@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/systems-of-record/system-of-record-facet.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-facet.shared.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-facet.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,qCAAqC,EAAE,MAAM,wDAAwD,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AAEzJ,6GAA6G;AAE7G;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD;;;OAGG;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,KAAK,CAAC,kCAAkC,EAAE,mDAAmD,CAAC;SAC9F,GAAG,CAAC,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,6BAA6B,EAAE;QACxD,KAAK,EACH,IAAI,6BAA6B,+CAA+C;cAC9E,GAAG,qCAAqC,CAAC,SAAS,CAAC,8DAA8D;cACjH,qHAAqH;KAC1H,CAAC;IACJ;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,4BAA4B,GAAG,CAAC,KAAa,EAAE,EAAE,CACrD,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,aAAa,KAAK,UAAU,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,gCAAgC,EAAE,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,YAAY,CAAC;IACvE,YAAY,EAAE,4BAA4B,CAAC,oBAAoB,CAAC;IAChE,WAAW,EAAE,4BAA4B,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAyF;IAC9I,CAAC,4BAA4B,CAAC,oBAAoB,CAAC,EAAE;QACnD,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,mFAAmF;sBACjF,sFAAsF;aAC3F;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,cAAc,CAAC,EAAE;QAC7C,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,6FAA6F;sBAC3F,+DAA+D;aACpE;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,aAAa,CAAC,EAAE;QAC5C,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,4FAA4F;sBAC1F,uFAAuF;sBACvF,yCAAyC;aAC9C;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE;QACpC,YAAY,EAAE;YACZ;gBACE,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,6FAA6F;sBAC3F,2FAA2F;sBAC3F,4EAA4E;aACjF;SACF;QACD,WAAW,EAAE;YACX,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wGAAwG,EAAE;SAC5J;KACF;IAED,CAAC,4BAA4B,CAAC,gCAAgC,CAAC,EAAE;QAC/D,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,yIAAyI,EAAE;YAC7L,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oGAAoG,EAAE;YACvJ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,uGAAuG,EAAE;YACxJ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2HAA2H,EAAE;SAC/K;QACD,WAAW,EAAE;YACX,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kIAAkI,EAAE;SAC1L;KACF;IAED,CAAC,4BAA4B,CAAC,qCAAqC,CAAC,EAAE;QACpE,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,qEAAqE,EAAE;YACzH;gBACE,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,2FAA2F;sBACzF,2FAA2F;sBAC3F,6CAA6C;aAClD;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,0FAA0F;sBACxF,wFAAwF;sBACxF,4EAA4E;aACjF;YACD,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4EAA4E,EAAE;YAC/H,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,oCAAoC,EAAE;YACrF,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+DAA+D,EAAE;SACnH;QACD,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,kFAAkF;sBAChF,2FAA2F;sBAC3F,qDAAqD;aAC1D;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,EAAE;QAChD,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,oGAAoG,EAAE;YACxJ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6DAA6D,EAAE;YAChH,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,oCAAoC,EAAE;YACrF;gBACE,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,uFAAuF;sBACrF,yFAAyF;sBACzF,8BAA8B;aACnC;YACD,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oCAAoC,EAAE;SACxF;QACD,WAAW,EAAE;YACX,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4GAA4G,EAAE;SACrK;KACF;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,mCAYX;AAZD,WAAY,mCAAmC;IAC7C,+FAA+F;IAC/F,0EAAmC,CAAA;IACnC;;;;;;;OAOG;IACH,0FAAmD,CAAA;AACrD,CAAC,EAZW,mCAAmC,KAAnC,mCAAmC,QAY9C;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,2CAKX;AALD,WAAY,2CAA2C;IACrD,0EAA0E;IAC1E,4EAA6B,CAAA;IAC7B,kEAAkE;IAClE,4EAA6B,CAAA;AAC/B,CAAC,EALW,2CAA2C,KAA3C,2CAA2C,QAKtD;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,uCAQX;AARD,WAAY,uCAAuC;IACjD,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;AACjB,CAAC,EARW,uCAAuC,KAAvC,uCAAuC,QAQlD;AAED;;;;;;;GAOG;AACH,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;IAEjI,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QACvG,yGAAyG;QACzG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE,qCAAqC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5G,gIAAgI;QAChI,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QACtG,kDAAkD;QAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;KAChH,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;IAElH,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,gCAAgC,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QACzH,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC;QACzE,4BAA4B,EAAE,kCAAkC;KACjE,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,qCAAqC,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QAC9H,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC;QAClE,yBAAyB,EAAE,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;QAC1E,uGAAuG;QACvG,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC3D,4BAA4B,EAAE,kCAAkC;KACjE,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QAC1G,yBAAyB,EAAE,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;QAC1E,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC3D,4BAA4B,EAAE,kCAAkC;KACjE,CAAC;CACH,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,6BAqBX;AArBD,WAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,8CAAa,CAAA;IACb;;;;;;;;;;OAUG;IACH,kEAAiC,CAAA;AACnC,CAAC,EArBW,6BAA6B,KAA7B,6BAA6B,QAqBxC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,2BAgBX;AAhBD,WAAY,2BAA2B;IACrC;;;;OAIG;IACH,8CAAe,CAAA;IACf;;;;;;;OAOG;IACH,4DAA6B,CAAA;AAC/B,CAAC,EAhBW,2BAA2B,KAA3B,2BAA2B,QAgBtC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,sDAAiB,CAAA;IACjB,iFAAiF;IACjF,oEAA+B,CAAA;AACjC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IACzC,+FAA+F;IAC/F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CACtD,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAQX;AARD,WAAY,+BAA+B;IACzC;;;;;OAKG;IACH,gFAA6C,CAAA;AAC/C,CAAC,EARW,+BAA+B,KAA/B,+BAA+B,QAQ1C;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,aAAa,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,6GAA6G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD;;;OAGG;IACH,YAAY,EAAE,4BAA4B,CAAC,gBAAgB,CAAC;IAC5D;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE;IACjE;;;;;;OAMG;IACH,SAAS,EAAE,oCAAoC,CAAC,QAAQ,EAAE;IAC1D;;;;;;;;;;OAUG;IACH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7F;;;;;;;;;;OAUG;IACH,oCAAoC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChF,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;OAIG;IACH,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC;WAC5F,KAAK,CAAC,eAAe,KAAK,oCAAoC,EAAE,CAAC;QACpE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,qDAAqD,oCAAoC,YAAY,KAAK,CAAC,eAAe,IAAI;SACxI,CAAC,CAAC;IACL,CAAC;IACD,uHAAuH;IACvH,0DAA0D;IAC1D,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,0CAA0C,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC;gBACjC,OAAO,EAAE,sBAAsB,KAAK,oBAAoB,0CAA0C,CAAC,KAAK,CAAC,6CAA6C;aACvJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,yHAAyH;IACzH,mCAAmC;IACnC,IAAI,KAAK,CAAC,oCAAoC,KAAK,SAAS;WACvD,CAAC,CAAC,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAChH,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,sCAAsC,CAAC;YAC9C,OAAO,EAAE,wDAAwD,qCAAqC,CAAC,gBAAgB,qEAAqE;SAC7L,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,8BAA8B,OAAO,IAAI,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,gGAAgG;IAChG,qEAAqE;IACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9D,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,sCAAsC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,8FAA8F;IAC9F,gGAAgG;IAChG,qFAAqF;IACrF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YACvF,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,cAAc,CAAC;oBACtB,OAAO,EAAE,iBAAiB,IAAI,CAAC,IAAI,wDAAwD,KAAK,CAAC,IAAI,6BAA6B;iBACnI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,4CAA4C,CAAC;AAEjG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,qCAAqC,GAAG,oBAAoB,CAAC;AAC1E,2DAA2D;AAE3D;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,WAAmB;IACpE,OAAO,GAAG,WAAW,GAAG,qCAAqC,EAAE,CAAC;AAClE,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,kCAAkC,CAAC,SAAiB;IAClE,OAAO,SAAS,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,qCAAqC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnJ,CAAC;AAcD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAG7C;IACC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,WAAW,KAAK,CAAC,MAAM,+BAA+B,KAAK,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,sBAAsB;kBACxH,+HAA+H;kBAC/H,2FAA2F;YAC/F,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;SACjG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC3F,CAAC;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,0EAA0E;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF,2EAA2E;IAC3E,SAAS,EAAE,oCAAoC,CAAC,QAAQ,EAAE;IAC1D,6FAA6F;IAC7F,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjF,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE;IACvC,IAAI,YAAY,CAAC,SAAS,KAAK,SAAS,IAAI,YAAY,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,qGAAqG,EAAE,CAAC,CAAC;IACjK,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7E,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,sCAAsC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,+HAA+H;AAC/H,MAAM,CAAC,MAAM,iDAAiD,GAAG,yDAAyD,CAAC;AAgB3H,kEAAkE;AAClE,MAAM,CAAN,IAAY,0CAOX;AAPD,WAAY,0CAA0C;IACpD,4EAA4E;IAC5E,qEAAuB,CAAA;IACvB,iEAAiE;IACjE,mEAAqB,CAAA;IACrB,qFAAqF;IACrF,iEAAmB,CAAA;AACrB,CAAC,EAPW,0CAA0C,KAA1C,0CAA0C,QAOrD;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qCAAqC,CAAC,KAYrD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;IACrC,IAAI,eAAe,GAAuB,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC5F,IAAI,yBAA6C,CAAC;IAClD,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAiB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,cAAc,GAA2B,EAAE,CAAC;IAElD,KAAK,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACnE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,0CAA0C,CAAC,SAAS;gBAC7D,OAAO,EAAE,UAAU,KAAK,SAAS;oBAC/B,CAAC,CAAC,WAAW,WAAW,mCAAmC,MAAM,2CAA2C;0BACxG,2DAA2D;oBAC/D,CAAC,CAAC,WAAW,WAAW,mCAAmC,MAAM,0BAA0B;0BACvF,GAAG,kCAAkC,CAAC,WAAW,CAAC,uBAAuB,UAAU,GAAG;gBAC5F,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;aACrF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,2CAA2C,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,0CAA0C,CAAC,OAAO;gBAC3D,OAAO,EAAE,WAAW,WAAW,8BAA8B,MAAM,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACrH,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;aAChC,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;QACjC,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,0CAA0C,CAAC,SAAS;gBAC7D,OAAO,EAAE,WAAW,WAAW,0CAA0C,MAAM,2BAA2B,YAAY,CAAC,MAAM,IAAI;gBACjI,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,MAAM,EAAE;aACrE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,WAAW,EAAE,CAAC;QACxC,IAAI,YAAY,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,0CAA0C,CAAC,QAAQ;oBAC5D,OAAO,EAAE,WAAW,MAAM,oCAAoC,eAAe,WAAW,MAAM,yBAAyB;0BACnH,6DAA6D;oBACjE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE;iBACvD,CAAC;YACJ,CAAC;YACD,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC;YACnC,eAAe,GAAG,MAAM,CAAC;YACzB,yBAAyB,GAAG,WAAW,CAAC;QAC1C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,0CAA0C,CAAC,QAAQ;oBAC5D,OAAO,EAAE,WAAW,MAAM,kCAAkC,KAAK,CAAC,IAAI,iBAAiB,QAAQ,aAAa,MAAM,GAAG;oBACrH,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;iBAC5E,CAAC;YACJ,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,gHAAgH;IAChH,oBAAoB;IACpB,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC;QACvD,GAAG,IAAI,CAAC,KAAK;QACb,gBAAgB;QAChB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACrF,OAAO;YACL,OAAO,EAAE,0CAA0C,CAAC,OAAO;YAC3D,OAAO,EAAE,WAAW,MAAM,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxI,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,IAAI;QAClB,WAAW,EAAE;YACX,GAAG,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;YAC5F,eAAe,EAAE,cAAc;SAChC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAAgC;IACnF,OAAO,KAAK,CAAC,eAAe,IAAI,6BAA6B,CAAC,IAAI,CAAC;AACrE,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,KAAgC,EAChC,cAA4C;IAE5C,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kCAAkC,CAChD,YAAsD,EACtD,KAAgC;IAIhC,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,uBAAuB,CAAC,2BAA2B,EAAE,OAAO,EAAE,CAAC;IAC7I,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,uBAAuB,CAAC,yBAAyB,EAAE,OAAO,EAAE,CAAC;AAChI,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAAgC,EAChC,cAA4C;IAE5C,MAAM,KAAK,GAAG,iCAAiC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,CAAC,MAAM,qCAAqC,cAAc,IAAI;cAC5E,YAAY,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,0CAA0C,CAAC,cAAc,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,CAAC,IAAwB,EAAsB,EAAE,CAClE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1F,MAAM,MAAM,GAAG,CAAC,IAAwB,EAAE,KAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5G,OAAO;QACL,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5F,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,8BAA8B,CAAC,KAAoC;IAC1E,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,4BAA4B,CAAC,oBAAoB,CAAC;QACvD,KAAK,4BAA4B,CAAC,cAAc,CAAC;QACjD,KAAK,4BAA4B,CAAC,aAAa,CAAC;QAChD,KAAK,4BAA4B,CAAC,KAAK,CAAC;QACxC,KAAK,4BAA4B,CAAC,gCAAgC;YAChE,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,KAAK,4BAA4B,CAAC,qCAAqC;YACrE,OAAO,IAAI,GAAG,CAAC;gBACb,KAAK,CAAC,qBAAqB,KAAK,mCAAmC,CAAC,eAAe;oBACjF,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,gBAAgB;aACrB,CAAC,CAAC;QACL,KAAK,4BAA4B,CAAC,iBAAiB;YACjD,8FAA8F;YAC9F,wDAAwD;YACxD,OAAO,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAChC,CAAC;AACH,CAAC","sourcesContent":["/**\n * `SystemOfRecordVendorFacet` — what a VENDOR is, as a system of record.\n *\n * Four concepts carry one job each in this lane (#1049 §4.1, #1055): the **external-data lane** (the\n * engine runtime), a **dialect adapter** (how to speak — `HttpApiTransportDialect`), a **vendor\n * facet** (this module: what the vendor needs to be addressed and believed), and a **system of\n * record** — a named, declared INSTANCE that resources bind by name.\n *\n * ## What a facet is NOT\n *\n * It is not a provider. A provider is selected through a capability plane, may carry a person's\n * lent credential, and has an operation catalogue; a system of record is a named deployment the\n * application reads its own business rows out of, spending its own service identity (D10, D12).\n * Nothing in this module may reach the provider registry, and the reverse import is what\n * `pnpm check:systems-of-record-separation` refuses.\n *\n * It is also not an INSTANCE. The facet says \"an Odoo needs a base URL, a database and a login, and\n * offers the in-args API-key credential\"; it never says WHICH Odoo. Two instances of one vendor\n * (`odoo-fr`, `odoo-de`) share this facet and differ only in their addresses and secrets — which is\n * the whole reason the instance is a separate concept from the vendor.\n *\n * ## Why this lives in `@wildo-ai/saas-models/external-data` (#1055 R2)\n *\n * The obvious home looks like `external-connectors-models`, beside the provider contracts. It\n * cannot be: that package depends only on `zod-decorators` and its own header forbids reaching\n * saas-models, while a facet is typed against `HttpApiTransportDialect`, which lives here. It is\n * also not `ProviderMetadata`-shaped, which is bundle-fenced. So the facet sits beside the binding\n * schema it serves, on the subpath whose two audiences — the app author and the backend — are\n * exactly the audiences a facet has.\n *\n * Note the split with the two VOCABULARIES it names: `HttpApiTransportDialect` and\n * `SystemOfRecordCredentialKind` are root-exported boundary modules, because the root-exported\n * `systemsOfRecord` declaration names them. The SHAPES here are subpath-only, because nothing\n * root-exported names a slot.\n *\n * ## Slots, and why their slugs are lowerCamelCase with nothing else in them\n *\n * A slot's slug becomes half of a derived environment-variable name, `WILDO_SOR_<NAME>__<SLOT>`\n * (#1055 R4). The instance name admits `-` and the slug admits neither `-` nor `_`, so the DOUBLE\n * underscore between them is a delimiter neither half can produce: the pair is recoverable from\n * the variable name, and `odoo-api` + `key` can never collide with `odoo` + `apiKey`. That property\n * is the reason for the regex, so widening it would silently reintroduce the collision.\n *\n * ## Partitioning LANDED in #1058, and was held back until it had a reader\n *\n * The facet is the single partition authority — which remote field carries the tenant, how it is\n * encoded — and that vocabulary arrived with the slice that first READS it. It is `partition`\n * below, and the INSTANCE-side opt-in is now honoured rather than refused at declaration.\n *\n * It was withheld until then on purpose, and the reasoning is kept because it is the general rule:\n * shipping a four-member vocabulary with no reader is the \"declared surface with nothing behind\n * it\" shape this repository keeps paying for. It landed additively, as an OPTIONAL field, so every\n * facet written against the earlier shape still parses.\n */\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\nimport { HttpApiKeyComponentCodec } from '../http-api-binding/http-api-binding.shared.schemas';\nimport { ExternalDataIncrementalExtractionMode } from '../external-data/external-data-pipeline.shared.schemas';\nimport { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';\nimport { SystemOfRecordActionCallShape, SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT } from './system-of-record-actions.shared.schemas';\nimport { SystemOfRecordErrorCode } from './system-of-record-error-codes.shared';\nimport { SYSTEM_OF_RECORD_ENABLED_SLOT, SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN, deriveSystemOfRecordEnabledEnvVarName } from './system-of-record-env.shared';\n\n/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */\n\n/**\n * One input an instance must supply — an address slot (non-secret, authored in the infra env\n * config) or a secret slot (authored in `secrets.json`). Both halves share this shape because both\n * derive an environment-variable name the same way; what differs is WHERE the value is authored and\n * whether it is ever printed.\n */\nexport const SystemOfRecordSlotSchema = z.strictObject({\n  /**\n   * lowerCamelCase, and nothing else — see the module header. Becomes the `<SLOT>` half of\n   * `WILDO_SOR_<NAME>__<SLOT>` by upper-snake-casing.\n   */\n  slug: z\n    .string()\n    .regex(SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN, 'A slot slug is lowerCamelCase with no separators.')\n    .max(40)\n    .refine((slug) => slug !== SYSTEM_OF_RECORD_ENABLED_SLOT, {\n      error:\n        `\"${SYSTEM_OF_RECORD_ENABLED_SLOT}\" is reserved: the environment builder emits `\n        + `${deriveSystemOfRecordEnabledEnvVarName('example')} itself to say an environment has no access to an instance. `\n        + 'A slot of that name would make \"declared absent\" indistinguishable from an address whose value happens to be false.',\n    }),\n  /**\n   * Whether an instance MUST supply it. A missing required slot refuses at `wildo config sync` and\n   * again at boot (#1055 E4) — the remedy is authoring a value, which needs no running companion,\n   * so refusing is legitimate there.\n   */\n  required: z.boolean(),\n  /** What an operator must put in it. Printed by sync and by the secrets report. */\n  description: z.string().min(1),\n});\nexport type SystemOfRecordSlot = z.infer<typeof SystemOfRecordSlotSchema>;\n\n/**\n * A slot list that cannot be order-dependent or ambiguous: sorted by slug, slugs unique.\n *\n * Mirrors `ProviderSecretContractShapeSchema`, and for the same reason — these lists are compared,\n * reported and (once #1057 lands) contributed by independently-versioned packages, so two facets\n * declaring the same slots in different orders must not be two different things.\n */\nconst systemOfRecordSlotListSchema = (label: string) =>\n  z.array(SystemOfRecordSlotSchema).superRefine((slots, context) => {\n    const seen = new Set<string>();\n    for (const [index, slot] of slots.entries()) {\n      if (seen.has(slot.slug)) {\n        context.addIssue({ code: 'custom', path: [index, 'slug'], message: `Duplicate ${label} slot \"${slot.slug}\".` });\n      }\n      seen.add(slot.slug);\n      if (index > 0 && slots[index - 1]!.slug.localeCompare(slot.slug) >= 0) {\n        context.addIssue({ code: 'custom', path: [index, 'slug'], message: `${label} slots must be sorted by slug.` });\n      }\n    }\n  });\n\n/**\n * What ONE credential kind needs, independent of vendor (#1055 R15).\n *\n * The kind owns its secrets and any address slot that exists only because the kind was chosen — a\n * future `OAUTH2_CLIENT_CREDENTIALS` owns `tokenUrl`, which no vendor would declare if it were\n * reached with a static key. `ODOO_API_KEY_IN_ARGS` needs no address slot of its own, and that is\n * the seam rather than an omission: its `database` and `login` inputs identify WHICH Odoo and WHICH\n * user, so they belong to the vendor and would survive a second Odoo credential kind.\n */\nexport const SystemOfRecordCredentialKindContractSchema = z.strictObject({\n  addressSlots: systemOfRecordSlotListSchema('credential address'),\n  secretSlots: systemOfRecordSlotListSchema('credential secret'),\n});\nexport type SystemOfRecordCredentialKindContract = z.infer<typeof SystemOfRecordCredentialKindContractSchema>;\n\n/**\n * Every credential kind's inputs. Engine-owned and CLOSED, keyed by the enum so a member added\n * without a contract is a compile error rather than a boot surprise.\n *\n * ## Which half a slot lands in, since the answer is not \"is it secret\"\n *\n * The split follows the precedent #1055 set with Odoo's `login`: **an identity slot is an ADDRESS\n * slot and a proof slot is a SECRET slot.** A `clientId` and a BASIC `username` are not\n * confidential — they name WHICH client and WHICH user — and putting them in `secrets.json` would\n * hide, from every diff and every environment review, the one thing an operator most often needs to\n * check. What must never be printed is the half that PROVES the identity.\n *\n * The consequence is that a credential's two halves are authored in two files. That is deliberate\n * and it is the same shape Odoo already has (`login` in the infra config, `apiKey` in the secrets),\n * so an operator meets one convention rather than two.\n *\n * ## Required-ness that a static list cannot express\n *\n * Three slots are declared `required: false` here and are made required by the FACET's offer, which\n * is the only place that knows: `certificateKeyId` when the vendor's assertion header policy is\n * {@link SystemOfRecordAssertionHeaderPolicy.KEY_ID_SUPPLIED}, `certificatePem` when it is\n * `X509_THUMBPRINT_DERIVED`, and `subject` for the JWT-bearer grant's `sub`. The join is performed\n * ONCE, in {@link resolveSystemOfRecordInstanceSlots}, rather than by each of the five readers of\n * \"what does this instance need\" — which is the enumeration failure\n * `invariant-call-site-enumeration.md` exists to stop.\n */\nexport const SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS: Readonly<Record<SystemOfRecordCredentialKind, SystemOfRecordCredentialKindContract>> = {\n  [SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS]: {\n    addressSlots: [],\n    secretSlots: [\n      {\n        slug: 'apiKey',\n        required: true,\n        description:\n          'Odoo external-API key (Settings → Users → API Keys). It replaces the password in '\n          + '`common.authenticate` and rides as a positional argument of every `execute_kw` call.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.API_KEY_HEADER]: {\n    addressSlots: [],\n    secretSlots: [\n      {\n        slug: 'apiKey',\n        required: true,\n        description:\n          'The static key this deployment presents. It travels in the header the vendor facet names — '\n          + 'the operator never chooses the header, only supplies the key.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.API_KEY_QUERY]: {\n    addressSlots: [],\n    secretSlots: [\n      {\n        slug: 'apiKey',\n        required: true,\n        description:\n          'The static key this deployment presents, appended as the query parameter the vendor facet '\n          + 'names. Weaker than a header — a URL reaches access logs and proxy logs — so prefer a '\n          + 'header kind when the vendor offers one.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.BASIC]: {\n    addressSlots: [\n      {\n        slug: 'username',\n        required: true,\n        description:\n          'The user this deployment authenticates as (SAP calls it a communication user). It names an '\n          + 'identity rather than proving one, so it is authored in the environment config beside the '\n          + 'base URL. It may not contain \":\" — RFC 7617 makes the colon the delimiter.',\n      },\n    ],\n    secretSlots: [\n      { slug: 'password', required: true, description: \"That user's password. Half of one credential; rotate it with the username only if the vendor requires.\" },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET]: {\n    addressSlots: [\n      { slug: 'audience', required: false, description: 'The `audience` / `resource` parameter, when the vendor requires one to scope the token (Entra names the resource; Salesforce does not).' },\n      { slug: 'clientId', required: true, description: 'The registered application (client) id. Names WHICH client, so it is addressing rather than proof.' },\n      { slug: 'scope', required: false, description: 'Space-delimited scopes to request. Omitted when the vendor derives them from the client registration.' },\n      { slug: 'tokenUrl', required: true, description: \"The token endpoint's absolute URL. Kind-owned: no vendor would declare it if the instance were reached with a static key.\" },\n    ],\n    secretSlots: [\n      { slug: 'clientSecret', required: true, description: 'The client secret issued with the client id. This is the half that proves the identity, and the only half that is never printed.' },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE]: {\n    addressSlots: [\n      { slug: 'audience', required: false, description: 'The `audience` / `resource` parameter when the vendor requires one.' },\n      {\n        slug: 'certificateKeyId',\n        required: false,\n        description:\n          'The key id the vendor assigned to this certificate, placed in the assertion\\'s protected '\n          + 'header as `kid` (NetSuite issues one at upload). REQUIRED when the vendor facet declares '\n          + 'the key-id header policy; unused otherwise.',\n      },\n      {\n        slug: 'certificatePem',\n        required: false,\n        description:\n          'The PUBLIC certificate in PEM, used to derive the `x5t` thumbprint the assertion header '\n          + 'carries. REQUIRED when the vendor facet declares the thumbprint header policy; unused '\n          + 'otherwise. Public material, so it is an address slot rather than a secret.',\n      },\n      { slug: 'clientId', required: true, description: 'The registered application (client) id — the assertion\\'s `iss` and `sub`.' },\n      { slug: 'scope', required: false, description: 'Space-delimited scopes to request.' },\n      { slug: 'tokenUrl', required: true, description: \"The token endpoint's absolute URL, and the assertion's `aud`.\" },\n    ],\n    secretSlots: [\n      {\n        slug: 'privateKeyPem',\n        required: true,\n        description:\n          'The UNENCRYPTED PKCS#8 private key, in PEM, that signs the client assertion. An '\n          + 'encrypted key is refused by name: the secret channel is the protection, and a passphrase '\n          + 'stored beside the key it protects protects nothing.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER]: {\n    addressSlots: [\n      { slug: 'audience', required: false, description: 'The assertion\\'s `aud`, when it differs from the token endpoint (Salesforce wants the login host).' },\n      { slug: 'clientId', required: true, description: 'The connected app\\'s consumer key — the assertion\\'s `iss`.' },\n      { slug: 'scope', required: false, description: 'Space-delimited scopes to request.' },\n      {\n        slug: 'subject',\n        required: false,\n        description:\n          'The user the assertion is made FOR — its `sub`. REQUIRED for this grant and declared '\n          + 'optional here only because the facet\\'s offer is what asserts it; a service account\\'s '\n          + 'username on the vendor side.',\n      },\n      { slug: 'tokenUrl', required: true, description: \"The token endpoint's absolute URL.\" },\n    ],\n    secretSlots: [\n      { slug: 'privateKeyPem', required: true, description: 'The UNENCRYPTED PKCS#8 private key, in PEM, that signs the assertion. An encrypted key is refused by name.' },\n    ],\n  },\n};\n\n/**\n * How a vendor wants a client assertion's PROTECTED HEADER built (#1056 R2).\n *\n * A generic \"sign it with the private key\" is rejected by both vendors that want an assertion, and\n * they want DIFFERENT things — which is why this is a facet policy rather than an engine constant.\n */\nexport enum SystemOfRecordAssertionHeaderPolicy {\n  /** `kid` carries a key id the VENDOR assigned when the certificate was uploaded (NetSuite). */\n  KEY_ID_SUPPLIED = 'key-id-supplied',\n  /**\n   * `x5t` carries the base64url SHA-1 thumbprint of the certificate, DERIVED by the engine from the\n   * supplied `certificatePem` (Microsoft Entra's certificate credential).\n   *\n   * SHA-1 is not a security choice here: `x5t` is defined as a SHA-1 thumbprint (RFC 7515 §4.1.7)\n   * and is an identifier for locating a key, never an integrity proof.\n   * spec-cite: RFC 7515 §4.1.7 (\"x5t\" (X.509 Certificate SHA-1 Thumbprint) Header Parameter).\n   */\n  X509_THUMBPRINT_DERIVED = 'x509-thumbprint-derived',\n}\n\n/**\n * Where a client's id and secret travel on a client-credentials token request.\n *\n * RFC 6749 §2.3.1 permits BOTH and says a server MUST support the Basic header while it MAY support\n * the body form — and real vendors differ, so the choice cannot be an engine default.\n * spec-cite: RFC 6749 §2.3.1 (Client Password).\n */\nexport enum SystemOfRecordClientAuthenticationPlacement {\n  /** `client_id` and `client_secret` as form fields in the request body. */\n  REQUEST_BODY = 'request-body',\n  /** `Authorization: Basic base64(client_id \":\" client_secret)`. */\n  BASIC_HEADER = 'basic-header',\n}\n\n/**\n * The algorithms an assertion may be signed with. Asymmetric ONLY, and that is the point: a\n * symmetric `HS*` assertion is signed with a shared secret, which makes the assertion no stronger\n * than the secret it was supposed to replace, and `none` is not an algorithm.\n */\nexport enum SystemOfRecordAssertionSigningAlgorithm {\n  RS256 = 'RS256',\n  RS384 = 'RS384',\n  RS512 = 'RS512',\n  PS256 = 'PS256',\n  ES256 = 'ES256',\n  ES384 = 'ES384',\n  ES512 = 'ES512',\n}\n\n/**\n * How long to treat a token as valid when the answer carries no `expires_in` (#1056 R3).\n *\n * A FACET property rather than a per-kind engine constant, because two vendors of the SAME kind\n * disagree: NetSuite's answer states `expires_in` is always 3600, while Salesforce's\n * client-credentials answer is reported to omit it. A per-kind constant would have to be wrong for\n * one of them.\n */\nconst tokenLifetimeFallbackSecondsSchema = z.number().int().min(30).max(86_400);\n\n/**\n * ONE credential kind as ONE vendor offers it — the kind, plus everything about it that varies by\n * VENDOR and not by deployment.\n *\n * A discriminated union rather than a kind list beside a policy map, so a policy cannot exist\n * without its kind and a kind cannot be offered without the policy it needs. `API_KEY_HEADER` with\n * no header name is unrepresentable here; under a parallel map it would parse and fail at the first\n * read.\n */\nexport const SystemOfRecordCredentialOfferSchema = z.discriminatedUnion('kind', [\n  z.strictObject({ kind: z.literal(SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS).systemEnum('SystemOfRecordCredentialKind') }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.API_KEY_HEADER).systemEnum('SystemOfRecordCredentialKind'),\n    /** The header the key travels in — `Authorization`, `X-API-Key`, `apikey`, whatever the vendor reads. */\n    headerName: z.string().regex(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/, 'A header name is an RFC 9110 token.').max(64),\n    /** What precedes the key in the header value, INCLUDING its trailing space (`\"Bearer \"`). Omitted when the key stands alone. */\n    valuePrefix: z.string().max(32).optional(),\n  }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.API_KEY_QUERY).systemEnum('SystemOfRecordCredentialKind'),\n    /** The query parameter the key is appended as. */\n    parameterName: z.string().regex(/^[A-Za-z0-9_.-]+$/, 'A query parameter name is alphanumeric with -._').max(64),\n  }),\n\n  z.strictObject({ kind: z.literal(SystemOfRecordCredentialKind.BASIC).systemEnum('SystemOfRecordCredentialKind') }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET).systemEnum('SystemOfRecordCredentialKind'),\n    clientAuthentication: z.enum(SystemOfRecordClientAuthenticationPlacement),\n    tokenLifetimeFallbackSeconds: tokenLifetimeFallbackSecondsSchema,\n  }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE).systemEnum('SystemOfRecordCredentialKind'),\n    assertionHeaderPolicy: z.enum(SystemOfRecordAssertionHeaderPolicy),\n    assertionSigningAlgorithm: z.enum(SystemOfRecordAssertionSigningAlgorithm),\n    /** How long the ASSERTION is valid — minutes, not hours; it is consumed once at the token endpoint. */\n    assertionLifetimeSeconds: z.number().int().min(30).max(600),\n    tokenLifetimeFallbackSeconds: tokenLifetimeFallbackSecondsSchema,\n  }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER).systemEnum('SystemOfRecordCredentialKind'),\n    assertionSigningAlgorithm: z.enum(SystemOfRecordAssertionSigningAlgorithm),\n    assertionLifetimeSeconds: z.number().int().min(30).max(600),\n    tokenLifetimeFallbackSeconds: tokenLifetimeFallbackSecondsSchema,\n  }),\n]);\nexport type SystemOfRecordCredentialOffer = z.infer<typeof SystemOfRecordCredentialOfferSchema>;\n\n/**\n * How a vendor's OData service pages a COLLECTION READ (#1292).\n *\n * A vendor property rather than a dialect constant, and the reason is one large implementation: the\n * Microsoft Dataverse Web API refuses `$skip` outright, while OData v4 defines it and a conformant\n * service serves it. A per-dialect default would have to be wrong for one of them — the same\n * argument #1056 R3 settled for the token-lifetime fallback.\n *\n * spec-cite: OData Version 4.01 Part 1: Protocol §11.2.6 (\"$top and $skip\") for the default; Microsoft\n * Learn, \"Query data using the Web API\"\n * (https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/query-data-web-api) for\n * the refusal — that page enumerates the query options the Web API does not support.\n */\nexport enum SystemOfRecordODataListPaging {\n  /**\n   * `$top` + `$skip` — one request for any page, which is what a page-numbered contract wants, unless the\n   * service serves fewer rows than `$top` and hands back a continuation: the page is then read to its end\n   * along the continuation (#1998), so the next page's `$skip` does not jump the rows the service held back.\n   *\n   * The default, because it is what OData v4 defines and what an uncatalogued service serves.\n   */\n  SKIP = 'skip',\n  /**\n   * `@odata.nextLink` only: the service hands back a continuation URL and refuses to be addressed by\n   * offset.\n   *\n   * The consequence is structural rather than a detail — a cursor has no page NUMBER, so reaching a page\n   * costs one request per page before it. The engine asks for the page size with `Prefer:\n   * odata.maxpagesize` on v4 (v2 has no such preference, so the service's own size decides) — never with\n   * `$top`, which would cap the whole collection (#1991) — walks forward\n   * counting ROWS rather than links (the service may serve a page size of its own, #1998), and refuses\n   * past a bound rather than pretending otherwise.\n   */\n  NEXT_LINK_ONLY = 'next-link-only',\n}\n\n/**\n * HOW a vendor partitions the data one deployment holds (#1058).\n *\n * Inside ONE corporate, a system of record usually holds several partitions — Odoo companies, SAP\n * company codes, Dynamics business units, NetSuite subsidiaries. They are not tenants: they all\n * belong to the operator, which is why they map onto ORGANIZATION UNITS of the owner organization\n * rather than onto organizations (#1049 Q3).\n */\nexport enum SystemOfRecordPartitionKind {\n  /**\n   * A FIELD on every row carries the partition (Odoo `company_id`, NetSuite `subsidiary`). The only\n   * kind supported today: it is filterable, so the confinement can be PUSHED DOWN and a caller never\n   * receives rows of a partition they may not see.\n   */\n  FIELD = 'field',\n  /**\n   * The partition is a PATH SEGMENT of the request (Business Central's `/companies({id})/customers`).\n   *\n   * Declared so a facet can be HONEST about a vendor this engine cannot confine yet, and refused by\n   * name where a partition is opted into. A path segment is chosen before the request is built, so it\n   * cannot express \"these three companies\" in one read — the confinement would have to fan out into\n   * one request per unit, which is a different mechanism rather than a different predicate.\n   */\n  PATH_SEGMENT = 'path-segment',\n}\n\n/**\n * The SHAPE a partition value arrives in — the difference between a number and a pair.\n *\n * Odoo answers a many2one as `[id, display_name]`: `company_id: [10, \"Acme\"]` on a read, and `false`\n * when unset. A reader that took the whole array as the key would match nothing, and one that took\n * `row.company_id` as a scalar would stamp `\"10,Acme\"`. The shape is declared because the engine\n * cannot tell a pair from a two-element list by looking.\n *\n * spec-cite: Odoo 18.0 developer documentation, \"External API\" — a many2one is returned as an\n * `[id, display_name]` pair under both *Read records* and *Search and read*.\n */\nexport enum SystemOfRecordPartitionValueShape {\n  /** The field holds the key directly (an integer, a GUID, a string). */\n  SCALAR = 'scalar',\n  /** Odoo's many2one: `[id, label]`, and `false` when unset. The id is the key. */\n  MANY2ONE_PAIR = 'many2one-pair',\n}\n\n/**\n * What a vendor's partitioning IS — declared by the FACET, opted into by the INSTANCE.\n *\n * The split is the same one every other vendor fact takes: how a vendor partitions is a property of\n * the vendor, and WHETHER this deployment's data is partitioned is a property of the deployment. A\n * single-company Odoo has a `company_id` on every row and nothing to confine.\n */\nexport const SystemOfRecordPartitionSupportSchema = z.strictObject({\n  kind: z.enum(SystemOfRecordPartitionKind),\n  /** The remote field carrying the partition key (`company_id`, `subsidiary`, `CompanyCode`). */\n  remoteField: z.string().min(1).max(120),\n  /**\n   * How a key is spelled on the wire. Reused from the KEY component vocabulary rather than given its\n   * own: a partition key is addressed exactly as a key component is — decoded from an operator's\n   * authored string, compiled into a remote predicate — and two vocabularies for one job would drift.\n   */\n  codec: z.enum(HttpApiKeyComponentCodec),\n  valueShape: z.enum(SystemOfRecordPartitionValueShape),\n});\nexport type SystemOfRecordPartitionSupport = z.infer<typeof SystemOfRecordPartitionSupportSchema>;\n\n/**\n * A step a vendor requires before it accepts ANY modifying request — a row write or a writing action — beyond the\n * credential every request carries (#1726).\n *\n * Declared by the FACET because it is a fact about the product, and refused at startup by the engine for every step it\n * does not perform (`WRITE_PREREQUISITE_NOT_SUPPORTED`): a write the vendor is known to refuse must not be opened, since\n * it would only surface as a remote `403` at the first request, under a code that names nothing.\n */\nexport enum SystemOfRecordWritePrerequisite {\n  /**\n   * SAP Gateway's cross-site-request-forgery protection: a modifying request must carry an `X-CSRF-Token` obtained by a\n   * prior NON-modifying request sent with `X-CSRF-Token: Fetch`, together with the session cookie that request set.\n   * spec-cite: SAP Help Portal, SAP Gateway Foundation — \"Cross-Site Request Forgery Protection\"\n   * (https://help.sap.com/saphelp_gateway20sp12/helpdata/en/e6/cae27d5e8d4996add4067280c8714e/frameset.htm).\n   */\n  CSRF_TOKEN_HANDSHAKE = 'csrf-token-handshake',\n}\n\n/**\n * The OData v4 control information that carries an entity's ETag in a JSON row (#1726) — the only row version an OData\n * vendor can declare in `rowVersionField`, and the value the OData write dialect sends as `If-Match`.\n *\n * The OData 4.0 spelling. A payload that is not OData-Version 4.0 omits the `odata.` infix (`@etag`); the engine asks\n * for 4.0 on its OData requests (`OData-MaxVersion: 4.0`), so a conformant service answers this spelling. A field MAPPED\n * onto the tag, and a `VERSION_CHECKED` comparison, read this spelling only; the write dialect alone also reads the\n * short form when it derives `If-Match`, which only widens what it can condition on.\n * spec-cite: OData JSON Format Version 4.01 §4.5.10 (Control Information: etag (odata.etag)) and §4.5 (\"In requests and\n * responses with an OData-Version header with a value of 4.0 control information names are prefixed with @odata.\").\n */\nexport const ODATA_ENTITY_TAG_CONTROL_INFORMATION = '@odata.etag';\n\n/**\n * What a vendor is, as a system of record. Parsed rather than trusted because #1057 lets a PACKAGE\n * ship one — a record produced by one package version and read by another.\n */\nexport const SystemOfRecordVendorFacetSchema = z.strictObject({\n  /** The vendor's stable identifier, named by an instance's `vendor`. Same charset law as an instance name. */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n  /**\n   * The dialects this vendor can be READ through. An instance's `dialect` must be one of them, and\n   * a binding's `dialect` must equal its instance's — both refused at boot registration, where the\n   * declaration and the facet are finally in the same scope.\n   */\n  dialects: z.array(z.enum(HttpApiTransportDialect)).min(1),\n  /**\n   * The vendor's own address slots — non-secret, authored per instance in the infra env config. The\n   * base URL is registration-scoped and is never credential material.\n   */\n  addressSlots: systemOfRecordSlotListSchema('vendor address'),\n  /**\n   * The credential kinds this vendor offers, each carrying THIS vendor's policy for it. The instance\n   * chooses one kind; a kind no offer names is refused.\n   *\n   * Reshaped from a bare `credentialKinds: Kind[]` in #1056. A list of kinds could say that a vendor\n   * accepts a header-borne API key and could not say WHICH header — so either the operator was asked\n   * (a question the vendor already answers, `derive-before-you-ask.md`) or the engine guessed. An\n   * offer is the kind and its vendor policy as one indivisible thing.\n   */\n  credentialOffers: z.array(SystemOfRecordCredentialOfferSchema).min(1),\n  /**\n   * How a COLLECTION READ pages against this vendor (#1292). Meaningful only for the OData dialects.\n   *\n   * OPTIONAL rather than defaulted, and the difference is not cosmetic: `.default()` would make the\n   * field REQUIRED on the parsed type, so every facet — Odoo's JSON-RPC included — would have to\n   * state an answer to a question about a dialect it does not speak. Absent means \"not an OData\n   * concern, or the conformant default\", and {@link resolveSystemOfRecordODataListPaging} is the one\n   * place that turns absence into `SKIP`.\n   */\n  odataListPaging: z.enum(SystemOfRecordODataListPaging).optional(),\n  /**\n   * How this vendor partitions one deployment's data (#1058), when it does.\n   *\n   * ABSENT means the vendor has no partition concept the engine can confine on — which is a real\n   * answer rather than an unfinished one, and the reason an instance opting into `partition` against\n   * such a facet is refused by name rather than silently doing nothing.\n   */\n  partition: SystemOfRecordPartitionSupportSchema.optional(),\n  /**\n   * The change-tracking mechanisms this vendor's deployments support, which a pipeline may read\n   * incrementally through (#1682). A pipeline declaring `incremental.mode` outside this list is refused\n   * at startup, naming the vendor.\n   *\n   * A VENDOR property rather than a dialect constant: whether a deployment can say what changed is a\n   * fact about the product (Odoo's ORM stamps `write_date` on every model that logs access; an OData\n   * service may or may not enable change tracking, #1722), not about the wire language.\n   *\n   * ABSENT means none — a real answer: that vendor's pipelines run full passes only.\n   */\n  incrementalExtractionModes: z.array(z.enum(ExternalDataIncrementalExtractionMode)).optional(),\n  /**\n   * The service-defined OData error codes with which this vendor says a tracked change position has EXPIRED (#1722), for a\n   * vendor that answers it with its own code rather than the protocol's `410 Gone` / `404 Not Found`.\n   *\n   * A delta-link pass whose link the vendor no longer honours starts over with a full pass. The protocol names the status\n   * for an expired URL, and the engine recognises it for every vendor; a vendor that answers something else instead\n   * states its code here, so the fallback does not depend on guessing which `400` means \"too old\". Dataverse documents\n   * `0x80044352` (`ExpiredVersionStamp`, \"Please perform a full sync\").\n   *\n   * ABSENT means the vendor answers the protocol's status, or has no change tracking.\n   */\n  odataExpiredChangePositionErrorCodes: z.array(z.string().min(1)).optional(),\n  /**\n   * The ACTION call shapes this vendor's product supports (#1678) — how a declared action is called on it: Odoo's\n   * `execute_kw` on a model method, an OData bound action, an OData unbound action import.\n   *\n   * A VENDOR property, like `partition`: whether a product exposes callable operations beyond row reads is a fact about\n   * the product, and a generic OData service may expose none. A binding declaring an action whose shape its vendor does\n   * not list is refused at boot, naming the vendor. ABSENT means none — the vendor is read (and perhaps written) only.\n   * Each listed shape must be spoken over one of the facet's own `dialects`.\n   */\n  actionCallShapes: z.array(z.enum(SystemOfRecordActionCallShape)).optional(),\n  /**\n   * The remote field this vendor's product maintains on EVERY row as its version — changed by the product itself on every\n   * write, never by a caller (#1724, #1726). Odoo: `write_date`, the ORM's \"Last Updated on\". An OData v4 vendor that\n   * serves entity tags: {@link ODATA_ENTITY_TAG_CONTROL_INFORMATION} (`@odata.etag`), and nothing else.\n   *\n   * A binding may declare `writeConcurrency: VERSION_CHECKED` only against a vendor that names one, and only with a\n   * version field that maps onto it (refused at boot, `WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR`). The engine then\n   * compares the version a caller read with the one it reads just before the write.\n   *\n   * ## What that comparison is worth depends on the DIALECT, not on this field\n   *\n   * - **Odoo (best-effort).** Its external API has no conditional write — `write(ids, vals)` applies the values, with no\n   *   precondition — so the comparison and the write are two separate calls, and a change landing between them is\n   *   overwritten. The check NARROWS the lost-update window to the gap between two calls; it does not close it.\n   * - **OData v4 (atomic).** The OData write dialect sends the version as `If-Match` on the `PATCH` or `DELETE`, and the\n   *   service itself refuses a mismatch with `412 Precondition Failed` and applies nothing. The engine's comparison\n   *   before sending is then only a fast refusal; the guarantee is the vendor's.\n   *   spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match) — \"the service MUST respond with 412\n   *   Precondition Failed and MUST ensure that no observable change occurs as a result of the request\".\n   *\n   * Declaring it for an OData vendor is also what lets its writes send the row's own entity tag rather than `*`: the\n   * write dialect reads `@odata.etag` from the row it reads first, so a row moved (into another partition, say) between\n   * that read and the write is refused by the vendor instead of written.\n   *\n   * A VENDOR property, like `incrementalExtractionModes`: whether a product maintains a per-row version is a fact about the\n   * product. ABSENT means none, and a binding against such a vendor states `LAST_WRITER_WINS` instead.\n   */\n  rowVersionField: z.string().min(1).max(120).optional(),\n  /**\n   * What this vendor requires before any modifying request (#1726) — see {@link SystemOfRecordWritePrerequisite}. ABSENT\n   * means nothing beyond the credential. A binding opening writes against a vendor listing a step the engine does not\n   * perform is refused at startup.\n   */\n  writePrerequisites: z.array(z.enum(SystemOfRecordWritePrerequisite)).optional(),\n}).superRefine((facet, context) => {\n  /*\n   * #1726 — over OData the row version IS the entity tag: it is what `If-Match` carries and what the service compares.\n   * A property value (a `modifiedon` column, a `RowVersion` field) is not an ETag, and sending one as `If-Match` would\n   * be refused as a mismatch on every write — so an OData vendor names the entity tag or nothing.\n   */\n  if (facet.rowVersionField !== undefined && facet.dialects.includes(HttpApiTransportDialect.ODATA)\n    && facet.rowVersionField !== ODATA_ENTITY_TAG_CONTROL_INFORMATION) {\n    context.addIssue({\n      code: 'custom',\n      path: ['rowVersionField'],\n      message: `An OData vendor's row version is its entity tag, \"${ODATA_ENTITY_TAG_CONTROL_INFORMATION}\" — got \"${facet.rowVersionField}\".`,\n    });\n  }\n  // #1678 — a call shape is spoken over one dialect; listing a shape over a dialect the vendor is not read through would\n  // advertise an action no instance of it could ever reach.\n  for (const [index, shape] of (facet.actionCallShapes ?? []).entries()) {\n    if (!facet.dialects.includes(SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT[shape])) {\n      context.addIssue({\n        code: 'custom',\n        path: ['actionCallShapes', index],\n        message: `Action call shape \"${shape}\" is spoken over ${SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT[shape]}, which this vendor's dialects do not list.`,\n      });\n    }\n  }\n  // #1722 — an expired-position code is read only by a delta-link pass, so a vendor listing one without that mode states a\n  // fact nothing could ever consult.\n  if (facet.odataExpiredChangePositionErrorCodes !== undefined\n    && !(facet.incrementalExtractionModes ?? []).includes(ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK)) {\n    context.addIssue({\n      code: 'custom',\n      path: ['odataExpiredChangePositionErrorCodes'],\n      message: `An expired change-position code is read only by the \"${ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK}\" mode, which this vendor's incrementalExtractionModes do not list.`,\n    });\n  }\n  const seenDialects = new Set<string>();\n  for (const [index, dialect] of facet.dialects.entries()) {\n    if (seenDialects.has(dialect)) {\n      context.addIssue({ code: 'custom', path: ['dialects', index], message: `Duplicate dialects member \"${dialect}\".` });\n    }\n    seenDialects.add(dialect);\n  }\n\n  // One vendor may not offer the same kind twice: the instance names a KIND, so two offers of one\n  // kind would make the policy the engine reads depend on array order.\n  const seenKinds = new Set<string>();\n  for (const [index, offer] of facet.credentialOffers.entries()) {\n    if (seenKinds.has(offer.kind)) {\n      context.addIssue({ code: 'custom', path: ['credentialOffers', index], message: `Duplicate credentialOffers member \"${offer.kind}\".` });\n    }\n    seenKinds.add(offer.kind);\n  }\n\n  // A vendor address slug that a kind also declares would make the derived environment variable\n  // ambiguous about who owns the value, so the two namespaces are checked against each other here\n  // rather than at the instance, where the failure would read as an authoring mistake.\n  const vendorSlugs = new Set(facet.addressSlots.map((slot) => slot.slug));\n  for (const offer of facet.credentialOffers) {\n    for (const slot of SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS[offer.kind].addressSlots) {\n      if (vendorSlugs.has(slot.slug)) {\n        context.addIssue({\n          code: 'custom',\n          path: ['addressSlots'],\n          message: `Address slot \"${slot.slug}\" is declared by this vendor AND by credential kind \"${offer.kind}\" — one slot has one owner.`,\n        });\n      }\n    }\n  }\n});\nexport type SystemOfRecordVendorFacet = z.infer<typeof SystemOfRecordVendorFacetSchema>;\n\n/**\n * The export a package's `./systems-of-record` module presents: a record of facets keyed by vendor id. The\n * backend's facet resolver and `wildo secrets` (which lists the credential slots an instance needs) both read\n * a facet module through this name, so it is declared once, beside the shape it carries.\n */\nexport const SYSTEM_OF_RECORD_FACET_RECORD_EXPORT = 'PROVIDER_CATALOGUE_SYSTEM_OF_RECORD_FACETS';\n\n/** The subpath a package exports its facet module under: `<package>/systems-of-record`. */\nexport const SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH = '/systems-of-record';\n/** @wildo_source:part:end saas.models.systems-of-record */\n\n/**\n * The specifier of `packageName`'s facet module. ONE spelling for the backend's resolver, `wildo secrets` and the\n * discovery that records the modules, so the three cannot disagree about where a package's facets live (#1675).\n */\nexport function systemOfRecordFacetModuleSpecifier(packageName: string): string {\n  return `${packageName}${SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH}`;\n}\n\n/** The package a facet module specifier belongs to: `@acme/erp/systems-of-record` → `@acme/erp`. */\nexport function packageOfSystemOfRecordFacetModule(specifier: string): string {\n  return specifier.endsWith(SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH) ? specifier.slice(0, -SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH.length) : specifier;\n}\n\n/** A vendor's BASE facet as one source presents it, before it is chosen. */\nexport interface SystemOfRecordBaseFacetCandidate {\n  /** Who presents it: `the engine`, `package @wildo-ai/systems-of-record`. */\n  readonly source: string;\n  /** The facet as presented — parsed here, since it was produced by one package version and is read by another. */\n  readonly raw: unknown;\n}\n\nexport type SystemOfRecordBaseFacetSelection =\n  | { readonly facet: SystemOfRecordVendorFacet; readonly source: string }\n  | { readonly conflict: string; readonly detail: Readonly<Record<string, unknown>> };\n\n/**\n * The ONE base facet for a vendor, or a refusal naming both sources when two present one (#1675).\n *\n * Refused rather than \"the first in authority order wins\": a base facet carries the vendor's partition, and module\n * order is the sorted order of discovered package names, so which package's partition confined a tenant's rows would\n * otherwise depend on how two names sort — and a newly installed package could replace the library's facet with\n * no opt-in at all. A package that knows more about a vendor it does not own ADDS to the base through an augmentation\n * an instance opts into; it never presents a second base.\n *\n * `undefined` when no source presents the vendor — the caller's own refusal names the vendor.\n *\n * assurance-control: WILDO.DATA.TENANT_ISOLATION WILDO.SECURITY.FAIL_CLOSED — two base facets for one vendor refuse,\n * so a tenant-confinement declaration never comes from whichever of two packages sorts first.\n */\nexport function selectSystemOfRecordBaseFacet(input: {\n  readonly vendor: string;\n  readonly candidates: readonly SystemOfRecordBaseFacetCandidate[];\n}): SystemOfRecordBaseFacetSelection | undefined {\n  const [first, second] = input.candidates;\n  if (first === undefined) return undefined;\n  if (second !== undefined) {\n    return {\n      conflict: `Vendor '${input.vendor}' has two base facets: from ${first.source} and from ${second.source}. One source owns a `\n        + 'vendor\\'s facet; a package that adds to it ships an augmentation (`PROVIDER_CATALOGUE_SYSTEM_OF_RECORD_FACET_AUGMENTATIONS`) '\n        + 'an instance opts into. Uninstall one of the two, or have it ship an augmentation instead.',\n      detail: { vendor: input.vendor, sources: input.candidates.map((candidate) => candidate.source) },\n    };\n  }\n  return { facet: SystemOfRecordVendorFacetSchema.parse(first.raw), source: first.source };\n}\n\n/** @wildo_source:part:start saas.models.systems-of-record.facet-augmentation facet:kind:api facet:audience:app-developer */\n/**\n * What a package ADDS to a vendor facet it does not own (#1675) — the facet counterpart of a provider\n * augmentation (#1672), with its own code path.\n *\n * One base facet per vendor answers — the one package module that presents it; two refuse, naming both. An\n * augmentation adds to it: a PARTITION declaration for a vendor whose base declares none (say a `company_id`\n * FIELD every row of an ERP carries, shipped by a package that knows the vendor better), or further\n * CREDENTIAL OFFERS. It never replaces or removes anything the base declares — two declarations of one\n * partition, or one credential kind offered twice, refuse at startup naming both sources.\n *\n * Only a FIELD partition can be confined. A PATH-SEGMENT partition (a company chosen in the request path) is\n * refused when an instance sets `partition: true`, augmented or not, because nothing narrows a read the path\n * already scoped — so augmenting one declares something no instance can use.\n *\n * INERT until an instance opts in: `systemsOfRecord.<name>.facetAugmentations` names the PACKAGES whose\n * augmentation applies to that instance. The facet is the single partition authority, so a partition\n * arriving from a package is a tenant-confinement change and is never applied because a package happens\n * to be installed.\n *\n * A package presents its augmentations beside its facets, from its `./systems-of-record` export, as a\n * record keyed by vendor id under {@link SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT}. A package\n * may ship augmentations and no facet at all. Its module is found the way every facet module is: by the\n * provider discovery walk `wildo config sync` runs, which reads the framework's names, the application's own\n * scope, and any package the application lists in `providers.packages` (#1676). Listing ADMITS the package;\n * an instance's opt-in ACTIVATES its augmentation. A package the walk did not record is refused by name.\n *\n * Entity descriptions are not augmentable: the facet declares none today, so there is nothing to add to.\n */\nexport const SystemOfRecordVendorFacetAugmentationSchema = z.strictObject({\n  /** The vendor this augments — must equal the key it is recorded under. */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n  /** A partition declaration for a vendor whose base facet declares none. */\n  partition: SystemOfRecordPartitionSupportSchema.optional(),\n  /** Credential kinds the base facet does not offer, each with this vendor's policy for it. */\n  credentialOffers: z.array(SystemOfRecordCredentialOfferSchema).min(1).optional(),\n}).superRefine((augmentation, context) => {\n  if (augmentation.partition === undefined && augmentation.credentialOffers === undefined) {\n    context.addIssue({ code: 'custom', path: [], message: 'A facet augmentation that adds nothing is refused: declare a partition, credential offers, or both.' });\n  }\n  const seenKinds = new Set<string>();\n  for (const [index, offer] of (augmentation.credentialOffers ?? []).entries()) {\n    if (seenKinds.has(offer.kind)) {\n      context.addIssue({ code: 'custom', path: ['credentialOffers', index], message: `Duplicate credentialOffers member \"${offer.kind}\".` });\n    }\n    seenKinds.add(offer.kind);\n  }\n});\nexport type SystemOfRecordVendorFacetAugmentation = z.infer<typeof SystemOfRecordVendorFacetAugmentationSchema>;\n\n/** The export a package's `./systems-of-record` module presents its facet augmentations under: a record keyed by vendor id. */\nexport const SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT = 'PROVIDER_CATALOGUE_SYSTEM_OF_RECORD_FACET_AUGMENTATIONS';\n/** @wildo_source:part:end saas.models.systems-of-record.facet-augmentation */\n\n/**\n * Where each thing a RESOLVED facet declares came from, once an instance's opted-in augmentations were applied\n * (#1675). Written only by {@link applySystemOfRecordFacetAugmentations}: a facet a package ships is parsed through\n * a strict schema with no such field, so a package cannot claim to have been augmented, nor attribute a partition\n * to someone else.\n */\nexport interface SystemOfRecordFacetAugmentationProvenance {\n  /** The package whose augmentation declared the instance's partition. */\n  readonly partition?: string;\n  /** Credential kind → the package whose augmentation offered it. */\n  readonly credentialKinds: Readonly<Record<string, string>>;\n}\n\n/** Why an instance's opted-in augmentations cannot be applied. */\nexport enum SystemOfRecordFacetAugmentationRefusalKind {\n  /** A package the instance opted in ships no augmentation for its vendor. */\n  NOT_FOUND = 'not-found',\n  /** Two sources declare the same partition or credential kind. */\n  CONFLICT = 'conflict',\n  /** An augmentation, or the facet it produces once merged, fails the facet schema. */\n  INVALID = 'invalid',\n}\n\nexport type SystemOfRecordFacetAugmentationResult =\n  | { readonly facet: SystemOfRecordVendorFacet; readonly augmentedBy: SystemOfRecordFacetAugmentationProvenance }\n  | { readonly refusal: SystemOfRecordFacetAugmentationRefusalKind; readonly message: string; readonly detail: Readonly<Record<string, unknown>> };\n\n/**\n * Folds an instance's opted-in augmentations into its base facet — and refuses, naming both sources, the moment two\n * of them declare the same thing. ONE implementation for the backend's facet resolver and `wildo secrets`, so a\n * listing cannot ask for a credential the backend would refuse, or miss one an augmentation offers.\n *\n * `augmentations` is in the instance's declared opt-in order; each `raw` is what the package's module presents under\n * {@link SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT} for this vendor (`undefined` when it presents none),\n * parsed here like a facet because it was produced by one package version and is read by another.\n *\n * assurance-control: WILDO.DATA.TENANT_ISOLATION WILDO.SECURITY.FAIL_CLOSED — a partition declaration (how a tenant's\n * rows are confined) is admitted from a package only when the instance opted that package in, only for a vendor whose\n * base facet declares none, never twice, and every admitted one is recorded with the package that contributed it.\n */\nexport function applySystemOfRecordFacetAugmentations(input: {\n  readonly vendor: string;\n  readonly base: { readonly facet: SystemOfRecordVendorFacet; readonly source: string };\n  readonly augmentations: ReadonlyArray<{\n    readonly packageName: string;\n    readonly raw: unknown;\n    /**\n     * Why the package's facet module could not be read at all — it was not discovered, or its import failed — named in\n     * the NOT_FOUND refusal, never swallowed. A full clause, since the reader supplies the remedy it knows.\n     */\n    readonly unreadable?: string;\n  }>;\n}): SystemOfRecordFacetAugmentationResult {\n  const { vendor, base } = input;\n  let partition = base.facet.partition;\n  let partitionSource: string | undefined = partition === undefined ? undefined : base.source;\n  let augmentedPartitionPackage: string | undefined;\n  const credentialOffers = [...base.facet.credentialOffers];\n  const offerSources = new Map<string, string>(base.facet.credentialOffers.map((offer) => [offer.kind, base.source]));\n  const augmentedKinds: Record<string, string> = {};\n\n  for (const { packageName, raw, unreadable } of input.augmentations) {\n    if (raw === undefined) {\n      return {\n        refusal: SystemOfRecordFacetAugmentationRefusalKind.NOT_FOUND,\n        message: unreadable === undefined\n          ? `Package ${packageName} is opted in to augment vendor '${vendor}' and ships no augmentation for it — its `\n            + '`./systems-of-record` module augments other vendors only.'\n          : `Package ${packageName} is opted in to augment vendor '${vendor}', and its facet module `\n            + `${systemOfRecordFacetModuleSpecifier(packageName)} could not be read: ${unreadable}.`,\n        detail: { vendor, packageName, ...(unreadable === undefined ? {} : { unreadable }) },\n      };\n    }\n    const parsed = SystemOfRecordVendorFacetAugmentationSchema.safeParse(raw);\n    if (!parsed.success) {\n      return {\n        refusal: SystemOfRecordFacetAugmentationRefusalKind.INVALID,\n        message: `Package ${packageName}'s augmentation of vendor '${vendor}' is malformed: ${z.prettifyError(parsed.error)}`,\n        detail: { vendor, packageName },\n      };\n    }\n    const augmentation = parsed.data;\n    if (augmentation.vendor !== vendor) {\n      return {\n        refusal: SystemOfRecordFacetAugmentationRefusalKind.NOT_FOUND,\n        message: `Package ${packageName} records an augmentation under vendor '${vendor}' that declares vendor '${augmentation.vendor}'.`,\n        detail: { vendor, packageName, declaredVendor: augmentation.vendor },\n      };\n    }\n    const source = `package ${packageName}`;\n    if (augmentation.partition !== undefined) {\n      if (partitionSource !== undefined) {\n        return {\n          refusal: SystemOfRecordFacetAugmentationRefusalKind.CONFLICT,\n          message: `Vendor '${vendor}' would be partitioned twice: by ${partitionSource} and by ${source}. The facet is the one `\n            + 'authority on how rows are confined — remove one of the two.',\n          detail: { vendor, sources: [partitionSource, source] },\n        };\n      }\n      partition = augmentation.partition;\n      partitionSource = source;\n      augmentedPartitionPackage = packageName;\n    }\n    for (const offer of augmentation.credentialOffers ?? []) {\n      const existing = offerSources.get(offer.kind);\n      if (existing !== undefined) {\n        return {\n          refusal: SystemOfRecordFacetAugmentationRefusalKind.CONFLICT,\n          message: `Vendor '${vendor}' would offer credential kind '${offer.kind}' twice: from ${existing} and from ${source}.`,\n          detail: { vendor, credentialKind: offer.kind, sources: [existing, source] },\n        };\n      }\n      offerSources.set(offer.kind, source);\n      credentialOffers.push(offer);\n      augmentedKinds[offer.kind] = packageName;\n    }\n  }\n\n  // Re-parsed as a whole, so every rule the base schema holds (a kind's slots against the vendor's) holds for the\n  // merged facet too.\n  const merged = SystemOfRecordVendorFacetSchema.safeParse({\n    ...base.facet,\n    credentialOffers,\n    ...(partition === undefined ? {} : { partition }),\n  });\n  if (!merged.success) {\n    const packages = input.augmentations.map((augmentation) => augmentation.packageName);\n    return {\n      refusal: SystemOfRecordFacetAugmentationRefusalKind.INVALID,\n      message: `Vendor '${vendor}''s facet, augmented by ${packages.join(', ')}, is no longer a valid facet: ${z.prettifyError(merged.error)}`,\n      detail: { vendor, packages },\n    };\n  }\n  return {\n    facet: merged.data,\n    augmentedBy: {\n      ...(augmentedPartitionPackage === undefined ? {} : { partition: augmentedPartitionPackage }),\n      credentialKinds: augmentedKinds,\n    },\n  };\n}\n\n/**\n * How this vendor pages an OData collection read — the ONE place an absent declaration becomes an\n * answer (#1292).\n *\n * `$skip` is what OData v4 defines and what a conformant service serves, so silence means the\n * conformant behaviour rather than an unknown. A second `?? SKIP` written at a consumer is how two\n * readers come to disagree about what silence meant.\n */\nexport function resolveSystemOfRecordODataListPaging(facet: SystemOfRecordVendorFacet): SystemOfRecordODataListPaging {\n  return facet.odataListPaging ?? SystemOfRecordODataListPaging.SKIP;\n}\n\n/** Every slot ONE instance must supply, once its facet and its credential kind are both known. */\nexport interface SystemOfRecordInstanceSlots {\n  readonly addressSlots: readonly SystemOfRecordSlot[];\n  readonly secretSlots: readonly SystemOfRecordSlot[];\n}\n\n/**\n * Find the offer a vendor makes for one kind, or `undefined`.\n *\n * Separate from {@link resolveSystemOfRecordInstanceSlots} because the two answer different\n * questions: this one is \"what is this vendor's POLICY for the kind I chose\", which the minter needs\n * at every call, while the slot union is a boot-time question asked once.\n */\nexport function findSystemOfRecordCredentialOffer(\n  facet: SystemOfRecordVendorFacet,\n  credentialKind: SystemOfRecordCredentialKind,\n): SystemOfRecordCredentialOffer | undefined {\n  return facet.credentialOffers.find((offer) => offer.kind === credentialKind);\n}\n\n/**\n * Which credential kind an instance uses — decided ONCE, for the backend registry that enforces it at boot\n * and for `wildo secrets`, which lists the secret slots that kind needs (#1637). Two readers deriving it\n * separately is how a listing comes to ask for a secret the backend will not read.\n *\n * DECLARED when the instance names one the facet offers; DERIVED when the instance names none and the\n * facet offers exactly one, because an author asked to choose between one option is being asked a question\n * the mechanism already holds the answer to (`derive-before-you-ask.md`). Otherwise a refusal, carrying\n * what the facet does offer so the reader can name it: a kind the vendor does not offer, or several on\n * offer and none chosen — the day the author acquires a real decision.\n */\nexport function chooseSystemOfRecordCredentialKind(\n  declaredKind: SystemOfRecordCredentialKind | undefined,\n  facet: SystemOfRecordVendorFacet,\n):\n  | { readonly kind: SystemOfRecordCredentialKind }\n  | { readonly refusal: SystemOfRecordErrorCode.CREDENTIAL_KIND_NOT_OFFERED | SystemOfRecordErrorCode.CREDENTIAL_KIND_AMBIGUOUS; readonly offered: readonly SystemOfRecordCredentialKind[] } {\n  const offered = facet.credentialOffers.map((offer) => offer.kind);\n  if (declaredKind !== undefined) {\n    return offered.includes(declaredKind) ? { kind: declaredKind } : { refusal: SystemOfRecordErrorCode.CREDENTIAL_KIND_NOT_OFFERED, offered };\n  }\n  return offered.length === 1 ? { kind: offered[0]! } : { refusal: SystemOfRecordErrorCode.CREDENTIAL_KIND_AMBIGUOUS, offered };\n}\n\n/**\n * The ONE place the vendor's slots and the credential kind's slots are joined.\n *\n * Every reader of \"what does this instance need\" goes through here — the environment-variable\n * derivation, `wildo config sync`'s coherence check, the k8s secrets generator, the CI collector\n * and the backend registry. Four of those five live in different packages, which is precisely why\n * re-deriving the union at each of them would drift (`invariant-call-site-enumeration.md`).\n *\n * ## It also applies the offer's REQUIRED-NESS, which is why it takes a facet and not a contract\n *\n * Three slots are declared optional in the contract map and become required here, because only the\n * vendor's offer knows: `certificateKeyId` under the key-id assertion header policy, `certificatePem`\n * under the thumbprint policy, and `subject` for the JWT-bearer grant. Declaring them required in the\n * contract would make every certificate vendor supply both halves of a choice only one of them makes;\n * leaving them optional everywhere would let an instance boot with an assertion it cannot build, and\n * fail at the first read instead of at configuration.\n *\n * Throws when the kind is not one the facet offers: that pairing is chosen by an instance and\n * refused where the instance is validated, so reaching here with it means a caller skipped the\n * check rather than an operator wrote something wrong.\n */\nexport function resolveSystemOfRecordInstanceSlots(\n  facet: SystemOfRecordVendorFacet,\n  credentialKind: SystemOfRecordCredentialKind,\n): SystemOfRecordInstanceSlots {\n  const offer = findSystemOfRecordCredentialOffer(facet, credentialKind);\n  if (offer === undefined) {\n    throw new Error(\n      `Vendor \"${facet.vendor}\" does not offer credential kind \"${credentialKind}\" `\n      + `(offers: ${facet.credentialOffers.map((candidate) => candidate.kind).join(', ')}).`,\n    );\n  }\n\n  const contract = SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS[credentialKind];\n  const requiredByOffer = slotSlugsTheOfferMakesRequired(offer);\n  const applyOffer = (slot: SystemOfRecordSlot): SystemOfRecordSlot =>\n    (slot.required || !requiredByOffer.has(slot.slug) ? slot : { ...slot, required: true });\n\n  const bySlug = (left: SystemOfRecordSlot, right: SystemOfRecordSlot) => left.slug.localeCompare(right.slug);\n  return {\n    addressSlots: [...facet.addressSlots, ...contract.addressSlots.map(applyOffer)].sort(bySlug),\n    secretSlots: [...contract.secretSlots.map(applyOffer)].sort(bySlug),\n  };\n}\n\n/**\n * Which otherwise-optional slugs THIS offer turns into obligations.\n *\n * A `switch` over the discriminated union rather than a lookup, so a member added to the union\n * without a decision here is a compile error rather than a slot that silently stays optional.\n */\nfunction slotSlugsTheOfferMakesRequired(offer: SystemOfRecordCredentialOffer): ReadonlySet<string> {\n  switch (offer.kind) {\n    case SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS:\n    case SystemOfRecordCredentialKind.API_KEY_HEADER:\n    case SystemOfRecordCredentialKind.API_KEY_QUERY:\n    case SystemOfRecordCredentialKind.BASIC:\n    case SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET:\n      return new Set();\n    case SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE:\n      return new Set([\n        offer.assertionHeaderPolicy === SystemOfRecordAssertionHeaderPolicy.KEY_ID_SUPPLIED\n          ? 'certificateKeyId'\n          : 'certificatePem',\n      ]);\n    case SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER:\n      // The `sub` of an RFC 7523 §2.1 assertion. Optional in the contract only because the GRANT is\n      // what asserts it — no other kind has a subject at all.\n      return new Set(['subject']);\n  }\n}\n"]}

package/dist/esm/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `systemOfRecordPartitionAssignments` — resource configuration.
+ *
+ * Every verb is `APP_ADMIN_SUPER_ADMIN` at APPLICATION scope and none is reachable with a tenant
+ * role, which is decision D11 of the slice: only an OPERATOR decides which part of the operator's own
+ * ERP a unit of the org chart corresponds to. A tenant administrator who could assign partitions
+ * could assign their own unit to a company they were never meant to see — the confinement would be
+ * configurable by the party it confines.
+ *
+ * See `system-of-record-partition-assignments.shared.schemas.ts` for what the row means and why it is
+ * APPLICATION-scoped rather than ORGANIZATIONS-scoped.
+ */
+import { z } from 'zod';
+import { CoreResourceOperation } from '../resources/resources.shared.core.definitions';
+import { type ResourceRelationship } from '../resources/resources.shared.schemas';
+type SystemOfRecordPartitionAssignmentsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.COUNT | CoreResourceOperation.CREATE | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY;
+export declare const systemOfRecordPartitionAssignmentsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("..").ResourceConfiguration<{
+    readonly REASSIGN: "reassign";
+}, SystemOfRecordPartitionAssignmentsCoreOperations, import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    applicationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>;
+    system: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    remoteKey: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    organizationUnitId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;
+    justification: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    assignedByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDefault<z.ZodDate>>>>>;
+}, z.core.$strip>>>;
+export {};
+//# sourceMappingURL=system-of-record-partition-assignments.shared.resources-config.schemas.d.ts.map

package/dist/esm/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-partition-assignments.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAAE,qBAAqB,EAAwD,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,uCAAuC,CAAC;AAY/C,KAAK,gDAAgD,GACjD,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAE5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,6EAA6E,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;mBA+NxI,CAAC"}

package/dist/esm/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.js

@@ -0,0 +1,233 @@
+/**
+ * `systemOfRecordPartitionAssignments` — resource configuration.
+ *
+ * Every verb is `APP_ADMIN_SUPER_ADMIN` at APPLICATION scope and none is reachable with a tenant
+ * role, which is decision D11 of the slice: only an OPERATOR decides which part of the operator's own
+ * ERP a unit of the org chart corresponds to. A tenant administrator who could assign partitions
+ * could assign their own unit to a company they were never meant to see — the confinement would be
+ * configurable by the party it confines.
+ *
+ * See `system-of-record-partition-assignments.shared.schemas.ts` for what the row means and why it is
+ * APPLICATION-scoped rather than ORGANIZATIONS-scoped.
+ */
+import { z } from 'zod';
+import { SystemOfRecordPartitionAssignmentSchema, SystemOfRecordPartitionAssignments_Operations, } from './system-of-record-partition-assignments.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../resources/resources.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas.js';
+import { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas.js';
+const SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_FILTER_FIELDS = {
+    system: z.string(),
+    remoteKey: z.string(),
+    organizationUnitId: z.string(),
+};
+export const systemOfRecordPartitionAssignmentsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: SystemOfRecordPartitionAssignmentSchema,
+    resourceIdentifier: CoreResourceType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /**
+     * `list` ALLOWED, and it is the load-bearing entry rather than a convenience.
+     *
+     * The read confinement resolves a caller's unit set into remote partition keys on EVERY read of
+     * every resource bound to a partitioned instance — and that caller is an ordinary tenant member
+     * with no application role at all. They can no more LIST these rows in their own right than they
+     * can read the deployment's configuration, so the lookup runs on a SYSTEM context. This is the
+     * same shape, and the same argument, as the access-grant resources: the authorization layer
+     * consults the row before the caller's own authority is established for the read it is gating.
+     *
+     * No trusted `create`/`update`: every transition belongs to a custom implementation that checks
+     * the unit against the owner organization and records the lifecycle event. A system door around
+     * those would be a second way to grant a set of members access to a company's data.
+     *
+     * `exportSubject: FORBIDDEN`. `assignedByUserId` is a foreign key back to USERS, so these rows sit
+     * on that operator's Art. 15 graph — and an included resource carrying NO declaration REFUSES the
+     * whole export, so the field cannot simply be omitted. FORBIDDEN because the row is not about the
+     * subject: it is the operator's corporate structure (which remote company corresponds to which
+     * unit), and disclosing the deployment's partition map to a data subject discloses a third party's
+     * business organization rather than the subject's personal data.
+     */
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        exportSubject: ResourceSystemAccessMode.FORBIDDEN,
+    },
+    /**
+     * Subject erasure RETAINS the row and scrubs its free text.
+     *
+     * Erasing the assignment itself would be a configuration change dressed as a privacy act: the
+     * partition would become unreachable to every member of its unit, which is an availability
+     * incident for the operator's business and does nothing for the data subject. What the subject's
+     * erasure does reach is the prose THEY wrote — `justification` — which is masked.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,
+    },
+    /** The row is about a remote partition, not a person. The operator's session ends through `USERS`. */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.COUNT,
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.DELETE,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
+    ],
+    operationsConfiguration: {
+        /*
+         * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be
+         * REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,
+         * which matches only INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize
+         * writer uses to stamp markers.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                }],
+        },
+        /**
+         * Assigning a partition to a unit — the verb that GRANTS a set of members access to a remote
+         * company's rows.
+         *
+         * HIGH rather than MEDIUM, and the threshold is the reason: HIGH is inside
+         * `AUTOMATIC_AUDIT_RISK_FLOOR`, so the generic `RESOURCE_OPERATION_PERFORMED` row fires without
+         * any declaration here. The dedicated lifecycle event carries what that row cannot — which unit,
+         * and on a reassignment, which unit it was before.
+         *
+         * No `requestDto`: the create contract is the schema's own, which is exactly right here. All
+         * four authored fields (`system`, `remoteKey`, `organizationUnitId`, `justification`) are
+         * required and creatable; `assignedByUserId` is `.excludeFromCreate()` and is server-authored
+         * from the session, so a caller cannot attribute an assignment to somebody else.
+         *
+         * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a remote partition reaches only the unit an
+         * operator deliberately assigned it to.
+         * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
+         */
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                },
+            ],
+        },
+        /**
+         * Unassigning — and it is not the mild verb it looks like.
+         *
+         * Removing the edge makes the partition unreachable to EVERY caller: the read pushes down the
+         * set of assigned keys, so a key with no assignment is in nobody's predicate. An operator
+         * unassigning by mistake does not narrow access, they remove a company from the product. HIGH
+         * for that reason, and the lifecycle event names the unit that was lost.
+         */
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                },
+            ],
+        },
+        [CoreResourceOperation.READ]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        /**
+         * The partition map an operator works from.
+         *
+         * `APP_ADMIN_SUPER_ADMIN`, and whether the owner organization's `ORG_ADMIN` may also read it is
+         * a deliberate LATER widening rather than an oversight: the rows describe the operator's own
+         * corporate structure, and an APPLICATION-scoped resource carries application roles, so opening
+         * it to a tenant role is a scope decision and not a role edit.
+         */
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    filterFields: SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_FILTER_FIELDS,
+                },
+            ],
+        },
+        [CoreResourceOperation.COUNT]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        /**
+         * MOVING a partition between units, under a compare-and-swap on the unit it is leaving.
+         *
+         * ## Why this is not an UPDATE
+         *
+         * `organizationUnitId` is `.excludeFromUpdate()`, so a plain UPDATE naming it SUCCEEDS and
+         * persists nothing — the repository's strict re-parse drops the field and the caller is told the
+         * write worked. That failure mode is silent by construction, which is why the field is excluded
+         * and this door exists: one writer, one contract, one audit event.
+         *
+         * ## Why the compare-and-swap
+         *
+         * `expectedCurrentOrganizationUnitId` is REQUIRED, not optional. Two administrators moving the
+         * same partition in opposite directions during one incident is not a hypothetical — it is the
+         * ordinary shape of an incident — and a last-write-wins result would leave a company assigned to
+         * a unit neither operator chose, with two plausible audit rows explaining it. Naming the unit
+         * you believe you are moving away from makes the second write REFUSE instead.
+         *
+         * No `enabledCondition`, and that is stated rather than omitted. The precedent resources
+         * duplicate their guard into `enabledCondition` so a console cannot render an affordance the
+         * implementation will refuse — but that guard is a question about the ROW's state, and this row
+         * has no state to be in. The only thing that can refuse a reassignment is the relationship
+         * between the request and the current unit, which `enabledCondition` cannot see: it receives
+         * `currentObject` and `initiatorIds`, never the request DTO. A condition that ignored the DTO
+         * would be an affordance guard that hides nothing while reading as defence in depth — #19 of
+         * `invariant-call-site-enumeration.md`. The CAS in the implementation is the whole guard.
+         *
+         * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — a move records both units and its reason.
+         */
+        [SystemOfRecordPartitionAssignments_Operations.REASSIGN]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
+                    requestDto: z.object({
+                        /** The unit the partition moves TO. Checked against the owner organization and ACTIVE status. */
+                        organizationUnitId: z.string().min(1),
+                        /** The unit the caller believes it is moving FROM. The row is refused if it disagrees. */
+                        expectedCurrentOrganizationUnitId: z.string().min(1)
+                            .describe('The unit you believe the partition is assigned to now, the one it moves away from. If it has already moved elsewhere, for instance because another administrator reassigned it, the request is refused with a 409 and nothing changes.'),
+                        /** Replaces the stored justification: the reason the partition is HERE, not the reason it once was. */
+                        justification: z.string().min(1).max(1000),
+                    }),
+                },
+            ],
+        },
+    },
+    // NOTE: the APPLICATION primary scope is NOT declared here. It is derived from the registry
+    // relationship carrying `isPrimaryScope: true` (APPLICATION → SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS).
+});
+//# sourceMappingURL=system-of-record-partition-assignments.shared.resources-config.schemas.js.map

package/dist/esm/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-partition-assignments.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-partition-assignments.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,uCAAuC,EACvC,6CAA6C,GAC9C,MAAM,yDAAyD,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,gDAAgD,CAAC;AAC7I,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAE7B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,0CAA0C,EAAE,MAAM,8CAA8C,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AAEvH,MAAM,mDAAmD,GAAG;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;CAC/B,CAAC;AAWF,MAAM,CAAC,MAAM,6EAA6E,GAAG,CAAC,sBAA8C,EAAE,EAAE,CAC9I,0CAA0C,CAIxC;IACA,UAAU,EAAE,uCAAuC;IACnD,kBAAkB,EAAE,gBAAgB,CAAC,sCAAsC;IAC3E,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,sCAAsC,CAAC;IACpH,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,aAAa,EAAE,wBAAwB,CAAC,SAAS;KAClD;IAED;;;;;;;OAOG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,wBAAwB;KACpD;IAED,sGAAsG;IACtG,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,KAAK;QAC3B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QAEvB;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C,CAAC;SACH;QAED;;;;;;;;;;;;;;;;;WAiBG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;WAOG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,mDAAmD;iBAClE;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE;YAC7B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BG;QACH,CAAC,6CAA6C,CAAC,QAAQ,CAAC,EAAE;YACxD,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;wBACnB,iGAAiG;wBACjG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBACrC,0FAA0F;wBAC1F,iCAAiC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;6BACjD,QAAQ,CAAC,wOAAwO,CAAC;wBACrP,uGAAuG;wBACvG,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;qBAC3C,CAAC;iBACH;aACF;SACF;KACF;IACD,4FAA4F;IAC5F,uGAAuG;CACxG,CAAC,CAAC","sourcesContent":["/**\n * `systemOfRecordPartitionAssignments` — resource configuration.\n *\n * Every verb is `APP_ADMIN_SUPER_ADMIN` at APPLICATION scope and none is reachable with a tenant\n * role, which is decision D11 of the slice: only an OPERATOR decides which part of the operator's own\n * ERP a unit of the org chart corresponds to. A tenant administrator who could assign partitions\n * could assign their own unit to a company they were never meant to see — the confinement would be\n * configurable by the party it confines.\n *\n * See `system-of-record-partition-assignments.shared.schemas.ts` for what the row means and why it is\n * APPLICATION-scoped rather than ORGANIZATIONS-scoped.\n */\n\nimport { z } from 'zod';\n\nimport {\n  SystemOfRecordPartitionAssignmentSchema,\n  SystemOfRecordPartitionAssignments_Operations,\n} from './system-of-record-partition-assignments.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n  type ResourceRelationship,\n} from '../resources/resources.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../resources/resources-config.shared.schemas';\nimport { CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../compliance/privacy/impersonalization.shared.schemas';\n\nconst SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_FILTER_FIELDS = {\n  system: z.string(),\n  remoteKey: z.string(),\n  organizationUnitId: z.string(),\n};\n\ntype SystemOfRecordPartitionAssignmentsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.COUNT\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.DELETE\n  // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const systemOfRecordPartitionAssignmentsResourceConfiguration_InitializationFactory = (resourcesRelationships: ResourceRelationship[]) =>\n  createResourceConfiguration_Initialization<\n    typeof SystemOfRecordPartitionAssignments_Operations,\n    SystemOfRecordPartitionAssignmentsCoreOperations,\n    typeof SystemOfRecordPartitionAssignmentSchema\n  >({\n    mainSchema: SystemOfRecordPartitionAssignmentSchema,\n    resourceIdentifier: CoreResourceType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS,\n    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS],\n    resourceRelationships: resourcesRelationships,\n    isSystemResource: true,\n\n    /**\n     * `list` ALLOWED, and it is the load-bearing entry rather than a convenience.\n     *\n     * The read confinement resolves a caller's unit set into remote partition keys on EVERY read of\n     * every resource bound to a partitioned instance — and that caller is an ordinary tenant member\n     * with no application role at all. They can no more LIST these rows in their own right than they\n     * can read the deployment's configuration, so the lookup runs on a SYSTEM context. This is the\n     * same shape, and the same argument, as the access-grant resources: the authorization layer\n     * consults the row before the caller's own authority is established for the read it is gating.\n     *\n     * No trusted `create`/`update`: every transition belongs to a custom implementation that checks\n     * the unit against the owner organization and records the lifecycle event. A system door around\n     * those would be a second way to grant a set of members access to a company's data.\n     *\n     * `exportSubject: FORBIDDEN`. `assignedByUserId` is a foreign key back to USERS, so these rows sit\n     * on that operator's Art. 15 graph — and an included resource carrying NO declaration REFUSES the\n     * whole export, so the field cannot simply be omitted. FORBIDDEN because the row is not about the\n     * subject: it is the operator's corporate structure (which remote company corresponds to which\n     * unit), and disclosing the deployment's partition map to a data subject discloses a third party's\n     * business organization rather than the subject's personal data.\n     */\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n      exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    },\n\n    /**\n     * Subject erasure RETAINS the row and scrubs its free text.\n     *\n     * Erasing the assignment itself would be a configuration change dressed as a privacy act: the\n     * partition would become unreachable to every member of its unit, which is an availability\n     * incident for the operator's business and does nothing for the data subject. What the subject's\n     * erasure does reach is the prose THEY wrote — `justification` — which is masked.\n     */\n    retentionPolicy: {\n      mode: ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE,\n    },\n\n    /** The row is about a remote partition, not a person. The operator's session ends through `USERS`. */\n    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.COUNT,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.DELETE,\n      // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n      CoreResourceOperation.UPDATE_MANY,\n    ],\n\n    operationsConfiguration: {\n\n      /*\n       * Route-less retention plumbing — INTERNAL_CALL registers no route and must not be\n       * REPOSITORY_ONLY: the retention primitives resolve through `getServiceOperationPathDefault`,\n       * which matches only INTERNAL_CALL / API_CALL. CRITICAL — it is the verb the impersonalize\n       * writer uses to stamp markers.\n       */\n      [CoreResourceOperation.UPDATE_MANY]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        }],\n      },\n\n      /**\n       * Assigning a partition to a unit — the verb that GRANTS a set of members access to a remote\n       * company's rows.\n       *\n       * HIGH rather than MEDIUM, and the threshold is the reason: HIGH is inside\n       * `AUTOMATIC_AUDIT_RISK_FLOOR`, so the generic `RESOURCE_OPERATION_PERFORMED` row fires without\n       * any declaration here. The dedicated lifecycle event carries what that row cannot — which unit,\n       * and on a reassignment, which unit it was before.\n       *\n       * No `requestDto`: the create contract is the schema's own, which is exactly right here. All\n       * four authored fields (`system`, `remoteKey`, `organizationUnitId`, `justification`) are\n       * required and creatable; `assignedByUserId` is `.excludeFromCreate()` and is server-authored\n       * from the session, so a caller cannot attribute an assignment to somebody else.\n       *\n       * assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — a remote partition reaches only the unit an\n       * operator deliberately assigned it to.\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE\n       */\n      [CoreResourceOperation.CREATE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n          },\n        ],\n      },\n\n      /**\n       * Unassigning — and it is not the mild verb it looks like.\n       *\n       * Removing the edge makes the partition unreachable to EVERY caller: the read pushes down the\n       * set of assigned keys, so a key with no assignment is in nobody's predicate. An operator\n       * unassigning by mistake does not narrow access, they remove a company from the product. HIGH\n       * for that reason, and the lifecycle event names the unit that was lost.\n       */\n      [CoreResourceOperation.DELETE]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * The partition map an operator works from.\n       *\n       * `APP_ADMIN_SUPER_ADMIN`, and whether the owner organization's `ORG_ADMIN` may also read it is\n       * a deliberate LATER widening rather than an oversight: the rows describe the operator's own\n       * corporate structure, and an APPLICATION-scoped resource carries application roles, so opening\n       * it to a tenant role is a scope decision and not a role edit.\n       */\n      [CoreResourceOperation.LIST]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n            filterFields: SYSTEM_OF_RECORD_PARTITION_ASSIGNMENT_FILTER_FIELDS,\n          },\n        ],\n      },\n\n      [CoreResourceOperation.COUNT]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          },\n        ],\n      },\n\n      /**\n       * MOVING a partition between units, under a compare-and-swap on the unit it is leaving.\n       *\n       * ## Why this is not an UPDATE\n       *\n       * `organizationUnitId` is `.excludeFromUpdate()`, so a plain UPDATE naming it SUCCEEDS and\n       * persists nothing — the repository's strict re-parse drops the field and the caller is told the\n       * write worked. That failure mode is silent by construction, which is why the field is excluded\n       * and this door exists: one writer, one contract, one audit event.\n       *\n       * ## Why the compare-and-swap\n       *\n       * `expectedCurrentOrganizationUnitId` is REQUIRED, not optional. Two administrators moving the\n       * same partition in opposite directions during one incident is not a hypothetical — it is the\n       * ordinary shape of an incident — and a last-write-wins result would leave a company assigned to\n       * a unit neither operator chose, with two plausible audit rows explaining it. Naming the unit\n       * you believe you are moving away from makes the second write REFUSE instead.\n       *\n       * No `enabledCondition`, and that is stated rather than omitted. The precedent resources\n       * duplicate their guard into `enabledCondition` so a console cannot render an affordance the\n       * implementation will refuse — but that guard is a question about the ROW's state, and this row\n       * has no state to be in. The only thing that can refuse a reassignment is the relationship\n       * between the request and the current unit, which `enabledCondition` cannot see: it receives\n       * `currentObject` and `initiatorIds`, never the request DTO. A condition that ignored the DTO\n       * would be an affordance guard that hides nothing while reading as defence in depth — #19 of\n       * `invariant-call-site-enumeration.md`. The CAS in the implementation is the whole guard.\n       *\n       * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — a move records both units and its reason.\n       */\n      [SystemOfRecordPartitionAssignments_Operations.REASSIGN]: {\n        variants: [\n          {\n            variantType: ResourceOperationVariantType.API_CALL,\n            isDefault: true,\n            roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            riskLevel: ResourceOperationRiskLevel.HIGH,\n            resourceOperationLike: CoreResourceOperation.UPDATE,\n            requestDto: z.object({\n              /** The unit the partition moves TO. Checked against the owner organization and ACTIVE status. */\n              organizationUnitId: z.string().min(1),\n              /** The unit the caller believes it is moving FROM. The row is refused if it disagrees. */\n              expectedCurrentOrganizationUnitId: z.string().min(1)\n                .describe('The unit you believe the partition is assigned to now, the one it moves away from. If it has already moved elsewhere, for instance because another administrator reassigned it, the request is refused with a 409 and nothing changes.'),\n              /** Replaces the stored justification: the reason the partition is HERE, not the reason it once was. */\n              justification: z.string().min(1).max(1000),\n            }),\n          },\n        ],\n      },\n    },\n    // NOTE: the APPLICATION primary scope is NOT declared here. It is derived from the registry\n    // relationship carrying `isPrimaryScope: true` (APPLICATION → SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS).\n  });\n"]}