required: false` here and are made required by the FACET's offer, which
+ * is the only place that knows: `certificateKeyId` when the vendor's assertion header policy is
+ * {@link SystemOfRecordAssertionHeaderPolicy.KEY_ID_SUPPLIED}, `certificatePem` when it is
+ * `X509_THUMBPRINT_DERIVED`, and `subject` for the JWT-bearer grant's `sub`. The join is performed
+ * ONCE, in {@link resolveSystemOfRecordInstanceSlots}, rather than by each of the five readers of
+ * "what does this instance need" — which is the enumeration failure
+ * `invariant-call-site-enumeration.md` exists to stop.
+ */
+export declare const SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS: Readonly<Record<SystemOfRecordCredentialKind, SystemOfRecordCredentialKindContract>>;
+/**
+ * How a vendor wants a client assertion's PROTECTED HEADER built (#1056 R2).
+ *
+ * A generic "sign it with the private key" is rejected by both vendors that want an assertion, and
+ * they want DIFFERENT things — which is why this is a facet policy rather than an engine constant.
+ */
+export declare enum SystemOfRecordAssertionHeaderPolicy {
+    /** `kid` carries a key id the VENDOR assigned when the certificate was uploaded (NetSuite). */
+    KEY_ID_SUPPLIED = "key-id-supplied",
+    /**
+     * `x5t` carries the base64url SHA-1 thumbprint of the certificate, DERIVED by the engine from the
+     * supplied `certificatePem` (Microsoft Entra's certificate credential).
+     *
+     * SHA-1 is not a security choice here: `x5t` is defined as a SHA-1 thumbprint (RFC 7515 §4.1.7)
+     * and is an identifier for locating a key, never an integrity proof.
+     * spec-cite: RFC 7515 §4.1.7 ("x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter).
+     */
+    X509_THUMBPRINT_DERIVED = "x509-thumbprint-derived"
+}
+/**
+ * Where a client's id and secret travel on a client-credentials token request.
+ *
+ * RFC 6749 §2.3.1 permits BOTH and says a server MUST support the Basic header while it MAY support
+ * the body form — and real vendors differ, so the choice cannot be an engine default.
+ * spec-cite: RFC 6749 §2.3.1 (Client Password).
+ */
+export declare enum SystemOfRecordClientAuthenticationPlacement {
+    /** `client_id` and `client_secret` as form fields in the request body. */
+    REQUEST_BODY = "request-body",
+    /** `Authorization: Basic base64(client_id ":" client_secret)`. */
+    BASIC_HEADER = "basic-header"
+}
+/**
+ * The algorithms an assertion may be signed with. Asymmetric ONLY, and that is the point: a
+ * symmetric `HS*` assertion is signed with a shared secret, which makes the assertion no stronger
+ * than the secret it was supposed to replace, and `none` is not an algorithm.
+ */
+export declare enum SystemOfRecordAssertionSigningAlgorithm {
+    RS256 = "RS256",
+    RS384 = "RS384",
+    RS512 = "RS512",
+    PS256 = "PS256",
+    ES256 = "ES256",
+    ES384 = "ES384",
+    ES512 = "ES512"
+}
+/**
+ * ONE credential kind as ONE vendor offers it — the kind, plus everything about it that varies by
+ * VENDOR and not by deployment.
+ *
+ * A discriminated union rather than a kind list beside a policy map, so a policy cannot exist
+ * without its kind and a kind cannot be offered without the policy it needs. `API_KEY_HEADER` with
+ * no header name is unrepresentable here; under a parallel map it would parse and fail at the first
+ * read.
+ */
+export declare const SystemOfRecordCredentialOfferSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.API_KEY_HEADER>>;
+    /** The header the key travels in — `Authorization`, `X-API-Key`, `apikey`, whatever the vendor reads. */
+    headerName: z.ZodString;
+    /** What precedes the key in the header value, INCLUDING its trailing space (`"Bearer "`). Omitted when the key stands alone. */
+    valuePrefix: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.API_KEY_QUERY>>;
+    /** The query parameter the key is appended as. */
+    parameterName: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.BASIC>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET>>;
+    clientAuthentication: z.ZodEnum<typeof SystemOfRecordClientAuthenticationPlacement>;
+    tokenLifetimeFallbackSeconds: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE>>;
+    assertionHeaderPolicy: z.ZodEnum<typeof SystemOfRecordAssertionHeaderPolicy>;
+    assertionSigningAlgorithm: z.ZodEnum<typeof SystemOfRecordAssertionSigningAlgorithm>;
+    /** How long the ASSERTION is valid — minutes, not hours; it is consumed once at the token endpoint. */
+    assertionLifetimeSeconds: z.ZodNumber;
+    tokenLifetimeFallbackSeconds: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER>>;
+    assertionSigningAlgorithm: z.ZodEnum<typeof SystemOfRecordAssertionSigningAlgorithm>;
+    assertionLifetimeSeconds: z.ZodNumber;
+    tokenLifetimeFallbackSeconds: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+export type SystemOfRecordCredentialOffer = z.infer<typeof SystemOfRecordCredentialOfferSchema>;
+/**
+ * How a vendor's OData service pages a COLLECTION READ (#1292).
+ *
+ * A vendor property rather than a dialect constant, and the reason is one large implementation: the
+ * Microsoft Dataverse Web API refuses `$skip` outright, while OData v4 defines it and a conformant
+ * service serves it. A per-dialect default would have to be wrong for one of them — the same
+ * argument #1056 R3 settled for the token-lifetime fallback.
+ *
+ * spec-cite: OData Version 4.01 Part 1: Protocol §11.2.6 ("$top and $skip") for the default; Microsoft
+ * Learn, "Query data using the Web API"
+ * (https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/query-data-web-api) for
+ * the refusal — that page enumerates the query options the Web API does not support.
+ */
+export declare enum SystemOfRecordODataListPaging {
+    /**
+     * `$top` + `$skip` — one request for any page, which is what a page-numbered contract wants, unless the
+     * service serves fewer rows than `$top` and hands back a continuation: the page is then read to its end
+     * along the continuation (#1998), so the next page's `$skip` does not jump the rows the service held back.
+     *
+     * The default, because it is what OData v4 defines and what an uncatalogued service serves.
+     */
+    SKIP = "skip",
+    /**
+     * `@odata.nextLink` only: the service hands back a continuation URL and refuses to be addressed by
+     * offset.
+     *
+     * The consequence is structural rather than a detail — a cursor has no page NUMBER, so reaching a page
+     * costs one request per page before it. The engine asks for the page size with `Prefer:
+     * odata.maxpagesize` on v4 (v2 has no such preference, so the service's own size decides) — never with
+     * `$top`, which would cap the whole collection (#1991) — walks forward
+     * counting ROWS rather than links (the service may serve a page size of its own, #1998), and refuses
+     * past a bound rather than pretending otherwise.
+     */
+    NEXT_LINK_ONLY = "next-link-only"
+}
+/**
+ * HOW a vendor partitions the data one deployment holds (#1058).
+ *
+ * Inside ONE corporate, a system of record usually holds several partitions — Odoo companies, SAP
+ * company codes, Dynamics business units, NetSuite subsidiaries. They are not tenants: they all
+ * belong to the operator, which is why they map onto ORGANIZATION UNITS of the owner organization
+ * rather than onto organizations (#1049 Q3).
+ */
+export declare enum SystemOfRecordPartitionKind {
+    /**
+     * A FIELD on every row carries the partition (Odoo `company_id`, NetSuite `subsidiary`). The only
+     * kind supported today: it is filterable, so the confinement can be PUSHED DOWN and a caller never
+     * receives rows of a partition they may not see.
+     */
+    FIELD = "field",
+    /**
+     * The partition is a PATH SEGMENT of the request (Business Central's `/companies({id})/customers`).
+     *
+     * Declared so a facet can be HONEST about a vendor this engine cannot confine yet, and refused by
+     * name where a partition is opted into. A path segment is chosen before the request is built, so it
+     * cannot express "these three companies" in one read — the confinement would have to fan out into
+     * one request per unit, which is a different mechanism rather than a different predicate.
+     */
+    PATH_SEGMENT = "path-segment"
+}
+/**
+ * The SHAPE a partition value arrives in — the difference between a number and a pair.
+ *
+ * Odoo answers a many2one as `[id, display_name]`: `company_id: [10, "Acme"]` on a read, and `false`
+ * when unset. A reader that took the whole array as the key would match nothing, and one that took
+ * `row.company_id` as a scalar would stamp `"10,Acme"`. The shape is declared because the engine
+ * cannot tell a pair from a two-element list by looking.
+ *
+ * spec-cite: Odoo 18.0 developer documentation, "External API" — a many2one is returned as an
+ * `[id, display_name]` pair under both *Read records* and *Search and read*.
+ */
+export declare enum SystemOfRecordPartitionValueShape {
+    /** The field holds the key directly (an integer, a GUID, a string). */
+    SCALAR = "scalar",
+    /** Odoo's many2one: `[id, label]`, and `false` when unset. The id is the key. */
+    MANY2ONE_PAIR = "many2one-pair"
+}
+/**
+ * What a vendor's partitioning IS — declared by the FACET, opted into by the INSTANCE.
+ *
+ * The split is the same one every other vendor fact takes: how a vendor partitions is a property of
+ * the vendor, and WHETHER this deployment's data is partitioned is a property of the deployment. A
+ * single-company Odoo has a `company_id` on every row and nothing to confine.
+ */
+export declare const SystemOfRecordPartitionSupportSchema: z.ZodObject<{
+    kind: z.ZodEnum<typeof SystemOfRecordPartitionKind>;
+    /** The remote field carrying the partition key (`company_id`, `subsidiary`, `CompanyCode`). */
+    remoteField: z.ZodString;
+    /**
+     * How a key is spelled on the wire. Reused from the KEY component vocabulary rather than given its
+     * own: a partition key is addressed exactly as a key component is — decoded from an operator's
+     * authored string, compiled into a remote predicate — and two vocabularies for one job would drift.
+     */
+    codec: z.ZodEnum<typeof HttpApiKeyComponentCodec>;
+    valueShape: z.ZodEnum<typeof SystemOfRecordPartitionValueShape>;
+}, z.core.$strict>;
+export type SystemOfRecordPartitionSupport = z.infer<typeof SystemOfRecordPartitionSupportSchema>;
+/**
+ * A step a vendor requires before it accepts ANY modifying request — a row write or a writing action — beyond the
+ * credential every request carries (#1726).
+ *
+ * Declared by the FACET because it is a fact about the product, and refused at startup by the engine for every step it
+ * does not perform (`WRITE_PREREQUISITE_NOT_SUPPORTED`): a write the vendor is known to refuse must not be opened, since
+ * it would only surface as a remote `403` at the first request, under a code that names nothing.
+ */
+export declare enum SystemOfRecordWritePrerequisite {
+    /**
+     * SAP Gateway's cross-site-request-forgery protection: a modifying request must carry an `X-CSRF-Token` obtained by a
+     * prior NON-modifying request sent with `X-CSRF-Token: Fetch`, together with the session cookie that request set.
+     * spec-cite: SAP Help Portal, SAP Gateway Foundation — "Cross-Site Request Forgery Protection"
+     * (https://help.sap.com/saphelp_gateway20sp12/helpdata/en/e6/cae27d5e8d4996add4067280c8714e/frameset.htm).
+     */
+    CSRF_TOKEN_HANDSHAKE = "csrf-token-handshake"
+}
+/**
+ * The OData v4 control information that carries an entity's ETag in a JSON row (#1726) — the only row version an OData
+ * vendor can declare in `rowVersionField`, and the value the OData write dialect sends as `If-Match`.
+ *
+ * The OData 4.0 spelling. A payload that is not OData-Version 4.0 omits the `odata.` infix (`@etag`); the engine asks
+ * for 4.0 on its OData requests (`OData-MaxVersion: 4.0`), so a conformant service answers this spelling. A field MAPPED
+ * onto the tag, and a `VERSION_CHECKED` comparison, read this spelling only; the write dialect alone also reads the
+ * short form when it derives `If-Match`, which only widens what it can condition on.
+ * spec-cite: OData JSON Format Version 4.01 §4.5.10 (Control Information: etag (odata.etag)) and §4.5 ("In requests and
+ * responses with an OData-Version header with a value of 4.0 control information names are prefixed with @odata.").
+ */
+export declare const ODATA_ENTITY_TAG_CONTROL_INFORMATION = "@odata.etag";
+/**
+ * What a vendor is, as a system of record. Parsed rather than trusted because #1057 lets a PACKAGE
+ * ship one — a record produced by one package version and read by another.
+ */
+export declare const SystemOfRecordVendorFacetSchema: z.ZodObject<{
+    /** The vendor's stable identifier, named by an instance's `vendor`. Same charset law as an instance name. */
+    vendor: z.ZodString;
+    /**
+     * The dialects this vendor can be READ through. An instance's `dialect` must be one of them, and
+     * a binding's `dialect` must equal its instance's — both refused at boot registration, where the
+     * declaration and the facet are finally in the same scope.
+     */
+    dialects: z.ZodArray<z.ZodEnum<typeof HttpApiTransportDialect>>;
+    /**
+     * The vendor's own address slots — non-secret, authored per instance in the infra env config. The
+     * base URL is registration-scoped and is never credential material.
+     */
+    addressSlots: z.ZodArray<z.ZodObject<{
+        /**
+         * lowerCamelCase, and nothing else — see the module header. Becomes the `<SLOT>` half of
+         * `WILDO_SOR_<NAME>__<SLOT>` by upper-snake-casing.
+         */
+        slug: z.ZodString;
+        /**
+         * Whether an instance MUST supply it. A missing required slot refuses at `wildo config sync` and
+         * again at boot (#1055 E4) — the remedy is authoring a value, which needs no running companion,
+         * so refusing is legitimate there.
+         */
+        required: z.ZodBoolean;
+        /** What an operator must put in it. Printed by sync and by the secrets report. */
+        description: z.ZodString;
+    }, z.core.$strict>>;
+    /**
+     * The credential kinds this vendor offers, each carrying THIS vendor's policy for it. The instance
+     * chooses one kind; a kind no offer names is refused.
+     *
+     * Reshaped from a bare `credentialKinds: Kind[]` in #1056. A list of kinds could say that a vendor
+     * accepts a header-borne API key and could not say WHICH header — so either the operator was asked
+     * (a question the vendor already answers, `derive-before-you-ask.md`) or the engine guessed. An
+     * offer is the kind and its vendor policy as one indivisible thing.
+     */
+    credentialOffers: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.API_KEY_HEADER>>;
+        /** The header the key travels in — `Authorization`, `X-API-Key`, `apikey`, whatever the vendor reads. */
+        headerName: z.ZodString;
+        /** What precedes the key in the header value, INCLUDING its trailing space (`"Bearer "`). Omitted when the key stands alone. */
+        valuePrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.API_KEY_QUERY>>;
+        /** The query parameter the key is appended as. */
+        parameterName: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.BASIC>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET>>;
+        clientAuthentication: z.ZodEnum<typeof SystemOfRecordClientAuthenticationPlacement>;
+        tokenLifetimeFallbackSeconds: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE>>;
+        assertionHeaderPolicy: z.ZodEnum<typeof SystemOfRecordAssertionHeaderPolicy>;
+        assertionSigningAlgorithm: z.ZodEnum<typeof SystemOfRecordAssertionSigningAlgorithm>;
+        /** How long the ASSERTION is valid — minutes, not hours; it is consumed once at the token endpoint. */
+        assertionLifetimeSeconds: z.ZodNumber;
+        tokenLifetimeFallbackSeconds: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER>>;
+        assertionSigningAlgorithm: z.ZodEnum<typeof SystemOfRecordAssertionSigningAlgorithm>;
+        assertionLifetimeSeconds: z.ZodNumber;
+        tokenLifetimeFallbackSeconds: z.ZodNumber;
+    }, z.core.$strict>], "kind">>;
+    /**
+     * How a COLLECTION READ pages against this vendor (#1292). Meaningful only for the OData dialects.
+     *
+     * OPTIONAL rather than defaulted, and the difference is not cosmetic: `.default()` would make the
+     * field REQUIRED on the parsed type, so every facet — Odoo's JSON-RPC included — would have to
+     * state an answer to a question about a dialect it does not speak. Absent means "not an OData
+     * concern, or the conformant default", and {@link resolveSystemOfRecordODataListPaging} is the one
+     * place that turns absence into `SKIP`.
+     */
+    odataListPaging: z.ZodOptional<z.ZodEnum<typeof SystemOfRecordODataListPaging>>;
+    /**
+     * How this vendor partitions one deployment's data (#1058), when it does.
+     *
+     * ABSENT means the vendor has no partition concept the engine can confine on — which is a real
+     * answer rather than an unfinished one, and the reason an instance opting into `partition` against
+     * such a facet is refused by name rather than silently doing nothing.
+     */
+    partition: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodEnum<typeof SystemOfRecordPartitionKind>;
+        /** The remote field carrying the partition key (`company_id`, `subsidiary`, `CompanyCode`). */
+        remoteField: z.ZodString;
+        /**
+         * How a key is spelled on the wire. Reused from the KEY component vocabulary rather than given its
+         * own: a partition key is addressed exactly as a key component is — decoded from an operator's
+         * authored string, compiled into a remote predicate — and two vocabularies for one job would drift.
+         */
+        codec: z.ZodEnum<typeof HttpApiKeyComponentCodec>;
+        valueShape: z.ZodEnum<typeof SystemOfRecordPartitionValueShape>;
+    }, z.core.$strict>>;
+    /**
+     * The change-tracking mechanisms this vendor's deployments support, which a pipeline may read
+     * incrementally through (#1682). A pipeline declaring `incremental.mode` outside this list is refused
+     * at startup, naming the vendor.
+     *
+     * A VENDOR property rather than a dialect constant: whether a deployment can say what changed is a
+     * fact about the product (Odoo's ORM stamps `write_date` on every model that logs access; an OData
+     * service may or may not enable change tracking, #1722), not about the wire language.
+     *
+     * ABSENT means none — a real answer: that vendor's pipelines run full passes only.
+     */
+    incrementalExtractionModes: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof ExternalDataIncrementalExtractionMode>>>;
+    /**
+     * The service-defined OData error codes with which this vendor says a tracked change position has EXPIRED (#1722), for a
+     * vendor that answers it with its own code rather than the protocol's `410 Gone` / `404 Not Found`.
+     *
+     * A delta-link pass whose link the vendor no longer honours starts over with a full pass. The protocol names the status
+     * for an expired URL, and the engine recognises it for every vendor; a vendor that answers something else instead
+     * states its code here, so the fallback does not depend on guessing which `400` means "too old". Dataverse documents
+     * `0x80044352` (`ExpiredVersionStamp`, "Please perform a full sync").
+     *
+     * ABSENT means the vendor answers the protocol's status, or has no change tracking.
+     */
+    odataExpiredChangePositionErrorCodes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    /**
+     * The ACTION call shapes this vendor's product supports (#1678) — how a declared action is called on it: Odoo's
+     * `execute_kw` on a model method, an OData bound action, an OData unbound action import.
+     *
+     * A VENDOR property, like `partition`: whether a product exposes callable operations beyond row reads is a fact about
+     * the product, and a generic OData service may expose none. A binding declaring an action whose shape its vendor does
+     * not list is refused at boot, naming the vendor. ABSENT means none — the vendor is read (and perhaps written) only.
+     * Each listed shape must be spoken over one of the facet's own `dialects`.
+     */
+    actionCallShapes: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof SystemOfRecordActionCallShape>>>;
+    /**
+     * The remote field this vendor's product maintains on EVERY row as its version — changed by the product itself on every
+     * write, never by a caller (#1724, #1726). Odoo: `write_date`, the ORM's "Last Updated on". An OData v4 vendor that
+     * serves entity tags: {@link ODATA_ENTITY_TAG_CONTROL_INFORMATION} (`@odata.etag`), and nothing else.
+     *
+     * A binding may declare `writeConcurrency: VERSION_CHECKED` only against a vendor that names one, and only with a
+     * version field that maps onto it (refused at boot, `WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR`). The engine then
+     * compares the version a caller read with the one it reads just before the write.
+     *
+     * ## What that comparison is worth depends on the DIALECT, not on this field
+     *
+     * - **Odoo (best-effort).** Its external API has no conditional write — `write(ids, vals)` applies the values, with no
+     *   precondition — so the comparison and the write are two separate calls, and a change landing between them is
+     *   overwritten. The check NARROWS the lost-update window to the gap between two calls; it does not close it.
+     * - **OData v4 (atomic).** The OData write dialect sends the version as `If-Match` on the `PATCH` or `DELETE`, and the
+     *   service itself refuses a mismatch with `412 Precondition Failed` and applies nothing. The engine's comparison
+     *   before sending is then only a fast refusal; the guarantee is the vendor's.
+     *   spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match) — "the service MUST respond with 412
+     *   Precondition Failed and MUST ensure that no observable change occurs as a result of the request".
+     *
+     * Declaring it for an OData vendor is also what lets its writes send the row's own entity tag rather than `*`: the
+     * write dialect reads `@odata.etag` from the row it reads first, so a row moved (into another partition, say) between
+     * that read and the write is refused by the vendor instead of written.
+     *
+     * A VENDOR property, like `incrementalExtractionModes`: whether a product maintains a per-row version is a fact about the
+     * product. ABSENT means none, and a binding against such a vendor states `LAST_WRITER_WINS` instead.
+     */
+    rowVersionField: z.ZodOptional<z.ZodString>;
+    /**
+     * What this vendor requires before any modifying request (#1726) — see {@link SystemOfRecordWritePrerequisite}. ABSENT
+     * means nothing beyond the credential. A binding opening writes against a vendor listing a step the engine does not
+     * perform is refused at startup.
+     */
+    writePrerequisites: z.ZodOptional<z.ZodArray<z.ZodEnum<typeof SystemOfRecordWritePrerequisite>>>;
+}, z.core.$strict>;
+export type SystemOfRecordVendorFacet = z.infer<typeof SystemOfRecordVendorFacetSchema>;
+/**
+ * The export a package's `./systems-of-record` module presents: a record of facets keyed by vendor id. The
+ * backend's facet resolver and `wildo secrets` (which lists the credential slots an instance needs) both read
+ * a facet module through this name, so it is declared once, beside the shape it carries.
+ */
+export declare const SYSTEM_OF_RECORD_FACET_RECORD_EXPORT = "PROVIDER_CATALOGUE_SYSTEM_OF_RECORD_FACETS";
+/** The subpath a package exports its facet module under: `<package>/systems-of-record`. */
+export declare const SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH = "/systems-of-record";
+/** @wildo_source:part:end saas.models.systems-of-record */
+/**
+ * The specifier of `packageName`'s facet module. ONE spelling for the backend's resolver, `wildo secrets` and the
+ * discovery that records the modules, so the three cannot disagree about where a package's facets live (#1675).
+ */
+export declare function systemOfRecordFacetModuleSpecifier(packageName: string): string;
+/** The package a facet module specifier belongs to: `@acme/erp/systems-of-record` → `@acme/erp`. */
+export declare function packageOfSystemOfRecordFacetModule(specifier: string): string;
+/** A vendor's BASE facet as one source presents it, before it is chosen. */
+export interface SystemOfRecordBaseFacetCandidate {
+    /** Who presents it: `the engine`, `package @wildo-ai/systems-of-record`. */
+    readonly source: string;
+    /** The facet as presented — parsed here, since it was produced by one package version and is read by another. */
+    readonly raw: unknown;
+}
+export type SystemOfRecordBaseFacetSelection = {
+    readonly facet: SystemOfRecordVendorFacet;
+    readonly source: string;
+} | {
+    readonly conflict: string;
+    readonly detail: Readonly<Record<string, unknown>>;
+};
+/**
+ * The ONE base facet for a vendor, or a refusal naming both sources when two present one (#1675).
+ *
+ * Refused rather than "the first in authority order wins": a base facet carries the vendor's partition, and module
+ * order is the sorted order of discovered package names, so which package's partition confined a tenant's rows would
+ * otherwise depend on how two names sort — and a newly installed package could replace the library's facet with
+ * no opt-in at all. A package that knows more about a vendor it does not own ADDS to the base through an augmentation
+ * an instance opts into; it never presents a second base.
+ *
+ * `undefined` when no source presents the vendor — the caller's own refusal names the vendor.
+ *
+ * assurance-control: WILDO.DATA.TENANT_ISOLATION WILDO.SECURITY.FAIL_CLOSED — two base facets for one vendor refuse,
+ * so a tenant-confinement declaration never comes from whichever of two packages sorts first.
+ */
+export declare function selectSystemOfRecordBaseFacet(input: {
+    readonly vendor: string;
+    readonly candidates: readonly SystemOfRecordBaseFacetCandidate[];
+}): SystemOfRecordBaseFacetSelection | undefined;
+/** @wildo_source:part:start saas.models.systems-of-record.facet-augmentation facet:kind:api facet:audience:app-developer */
+/**
+ * What a package ADDS to a vendor facet it does not own (#1675) — the facet counterpart of a provider
+ * augmentation (#1672), with its own code path.
+ *
+ * One base facet per vendor answers — the one package module that presents it; two refuse, naming both. An
+ * augmentation adds to it: a PARTITION declaration for a vendor whose base declares none (say a `company_id`
+ * FIELD every row of an ERP carries, shipped by a package that knows the vendor better), or further
+ * CREDENTIAL OFFERS. It never replaces or removes anything the base declares — two declarations of one
+ * partition, or one credential kind offered twice, refuse at startup naming both sources.
+ *
+ * Only a FIELD partition can be confined. A PATH-SEGMENT partition (a company chosen in the request path) is
+ * refused when an instance sets `partition: true`, augmented or not, because nothing narrows a read the path
+ * already scoped — so augmenting one declares something no instance can use.
+ *
+ * INERT until an instance opts in: `systemsOfRecord.<name>.facetAugmentations` names the PACKAGES whose
+ * augmentation applies to that instance. The facet is the single partition authority, so a partition
+ * arriving from a package is a tenant-confinement change and is never applied because a package happens
+ * to be installed.
+ *
+ * A package presents its augmentations beside its facets, from its `./systems-of-record` export, as a
+ * record keyed by vendor id under {@link SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT}. A package
+ * may ship augmentations and no facet at all. Its module is found the way every facet module is: by the
+ * provider discovery walk `wildo config sync` runs, which reads the framework's names, the application's own
+ * scope, and any package the application lists in `providers.packages` (#1676). Listing ADMITS the package;
+ * an instance's opt-in ACTIVATES its augmentation. A package the walk did not record is refused by name.
+ *
+ * Entity descriptions are not augmentable: the facet declares none today, so there is nothing to add to.
+ */
+export declare const SystemOfRecordVendorFacetAugmentationSchema: z.ZodObject<{
+    /** The vendor this augments — must equal the key it is recorded under. */
+    vendor: z.ZodString;
+    /** A partition declaration for a vendor whose base facet declares none. */
+    partition: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodEnum<typeof SystemOfRecordPartitionKind>;
+        /** The remote field carrying the partition key (`company_id`, `subsidiary`, `CompanyCode`). */
+        remoteField: z.ZodString;
+        /**
+         * How a key is spelled on the wire. Reused from the KEY component vocabulary rather than given its
+         * own: a partition key is addressed exactly as a key component is — decoded from an operator's
+         * authored string, compiled into a remote predicate — and two vocabularies for one job would drift.
+         */
+        codec: z.ZodEnum<typeof HttpApiKeyComponentCodec>;
+        valueShape: z.ZodEnum<typeof SystemOfRecordPartitionValueShape>;
+    }, z.core.$strict>>;
+    /** Credential kinds the base facet does not offer, each with this vendor's policy for it. */
+    credentialOffers: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.API_KEY_HEADER>>;
+        /** The header the key travels in — `Authorization`, `X-API-Key`, `apikey`, whatever the vendor reads. */
+        headerName: z.ZodString;
+        /** What precedes the key in the header value, INCLUDING its trailing space (`"Bearer "`). Omitted when the key stands alone. */
+        valuePrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.API_KEY_QUERY>>;
+        /** The query parameter the key is appended as. */
+        parameterName: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.BASIC>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET>>;
+        clientAuthentication: z.ZodEnum<typeof SystemOfRecordClientAuthenticationPlacement>;
+        tokenLifetimeFallbackSeconds: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE>>;
+        assertionHeaderPolicy: z.ZodEnum<typeof SystemOfRecordAssertionHeaderPolicy>;
+        assertionSigningAlgorithm: z.ZodEnum<typeof SystemOfRecordAssertionSigningAlgorithm>;
+        /** How long the ASSERTION is valid — minutes, not hours; it is consumed once at the token endpoint. */
+        assertionLifetimeSeconds: z.ZodNumber;
+        tokenLifetimeFallbackSeconds: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER>>;
+        assertionSigningAlgorithm: z.ZodEnum<typeof SystemOfRecordAssertionSigningAlgorithm>;
+        assertionLifetimeSeconds: z.ZodNumber;
+        tokenLifetimeFallbackSeconds: z.ZodNumber;
+    }, z.core.$strict>], "kind">>>;
+}, z.core.$strict>;
+export type SystemOfRecordVendorFacetAugmentation = z.infer<typeof SystemOfRecordVendorFacetAugmentationSchema>;
+/** The export a package's `./systems-of-record` module presents its facet augmentations under: a record keyed by vendor id. */
+export declare const SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT = "PROVIDER_CATALOGUE_SYSTEM_OF_RECORD_FACET_AUGMENTATIONS";
+/** @wildo_source:part:end saas.models.systems-of-record.facet-augmentation */
+/**
+ * Where each thing a RESOLVED facet declares came from, once an instance's opted-in augmentations were applied
+ * (#1675). Written only by {@link applySystemOfRecordFacetAugmentations}: a facet a package ships is parsed through
+ * a strict schema with no such field, so a package cannot claim to have been augmented, nor attribute a partition
+ * to someone else.
+ */
+export interface SystemOfRecordFacetAugmentationProvenance {
+    /** The package whose augmentation declared the instance's partition. */
+    readonly partition?: string;
+    /** Credential kind → the package whose augmentation offered it. */
+    readonly credentialKinds: Readonly<Record<string, string>>;
+}
+/** Why an instance's opted-in augmentations cannot be applied. */
+export declare enum SystemOfRecordFacetAugmentationRefusalKind {
+    /** A package the instance opted in ships no augmentation for its vendor. */
+    NOT_FOUND = "not-found",
+    /** Two sources declare the same partition or credential kind. */
+    CONFLICT = "conflict",
+    /** An augmentation, or the facet it produces once merged, fails the facet schema. */
+    INVALID = "invalid"
+}
+export type SystemOfRecordFacetAugmentationResult = {
+    readonly facet: SystemOfRecordVendorFacet;
+    readonly augmentedBy: SystemOfRecordFacetAugmentationProvenance;
+} | {
+    readonly refusal: SystemOfRecordFacetAugmentationRefusalKind;
+    readonly message: string;
+    readonly detail: Readonly<Record<string, unknown>>;
+};
+/**
+ * Folds an instance's opted-in augmentations into its base facet — and refuses, naming both sources, the moment two
+ * of them declare the same thing. ONE implementation for the backend's facet resolver and `wildo secrets`, so a
+ * listing cannot ask for a credential the backend would refuse, or miss one an augmentation offers.
+ *
+ * `augmentations` is in the instance's declared opt-in order; each `raw` is what the package's module presents under
+ * {@link SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT} for this vendor (`undefined` when it presents none),
+ * parsed here like a facet because it was produced by one package version and is read by another.
+ *
+ * assurance-control: WILDO.DATA.TENANT_ISOLATION WILDO.SECURITY.FAIL_CLOSED — a partition declaration (how a tenant's
+ * rows are confined) is admitted from a package only when the instance opted that package in, only for a vendor whose
+ * base facet declares none, never twice, and every admitted one is recorded with the package that contributed it.
+ */
+export declare function applySystemOfRecordFacetAugmentations(input: {
+    readonly vendor: string;
+    readonly base: {
+        readonly facet: SystemOfRecordVendorFacet;
+        readonly source: string;
+    };
+    readonly augmentations: ReadonlyArray<{
+        readonly packageName: string;
+        readonly raw: unknown;
+        /**
+         * Why the package's facet module could not be read at all — it was not discovered, or its import failed — named in
+         * the NOT_FOUND refusal, never swallowed. A full clause, since the reader supplies the remedy it knows.
+         */
+        readonly unreadable?: string;
+    }>;
+}): SystemOfRecordFacetAugmentationResult;
+/**
+ * How this vendor pages an OData collection read — the ONE place an absent declaration becomes an
+ * answer (#1292).
+ *
+ * `$skip` is what OData v4 defines and what a conformant service serves, so silence means the
+ * conformant behaviour rather than an unknown. A second `?? SKIP` written at a consumer is how two
+ * readers come to disagree about what silence meant.
+ */
+export declare function resolveSystemOfRecordODataListPaging(facet: SystemOfRecordVendorFacet): SystemOfRecordODataListPaging;
+/** Every slot ONE instance must supply, once its facet and its credential kind are both known. */
+export interface SystemOfRecordInstanceSlots {
+    readonly addressSlots: readonly SystemOfRecordSlot[];
+    readonly secretSlots: readonly SystemOfRecordSlot[];
+}
+/**
+ * Find the offer a vendor makes for one kind, or `undefined`.
+ *
+ * Separate from {@link resolveSystemOfRecordInstanceSlots} because the two answer different
+ * questions: this one is "what is this vendor's POLICY for the kind I chose", which the minter needs
+ * at every call, while the slot union is a boot-time question asked once.
+ */
+export declare function findSystemOfRecordCredentialOffer(facet: SystemOfRecordVendorFacet, credentialKind: SystemOfRecordCredentialKind): SystemOfRecordCredentialOffer | undefined;
+/**
+ * Which credential kind an instance uses — decided ONCE, for the backend registry that enforces it at boot
+ * and for `wildo secrets`, which lists the secret slots that kind needs (#1637). Two readers deriving it
+ * separately is how a listing comes to ask for a secret the backend will not read.
+ *
+ * DECLARED when the instance names one the facet offers; DERIVED when the instance names none and the
+ * facet offers exactly one, because an author asked to choose between one option is being asked a question
+ * the mechanism already holds the answer to (`derive-before-you-ask.md`). Otherwise a refusal, carrying
+ * what the facet does offer so the reader can name it: a kind the vendor does not offer, or several on
+ * offer and none chosen — the day the author acquires a real decision.
+ */
+export declare function chooseSystemOfRecordCredentialKind(declaredKind: SystemOfRecordCredentialKind | undefined, facet: SystemOfRecordVendorFacet): {
+    readonly kind: SystemOfRecordCredentialKind;
+} | {
+    readonly refusal: SystemOfRecordErrorCode.CREDENTIAL_KIND_NOT_OFFERED | SystemOfRecordErrorCode.CREDENTIAL_KIND_AMBIGUOUS;
+    readonly offered: readonly SystemOfRecordCredentialKind[];
+};
+/**
+ * The ONE place the vendor's slots and the credential kind's slots are joined.
+ *
+ * Every reader of "what does this instance need" goes through here — the environment-variable
+ * derivation, `wildo config sync`'s coherence check, the k8s secrets generator, the CI collector
+ * and the backend registry. Four of those five live in different packages, which is precisely why
+ * re-deriving the union at each of them would drift (`invariant-call-site-enumeration.md`).
+ *
+ * ## It also applies the offer's REQUIRED-NESS, which is why it takes a facet and not a contract
+ *
+ * Three slots are declared optional in the contract map and become required here, because only the
+ * vendor's offer knows: `certificateKeyId` under the key-id assertion header policy, `certificatePem`
+ * under the thumbprint policy, and `subject` for the JWT-bearer grant. Declaring them required in the
+ * contract would make every certificate vendor supply both halves of a choice only one of them makes;
+ * leaving them optional everywhere would let an instance boot with an assertion it cannot build, and
+ * fail at the first read instead of at configuration.
+ *
+ * Throws when the kind is not one the facet offers: that pairing is chosen by an instance and
+ * refused where the instance is validated, so reaching here with it means a caller skipped the
+ * check rather than an operator wrote something wrong.
+ */
+export declare function resolveSystemOfRecordInstanceSlots(facet: SystemOfRecordVendorFacet, credentialKind: SystemOfRecordCredentialKind): SystemOfRecordInstanceSlots;
+//# sourceMappingURL=system-of-record-facet.shared.schemas.d.ts.map