@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/external-data/external-data-pipeline.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-data-pipeline.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-data/external-data-pipeline.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAEhG;;;;;GAKG;AACH,kHAAkH;AAClH,MAAM,CAAN,IAAY,6BAEX;AAFD,WAAY,6BAA6B;IACvC,oDAAmB,CAAA;AACrB,CAAC,EAFW,6BAA6B,KAA7B,6BAA6B,QAExC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAcX;AAdD,WAAY,iCAAiC;IAC3C;;;;OAIG;IACH,sDAAiB,CAAA;IACjB;;;;;OAKG;IACH,kDAAa,CAAA;AACf,CAAC,EAdW,iCAAiC,KAAjC,iCAAiC,QAc5C;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,uGAAuG;IACvG,6CAAiB,CAAA;IACjB,mGAAmG;IACnG,mDAAuB,CAAA;IACvB,uFAAuF;IACvF,6CAAiB,CAAA;AACnB,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED,kGAAkG;AAClG,MAAM,CAAN,IAAY,4BAKX;AALD,WAAY,4BAA4B;IACtC,+DAA+D;IAC/D,6DAA6B,CAAA;IAC7B,yGAAyG;IACzG,qDAAqB,CAAA;AACvB,CAAC,EALW,4BAA4B,KAA5B,4BAA4B,QAKvC;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,yBAWX;AAXD,WAAY,yBAAyB;IACnC,+EAA+E;IAC/E,0CAAa,CAAA;IACb;;;;OAIG;IACH,sEAAyC,CAAA;IACzC,mFAAmF;IACnF,sEAAyC,CAAA;AAC3C,CAAC,EAXW,yBAAyB,KAAzB,yBAAyB,QAWpC;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,YAAY,CAAC;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC;QACnF;;;;WAIG;QACH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,QAAQ,CAAC;QACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KACzD,CAAC;CACH,CAAC,CAAC;AAKH,iGAAiG;AACjG,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAE9F;;;;;;;GAOG;AACH,kHAAkH;AAClH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAE/F;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,EAAE,4BAA4B;IAErC;;;;;OAKG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE3D,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5D;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAC,QAAQ,EAAE;IAEnG,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,MAAM,CAAC;IAEvG,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC;IAEvF;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CAC3D,CAAC,CAAC;AAmBH;;;;GAIG;AACH,MAAM,UAAU,8CAA8C,CAAC,WAA4C;IACzG;;;;;;;;;OASG;IAEH,wFAAwF;IACxF,6FAA6F;IAC7F,yFAAyF;IACzF,8FAA8F;IAC9F,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,wTAAwT,CACzT,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,UAAU,8DAA8D,CAAC,CAAC;QAC3H,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEnC,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,CAAC,UAAU,sIAAsI,CAChL,CAAC;QACJ,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI;YACpC,CAAC,yBAAyB,EAAE,WAAW,CAAC,uBAAuB,CAAC;YAChE,CAAC,wBAAwB,EAAE,WAAW,CAAC,sBAAsB,CAAC;SACtD,EAAE,CAAC;YACX,IAAI,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,CAAC,UAAU,YAAY,KAAK,0GAA0G,CACrK,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IACE,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,YAAY;eACrD,KAAK,CAAC,QAAQ,KAAK,yBAAyB,CAAC,kBAAkB;eAC/D,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EACvE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,YAAY,KAAK,CAAC,UAAU,iBAAiB,yBAAyB,CAAC,kBAAkB,gEAAgE,WAAW,CAAC,OAAO,CAAC,OAAO,UAAU,CAC/L,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,uBAAuB,GAAG;QAC9B,CAAC,yBAAyB,EAAE,WAAW,CAAC,uBAAuB,CAAU;QACzE,CAAC,wBAAwB,EAAE,WAAW,CAAC,sBAAsB,CAAU;KACxE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7C,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,aAAa,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAE,CAAC;QACpD,MAAM,YAAY,GAAG,aAAa,KAAK,yBAAyB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACxH,MAAM,IAAI,KAAK,CACb,GAAG,aAAa,wBAAwB,YAAY,sFAAsF;cACxI,sIAAsI;cACtI,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,IACE,WAAW,CAAC,uBAAuB,KAAK,SAAS;WAC9C,WAAW,CAAC,uBAAuB,KAAK,WAAW,CAAC,sBAAsB,EAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2LAA2L,CAC5L,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI;QACpC,CAAC,yBAAyB,EAAE,WAAW,CAAC,uBAAuB,CAAC;QAChE,CAAC,wBAAwB,EAAE,WAAW,CAAC,sBAAsB,CAAC;KACtD,EAAE,CAAC;QACX,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6KAA6K,CACtL,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * The ETL PIPELINE declaration (`externalDataPipeline`) — partial-resource coverage, model v3\n * (`.claude/plans/etl-partial-resource-coverage.md`, PR-3/PR-19; decisions D-P1…D-P10).\n *\n * \"Some resources local, some remote, ETL between them\": an ordinary LOCAL resource may declare\n * ONE inbound pipeline from a remote HTTP-API entity. The declaration reuses the whole\n * {@link HttpApiResourceBindingSchema} as its source half (provider, entity, dialect, key\n * fields, remote-call semantics — the E is the same adapter plumbing the VIRTUAL mode runs on),\n * adds the T (a declared field mapping) and the L/refresh contract (population posture, orphan\n * policy, schedule, run bounds). The destination stays a FULL local resource — files, RAG,\n * retention/erasure, charts and the read-only UI chain are all inherited, never re-built.\n *\n * Everything here is a CLOSED vocabulary with one named source; the runtime seams (P-2) consume\n * these members, and the paper's ledger rows (PR-…) are cited per surface.\n */\n\nimport { z } from 'zod';\n\nimport { HttpApiResourceBindingSchema } from '../http-api-binding/http-api-binding.shared.schemas';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\n\n/**\n * Pipeline direction (PR-19). A SINGLE-member enum on purpose: reverse ETL (local→remote) and\n * bidirectional sync belong to the outbound-writes gate (ETL plan Step 5, concurrency contract),\n * but the DECLARATION is direction-extensible NOW so those arrive as new members instead of a\n * schema reshape — the immutability-needs-a-paired-path lesson applied to a vocabulary.\n */\n/** @wildo_source:part:start saas.models.external-data-pipeline facet:layer:shared facet:audience:app-developer */\nexport enum ExternalDataPipelineDirection {\n  INBOUND = 'inbound',\n}\n\n/**\n * Who owns the destination's row population (D-P8, v3.1 §1).\n *\n * The declared answer to the question the orphan sweep MUST have: \"is a row the pipeline did not\n * create a USER row, or a VANISHED remote row?\" — undeclared mixed populations are how an orphan\n * pass deletes user data.\n */\nexport enum ExternalDataDestinationPopulation {\n  /**\n   * Every row comes from the pipeline. Caller CREATE is refused at declaration time, and orphan\n   * detection may consider the whole population. The default: safest, and the honest description\n   * of a synced master-data table.\n   */\n  CLOSED = 'closed',\n  /**\n   * Mixed rows: users may create rows the pipeline does not own. Pipeline rows are identified by\n   * the remote-key field being present, and orphan detection is CONFINED to that population. A\n   * user row that later matches an incoming remote key is ADOPTED by the upsert (documented\n   * collision semantics, not an accident).\n   */\n  OPEN = 'open',\n}\n\n/**\n * What happens to a destination row whose remote counterpart disappeared (D-P9).\n *\n * MIRRORS `DataSeedSyncOrphanPolicy` (saas-backend-lib, data-seeding) member-for-member, and the\n * P-2 pipeline→SYNC seam maps the two 1:1. A separate enum EXISTS ONLY because of dependency\n * direction: this declaration lives in saas-models, the data-seeding models live in\n * saas-backend-lib, and models cannot import backend. If the data-seeding vocabulary ever moves\n * down to saas-models, collapse this enum into it — do not let the two drift meanwhile (the\n * seam's mapping is exhaustive and compile-forced, so a new member on either side reddens P-2).\n */\nexport enum ExternalDataOrphanPolicy {\n  /** Hard-delete the orphan row — flows through ordinary lifecycle (cascades, file teardown). Opt-in. */\n  DELETE = 'delete',\n  /** Mark the row deprecated and keep it; a re-appearing remote key REVIVES it (v3.1 §4). Opt-in. */\n  DEPRECATE = 'deprecate',\n  /** Touch nothing; surface the diff in the run ledger. The DEFAULT — least surprise. */\n  REPORT = 'report',\n}\n\n/** The two shapes a mapping entry can take — a closed discriminator, never inferred from keys. */\nexport enum ExternalDataMappingEntryKind {\n  /** Copy (and coerce) one remote field into one local field. */\n  REMOTE_FIELD = 'remote-field',\n  /** Fill one local field with a declared constant (destination-required fields with no remote source). */\n  CONSTANT = 'constant',\n}\n\n/**\n * Built-in, closed coercion vocabulary for REMOTE_FIELD entries (v3.1 §3 / PR-8). Slice 1 ships\n * exactly the coercions the two generic dialects force; arbitrary transforms are the recorded\n * widenings (W-FK resolution, W-AGENT authored transforms) — never an open function slot here.\n */\nexport enum ExternalDataFieldCoercion {\n  /** Value lands as extracted (after the destination schema's own Zod parse). */\n  NONE = 'none',\n  /**\n   * Odoo spells an ABSENT value as boolean `false` — a mapped string field would otherwise store\n   * literal `false`. Applied by DEFAULT for ODOO_JSONRPC sources; declaring it on another dialect\n   * is refused (the name is Odoo's semantics, not a generic null-coalesce).\n   */\n  ODOO_FALSE_AS_NULL = 'odoo-false-as-null',\n  /** Parse a strict-ISO datetime string into a Date for a date-typed local field. */\n  ISO_STRING_TO_DATE = 'iso-string-to-date',\n}\n\n/** One declared T-step: remote field → local field with a built-in coercion, or a constant. */\nexport const ExternalDataFieldMappingEntrySchema = z.discriminatedUnion('kind', [\n  z.object({\n    kind: z.literal(ExternalDataMappingEntryKind.REMOTE_FIELD),\n    remoteField: z.string().trim().min(1),\n    localField: z.string().trim().min(1),\n    coercion: z.enum(ExternalDataFieldCoercion).default(ExternalDataFieldCoercion.NONE),\n    /**\n     * `true`: a row whose extracted value is ABSENT is REJECTED (reported per row in the run\n     * ledger; its previous local version survives). `false` (default): absent lands as null,\n     * which the declaration coherence requires the local field to accept.\n     */\n    required: z.boolean().default(false),\n  }),\n  z.object({\n    kind: z.literal(ExternalDataMappingEntryKind.CONSTANT),\n    localField: z.string().trim().min(1),\n    constant: z.union([z.string(), z.number(), z.boolean()]),\n  }),\n]);\n\n/** @wildo_source:part:end saas.models.external-data-pipeline */\nexport type ExternalDataFieldMappingEntry = z.infer<typeof ExternalDataFieldMappingEntrySchema>;\n\n/** Scalar values admissible in the declared source filter (T-set equality conjunctions only). */\nconst externalDataPipelineFilterScalarSchema = z.union([z.string(), z.number(), z.boolean()]);\n\n/**\n * The inbound pipeline declaration an ordinary LOCAL resource carries as `externalDataPipeline`.\n *\n * NOT legal on an HTTP_API-adapter resource (a virtual resource IS the remote side); the\n * resource-configuration factory enforces that plus every mainSchema-dependent coherence rule —\n * see `validateExternalDataPipelineDeclarationAgainstSchema` there. This module owns only the\n * schema-independent shape and coherence.\n */\n/** @wildo_source:part:start saas.models.external-data-pipeline facet:layer:shared facet:audience:app-developer */\nexport const ExternalDataPipelineDeclarationSchema = z.object({\n  direction: z.enum(ExternalDataPipelineDirection).default(ExternalDataPipelineDirection.INBOUND),\n\n  /**\n   * The source half — the SAME binding declaration the VIRTUAL mode uses (the system of record it\n   * reads, entity, dialect, key fields + codecs, remote-call semantics, erasure stance).\n   *\n   * Every source is a SYSTEM OF RECORD: a deployment the OPERATOR runs, read with the application's\n   * own service identity, with ONE owner organization. There is no per-tenant variant to confine\n   * (that was `tenancy`, removed in #1055 — a customer's own connected account is a CONNECTOR, a\n   * different thing that no binding names), so a pipeline extracts the operator's rows and the\n   * destination's own scope declaration decides who may then read them.\n   *\n   * ⚠ OPERATIONAL HAZARD (PR-16): changing `keyFields` or a component CODEC after rows exist\n   * re-keys EVERY business key — the whole destination population orphans and re-creates on the\n   * next full pass, detaching local annotations (extension fields, files, chunks) from the rows\n   * that replace them. Treat a key/codec change as a MIGRATION EVENT, never a config tweak. Not\n   * mechanically detectable at authoring (no row access here). Relatedly: a remote system that\n   * RECYCLES ids hands the recycled row the OLD row's local annotations — the upsert cannot tell\n   * a revived entity from a new one wearing its key.\n   */\n  binding: HttpApiResourceBindingSchema,\n\n  /**\n   * The LOCAL field holding the row's remote identity — the synthesized id (paper A codec) as a\n   * plain STRING business key. The factory requires it declared `.isBusinessKey()` +\n   * `excludeFromCreate/Update`: SYNC's idempotent upsert keys on it, and no caller may mint or\n   * move it.\n   */\n  remoteKeyLocalField: z.string().trim().min(1),\n\n  /**\n   * Where a row's remote PARTITION lands, when the source instance is partitioned (#1058 E4).\n   *\n   * Declared TOGETHER or not at all, and only for a partitioned source. The resources registry —\n   * which is the first place the pipeline declaration and the systems-of-record registry are both\n   * in scope — refuses a partitioned source that declares neither, and refuses either field on an\n   * unpartitioned one.\n   *\n   * ## Why TWO fields rather than one\n   *\n   * They hold different things, and collapsing them is the mistake #1058 R5 was written to record.\n   *\n   * `partitionUnitLocalField` carries the Wildo ORGANIZATION UNIT that owns the row's partition. It\n   * is what organization-unit narrowing filters on, so it is what confines a member of one\n   * subsidiary to their own company's rows. Declare the destination narrowable on this field.\n   *\n   * `partitionKeyLocalField` carries the REMOTE key verbatim — Odoo's `company_id`, NetSuite's\n   * `subsidiary`. It exists because the unit id CANNOT answer the question the orphan walk asks.\n   * When an operator unassigns a partition, the unit still exists and other rows still point at it;\n   * only the partition→unit edge is gone. A row loaded before the unassignment therefore still\n   * carries a perfectly valid unit id, and nothing about it says \"this row's partition is no longer\n   * mapped\". Without the remote key stored per row, the next pass sees those rows absent from the\n   * extraction and an orphan policy of DELETE erases them — an operator's unassignment becoming a\n   * mass delete.\n   *\n   * Both are ENGINE-WRITTEN: the transform stamps them from the assignment map, so a mapping entry\n   * targeting either is refused, as is a caller write (the factory requires both\n   * `.excludeFromCreate()` and `.excludeFromUpdate()`).\n   *\n   * Both must ACCEPT ABSENCE. A row whose partition field is unset is SHARED (E2 — an Odoo product\n   * belonging to no company); it belongs to every caller and to no unit, and both fields land null.\n   */\n  partitionUnitLocalField: z.string().trim().min(1).optional(),\n  partitionKeyLocalField: z.string().trim().min(1).optional(),\n\n  /** The declared T — at least one entry; targets validated against `mainSchema` by the factory. */\n  mapping: z.array(ExternalDataFieldMappingEntrySchema).min(1),\n\n  /**\n   * Optional remote-side subset (v3.1 §2): equality conjunctions over REMOTE fields, exactly the\n   * T-set's T3 shape — anything richer is a widening, not an improvisation.\n   */\n  sourceFilter: z.record(z.string().trim().min(1), externalDataPipelineFilterScalarSchema).optional(),\n\n  population: z.enum(ExternalDataDestinationPopulation).default(ExternalDataDestinationPopulation.CLOSED),\n\n  orphanPolicy: z.enum(ExternalDataOrphanPolicy).default(ExternalDataOrphanPolicy.REPORT),\n\n  /**\n   * Cron expression for the scheduled refresh (crontabs machinery). Absent = on-demand only —\n   * legal, and honest for a manually-driven backfill.\n   */\n  scheduleCron: z.string().trim().min(1).optional(),\n\n  /**\n   * Extraction bound per run (v3.1 §2): a big backfill progresses across runs via the ledger's\n   * resumable cursor instead of owning one unbounded run. The default matches the rate-budget\n   * era's \"bounded by construction\" posture.\n   */\n  maxRowsPerRun: z.number().int().positive().default(10_000),\n});\n\n/** @wildo_source:part:end saas.models.external-data-pipeline */\nexport type ExternalDataPipelineDeclaration = z.infer<typeof ExternalDataPipelineDeclarationSchema>;\n\n/**\n * What an APPLICATION AUTHOR writes — the schema's INPUT shape, so every field carrying a\n * `.default()` is optional to type. Consumers read the parsed shape above, where those same fields\n * are guaranteed present.\n *\n * The distinction is not cosmetic, and the first dogfood proved it: typing the resource-config\n * field with the PARSED shape forced an author to spell out a `coercion` + `required` on every\n * mapping entry, and the two binding defaults that existed at the time (`verifyMetadataAtBoot` and\n * `connection`, both since removed by #1055) — values the schema exists to supply. `DataSeedDefinitionAuthored` records the identical lesson for seeds (\"authors may omit\n * this field and the dispatcher still reads a guaranteed `string[]`\"); this is the same split, and\n * it was missed here because nothing had authored a pipeline by hand yet.\n */\nexport type ExternalDataPipelineDeclarationAuthored = z.input<typeof ExternalDataPipelineDeclarationSchema>;\n\n/**\n * Schema-INDEPENDENT coherence of a parsed declaration — the mainSchema-dependent half lives in\n * the resource-configuration factory (it needs the shape). Throws with the offending path named,\n * mirroring `assertHttpApiBindingDialectCoherence`'s contract.\n */\nexport function assertExternalDataPipelineDeclarationCoherence(declaration: ExternalDataPipelineDeclaration): void {\n  /*\n   * The S1 tenancy confinement was REMOVED here with `tenancy` itself (#1055).\n   *\n   * It refused any source that was not `SINGLE_TENANT_BINDING`, because a pushdown-tenancy source\n   * would have needed a declared remote-scope→organization mapping and a wrong assignment is a\n   * cross-tenant leak. That reasoning is intact; what changed is that the state it refused can no\n   * longer be declared. A pipeline's source is a system of record, a system of record has one owner\n   * organization, and the rows a LOAD writes are stamped with it (#868) rather than mapped from a\n   * remote scope field.\n   */\n\n  // D-P10: extraction uses drift-safe paging ONLY (`@odata.nextLink` / the Odoo id-keyset\n  // cursor). REST_JSON declares offset paging, which skips or doubles rows whenever the remote\n  // set shifts mid-run — so a REST_JSON pipeline SOURCE is refused until a declared cursor\n  // contract exists for the dialect (a recorded widening beside W-DELTA, not an improvisation).\n  if (declaration.binding.dialect === HttpApiTransportDialect.REST_JSON) {\n    throw new Error(\n      'binding.dialect: REST_JSON pipeline sources are refused in slice 1 — the dialect declares offset paging, which drifts under concurrent remote change (rows skipped or doubled). ODATA (@odata.nextLink) and ODOO_JSONRPC (id cursor) sources are drift-safe; a declared REST cursor contract is the recorded widening.',\n    );\n  }\n\n  const localTargets = new Set<string>();\n  for (const entry of declaration.mapping) {\n    if (localTargets.has(entry.localField)) {\n      throw new Error(`mapping: local field '${entry.localField}' is targeted by more than one entry — one writer per field.`);\n    }\n    localTargets.add(entry.localField);\n\n    if (entry.localField === declaration.remoteKeyLocalField) {\n      throw new Error(\n        `mapping: local field '${entry.localField}' is the remoteKeyLocalField — the remote identity is written by the pipeline's L from the synthesized id, never by a mapping entry.`,\n      );\n    }\n\n    /*\n     * Same rule, one field over (#1058 E4): both partition fields are ENGINE-written, stamped by the\n     * transform from the assignment map. A mapping entry targeting one would be the second writer of\n     * a field whose value decides who may see the row — and, because the stamp runs after the\n     * mapping, an INERT one. An authoring mistake that silently does nothing is worse than one that\n     * fails: the author reads a declaration that looks like it decides the unit, and no run ever\n     * disagrees with them.\n     */\n    for (const [label, partitionField] of [\n      ['partitionUnitLocalField', declaration.partitionUnitLocalField],\n      ['partitionKeyLocalField', declaration.partitionKeyLocalField],\n    ] as const) {\n      if (partitionField !== undefined && entry.localField === partitionField) {\n        throw new Error(\n          `mapping: local field '${entry.localField}' is the ${label} — the partition stamp is written by the pipeline's T from the assignment map, never by a mapping entry.`,\n        );\n      }\n    }\n\n    if (\n      entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD\n      && entry.coercion === ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL\n      && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC\n    ) {\n      throw new Error(\n        `mapping('${entry.localField}').coercion: '${ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL}' names Odoo's absent-as-false semantics and is refused on a ${declaration.binding.dialect} source.`,\n      );\n    }\n  }\n\n  /*\n   * TOGETHER or not at all (#1058 E4).\n   *\n   * Declaring only the unit field loses the orphan walk's protection — a row whose partition is\n   * later unassigned still carries a valid unit id, nothing says the edge is gone, and a DELETE\n   * orphan policy erases it. Declaring only the key field loses the confinement: the rows carry\n   * their remote partition and no unit, so narrowing has nothing to filter on and every member of\n   * the owner organization reads every subsidiary's rows. Neither half is useful alone, and both\n   * failures are silent.\n   */\n  const declaredPartitionFields = [\n    ['partitionUnitLocalField', declaration.partitionUnitLocalField] as const,\n    ['partitionKeyLocalField', declaration.partitionKeyLocalField] as const,\n  ].filter(([, value]) => value !== undefined);\n  if (declaredPartitionFields.length === 1) {\n    const [declaredLabel] = declaredPartitionFields[0]!;\n    const missingLabel = declaredLabel === 'partitionUnitLocalField' ? 'partitionKeyLocalField' : 'partitionUnitLocalField';\n    throw new Error(\n      `${declaredLabel} is declared without ${missingLabel} — the two partition fields answer different questions and neither is useful alone. `\n      + 'The unit is what narrowing confines a caller by; the remote key is what keeps an unassigned partition out of the orphan comparison, '\n      + 'because after an unassignment the unit id still resolves and says nothing.',\n    );\n  }\n  if (\n    declaration.partitionUnitLocalField !== undefined\n    && declaration.partitionUnitLocalField === declaration.partitionKeyLocalField\n  ) {\n    throw new Error(\n      'partitionUnitLocalField and partitionKeyLocalField name the same field — one would overwrite the other, and which survived would decide either who sees the row or whether it is deleted.',\n    );\n  }\n  for (const [label, partitionField] of [\n    ['partitionUnitLocalField', declaration.partitionUnitLocalField],\n    ['partitionKeyLocalField', declaration.partitionKeyLocalField],\n  ] as const) {\n    if (partitionField !== undefined && partitionField === declaration.remoteKeyLocalField) {\n      throw new Error(\n        `${label} names the remoteKeyLocalField — the row's IDENTITY and its PARTITION are different facts, and sharing a field would make the business key change when a row moves company.`,\n      );\n    }\n  }\n}\n"]}
+{"version":3,"file":"external-data-pipeline.shared.schemas.js","sourceRoot":"","sources":["../../../../src/external-data/external-data-pipeline.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,qDAAqD,CAAC;AAClJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AAEvF;;;;;;GAMG;AACH,kHAAkH;AAClH,MAAM,CAAN,IAAY,6BA4BX;AA5BD,WAAY,6BAA6B;IACvC;;;OAGG;IACH,oDAAmB,CAAA;IACnB;;;;;;;;;OASG;IACH,sDAAqB,CAAA;IACrB;;;;;;;;;OASG;IACH,gEAA+B,CAAA;AACjC,CAAC,EA5BW,6BAA6B,KAA7B,6BAA6B,QA4BxC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,sBAOX;AAPD,WAAY,sBAAsB;IAChC,8GAA8G;IAC9G,2CAAiB,CAAA;IACjB,iEAAiE;IACjE,yCAAe,CAAA;IACf,iHAAiH;IACjH,uCAAa,CAAA;AACf,CAAC,EAPW,sBAAsB,KAAtB,sBAAsB,QAOjC;AAGD;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,iCAcX;AAdD,WAAY,iCAAiC;IAC3C;;;;OAIG;IACH,sDAAiB,CAAA;IACjB;;;;;OAKG;IACH,kDAAa,CAAA;AACf,CAAC,EAdW,iCAAiC,KAAjC,iCAAiC,QAc5C;AAED;;;;;;;;;GASG;AACH,MAAM,CAAN,IAAY,wBAOX;AAPD,WAAY,wBAAwB;IAClC,uGAAuG;IACvG,6CAAiB,CAAA;IACjB,mGAAmG;IACnG,mDAAuB,CAAA;IACvB,uFAAuF;IACvF,6CAAiB,CAAA;AACnB,CAAC,EAPW,wBAAwB,KAAxB,wBAAwB,QAOnC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,4BAiCX;AAjCD,WAAY,4BAA4B;IACtC,+DAA+D;IAC/D,6DAA6B,CAAA;IAC7B,yGAAyG;IACzG,qDAAqB,CAAA;IACrB;;;;;OAKG;IACH,qEAAqC,CAAA;IACrC;;;;OAIG;IACH,qDAAqB,CAAA;IACrB;;;OAGG;IACH,+DAA+B,CAAA;IAC/B;;;OAGG;IACH,yDAAyB,CAAA;IACzB;;;OAGG;IACH,2DAA2B,CAAA;AAC7B,CAAC,EAjCW,4BAA4B,KAA5B,4BAA4B,QAiCvC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAA8C,IAAI,GAAG,CAAC;IAC3G,4BAA4B,CAAC,YAAY;IACzC,4BAA4B,CAAC,gBAAgB;CAC9C,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAkC,IAAI,GAAG,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AAE7I;;GAEG;AACH,MAAM,CAAN,IAAY,+BAQX;AARD,WAAY,+BAA+B;IACzC;;;OAGG;IACH,4DAAyB,CAAA;IACzB,sHAAsH;IACtH,8DAA2B,CAAA;AAC7B,CAAC,EARW,+BAA+B,KAA/B,+BAA+B,QAQ1C;AAED,4DAA4D;AAC5D,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,8EAA8E;IAC9E,kEAA6B,CAAA;IAC7B,yCAAyC;IACzC,wDAAmB,CAAA;AACrB,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED,6DAA6D;AAC7D,MAAM,CAAN,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAC5C,8EAA8E;IAC9E,2DAAqB,CAAA;IACrB,gFAAgF;IAChF,mEAA6B,CAAA;AAC/B,CAAC,EALW,kCAAkC,KAAlC,kCAAkC,QAK7C;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,qCAeX;AAfD,WAAY,qCAAqC;IAC/C;;;;;;;OAOG;IACH,wEAA+B,CAAA;IAC/B;;;OAGG;IACH,0DAAiB,CAAA;AACnB,CAAC,EAfW,qCAAqC,KAArC,qCAAqC,QAehD;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,qCAsBX;AAtBD,WAAY,qCAAqC;IAC/C;;;;;OAKG;IACH,wEAA+B,CAAA;IAC/B;;;;;;;;;;;;OAYG;IACH,kEAAyB,CAAA;AAC3B,CAAC,EAtBW,qCAAqC,KAArC,qCAAqC,QAsBhD;AAED;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,yBAWX;AAXD,WAAY,yBAAyB;IACnC,+EAA+E;IAC/E,0CAAa,CAAA;IACb;;;;OAIG;IACH,sEAAyC,CAAA;IACzC,mFAAmF;IACnF,sEAAyC,CAAA;AAC3C,CAAC,EAXW,yBAAyB,KAAzB,yBAAyB,QAWpC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAN,IAAY,mCAeX;AAfD,WAAY,mCAAmC;IAC7C;;;;OAIG;IACH,oDAAa,CAAA;IACb;;;;;;OAMG;IACH,8EAAuC,CAAA;AACzC,CAAC,EAfW,mCAAmC,KAAnC,mCAAmC,QAe9C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,gBAAgB,CAAC;IAC9D,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,wEAAwE;IACxE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,mGAAmG;IACnG,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE;IACpE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,aAAa,CAAC;IACtH;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD,6FAA6F;IAC7F,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAEnG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,QAAQ,CAAC;IACtD,2EAA2E;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,+FAA+F;IAC/F,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QAC7B,WAAW,EAAE,kCAAkC;QAC/C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;KAC9D,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACV,uEAAuE;IACvE,QAAQ,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;QACvC,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,UAAU,CAAC,EAAE,CAAC;QACjF,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;KAClJ,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,+BAA+B,CAAC,UAAU,EAAE,CAAC;IAClE,oGAAoG;IACpG,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACrC,CAAC,CAAC;AAIH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,+DAA+D;IAC/D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC1C,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3G,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACV,0EAA0E;IAC1E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACrC,CAAC,CAAC;AAIH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,YAAY,CAAC;IACrE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,UAAU,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,qEAAqE;IACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,sCAAsC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,0EAA0E;IAC1E,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACrC,CAAC,CAAC;AAIH,qEAAqE;AACrE,MAAM,oCAAoC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACxE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,kCAAkC,EAAE,CAAC;IAC9H,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,YAAY,CAAC;QAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,iHAAiH;QACjH,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC;KACpF,CAAC;CACH,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,WAAW,CAAC;IACzD,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,IAAI,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjI,SAAS,EAAE,oCAAoC;CAChD,CAAC,CAAC;AAIH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,YAAY,CAAC;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,CAAC;QACnF;;;;WAIG;QACH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACpC,yFAAyF;QACzF,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE;KACjD,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,QAAQ,CAAC;QACtD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;KACzD,CAAC;IACF,6CAA6C;IAC7C,kCAAkC;IAClC,2CAA2C;IAC3C,wCAAwC;IACxC,yCAAyC;CAC1C,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,qCAqBX;AArBD,WAAY,qCAAqC;IAC/C;;;;OAIG;IACH,4EAAmC,CAAA;IACnC;;;;;OAKG;IACH,gFAAuC,CAAA;IACvC;;;;;OAKG;IACH,8EAAqC,CAAA;AACvC,CAAC,EArBW,qCAAqC,KAArC,qCAAqC,QAqBhD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC7F,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,eAAe,CAAC;QACtE;;;;WAIG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,oGAAoG;QACpG,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACzE,CAAC;IACF;;;;;;;;;;;;;OAaG;IACH,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,iBAAiB,CAAC;QACxE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,oFAAoF;QACpF,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACzE,CAAC;IACF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,gBAAgB,CAAC;QACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACvC,CAAC;CACH,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAqF;IACtI,CAAC,qCAAqC,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC,YAAY;IAC7F,CAAC,qCAAqC,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC,KAAK;IACxF,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC,KAAK;CACxF,CAAC;AAKF;;;;;;;GAOG;AACH,MAAM,UAAU,wCAAwC,CAAC,KAAoC;IAC3F,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,4BAA4B,CAAC,YAAY,CAAC;QAC/C,KAAK,4BAA4B,CAAC,gBAAgB,CAAC;QACnD,KAAK,4BAA4B,CAAC,QAAQ,CAAC;QAC3C,KAAK,4BAA4B,CAAC,UAAU;YAC1C,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7B,KAAK,4BAA4B,CAAC,QAAQ;YACxC,OAAO,EAAE,CAAC;QACZ,KAAK,4BAA4B,CAAC,aAAa;YAC7C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,iCAAiC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/I,KAAK,4BAA4B,CAAC,WAAW;YAC3C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;oBACjB,KAAK,CAAC,WAAW;oBACjB,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;yBACpE,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,kCAAkC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;iBACzH,CAAC,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,SAAS,GAAU,KAAK,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qEAAqE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,mCAAmC,CAAC,OAAiD;IACnG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,4GAA4G;AAC5G,SAAS,mBAAmB,CAAC,KAAgC;IAC3D,OAAO,GAAG,OAAO,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4CAA4C,CAC1D,KAAkE,EAClE,OAAgC;IAEhC,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,UAAU,CAAC;IAC5D,OAAO,OAAO,KAAK,uBAAuB,CAAC,YAAY;QACrD,CAAC,CAAC,qCAAqC,CAAC,aAAa;QACrD,CAAC,CAAC,qCAAqC,CAAC,MAAM,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,mGAAmG;AACnG,MAAM,sCAAsC,GAAG,QAAQ,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IAC5F,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC5E,CAAC,CAAC,MAAM,CAAC;QACP,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,iBAAiB,CAAC;QAC3E,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC;KACjG,CAAC;CACH,CAAC,CAAC;AAIH,iGAAiG;AACjG,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAE9F;;;;;;;GAOG;AACH,kHAAkH;AAClH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D;;;;;;;;;OASG;IACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC;IAE/F;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,OAAO,EAAE,4BAA4B;IAErC;;;;;;;;;;;;OAYG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACH,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE3D,kGAAkG;IAClG,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5D;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAC,QAAQ,EAAE;IAEnG,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,MAAM,CAAC;IAEvG;;;;OAIG;IACH,eAAe,EAAE,4CAA4C,CAAC,QAAQ,EAAE;IAExE,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,MAAM,CAAC;IAEvF;;;;OAIG;IACH,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;IAE7D;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEjD;;;;;OAKG;IACH,WAAW,EAAE,kDAAkD,CAAC,QAAQ,EAAE;IAE1E;;;;;;;;;;;;;;;OAeG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAE1D;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;CAC/E,CAAC,CAAC;AAmBH;;;;GAIG;AACH,SAAS,0CAA0C,CAAC,KAAoC,EAAE,OAAgC;IACxH,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,UAAU,IAAI,CAAC;IAC5C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,4BAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,EAAE,WAAW,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC3C,MAAM,GAAG,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;gBAC7C,+GAA+G;gBAC/G,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,mDAAmD,CAAC,CAAC;gBACpJ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;YACD,OAAO;QACT,CAAC;QACD,KAAK,4BAA4B,CAAC,aAAa;YAC7C,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,iCAAiC,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9F,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,sGAAsG,CAAC,CAAC;YAC/H,CAAC;YACD,OAAO;QACT,KAAK,4BAA4B,CAAC,UAAU;YAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,yGAAyG,CAAC,CAAC;YAClI,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAClF,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,mGAAmG,CAAC,CAAC;YAC5H,CAAC;YACD,OAAO;QACT,KAAK,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;gBACxC,uGAAuG;gBACvG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,qBAAqB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,+DAA+D,CAAC,CAAC;gBACpJ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3F,IACE,OAAO,CAAC,IAAI,KAAK,kCAAkC,CAAC,YAAY;uBAC7D,OAAO,CAAC,QAAQ,KAAK,yBAAyB,CAAC,kBAAkB;uBACjE,OAAO,KAAK,uBAAuB,CAAC,YAAY,EACnD,CAAC;oBACD,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,0BAA0B,yBAAyB,CAAC,kBAAkB,6CAA6C,OAAO,UAAU,CAC1I,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO;QACT,CAAC;QACD;YACE,OAAO;IACX,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8CAA8C,CAAC,WAA4C;IACzG,IAAI,WAAW,CAAC,SAAS,KAAK,6BAA6B,CAAC,QAAQ,EAAE,CAAC;QACrE,2CAA2C,CAAC,WAAW,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IACD,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,KAAK,6BAA6B,CAAC,aAAa,CAAC;IAC5F,IAAI,aAAa,EAAE,CAAC;QAClB,iGAAiG;QACjG,+CAA+C,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,IAAI,WAAW,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,+IAA+I,CAAC,CAAC;QACnK,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QACjG,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,YAAY,KAAK,CAAC,UAAU,4GAA4G;kBACtI,SAAS,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,mDAAmD,CAClG,CAAC;QACJ,CAAC;IACH,CAAC;IACD;;;;OAIG;IACH,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,0BAA0B,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,2DAA2D;cAC/H,2HAA2H;cAC3H,gFAAgF,CACnF,CAAC;IACJ,CAAC;IACD;;;;;;;;;OASG;IAEH;;;;;;;;;;OAUG;IACH,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7I,MAAM,IAAI,KAAK,CACb,yIAAyI;cACvI,8HAA8H;cAC9H,6HAA6H;cAC7H,qEAAqE,CACxE,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,8FAA8F;IAC9F,gFAAgF;IAChF,IACE,WAAW,CAAC,eAAe,KAAK,SAAS;WACtC,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EACvE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kCAAkC,WAAW,CAAC,OAAO,CAAC,OAAO,6JAA6J,CAC3N,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,eAAe,GAAG,sCAAsC,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7F,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,sBAAsB,WAAW,CAAC,WAAW,CAAC,IAAI,oBAAoB,eAAe,iCAAiC;kBACpH,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,+CAA+C,qCAAqC,CAAC,iBAAiB,OAAO;kBAC3I,IAAI,qCAAqC,CAAC,gBAAgB,uFAAuF,CACpJ,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,WAAW,CAAC,IAAI,KAAK,qCAAqC,CAAC,gBAAgB,EAAE,CAAC;YAC5F,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,sBAAsB,qCAAqC,CAAC,gBAAgB,8DAA8D;sBACxI,iFAAiF;sBACjF,IAAI,qCAAqC,CAAC,iBAAiB,mBAAmB,CACjF,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,sBAAsB,qCAAqC,CAAC,gBAAgB,8DAA8D;sBACxI,oCAAoC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,qCAAqC,CAChH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,sHAAsH;kBACpH,oHAAoH,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,UAAU,8DAA8D,CAAC,CAAC;QAC3H,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEnC,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,CAAC,UAAU,sIAAsI,CAChL,CAAC;QACJ,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI;YACpC,CAAC,yBAAyB,EAAE,WAAW,CAAC,uBAAuB,CAAC;YAChE,CAAC,wBAAwB,EAAE,WAAW,CAAC,sBAAsB,CAAC;SACtD,EAAE,CAAC;YACX,IAAI,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,CAAC,UAAU,YAAY,KAAK,0GAA0G,CACrK,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IACE,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,YAAY;eACrD,KAAK,CAAC,QAAQ,KAAK,yBAAyB,CAAC,kBAAkB;eAC/D,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EACvE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,YAAY,KAAK,CAAC,UAAU,iBAAiB,yBAAyB,CAAC,kBAAkB,gEAAgE,WAAW,CAAC,OAAO,CAAC,OAAO,UAAU,CAC/L,CAAC;QACJ,CAAC;QAED,0CAA0C,CAAC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE/E,0GAA0G;QAC1G,+EAA+E;QAC/E,IACE,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,gBAAgB;eACzD,KAAK,CAAC,UAAU,KAAK,qCAAqC,CAAC,aAAa;eACxE,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EACvE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,YAAY,KAAK,CAAC,UAAU,mBAAmB,qCAAqC,CAAC,aAAa,iDAAiD,WAAW,CAAC,OAAO,CAAC,OAAO,sBAAsB,qCAAqC,CAAC,MAAM,IAAI,CACrP,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,uBAAuB,GAAG;QAC9B,CAAC,yBAAyB,EAAE,WAAW,CAAC,uBAAuB,CAAU;QACzE,CAAC,wBAAwB,EAAE,WAAW,CAAC,sBAAsB,CAAU;KACxE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC7C,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,aAAa,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAE,CAAC;QACpD,MAAM,YAAY,GAAG,aAAa,KAAK,yBAAyB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACxH,MAAM,IAAI,KAAK,CACb,GAAG,aAAa,wBAAwB,YAAY,sFAAsF;cACxI,sIAAsI;cACtI,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD,IACE,WAAW,CAAC,uBAAuB,KAAK,SAAS;WAC9C,WAAW,CAAC,uBAAuB,KAAK,WAAW,CAAC,sBAAsB,EAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,2LAA2L,CAC5L,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI;QACpC,CAAC,yBAAyB,EAAE,WAAW,CAAC,uBAAuB,CAAC;QAChE,CAAC,wBAAwB,EAAE,WAAW,CAAC,sBAAsB,CAAC;KACtD,EAAE,CAAC;QACX,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6KAA6K,CACtL,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,6BAA6B,CAAC,KAAyD;IACrG,OAAO,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC;AACrG,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,iCAAiC,CAAC,WAAoE;IACpH,OAAO,WAAW,CAAC,cAAc,IAAI,0BAA0B,CAAC,iBAAiB,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAwC,EAAE,KAAyD;IAC3I,IAAI,SAAS,KAAK,6BAA6B,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACvE,IAAI,SAAS,KAAK,6BAA6B,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,6BAA6B,CAAC,KAAK,CAAC,KAAK,sBAAsB,CAAC,KAAK,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAwC,EAAE,KAAyD;IACzI,IAAI,SAAS,KAAK,6BAA6B,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,SAAS,KAAK,6BAA6B,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,6BAA6B,CAAC,KAAK,CAAC,KAAK,sBAAsB,CAAC,MAAM,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,+CAA+C,CAAC,WAA4C;IACnG,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,0IAA0I;cACxI,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kCAAkC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,0BAA0B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,wFAAwF;cACvI,mFAAmF,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,KAAK,iCAAiC,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpH,MAAM,IAAI,KAAK,CACb,uIAAuI;cACrI,8DAA8D,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,KAAK,2BAA2B,CAAC,eAAe,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CACb,8BAA8B,2BAA2B,CAAC,eAAe,sEAAsE;cAC7I,gIAAgI;cAChI,uCAAuC,2BAA2B,CAAC,gBAAgB,qEAAqE,CAC3J,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,eAAe,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CACb,qBAAqB,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,iFAAiF;cACtI,0DAA0D,oBAAoB,CAAC,eAAe,8CAA8C,CAC/I,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1G,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,yIAAyI;cACvI,qBAAqB,CACxB,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,UAAU,IAAI,CAAC;QAC5C,MAAM,KAAK,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,0CAA0C,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,QAAQ,KAAK,CAAC,IAAI,8FAA8F,CAAC,CAAC;QACzI,CAAC;QACD,IAAI,KAAK,KAAK,sBAAsB,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,YAAY,EAAE,CAAC;YACvG,IAAI,KAAK,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,kHAAkH,CAAC,CAAC;YAC7J,IAAI,KAAK,CAAC,QAAQ,KAAK,yBAAyB,CAAC,IAAI,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,iGAAiG,CAAC,CAAC;YAC1H,CAAC;QACH,CAAC;QACD,IAAI,KAAK,KAAK,sBAAsB,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,gBAAgB;eACrG,KAAK,CAAC,UAAU,KAAK,qCAAqC,CAAC,aAAa,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,4FAA4F,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,WAAW,CAAC,uBAAuB,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,uBAAuB,EAAE,CAAC;YAClH,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,UAAU,0FAA0F,CAAC,CAAC;QACzI,CAAC;QACD,IAAI,WAAW,CAAC,sBAAsB,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,sBAAsB,EAAE,CAAC;YAChH,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,UAAU,wFAAwF,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,2CAA2C,CAAC,WAA4C;IAC/F,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,gIAAgI;cAC9H,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,4GAA4G;IAC5G,iGAAiG;IACjG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,qIAAqI;cACnI,8DAA8D,CACjE,CAAC;IACJ,CAAC;IACD;;;;;OAKG;IACH,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,eAAe,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CACb,qBAAqB,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,iFAAiF;cACtI,2EAA2E,oBAAoB,CAAC,eAAe,2BAA2B;cAC1I,qBAAqB,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kCAAkC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,0BAA0B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,kFAAkF;cACjI,kIAAkI;cAClI,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IACD;;;;OAIG;IACH,IAAI,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,KAAK,2BAA2B,CAAC,eAAe,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CACb,8BAA8B,2BAA2B,CAAC,eAAe,2DAA2D;cAClI,gGAAgG,2BAA2B,CAAC,gBAAgB,KAAK;cACjJ,mHAAmH,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAA6B;QAC5C,CAAC,cAAc,EAAE,WAAW,CAAC,YAAY,CAAC;QAC1C,CAAC,aAAa,EAAE,WAAW,CAAC,WAAW,CAAC;QACxC,CAAC,iBAAiB,EAAE,WAAW,CAAC,eAAe,CAAC;QAChD,CAAC,wBAAwB,EAAE,WAAW,CAAC,sBAAsB,CAAC;KAC/D,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,iHAAiH;kBACvH,CAAC,KAAK,KAAK,wBAAwB;oBACnC,CAAC,CAAC,4HAA4H;oBAC9H,CAAC,CAAC,EAAE,CAAC,CACR,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,UAAU,IAAI,CAAC;QAC5C,IAAI,CAAC,0CAA0C,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,QAAQ,KAAK,CAAC,IAAI,yGAAyG;kBAC9H,gBAAgB,4BAA4B,CAAC,YAAY,gDAAgD;kBACzG,IAAI,4BAA4B,CAAC,gBAAgB,0DAA0D,CAC9G,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,UAAU,sEAAsE,CAAC,CAAC;QACnI,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,MAAM,KAAK,CAAC,UAAU,wFAAwF,CAAC,CAAC;QACvI,CAAC;QACD,IAAI,WAAW,CAAC,uBAAuB,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,WAAW,CAAC,uBAAuB,EAAE,CAAC;YAClH,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,MAAM,KAAK,CAAC,UAAU,2GAA2G;kBACpI,wBAAwB,CAC3B,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,2HAA2H;kBAC9H,iHAAiH,CACpH,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,KAAK,yBAAyB,CAAC,IAAI,EAAE,CAAC;YAClH,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,eAAe,KAAK,CAAC,QAAQ,6FAA6F;kBAC7H,2GAA2G,CAC9G,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,gBAAgB,EAAE,CAAC;YACjE,IAAI,KAAK,CAAC,UAAU,KAAK,qCAAqC,CAAC,aAAa,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,iBAAiB,KAAK,CAAC,UAAU,2FAA2F;sBAC/H,gHAAgH,CACnH,CAAC;YACJ,CAAC;YACD;;;;;;;eAOG;YACH,IACE,KAAK,CAAC,UAAU,KAAK,qCAAqC,CAAC,aAAa;mBACrE,WAAW,CAAC,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EACvE,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,iBAAiB,qCAAqC,CAAC,aAAa,4CAA4C,WAAW,CAAC,OAAO,CAAC,OAAO,sBAAsB,qCAAqC,CAAC,MAAM,IAAI,CACvN,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * The ETL PIPELINE declaration (`externalDataPipeline`) — partial-resource coverage, model v3\n * (`.claude/plans/etl-partial-resource-coverage.md`, PR-3/PR-19; decisions D-P1…D-P10).\n *\n * \"Some resources local, some remote, ETL between them\": an ordinary LOCAL resource may declare\n * ONE inbound pipeline from a remote HTTP-API entity. The declaration reuses the whole\n * {@link HttpApiResourceBindingSchema} as its source half (provider, entity, dialect, key\n * fields, remote-call semantics — the E is the same adapter plumbing the VIRTUAL mode runs on),\n * adds the T (a declared field mapping) and the L/refresh contract (population posture, orphan\n * policy, schedule, run bounds). The destination stays a FULL local resource — files, RAG,\n * retention/erasure, charts and the read-only UI chain are all inherited, never re-built.\n *\n * Everything here is a CLOSED vocabulary with one named source; the runtime seams (P-2) consume\n * these members, and the paper's ledger rows (PR-…) are cited per surface.\n */\n\nimport { z } from 'zod';\n\nimport { HttpApiResourceBindingSchema, HttpApiWriteConcurrencyMode, HttpApiWriteVerb } from '../http-api-binding/http-api-binding.shared.schemas';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\nimport { HttpApiErasureStance } from '../http-api-binding/http-api-erasure-stance.shared';\nimport { ExternalDataConflictPolicy } from './external-data-pipeline-pass-mode.shared';\n\n/**\n * Pipeline direction (PR-19). Declared per pipeline; `INBOUND` when omitted.\n *\n * The vocabulary was single-member until the write path (#1679) existed, so reverse ETL arrived as a new member\n * rather than a schema reshape. Keeping one row correct when BOTH sides change it is a third member, with its own\n * conflict policy (#1723) — neither of these two decides a conflict.\n */\n/** @wildo_source:part:start saas.models.external-data-pipeline facet:layer:shared facet:audience:app-developer */\nexport enum ExternalDataPipelineDirection {\n  /**\n   * The system of record is the source: a pass reads its rows and loads them into the destination. The mapped fields\n   * are remote-authoritative, so callers may not write them.\n   */\n  INBOUND = 'inbound',\n  /**\n   * The destination is the source (#1690): a row created or changed locally is sent to the system of record on the\n   * next pass — created there when it has no remote key yet, updated when it has one. The mapped fields are the\n   * application's own, so callers write them; the remote key is written by the engine, once, from the create's answer.\n   *\n   * Only rows of the organization that owns the application are ever sent (a system of record belongs to it alone),\n   * and on a partitioned instance only rows whose organization unit is assigned to a partition. A local DELETE is not\n   * sent: a system of record keeps its own records, and removing one is its operator's decision, not a side effect of\n   * a local edit.\n   */\n  OUTBOUND = 'outbound',\n  /**\n   * Both sides change the row (#1723): a pass LOADS what the system of record changed and SENDS what the application\n   * changed, field by field, as each mapping entry's `owner` declares — REMOTE fields are loaded and read-only locally,\n   * LOCAL fields are sent and never loaded, BOTH fields are loaded AND sent. A row whose BOTH fields changed on both\n   * sides since they last agreed is a CONFLICT, decided by the declared `conflictPolicy`.\n   *\n   * \"Since they last agreed\" is the system of record's own row version (Odoo `write_date`, an OData entity tag), kept\n   * per row by the engine — so the direction is legal only on an instance whose vendor declares one. A local DELETE is\n   * not sent, as on OUTBOUND.\n   */\n  BIDIRECTIONAL = 'bidirectional',\n}\n\n/**\n * Which side OWNS a mapped field of a BIDIRECTIONAL pipeline (#1723). Declared on each `REMOTE_FIELD` / `REMOTE_REFERENCE`\n * entry as `owner`, and refused on any other direction (an INBOUND pipeline's fields are all the system of record's, an\n * OUTBOUND pipeline's all the application's).\n *\n * Only BOTH fields can conflict, which keeps the common case — remote master data plus a few locally-owned fields —\n * out of conflict handling entirely.\n */\nexport enum ExternalDataFieldOwner {\n  /** The system of record's: loaded, read-only for callers, never sent. The default when `owner` is omitted. */\n  REMOTE = 'remote',\n  /** The application's: written by callers, sent, never loaded. */\n  LOCAL = 'local',\n  /** Both sides': written by callers AND loaded, sent AND read back — the only kind of field that can conflict. */\n  BOTH = 'both',\n}\n\n\n/**\n * Who owns the destination's row population (D-P8, v3.1 §1).\n *\n * The declared answer to the question the orphan sweep MUST have: \"is a row the pipeline did not\n * create a USER row, or a VANISHED remote row?\" — undeclared mixed populations are how an orphan\n * pass deletes user data.\n */\nexport enum ExternalDataDestinationPopulation {\n  /**\n   * Every row comes from the pipeline. Caller CREATE is refused at declaration time, and orphan\n   * detection may consider the whole population. The default: safest, and the honest description\n   * of a synced master-data table.\n   */\n  CLOSED = 'closed',\n  /**\n   * Mixed rows: users may create rows the pipeline does not own. Pipeline rows are identified by\n   * the remote-key field being present, and orphan detection is CONFINED to that population. A\n   * user row that later matches an incoming remote key is ADOPTED by the upsert (documented\n   * collision semantics, not an accident).\n   */\n  OPEN = 'open',\n}\n\n/**\n * What happens to a destination row whose remote counterpart disappeared (D-P9).\n *\n * MIRRORS `DataSeedSyncOrphanPolicy` (saas-backend-lib, data-seeding) member-for-member, and the\n * P-2 pipeline→SYNC seam maps the two 1:1. A separate enum EXISTS ONLY because of dependency\n * direction: this declaration lives in saas-models, the data-seeding models live in\n * saas-backend-lib, and models cannot import backend. If the data-seeding vocabulary ever moves\n * down to saas-models, collapse this enum into it — do not let the two drift meanwhile (the\n * seam's mapping is exhaustive and compile-forced, so a new member on either side reddens P-2).\n */\nexport enum ExternalDataOrphanPolicy {\n  /** Hard-delete the orphan row — flows through ordinary lifecycle (cascades, file teardown). Opt-in. */\n  DELETE = 'delete',\n  /** Mark the row deprecated and keep it; a re-appearing remote key REVIVES it (v3.1 §4). Opt-in. */\n  DEPRECATE = 'deprecate',\n  /** Touch nothing; surface the diff in the run ledger. The DEFAULT — least surprise. */\n  REPORT = 'report',\n}\n\n/**\n * The shapes a mapping entry can take — a closed discriminator, never inferred from keys.\n *\n * ## The DECLARED EXPRESSIONS (#1685), and the open function slot they replace\n *\n * `ENUM_MAP`, `CONCATENATION`, `ARITHMETIC` and `CONDITIONAL` derive a local value from remote values. They are\n * the first of the T's recorded widenings (D-P4: computed transforms, then multi-source joins, then transforms\n * authored by the app-creation lane's agents) and they are DATA: every one names the remote fields it reads, the\n * local field it writes, and a closed operation with declared constants. Nothing in them executes code the\n * declaration does not show, so each is checked at startup against the destination schema (target type, enum\n * membership, absence) and requested by the extraction like any mapped field.\n *\n * An open function slot (`transform: (row) => value`) is refused on purpose: it would put arbitrary code inside the\n * load with no declaration anyone can review, validate or fingerprint. A derivation beyond these four stays a\n * pre-load step in the application's own code, run by its own job.\n */\nexport enum ExternalDataMappingEntryKind {\n  /** Copy (and coerce) one remote field into one local field. */\n  REMOTE_FIELD = 'remote-field',\n  /** Fill one local field with a declared constant (destination-required fields with no remote source). */\n  CONSTANT = 'constant',\n  /**\n   * Turn a remote REFERENCE into a real local foreign key (#1684) — an Odoo many2one (`parent_id`,\n   * `partner_id`), an OData navigation key. The remote value names a row of ANOTHER remote entity (or of\n   * the same one); the pipeline writes the local foreign key to that row's LOCAL copy, never the remote\n   * id. See {@link ExternalDataRemoteReferenceMappingEntrySchema}.\n   */\n  REMOTE_REFERENCE = 'remote-reference',\n  /**\n   * Map a remote CODE onto a member of a local enum (#1685) — an Odoo selection (`draft`/`posted`), a vendor status\n   * code. Every mapped code is declared; a code the declaration does not name either rejects the row or lands a\n   * declared default. See {@link ExternalDataEnumMappingEntrySchema}.\n   */\n  ENUM_MAP = 'enum-map',\n  /**\n   * Join remote fields and literals into one local string (#1685) — a display name from a first and a last name.\n   * See {@link ExternalDataConcatenationMappingEntrySchema}.\n   */\n  CONCATENATION = 'concatenation',\n  /**\n   * `remote × factor + offset` on one numeric remote field (#1685) — a unit conversion, or a currency conversion at\n   * a DECLARED constant rate. See {@link ExternalDataArithmeticMappingEntrySchema}.\n   */\n  ARITHMETIC = 'arithmetic',\n  /**\n   * Choose the local value by ONE remote field's value (#1685): a list of cases, each an exact value, and an\n   * `otherwise`. See {@link ExternalDataConditionalMappingEntrySchema}.\n   */\n  CONDITIONAL = 'conditional',\n}\n\n/**\n * The mapping entry kinds an OUTBOUND pipeline may declare (#1690): a local field sent as one remote field, and a local\n * foreign key sent as the target row's REMOTE key. The declared expressions (#1685) derive one local value from remote\n * ones and have no inverse — a concatenation cannot be split back into its parts — and a CONSTANT names no remote field.\n */\nexport const EXTERNAL_DATA_OUTBOUND_MAPPING_ENTRY_KINDS: ReadonlySet<ExternalDataMappingEntryKind> = new Set([\n  ExternalDataMappingEntryKind.REMOTE_FIELD,\n  ExternalDataMappingEntryKind.REMOTE_REFERENCE,\n]);\n\n/**\n * The write verbs an OUTBOUND pipeline may open on its binding (#1690): a create for a row with no remote key yet, and\n * an update for one that has one. DELETE is not among them — see {@link ExternalDataPipelineDirection.OUTBOUND}.\n */\nexport const EXTERNAL_DATA_OUTBOUND_WRITE_VERBS: ReadonlySet<HttpApiWriteVerb> = new Set([HttpApiWriteVerb.CREATE, HttpApiWriteVerb.UPDATE]);\n\n/**\n * What an `ENUM_MAP` does with a remote code its declaration does not name (#1685).\n */\nexport enum ExternalDataUnmappedValuePolicy {\n  /**\n   * The DEFAULT. The row is REJECTED and reported, and its previous local version survives. A vendor that adds a\n   * code is then visible on the next run's report instead of being folded silently into some other member.\n   */\n  REJECT_ROW = 'reject-row',\n  /** The row lands the declared `localValue`. Choose it only where every future code genuinely means the same thing. */\n  USE_DEFAULT = 'use-default',\n}\n\n/** The two things a `CONCATENATION` part can be (#1685). */\nexport enum ExternalDataConcatenationPartKind {\n  /** The value of one remote field. An absent or empty value drops the part. */\n  REMOTE_FIELD = 'remote-field',\n  /** A declared literal, written as-is. */\n  LITERAL = 'literal',\n}\n\n/** The two things a `CONDITIONAL` outcome can be (#1685). */\nexport enum ExternalDataConditionalOutcomeKind {\n  /** A declared constant, checked against the local field's type at startup. */\n  CONSTANT = 'constant',\n  /** Another remote field's value, copied as a `REMOTE_FIELD` entry copies it. */\n  REMOTE_FIELD = 'remote-field',\n}\n\n/**\n * How a REMOTE_REFERENCE's remote value becomes the target's key (#1684). A closed vocabulary, one\n * member per wire shape, because the shapes differ in kind and guessing between them silently resolves\n * nothing.\n */\nexport enum ExternalDataRemoteReferenceValueShape {\n  /**\n   * Odoo's many2one: `search_read` answers `[id, display_name]`, or `false` when the reference is empty.\n   * The key is the pair's FIRST element; the display name is ignored (it is a label, not an identity).\n   * spec-cite: Odoo 18.0 developer reference, External API — \"Read records\" / \"Search and read\"\n   * (`odoo/documentation/18.0/content/developer/reference/external_api.rst`) — a many2one reads as\n   * `[21, 'Belgium']`; `false` for an unset one is the ORM's null spelling (measured shape recorded on the\n   * provider simulator, `odoo-jsonrpc-mock.ts`).\n   */\n  ODOO_MANY2ONE = 'odoo-many2one',\n  /**\n   * The remote value IS the target's key component, as a plain scalar — an OData navigation property's\n   * foreign-key field (`ParentAccountID`), a REST id column. `null` or an empty string is an empty reference.\n   */\n  SCALAR = 'scalar',\n}\n\n/**\n * What a run does with a reference whose target has no local row yet (#1684).\n *\n * Resolution happens AFTER the load, in its own phase, so a reference to a row loaded by the same run —\n * including a child extracted before its parent, and a self-reference — always resolves. What remains\n * \"unresolved\" is a target the destination does not hold at all: outside the pipeline's `sourceFilter`,\n * in a partition nobody assigned, not yet loaded by the target's own pipeline.\n */\nexport enum ExternalDataUnresolvedReferencePolicy {\n  /**\n   * The DEFAULT. The row loads with the foreign key EMPTY, and the reference is kept in the pipeline's\n   * pending-resolution set. The set is retried at the end of EVERY later run of the pipeline, incremental\n   * ones included — which is the only way such a row is ever resolved under incremental extraction (#1682),\n   * because a child that did not change is never re-read. Counted on every run's report and summary.\n   */\n  LEAVE_PENDING = 'leave-pending',\n  /**\n   * The row is REJECTED (reported per row; its previous local version survives) when its target is not\n   * already loaded and not among the rows of the same PAGE — a run loads page by page (#1689), so a target\n   * on a LATER page of the same run is not loaded yet. It is retried only when the row is extracted again\n   * — every full pass, or an incremental pass after it changes — and a pass that reads parents before their\n   * children never meets the case. For a self-referencing entity whose source order you do not control,\n   * `LEAVE_PENDING` resolves the link at the end of the same run instead. A reference to a VIRTUAL (read-through)\n   * target never rejects: its key is its local id, and there is nothing local to be missing.\n   *\n   * The check runs BEFORE the load, against the target as it stands then. A self-referenced target that the same\n   * full pass's orphan walk deletes (`orphanPolicy: DELETE`) saved the row from rejection and is then gone, so that\n   * row loads with its foreign key empty and pending — the one case this policy cannot rule out.\n   */\n  REJECT_ROW = 'reject-row',\n}\n\n/**\n * Built-in, closed coercion vocabulary for REMOTE_FIELD entries (v3.1 §3 / PR-8). Slice 1 ships\n * exactly the coercions the two generic dialects force. A value COMPUTED from remote fields is one of\n * the declared expressions (#1685 — D-P4's first widening: `ENUM_MAP`, `CONCATENATION`, `ARITHMETIC`,\n * `CONDITIONAL`), and transforms authored by the app-creation lane's agents remain a recorded widening\n * (W-AGENT) — never an open function slot here. Foreign-key resolution,\n * once recorded as the W-FK widening beside it, is not a coercion at all: it is its own entry kind,\n * {@link ExternalDataMappingEntryKind.REMOTE_REFERENCE} (#1684).\n */\nexport enum ExternalDataFieldCoercion {\n  /** Value lands as extracted (after the destination schema's own Zod parse). */\n  NONE = 'none',\n  /**\n   * Odoo spells an ABSENT value as boolean `false` — a mapped string field would otherwise store\n   * literal `false`. Applied by DEFAULT for ODOO_JSONRPC sources; declaring it on another dialect\n   * is refused (the name is Odoo's semantics, not a generic null-coalesce).\n   */\n  ODOO_FALSE_AS_NULL = 'odoo-false-as-null',\n  /** Parse a strict-ISO datetime string into a Date for a date-typed local field. */\n  ISO_STRING_TO_DATE = 'iso-string-to-date',\n}\n\n/**\n * What a pipeline does with a remote row its source has ARCHIVED rather than deleted (#1732).\n *\n * ## Why this exists: archived is not deleted, and absence reads as deletion\n *\n * Odoo archives a record by setting its `active` field to `false`, and an archived record is then\n * \"invisible in most searches and listing\" — a plain `search_read` leaves it out, exactly as if it\n * had been deleted.\n * spec-cite: Odoo 17.0 ORM API reference, \"Reserved Field names\" → `Model.active`\n * (https://www.odoo.com/documentation/17.0/developer/reference/backend/orm.html).\n *\n * A pipeline's orphan walk reads \"absent from a complete pass\" as \"deleted remotely\", so an extraction\n * that inherited Odoo's default visibility turned every archive into a deletion: `REPORT` reported\n * it, `DEPRECATE` deprecated it, and `DELETE` hard-deleted the local row together with its local\n * extension fields, files and RAG chunks. Un-archiving later re-created a bare row.\n *\n * So extraction ALWAYS asks Odoo for archived rows too (the `active_test: false` context), and an\n * archived row is always OBSERVED — present in the source, never an orphan. What remains a choice is\n * only whether it is LOADED, and that is this vocabulary. Every member keeps the row observed; no\n * member can turn an archive into a deletion.\n *\n * Declared on Odoo sources only (`archivedRecords`); an OData source has no protocol-level archive\n * state, and the declaration coherence refuses the field there.\n */\nexport enum ExternalDataArchivedRecordTreatment {\n  /**\n   * The DEFAULT. An archived row is loaded like any other row. Map the source's archive flag\n   * (`active` on most Odoo models) onto a local boolean like any other field, and the destination can\n   * show or filter archived rows — and an un-archive changes exactly that one value.\n   */\n  LOAD = 'load',\n  /**\n   * An archived row is NOT loaded, but still counts as observed, so it is never an orphan — the same\n   * treatment rows of an unassigned partition get. A local row loaded while the record was live KEEPS\n   * its last loaded version (it is neither updated nor deleted) until the record is un-archived.\n   * Choose it to keep archived records out of a destination that never held them; choose `LOAD` with\n   * the flag mapped when the destination must reflect archival.\n   */\n  EXCLUDE_FROM_LOAD = 'exclude-from-load',\n}\n\n/**\n * A REMOTE_REFERENCE mapping entry (#1684): a remote reference field written as a real LOCAL foreign key.\n *\n * ## What the local field holds\n *\n * - a target that is another PIPELINE destination on the same system of record (or this one — a\n *   self-reference such as Odoo `res.partner.parent_id`): the target's local row id, found by synthesizing\n *   the target's key with THE TARGET BINDING's key codec and looking it up on the target's\n *   `remoteKeyLocalField`;\n * - a target that is a VIRTUAL (read-through) resource bound to the same system of record: the synthesized\n *   key itself — a virtual row's `_id` IS that value, so nothing is looked up.\n *\n * ## When it is written\n *\n * After the load, in its own phase — never inside the row transform. So a child extracted before its\n * parent, a self-reference, and a cycle between two pipelines all resolve without ordering anything. The\n * resolution phase is the ONLY writer of the local field: the load never touches it, which is why the field\n * is left out of the load's managed fields.\n *\n * ## What the declaration owes (checked at authoring and at startup)\n *\n * - `localField` is the foreign key of a declared relationship between this resource and `targetResourceType`,\n *   a STRING field that accepts absence (an unresolved reference leaves it empty), and — like every\n *   pipeline-written field — `.excludeFromCreate().excludeFromUpdate()`;\n * - the target is a pipeline destination or a virtual resource on THIS pipeline's system of record, keyed by\n *   ONE key field (a composite target key is a recorded widening);\n * - when the target's orphan policy DELETES rows and the relationship tears children down with their parent,\n *   `orphanCascadeAcknowledged: true` — a row vanishing from the target's source would otherwise take this\n *   resource's rows with it through the ordinary `onParentDelete` rules, and nothing about this declaration\n *   says so unless the author does.\n */\nexport const ExternalDataRemoteReferenceMappingEntrySchema = z.strictObject({\n  kind: z.literal(ExternalDataMappingEntryKind.REMOTE_REFERENCE),\n  /** The remote field carrying the reference (`parent_id` on Odoo `res.partner`). */\n  remoteField: z.string().trim().min(1),\n  /** The local foreign-key field the resolved reference is written to. */\n  localField: z.string().trim().min(1),\n  /** The LOCAL resource the reference resolves to — a pipeline destination or a virtual resource. */\n  targetResourceType: z.string().trim().min(1),\n  /**\n   * How the remote value becomes the target's key. Absent = resolved at AUTHORING from the source dialect:\n   * `ODOO_MANY2ONE` on an Odoo source, `SCALAR` otherwise — the resource factory writes the resolved value\n   * into the declaration, exactly as it resolves the Odoo absent-as-false coercion.\n   */\n  valueShape: z.enum(ExternalDataRemoteReferenceValueShape).optional(),\n  unresolved: z.enum(ExternalDataUnresolvedReferencePolicy).default(ExternalDataUnresolvedReferencePolicy.LEAVE_PENDING),\n  /**\n   * The author has read that the target's `orphanPolicy: DELETE` will cascade into this resource's rows\n   * through the relationship's `onParentDelete` teardown, and wants that. Only meaningful — and only\n   * demanded — when both are true; see the schema's header.\n   */\n  orphanCascadeAcknowledged: z.boolean().default(false),\n  /** Which side owns the reference — BIDIRECTIONAL pipelines only (#1723). Absent = REMOTE. */\n  owner: z.enum(ExternalDataFieldOwner).optional(),\n});\n\nexport type ExternalDataRemoteReferenceMappingEntry = z.infer<typeof ExternalDataRemoteReferenceMappingEntrySchema>;\n\n/**\n * A remote SCALAR a declared expression compares against or maps from (#1685) — the value shapes a remote field\n * carries that can be matched exactly. An Odoo selection is a string, a status code may be a number, a flag a\n * boolean. Objects and arrays (an Odoo many2one pair) cannot be matched and are not declarable.\n */\nconst externalDataExpressionScalarSchema = z.union([z.string(), z.number().finite(), z.boolean()]);\n\n/**\n * An `ENUM_MAP` entry (#1685): one remote code → one member of the local field's enum.\n *\n * - the local field is an ENUM, and every declared `localValue` (and the default's) is one of its members — checked\n *   at startup, so a renamed member fails the boot rather than every row;\n * - an ABSENT remote value (the field unset: `null`, missing, or Odoo's `false` when `false` is not itself a declared\n *   code) lands null, or rejects the row when `required`;\n * - a PRESENT code the declaration does not name follows `unmapped`: rejected by default, or the declared member.\n */\nexport const ExternalDataEnumMappingEntrySchema = z.strictObject({\n  kind: z.literal(ExternalDataMappingEntryKind.ENUM_MAP),\n  /** The remote field carrying the code (`state` on Odoo `account.move`). */\n  remoteField: z.string().trim().min(1),\n  localField: z.string().trim().min(1),\n  /** Every code the declaration maps, each to one member of the local enum. Codes are unique. */\n  values: z.array(z.strictObject({\n    remoteValue: externalDataExpressionScalarSchema,\n    localValue: z.union([z.string().min(1), z.number().finite()]),\n  })).min(1),\n  /** A PRESENT code no `values` entry names. Absent = reject the row. */\n  unmapped: z.discriminatedUnion('policy', [\n    z.strictObject({ policy: z.literal(ExternalDataUnmappedValuePolicy.REJECT_ROW) }),\n    z.strictObject({ policy: z.literal(ExternalDataUnmappedValuePolicy.USE_DEFAULT), localValue: z.union([z.string().min(1), z.number().finite()]) }),\n  ]).default({ policy: ExternalDataUnmappedValuePolicy.REJECT_ROW }),\n  /** `true`: a row whose remote code is ABSENT is rejected. `false` (default): absence lands null. */\n  required: z.boolean().default(false),\n});\n\nexport type ExternalDataEnumMappingEntry = z.infer<typeof ExternalDataEnumMappingEntrySchema>;\n\n/**\n * A `CONCATENATION` entry (#1685): remote fields and literals joined into one local STRING.\n *\n * Every part with a value is written, in order, joined by `separator`; a remote part whose value is absent or empty\n * (`null`, missing, `''`, or Odoo's `false`) is DROPPED with its separator, the way SQL's `concat_ws` ignores a NULL\n * argument — so `first` + `last` joined by a space yields `'Ada'`, never `'Ada '`, when the last name is unset. A\n * number is written as JavaScript's shortest round-trip text (`42`, `12.5`; exponent notation only beyond `1e21` or\n * below `1e-6`); any other value (a boolean off Odoo, a many2one pair) rejects the row.\n *\n * spec-cite: PostgreSQL 17 documentation, §9.4 \"String Functions and Operators\", `concat_ws` — \"NULL arguments are\n * ignored\" (https://www.postgresql.org/docs/17/functions-string.html).\n *\n * When NO remote part has a value, the result is ABSENT — literals alone are decoration, not data — and lands null,\n * or rejects the row when `required`.\n */\nexport const ExternalDataConcatenationMappingEntrySchema = z.strictObject({\n  kind: z.literal(ExternalDataMappingEntryKind.CONCATENATION),\n  localField: z.string().trim().min(1),\n  /** At least two parts, at least one of them a remote field. */\n  parts: z.array(z.discriminatedUnion('kind', [\n    z.strictObject({ kind: z.literal(ExternalDataConcatenationPartKind.REMOTE_FIELD), remoteField: z.string().trim().min(1) }),\n    z.strictObject({ kind: z.literal(ExternalDataConcatenationPartKind.LITERAL), literal: z.string().min(1) }),\n  ])).min(2),\n  /** Written between two parts that both have a value. Default: nothing. */\n  separator: z.string().default(''),\n  required: z.boolean().default(false),\n});\n\nexport type ExternalDataConcatenationMappingEntry = z.infer<typeof ExternalDataConcatenationMappingEntrySchema>;\n\n/**\n * An `ARITHMETIC` entry (#1685): `remote × factor + offset` onto a local NUMBER.\n *\n * A currency conversion is legal only as a DECLARED rate (`factor`): a live exchange rate is a second source, which\n * is a join, and joins are a later widening. The declaration is the rate's record, so changing it changes the\n * pipeline's extraction fingerprint and an incremental pipeline re-reads every row under the new rate.\n *\n * The remote value is a finite number, or a string holding a plain decimal numeral (`'12.50'` — how OData v2 and\n * several REST APIs serialize decimals). Anything else rejects the row. `decimalPlaces` rounds the RESULT half away\n * from zero, in binary floating point: it keeps `0.1 × 3` from landing as `0.30000000000000004`, and it does not make\n * the value exact — an amount that must be exact to the cent belongs in a type this expression does not produce.\n */\nexport const ExternalDataArithmeticMappingEntrySchema = z.strictObject({\n  kind: z.literal(ExternalDataMappingEntryKind.ARITHMETIC),\n  remoteField: z.string().trim().min(1),\n  localField: z.string().trim().min(1),\n  /** Multiplier. Never 0 — a constant result is a `CONSTANT` entry. */\n  factor: z.number().finite().default(1),\n  /** Added after the multiplication. */\n  offset: z.number().finite().default(0),\n  /** Round the result to this many decimal places. Absent = no rounding. */\n  decimalPlaces: z.number().int().min(0).max(12).optional(),\n  required: z.boolean().default(false),\n});\n\nexport type ExternalDataArithmeticMappingEntry = z.infer<typeof ExternalDataArithmeticMappingEntrySchema>;\n\n/** What a `CONDITIONAL` case (or its `otherwise`) writes (#1685). */\nconst ExternalDataConditionalOutcomeSchema = z.discriminatedUnion('kind', [\n  z.strictObject({ kind: z.literal(ExternalDataConditionalOutcomeKind.CONSTANT), constant: externalDataExpressionScalarSchema }),\n  z.strictObject({\n    kind: z.literal(ExternalDataConditionalOutcomeKind.REMOTE_FIELD),\n    remoteField: z.string().trim().min(1),\n    /** As on a `REMOTE_FIELD` entry: Odoo's absent-as-false is resolved at authoring from the local field's type. */\n    coercion: z.enum(ExternalDataFieldCoercion).default(ExternalDataFieldCoercion.NONE),\n  }),\n]);\n\nexport type ExternalDataConditionalOutcome = z.infer<typeof ExternalDataConditionalOutcomeSchema>;\n\n/**\n * A `CONDITIONAL` entry (#1685): the local value chosen by ONE remote field's value.\n *\n * The cases are tried in order and the first whose `equals` is exactly (`===`) the remote value wins; no case\n * matching — an absent value included — takes `otherwise`. On an Odoo source an unset field reads `false`, so a declared\n * `equals: false` case catches it before `otherwise` does. An outcome is a constant (checked against the local\n * field's type, and against its members when it is an enum) or another remote field's value. Conditions over two\n * fields, ranges and patterns are not part of the set: they are exactly what makes an expression language grow into\n * the open function slot this set exists to avoid.\n */\nexport const ExternalDataConditionalMappingEntrySchema = z.strictObject({\n  kind: z.literal(ExternalDataMappingEntryKind.CONDITIONAL),\n  /** The remote field whose value decides. */\n  remoteField: z.string().trim().min(1),\n  localField: z.string().trim().min(1),\n  cases: z.array(z.strictObject({ equals: externalDataExpressionScalarSchema, then: ExternalDataConditionalOutcomeSchema })).min(1),\n  otherwise: ExternalDataConditionalOutcomeSchema,\n});\n\nexport type ExternalDataConditionalMappingEntry = z.infer<typeof ExternalDataConditionalMappingEntrySchema>;\n\n/**\n * One declared T-step: remote field → local field with a built-in coercion, a constant, a resolved reference, or one\n * of the four declared expressions (#1685).\n *\n * Every entry shape is STRICT: an unknown key is refused, not dropped. That is what makes the refusal of an open\n * function slot real — `{ kind: 'remote-field', …, transform: (value) => … }` used to parse with `transform` silently\n * stripped, a declaration that reads as if it ran code and runs none.\n */\nexport const ExternalDataFieldMappingEntrySchema = z.discriminatedUnion('kind', [\n  z.strictObject({\n    kind: z.literal(ExternalDataMappingEntryKind.REMOTE_FIELD),\n    remoteField: z.string().trim().min(1),\n    localField: z.string().trim().min(1),\n    coercion: z.enum(ExternalDataFieldCoercion).default(ExternalDataFieldCoercion.NONE),\n    /**\n     * `true`: a row whose extracted value is ABSENT is REJECTED (reported per row in the run\n     * ledger; its previous local version survives). `false` (default): absent lands as null,\n     * which the declaration coherence requires the local field to accept.\n     */\n    required: z.boolean().default(false),\n    /** Which side owns the field — BIDIRECTIONAL pipelines only (#1723). Absent = REMOTE. */\n    owner: z.enum(ExternalDataFieldOwner).optional(),\n  }),\n  z.strictObject({\n    kind: z.literal(ExternalDataMappingEntryKind.CONSTANT),\n    localField: z.string().trim().min(1),\n    constant: z.union([z.string(), z.number(), z.boolean()]),\n  }),\n  ExternalDataRemoteReferenceMappingEntrySchema,\n  ExternalDataEnumMappingEntrySchema,\n  ExternalDataConcatenationMappingEntrySchema,\n  ExternalDataArithmeticMappingEntrySchema,\n  ExternalDataConditionalMappingEntrySchema,\n]);\n\n/**\n * HOW a source says what changed — one member per remote change-tracking mechanism (#1682).\n *\n * A closed vocabulary shared by two parties: a system-of-record VENDOR FACET declares which modes its\n * deployments support (`incrementalExtractionModes`), and a pipeline declaration chooses one. A\n * pipeline asking for a mode its source's facet does not declare is refused at startup, naming both.\n *\n * Three modes: Odoo's `write_date`, and the two OData v4 mechanisms (#1722) — a modified-at filter and\n * the delta-link protocol. The incremental TRACK on the state row is mode-neutral (its watermark and\n * cursor are opaque, mode-owned text), so a new mode needed no reshape of it.\n */\nexport enum ExternalDataIncrementalExtractionMode {\n  /**\n   * Odoo's `write_date` — the \"Last Updated on\" column the ORM maintains on every model that logs\n   * access. Read in (SECOND, id) order from a watermark, with a declared lookback. See\n   * {@link ExternalDataIncrementalExtractionDeclarationSchema}.\n   */\n  ODOO_WRITE_DATE = 'odoo-write-date',\n  /**\n   * OData v4, a MODIFIED-AT property the declaration names (`modifiedAtRemoteField` — per entity, not per\n   * vendor: Dataverse's `modifiedon`, Business Central's `lastModifiedDateTime`). Rows with that property at\n   * or after the watermark (less the lookback) are read in KEY order, and the watermark moves only when the\n   * pass completes. Catches no deletions: full passes find those.\n   */\n  ODATA_MODIFIED_AT = 'odata-modified-at',\n  /**\n   * OData v4 CHANGE TRACKING: the first pass asks for `Prefer: odata.track-changes` and keeps the service's\n   * `@odata.deltaLink`; every later pass follows it and receives changed entities AND deleted ones, so an\n   * incremental pass applies the orphan policy to each deleted key. The vendor must track changes for the\n   * entity set (Dataverse: per table).\n   */\n  ODATA_DELTA_LINK = 'odata-delta-link',\n}\n\n/**\n * `incremental` — read only what changed between full passes (#1682).\n *\n * ## What an incremental pass does, and what it never does\n *\n * - It reads the rows changed since the pipeline's WATERMARK — the largest remote position a previous\n *   incremental pass actually LOADED, never the local clock (a local clock and a remote clock disagree,\n *   and the gap is rows nobody reads).\n * - The watermark advances only after the rows that reached it are loaded. A crash re-reads; it never\n *   skips.\n * - It NEVER detects deletions. A row deleted remotely does not \"change\", so no incremental read can\n *   see it. Deletions are found by FULL passes only, on `fullPassCron` — which is why that cadence is\n *   required rather than optional: an incremental-only pipeline would keep deleted rows forever.\n * - It runs on the pipeline's `scheduleCron`, which is therefore required too.\n *\n * ## The Odoo mode — why (second, id), and why a lookback\n *\n * Odoo STORES `write_date` with microseconds (the writing transaction's `now()`) and SERVES it cut to\n * the second, while a domain compares the stored value. Two obvious designs fail on that gap:\n * `write_date > w` skips the rows that share the last row's second but did not fit on the page, and a\n * keyset on the served `(write_date, id)` re-reads its own last row forever, because a row served as\n * `10:00:00` is stored after `10:00:00`. The extraction therefore walks (SECOND, id): it finishes one\n * second by id (`s <= write_date < s+1s AND id > i`, ordered by id), then finds the next rows from the\n * following second. Every row is read once per pass, however many rows share a second.\n * spec-cite: N/A — Odoo 17.0 SOURCE, not a document: `odoo/models.py`\n * `vals.setdefault('write_date', self.env.cr.now())`, `odoo/sql_db.py` `Cursor.now`\n * (`SELECT (now() AT TIME ZONE 'UTC')`), `odoo/fields.py` `Datetime.to_string` (`strftime`), and no\n * `Datetime.convert_to_column` override (the base field stores the full value).\n *\n * The lookback re-reads the last `lookbackSeconds` of changes at the START of every incremental pass.\n * Odoo stamps `write_date` when the writing transaction runs, not when it commits, so a long\n * transaction can commit a row whose `write_date` is already older than a watermark another pass\n * advanced past in the meantime; without a lookback that row is never read — and a transaction that\n * commits later inside the watermark's own second is caught the same way. Re-reads are free where it\n * matters: the load compares content and writes nothing for an unchanged row. UNVERIFIED against a\n * live Odoo — the default is a margin, not a measurement; raise it for a deployment with long batch\n * jobs. `0` is NOT a harmless setting: without a lookback, a row written later inside a second a pass\n * has already finished is read only when it changes again (or by a full pass).\n *\n * ## Changing the declaration resets the incremental track\n *\n * An incremental pass never re-reads a row that did not change remotely, so a change to what is\n * extracted or how it is loaded — the binding, key fields, mapping, `sourceFilter`, partition fields,\n * archived-record treatment, or the operator's partition ASSIGNMENTS — would otherwise never reach the\n * rows already loaded. The run fingerprints those inputs; a different fingerprint drops the watermark,\n * and the next incremental pass reads the whole source again. The run summary says it did.\n */\nexport const ExternalDataIncrementalExtractionDeclarationSchema = z.discriminatedUnion('mode', [\n  z.object({\n    mode: z.literal(ExternalDataIncrementalExtractionMode.ODOO_WRITE_DATE),\n    /**\n     * When FULL passes run (cron). The only deletion detector, so required. A full pass that takes\n     * several runs continues on `scheduleCron` ticks until it completes, interleaved with incremental\n     * passes; neither track waits for the other.\n     */\n    fullPassCron: z.string().trim().min(1),\n    /** Seconds of changes re-read at the start of every incremental pass (see above). Up to one day. */\n    lookbackSeconds: z.number().int().nonnegative().max(86_400).default(300),\n  }),\n  /*\n   * ## The OData modified-at mode (#1722)\n   *\n   * `$filter=<modifiedAtRemoteField> ge <watermark − lookback>`, ordered by the KEY as a full pass is, paged\n   * by the service. Because the pages are in key order and not in modified-at order, a page's largest\n   * timestamp says nothing about the rows still to come, so the watermark moves only when the PASS completes\n   * (to the largest timestamp the pass read), never per page — a per-page watermark would skip the rows of\n   * a later page modified before it. `ge`, not `gt`: two rows sharing the watermark's instant are both read.\n   *\n   * The property must be an `Edm.DateTimeOffset` the service filters on. The lookback plays the role it\n   * plays for Odoo: a row written by a transaction that commits after the pass read past its timestamp is\n   * re-read by the next pass. Changing `modifiedAtRemoteField` starts the track over (the stored watermark\n   * names the property it was read on).\n   */\n  z.object({\n    mode: z.literal(ExternalDataIncrementalExtractionMode.ODATA_MODIFIED_AT),\n    fullPassCron: z.string().trim().min(1),\n    /** The entity's modified-at property (`Edm.DateTimeOffset`), by its REMOTE name. */\n    modifiedAtRemoteField: z.string().trim().min(1),\n    lookbackSeconds: z.number().int().nonnegative().max(86_400).default(300),\n  }),\n  /*\n   * ## The OData delta-link mode (#1722)\n   *\n   * The first incremental pass reads the whole entity set with `Prefer: odata.track-changes` and keeps the\n   * `@odata.deltaLink` the service puts on its last page; each later pass GETs that link and receives what\n   * changed and what was DELETED since. A deleted entity carries only its id, so the orphan policy is applied\n   * to that key — an incremental pass that finds deletions, which the other modes cannot.\n   *\n   * Refused at declaration: a `sourceFilter` (Dataverse refuses `$filter`, `$orderby`, `$expand` and `$top`\n   * with change tracking) and a composite key (a deleted entity names one id). A delta link the service no\n   * longer honours (`410 Gone`) resets the track and the same run falls back to a FULL pass, which is what\n   * finds the deletions the expired link would have reported; the run summary says so.\n   * spec-cite: Microsoft Learn, \"Use change tracking to synchronize data with external systems\"\n   * (https://learn.microsoft.com/en-us/power-apps/developer/data-platform/use-change-tracking-synchronize-data-external-systems),\n   * \"Query options not supported in Change Tracking Web API request\" — \"System query options $filter,\n   * $orderby, $expand, and $top aren't supported when you use the Prefer: odata.track-changes header\".\n   * spec-cite: OData Version 4.01 Part 1: Protocol §9.2.4 — \"410 Gone indicates that the requested resource is\n   * no longer available. This can happen if a client has waited too long to follow a delta link\".\n   *\n   * No lookback: a delta link is the service's own position, not a clock.\n   */\n  z.object({\n    mode: z.literal(ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK),\n    fullPassCron: z.string().trim().min(1),\n  }),\n]);\n\nexport type ExternalDataIncrementalExtractionDeclaration = z.infer<typeof ExternalDataIncrementalExtractionDeclarationSchema>;\n\n/**\n * The dialect each incremental mode is spoken over. A `Record` over the enum so a mode added without\n * its dialect is a compile error rather than a declaration the coherence check silently waves through.\n */\nexport const EXTERNAL_DATA_INCREMENTAL_MODE_DIALECT: Readonly<Record<ExternalDataIncrementalExtractionMode, HttpApiTransportDialect>> = {\n  [ExternalDataIncrementalExtractionMode.ODOO_WRITE_DATE]: HttpApiTransportDialect.ODOO_JSONRPC,\n  [ExternalDataIncrementalExtractionMode.ODATA_MODIFIED_AT]: HttpApiTransportDialect.ODATA,\n  [ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK]: HttpApiTransportDialect.ODATA,\n};\n\n/** @wildo_source:part:end saas.models.external-data-pipeline */\nexport type ExternalDataFieldMappingEntry = z.infer<typeof ExternalDataFieldMappingEntrySchema>;\n\n/**\n * Every remote field one mapping entry READS (#1685) — the one answer to that question, total over the entry kinds.\n *\n * The extraction requests exactly these (with the key fields and the archive flag), so a field an expression reads is\n * never missing from `fields` / `$select` — and a field the remote does not have fails the request loudly instead of\n * landing null on every row. The run's contract-drift probe checks the same list. A new kind that forgets to say what\n * it reads is a compile error here, not an extraction that silently omits a field.\n */\nexport function listExternalDataMappingEntryRemoteFields(entry: ExternalDataFieldMappingEntry): readonly string[] {\n  switch (entry.kind) {\n    case ExternalDataMappingEntryKind.REMOTE_FIELD:\n    case ExternalDataMappingEntryKind.REMOTE_REFERENCE:\n    case ExternalDataMappingEntryKind.ENUM_MAP:\n    case ExternalDataMappingEntryKind.ARITHMETIC:\n      return [entry.remoteField];\n    case ExternalDataMappingEntryKind.CONSTANT:\n      return [];\n    case ExternalDataMappingEntryKind.CONCATENATION:\n      return [...new Set(entry.parts.flatMap((part) => (part.kind === ExternalDataConcatenationPartKind.REMOTE_FIELD ? [part.remoteField] : [])))];\n    case ExternalDataMappingEntryKind.CONDITIONAL:\n      return [...new Set([\n        entry.remoteField,\n        ...[...entry.cases.map((entryCase) => entryCase.then), entry.otherwise]\n          .flatMap((outcome) => (outcome.kind === ExternalDataConditionalOutcomeKind.REMOTE_FIELD ? [outcome.remoteField] : [])),\n      ])];\n    default: {\n      const unhandled: never = entry;\n      throw new Error(`listExternalDataMappingEntryRemoteFields: unhandled mapping entry ${JSON.stringify(unhandled)}`);\n    }\n  }\n}\n\n/** Every remote field a pipeline's mapping reads, deduplicated, in declaration order (#1685). */\nexport function listExternalDataMappingRemoteFields(mapping: readonly ExternalDataFieldMappingEntry[]): readonly string[] {\n  return [...new Set(mapping.flatMap(listExternalDataMappingEntryRemoteFields))];\n}\n\n/** A scalar's identity for uniqueness checks: `1` and `'1'` are different codes, as `===` says they are. */\nfunction expressionScalarKey(value: string | number | boolean): string {\n  return `${typeof value}:${String(value)}`;\n}\n\n/**\n * The value shape a REMOTE_REFERENCE is read with (#1684) — the declared one, or the source dialect's default:\n * Odoo answers every many2one as a pair, every other dialect names a key as a scalar.\n *\n * The ONE place that default lives. The resource factory writes its answer into the declaration at authoring, and\n * the transform asks the same function, so a declaration parsed without passing through the factory (a test, a\n * tool) reads the same shape an application does.\n */\nexport function resolveExternalDataRemoteReferenceValueShape(\n  entry: Pick<ExternalDataRemoteReferenceMappingEntry, 'valueShape'>,\n  dialect: HttpApiTransportDialect,\n): ExternalDataRemoteReferenceValueShape {\n  if (entry.valueShape !== undefined) return entry.valueShape;\n  return dialect === HttpApiTransportDialect.ODOO_JSONRPC\n    ? ExternalDataRemoteReferenceValueShape.ODOO_MANY2ONE\n    : ExternalDataRemoteReferenceValueShape.SCALAR;\n}\n\n/**\n * The archive flag Odoo filters on by default. Odoo's ORM names it `active` (or `x_active` on a\n * Studio-created field), so the declaration defaults to `active` and lets a model with the other\n * spelling say so.\n */\n// semantic-literal-boundary: Odoo's own reserved field name, at the declaration that addresses it.\nconst ODOO_DEFAULT_ARCHIVE_FLAG_REMOTE_FIELD = 'active';\n\n/**\n * `archivedRecords` — how an Odoo pipeline treats archived rows (#1732). Absent means\n * {@link ExternalDataArchivedRecordTreatment.LOAD}.\n *\n * `EXCLUDE_FROM_LOAD` must read each row's archive flag, so it names the flag's REMOTE field; the\n * extraction requests that field. `LOAD` reads nothing extra — a pipeline that wants the flag on the\n * destination maps it, which is an ordinary mapping entry, not part of this declaration.\n */\nexport const ExternalDataArchivedRecordsDeclarationSchema = z.discriminatedUnion('treatment', [\n  z.object({ treatment: z.literal(ExternalDataArchivedRecordTreatment.LOAD) }),\n  z.object({\n    treatment: z.literal(ExternalDataArchivedRecordTreatment.EXCLUDE_FROM_LOAD),\n    archiveFlagRemoteField: z.string().trim().min(1).default(ODOO_DEFAULT_ARCHIVE_FLAG_REMOTE_FIELD),\n  }),\n]);\n\nexport type ExternalDataArchivedRecordsDeclaration = z.infer<typeof ExternalDataArchivedRecordsDeclarationSchema>;\n\n/** Scalar values admissible in the declared source filter (T-set equality conjunctions only). */\nconst externalDataPipelineFilterScalarSchema = z.union([z.string(), z.number(), z.boolean()]);\n\n/**\n * The inbound pipeline declaration an ordinary LOCAL resource carries as `externalDataPipeline`.\n *\n * NOT legal on an HTTP_API-adapter resource (a virtual resource IS the remote side); the\n * resource-configuration factory enforces that plus every mainSchema-dependent coherence rule —\n * see `validateExternalDataPipelineDeclarationAgainstSchema` there. This module owns only the\n * schema-independent shape and coherence.\n */\n/** @wildo_source:part:start saas.models.external-data-pipeline facet:layer:shared facet:audience:app-developer */\nexport const ExternalDataPipelineDeclarationSchema = z.object({\n  /**\n   * Which way rows travel — see {@link ExternalDataPipelineDirection}. `INBOUND` when omitted.\n   *\n   * An OUTBOUND pipeline (#1690) reuses this whole declaration with the arrows reversed: the binding opens the writes\n   * it sends (`writableVerbs: [CREATE, UPDATE]`, with the same `writeConcurrency` a read-through binding states), each\n   * `mapping` entry names the local field SENT and the remote field it lands on, and `remoteKeyLocalField` receives the\n   * key the system of record assigns when it creates the row. The fields that only describe reading a source —\n   * `sourceFilter`, `incremental`, `archivedRecords`, `partitionKeyLocalField`, `population`, `orphanPolicy` — are\n   * refused on it, because nothing would read them.\n   */\n  direction: z.enum(ExternalDataPipelineDirection).default(ExternalDataPipelineDirection.INBOUND),\n\n  /**\n   * The source half — the SAME binding declaration the VIRTUAL mode uses (the system of record it\n   * reads, entity, dialect, key fields + codecs, remote-call semantics, erasure stance).\n   *\n   * Every source is a SYSTEM OF RECORD: a deployment the OPERATOR runs, read with the application's\n   * own service identity, with ONE owner organization. There is no per-tenant variant to confine\n   * (that was `tenancy`, removed in #1055 — a customer's own connected account is a CONNECTOR, a\n   * different thing that no binding names), so a pipeline extracts the operator's rows and the\n   * destination's own scope declaration decides who may then read them.\n   *\n   * How the source is WALKED is the dialect's, and only drift-safe walks are admitted: OData v4 follows\n   * the server's `@odata.nextLink`; OData v2 (`ODATA_V2`, #1687) walks the binding's key fields and never\n   * follows `__next`, because v2 promises no stability across a partial listing; Odoo walks its id keyset;\n   * and a REST_JSON source walks the KEYSET its `list` statement declares\n   * (`operations.list.statement.keyset: { keyRemoteField }`, #1686) — the engine builds \"the next N rows\n   * after the last key, in key order\" and stores that key as the cursor.\n   * A REST source with no keyset (offset paging only) is refused.\n   *\n   * ⚠ OPERATIONAL HAZARD (PR-16): changing `keyFields` or a component CODEC after rows exist\n   * re-keys EVERY business key — the whole destination population orphans and re-creates on the\n   * next full pass, detaching local annotations (extension fields, files, chunks) from the rows\n   * that replace them. Treat a key/codec change as a MIGRATION EVENT, never a config tweak. Not\n   * mechanically detectable at authoring (no row access here). Relatedly: a remote system that\n   * RECYCLES ids hands the recycled row the OLD row's local annotations — the upsert cannot tell\n   * a revived entity from a new one wearing its key.\n   */\n  binding: HttpApiResourceBindingSchema,\n\n  /**\n   * The LOCAL field holding the row's remote identity — the synthesized id (paper A codec) as a\n   * plain STRING business key. The factory requires it declared `.isBusinessKey()` +\n   * `excludeFromCreate/Update`: SYNC's idempotent upsert keys on it, and no caller may mint or\n   * move it.\n   *\n   * On an OUTBOUND pipeline (#1690) it is empty until the row is first sent: the engine writes the key the system of\n   * record answers the create with, exactly once, and then updates the remote row it names. It must therefore accept\n   * absence, and it is still excluded from create and update — a caller that could write it could point a local row at\n   * any remote record. It must be `.isUnique()` (global, sparse — the default) and `.optional()`, never `.nullable()`:\n   * one remote record, one local row, enforced by the store on every path that writes the key, while the rows not yet\n   * sent (no key) stay outside the index. No business key is required there: nothing upserts on it.\n   */\n  remoteKeyLocalField: z.string().trim().min(1),\n\n  /**\n   * Where a row's remote PARTITION lands, when the source instance is partitioned (#1058 E4).\n   *\n   * Declared TOGETHER or not at all, and only for a partitioned source. The resources registry —\n   * which is the first place the pipeline declaration and the systems-of-record registry are both\n   * in scope — refuses a partitioned source that declares neither, and refuses either field on an\n   * unpartitioned one.\n   *\n   * ## Why TWO fields rather than one\n   *\n   * They hold different things, and collapsing them is the mistake #1058 R5 was written to record.\n   *\n   * `partitionUnitLocalField` carries the Wildo ORGANIZATION UNIT that owns the row's partition. It\n   * is what organization-unit narrowing filters on, so it is what confines a member of one\n   * subsidiary to their own company's rows. Declare the destination narrowable on this field.\n   *\n   * `partitionKeyLocalField` carries the REMOTE key verbatim — Odoo's `company_id`, NetSuite's\n   * `subsidiary`. It exists because the unit id CANNOT answer the question the orphan walk asks.\n   * When an operator unassigns a partition, the unit still exists and other rows still point at it;\n   * only the partition→unit edge is gone. A row loaded before the unassignment therefore still\n   * carries a perfectly valid unit id, and nothing about it says \"this row's partition is no longer\n   * mapped\". Without the remote key stored per row, the next pass sees those rows absent from the\n   * extraction and an orphan policy of DELETE erases them — an operator's unassignment becoming a\n   * mass delete.\n   *\n   * Both are ENGINE-WRITTEN: the transform stamps them from the assignment map, so a mapping entry\n   * targeting either is refused, as is a caller write (the factory requires both\n   * `.excludeFromCreate()` and `.excludeFromUpdate()`).\n   *\n   * Both must ACCEPT ABSENCE. A row whose partition field is unset is SHARED (E2 — an Odoo product\n   * belonging to no company); it belongs to every caller and to no unit, and both fields land null.\n   */\n  partitionUnitLocalField: z.string().trim().min(1).optional(),\n  partitionKeyLocalField: z.string().trim().min(1).optional(),\n\n  /** The declared T — at least one entry; targets validated against `mainSchema` by the factory. */\n  mapping: z.array(ExternalDataFieldMappingEntrySchema).min(1),\n\n  /**\n   * Optional remote-side subset (v3.1 §2): equality conjunctions over REMOTE fields, exactly the\n   * T-set's T3 shape — anything richer is a widening, not an improvisation.\n   */\n  sourceFilter: z.record(z.string().trim().min(1), externalDataPipelineFilterScalarSchema).optional(),\n\n  population: z.enum(ExternalDataDestinationPopulation).default(ExternalDataDestinationPopulation.CLOSED),\n\n  /**\n   * Odoo sources only: whether ARCHIVED remote rows are loaded (#1732). Absent = `LOAD`. Archived rows\n   * are extracted and counted as observed under every treatment, so archiving a record in Odoo never\n   * reaches the orphan policy — see {@link ExternalDataArchivedRecordTreatment}.\n   */\n  archivedRecords: ExternalDataArchivedRecordsDeclarationSchema.optional(),\n\n  orphanPolicy: z.enum(ExternalDataOrphanPolicy).default(ExternalDataOrphanPolicy.REPORT),\n\n  /**\n   * What a BIDIRECTIONAL pipeline (#1723) does with a row whose BOTH-owned fields changed on both sides since they last\n   * agreed — see {@link ExternalDataConflictPolicy}. Absent = REFUSE_AND_REPORT: nothing is overwritten that nobody\n   * decided to overwrite. Refused on any other direction, where no field has two owners.\n   */\n  conflictPolicy: z.enum(ExternalDataConflictPolicy).optional(),\n\n  /**\n   * Cron expression for the scheduled refresh (crontabs machinery). Absent = on-demand only —\n   * legal, and honest for a manually-driven backfill.\n   */\n  scheduleCron: z.string().trim().min(1).optional(),\n\n  /**\n   * Read only what changed between full passes (#1682). Absent = every pass is a FULL pass, the\n   * behaviour of every pipeline before this existed. When declared, `scheduleCron` runs incremental\n   * passes and `incremental.fullPassCron` runs the full passes that alone detect deletions — see\n   * {@link ExternalDataIncrementalExtractionDeclarationSchema}.\n   */\n  incremental: ExternalDataIncrementalExtractionDeclarationSchema.optional(),\n\n  /**\n   * Extraction bound per run (v3.1 §2): a big backfill progresses across runs via the ledger's\n   * resumable cursor instead of owning one unbounded run. The default matches the rate-budget\n   * era's \"bounded by construction\" posture.\n   *\n   * A run ends on a PAGE boundary, so it may carry up to one page more than this — never fewer\n   * rows than the pass has left, and never a page cut short: the source's continuation follows the\n   * whole page, so rows cut from it would be read by no run. An OData v4 source asks for pages of\n   * `min(maxRowsPerRun, 1000)` (`Prefer: odata.maxpagesize`), which a service may honour or not\n   * (#1991). Whether a pass is COMPLETE is never decided from this number — only from the source\n   * answering that nothing is left.\n   *\n   * It bounds a run's WORK, not its memory: a run loads and checkpoints each page (up to 1 000 rows)\n   * before it reads the next (#1689), so it holds one page, and a run that fails part-way keeps the\n   * pages it loaded — the next run resumes after them.\n   */\n  maxRowsPerRun: z.number().int().positive().default(10_000),\n\n  /**\n   * How long one run may spend before it stops at a page boundary (#1683) — the run's DEADLINE, in\n   * milliseconds.\n   *\n   * A run PACES against its source's rate budget: when the binding's `remoteCallSemantics\n   * .maxRequestsPerMinute` is full it waits for room instead of failing, and it waits as long as a\n   * throttling source's `Retry-After` asks. This bounds that waiting. No wait that would end past the\n   * deadline is taken and no page starts after it; the run then ends as a PARTIAL pass — every page it\n   * loaded is kept and its cursor continues the pass on the next run — never as a failure.\n   *\n   * It bounds extraction and load together: each page is loaded before the next is read (#1689), so a\n   * run finishes after the page it was working on, by at most one page's extraction and load.\n   *\n   * Fifteen minutes by default: well inside an hourly `scheduleCron`, and long enough that a pass of the\n   * default `maxRowsPerRun` completes at even a small binding ceiling. Six hours at most — a run that\n   * needs longer is a backfill, and resuming across runs is what the cursor is for.\n   */\n  maxRunDurationMs: z.number().int().min(1_000).max(21_600_000).default(900_000),\n});\n\n/** @wildo_source:part:end saas.models.external-data-pipeline */\nexport type ExternalDataPipelineDeclaration = z.infer<typeof ExternalDataPipelineDeclarationSchema>;\n\n/**\n * What an APPLICATION AUTHOR writes — the schema's INPUT shape, so every field carrying a\n * `.default()` is optional to type. Consumers read the parsed shape above, where those same fields\n * are guaranteed present.\n *\n * The distinction is not cosmetic, and the first dogfood proved it: typing the resource-config\n * field with the PARSED shape forced an author to spell out a `coercion` + `required` on every\n * mapping entry, and the two binding defaults that existed at the time (`verifyMetadataAtBoot` and\n * `connection`, both since removed by #1055) — values the schema exists to supply. `DataSeedDefinitionAuthored` records the identical lesson for seeds (\"authors may omit\n * this field and the dispatcher still reads a guaranteed `string[]`\"); this is the same split, and\n * it was missed here because nothing had authored a pipeline by hand yet.\n */\nexport type ExternalDataPipelineDeclarationAuthored = z.input<typeof ExternalDataPipelineDeclarationSchema>;\n\n/**\n * The schema-INDEPENDENT half of a declared expression's coherence (#1685); the destination-schema half (target\n * type, enum membership, absence) is the resource factory's. Each refusal names a declaration that would either do\n * nothing or decide something the author cannot see.\n */\nfunction assertExternalDataExpressionEntryCoherence(entry: ExternalDataFieldMappingEntry, dialect: HttpApiTransportDialect): void {\n  const at = `mapping('${entry.localField}')`;\n  switch (entry.kind) {\n    case ExternalDataMappingEntryKind.ENUM_MAP: {\n      const seen = new Set<string>();\n      for (const { remoteValue } of entry.values) {\n        const key = expressionScalarKey(remoteValue);\n        // Two entries for one code: the first would win silently, and the second would read as a mapping that happens.\n        if (seen.has(key)) throw new Error(`${at}.values: the remote code ${JSON.stringify(remoteValue)} is mapped more than once — one code, one member.`);\n        seen.add(key);\n      }\n      return;\n    }\n    case ExternalDataMappingEntryKind.CONCATENATION:\n      if (!entry.parts.some((part) => part.kind === ExternalDataConcatenationPartKind.REMOTE_FIELD)) {\n        throw new Error(`${at}.parts: a CONCATENATION of literals only reads nothing from the source — declare a CONSTANT instead.`);\n      }\n      return;\n    case ExternalDataMappingEntryKind.ARITHMETIC:\n      if (entry.factor === 0) {\n        throw new Error(`${at}.factor: 0 makes every row the same value, which is a CONSTANT entry, not arithmetic on a remote field.`);\n      }\n      if (entry.factor === 1 && entry.offset === 0 && entry.decimalPlaces === undefined) {\n        throw new Error(`${at}: factor 1 and offset 0 with no rounding copy the value unchanged — declare a REMOTE_FIELD entry.`);\n      }\n      return;\n    case ExternalDataMappingEntryKind.CONDITIONAL: {\n      const seen = new Set<string>();\n      for (const { equals } of entry.cases) {\n        const key = expressionScalarKey(equals);\n        // A second case for one value can never be reached: cases are tried in order and the first match wins.\n        if (seen.has(key)) throw new Error(`${at}.cases: the value ${JSON.stringify(equals)} has more than one case, and only the first could ever apply.`);\n        seen.add(key);\n      }\n      for (const outcome of [...entry.cases.map((entryCase) => entryCase.then), entry.otherwise]) {\n        if (\n          outcome.kind === ExternalDataConditionalOutcomeKind.REMOTE_FIELD\n          && outcome.coercion === ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL\n          && dialect !== HttpApiTransportDialect.ODOO_JSONRPC\n        ) {\n          throw new Error(\n            `${at}: an outcome declares '${ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL}', Odoo's absent-as-false semantics, on a ${dialect} source.`,\n          );\n        }\n      }\n      return;\n    }\n    default:\n      return;\n  }\n}\n\n/**\n * Schema-INDEPENDENT coherence of a parsed declaration — the mainSchema-dependent half lives in\n * the resource-configuration factory (it needs the shape). Throws with the offending path named,\n * mirroring `assertHttpApiBindingDialectCoherence`'s contract.\n */\nexport function assertExternalDataPipelineDeclarationCoherence(declaration: ExternalDataPipelineDeclaration): void {\n  if (declaration.direction === ExternalDataPipelineDirection.OUTBOUND) {\n    assertExternalDataOutboundPipelineCoherence(declaration);\n    return;\n  }\n  const bidirectional = declaration.direction === ExternalDataPipelineDirection.BIDIRECTIONAL;\n  if (bidirectional) {\n    // Its SENDING half here; its LOADING half is an INBOUND pipeline's, checked by everything below.\n    assertExternalDataBidirectionalSendingCoherence(declaration);\n  } else {\n    if (declaration.conflictPolicy !== undefined) {\n      throw new Error(`conflictPolicy: decides a row changed on both sides, which only a BIDIRECTIONAL pipeline has. Remove it, or declare direction: BIDIRECTIONAL.`);\n    }\n    const owned = declaration.mapping.find((entry) => 'owner' in entry && entry.owner !== undefined);\n    if (owned !== undefined) {\n      throw new Error(\n        `mapping('${owned.localField}').owner: field ownership is declared on a BIDIRECTIONAL pipeline, where fields are loaded, sent or both. `\n        + `On an ${declaration.direction.toUpperCase()} pipeline every field travels one way; remove it.`,\n      );\n    }\n  }\n  /*\n   * #1679 — an INBOUND pipeline READS its source; nothing in that lane sends a write through its binding. An opened\n   * verb would be a declaration that decides nothing while reading like a write door. An OUTBOUND pipeline (#1690) is\n   * where a pipeline's binding opens writes.\n   */\n  if (!bidirectional && declaration.binding.writableVerbs.length > 0) {\n    throw new Error(\n      `binding.writableVerbs [${declaration.binding.writableVerbs.join(', ')}] opens writes on an INBOUND pipeline's source, which it `\n      + 'never sends. Declare direction: OUTBOUND to send local rows to the system of record, or put the writes on a read-through '\n      + '(HTTP_API) resource; otherwise remove writableVerbs from the pipeline binding.',\n    );\n  }\n  /*\n   * The S1 tenancy confinement was REMOVED here with `tenancy` itself (#1055).\n   *\n   * It refused any source that was not `SINGLE_TENANT_BINDING`, because a pushdown-tenancy source\n   * would have needed a declared remote-scope→organization mapping and a wrong assignment is a\n   * cross-tenant leak. That reasoning is intact; what changed is that the state it refused can no\n   * longer be declared. A pipeline's source is a system of record, a system of record has one owner\n   * organization, and the rows a LOAD writes are stamped with it (#868) rather than mapped from a\n   * remote scope field.\n   */\n\n  /*\n   * D-P10: extraction uses drift-safe paging ONLY — OData v4 follows the server's own `@odata.nextLink`,\n   * OData v2 walks the binding's key fields (#1687), Odoo walks an id keyset, and a REST_JSON source walks\n   * the KEYSET its `list` statement declares\n   * (#1686). Offset paging skips or doubles rows whenever the remote set shifts mid-run, so a REST\n   * source with no keyset — a parameter-based read, or a statement read with none declared — is refused:\n   * offset-only APIs have no drift-safe contract to walk.\n   *\n   * The keyset's own shape (one key field, a walkable codec, the page bound its language needs) is\n   * checked by `assertHttpApiBindingDialectCoherence`, which the factory runs on this binding too.\n   */\n  if (declaration.binding.dialect === HttpApiTransportDialect.REST_JSON && declaration.binding.operations.list.statement?.keyset === undefined) {\n    throw new Error(\n      'binding.operations.list: a REST_JSON pipeline source must walk a declared KEYSET — offset paging drifts under concurrent remote change '\n      + '(rows skipped or doubled), so a REST source is refused unless its list member reads through a query statement that declares '\n      + \"`keyset: { keyRemoteField: '<the key field>' }` (SOQL, SuiteQL). An API that pages by offset only, with no filterable key, \"\n      + 'cannot feed a pipeline; read it through a virtual resource instead.',\n    );\n  }\n\n  // Archive state is Odoo's (`active` / `active_test`); an OData service has no protocol-level\n  // equivalent, so the declaration would describe a mechanism the source does not have — and an\n  // EXCLUDE_FROM_LOAD reading a flag the rows never carry would reject every row.\n  if (\n    declaration.archivedRecords !== undefined\n    && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC\n  ) {\n    throw new Error(\n      `archivedRecords: declared on a ${declaration.binding.dialect} source — archived-record handling is Odoo's archive semantics (the 'active' field and the 'active_test' context) and applies to ODOO_JSONRPC sources only.`,\n    );\n  }\n\n  /*\n   * #1682 — an incremental mode is a mechanism of ONE dialect, and it needs a clock to run on.\n   *\n   * The dialect check is the engine's half: the Odoo mode compiles an Odoo domain, so declaring it on\n   * an OData source would compile nothing the source understands. Whether this VENDOR's deployments\n   * support the mode is the facet's half, refused at startup where the facet is in scope.\n   *\n   * `scheduleCron` is required because it is what runs incremental passes. Without it the declaration\n   * would describe a track nothing ever advances, while full passes ran alone on `fullPassCron` — an\n   * `incremental` block that changed nothing is the configuration-that-looks-like-a-control shape.\n   */\n  if (declaration.incremental !== undefined) {\n    const requiredDialect = EXTERNAL_DATA_INCREMENTAL_MODE_DIALECT[declaration.incremental.mode];\n    if (declaration.binding.dialect !== requiredDialect) {\n      throw new Error(\n        `incremental.mode: '${declaration.incremental.mode}' is spoken over ${requiredDialect} and this pipeline's source is `\n        + `${declaration.binding.dialect}. An OData v4 source reads changes through '${ExternalDataIncrementalExtractionMode.ODATA_MODIFIED_AT}' or `\n        + `'${ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK}'; an OData v2 or REST_JSON source has no incremental mode and runs FULL passes only.`,\n      );\n    }\n    if (declaration.incremental.mode === ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK) {\n      if (declaration.sourceFilter !== undefined) {\n        throw new Error(\n          `incremental.mode: '${ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK}' reads with change tracking, which refuses a $filter, so a `\n          + 'sourceFilter cannot be sent with it. Remove sourceFilter, or read changes with '\n          + `'${ExternalDataIncrementalExtractionMode.ODATA_MODIFIED_AT}', which filters.`,\n        );\n      }\n      if (declaration.binding.keyFields.length !== 1) {\n        throw new Error(\n          `incremental.mode: '${ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK}' needs a single key field: a deleted entity is reported by `\n          + `one id, which a composite key of ${declaration.binding.keyFields.length} components cannot be rebuilt from.`,\n        );\n      }\n    }\n    if (declaration.scheduleCron === undefined) {\n      throw new Error(\n        'incremental: declared without scheduleCron — incremental passes run on scheduleCron, so nothing would ever run one. '\n        + 'Declare scheduleCron (how often changes are read) beside incremental.fullPassCron (how often deletions are found).',\n      );\n    }\n  }\n\n  const localTargets = new Set<string>();\n  for (const entry of declaration.mapping) {\n    if (localTargets.has(entry.localField)) {\n      throw new Error(`mapping: local field '${entry.localField}' is targeted by more than one entry — one writer per field.`);\n    }\n    localTargets.add(entry.localField);\n\n    if (entry.localField === declaration.remoteKeyLocalField) {\n      throw new Error(\n        `mapping: local field '${entry.localField}' is the remoteKeyLocalField — the remote identity is written by the pipeline's L from the synthesized id, never by a mapping entry.`,\n      );\n    }\n\n    /*\n     * Same rule, one field over (#1058 E4): both partition fields are ENGINE-written, stamped by the\n     * transform from the assignment map. A mapping entry targeting one would be the second writer of\n     * a field whose value decides who may see the row — and, because the stamp runs after the\n     * mapping, an INERT one. An authoring mistake that silently does nothing is worse than one that\n     * fails: the author reads a declaration that looks like it decides the unit, and no run ever\n     * disagrees with them.\n     */\n    for (const [label, partitionField] of [\n      ['partitionUnitLocalField', declaration.partitionUnitLocalField],\n      ['partitionKeyLocalField', declaration.partitionKeyLocalField],\n    ] as const) {\n      if (partitionField !== undefined && entry.localField === partitionField) {\n        throw new Error(\n          `mapping: local field '${entry.localField}' is the ${label} — the partition stamp is written by the pipeline's T from the assignment map, never by a mapping entry.`,\n        );\n      }\n    }\n\n    if (\n      entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD\n      && entry.coercion === ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL\n      && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC\n    ) {\n      throw new Error(\n        `mapping('${entry.localField}').coercion: '${ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL}' names Odoo's absent-as-false semantics and is refused on a ${declaration.binding.dialect} source.`,\n      );\n    }\n\n    assertExternalDataExpressionEntryCoherence(entry, declaration.binding.dialect);\n\n    // #1684 — an Odoo many2one pair is Odoo's wire shape; declared on another dialect it would read the first\n    // element of a value that is not a pair and reject (or mis-resolve) every row.\n    if (\n      entry.kind === ExternalDataMappingEntryKind.REMOTE_REFERENCE\n      && entry.valueShape === ExternalDataRemoteReferenceValueShape.ODOO_MANY2ONE\n      && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC\n    ) {\n      throw new Error(\n        `mapping('${entry.localField}').valueShape: '${ExternalDataRemoteReferenceValueShape.ODOO_MANY2ONE}' is Odoo's many2one pair and is refused on a ${declaration.binding.dialect} source — declare '${ExternalDataRemoteReferenceValueShape.SCALAR}'.`,\n      );\n    }\n  }\n\n  /*\n   * TOGETHER or not at all (#1058 E4).\n   *\n   * Declaring only the unit field loses the orphan walk's protection — a row whose partition is\n   * later unassigned still carries a valid unit id, nothing says the edge is gone, and a DELETE\n   * orphan policy erases it. Declaring only the key field loses the confinement: the rows carry\n   * their remote partition and no unit, so narrowing has nothing to filter on and every member of\n   * the owner organization reads every subsidiary's rows. Neither half is useful alone, and both\n   * failures are silent.\n   */\n  const declaredPartitionFields = [\n    ['partitionUnitLocalField', declaration.partitionUnitLocalField] as const,\n    ['partitionKeyLocalField', declaration.partitionKeyLocalField] as const,\n  ].filter(([, value]) => value !== undefined);\n  if (declaredPartitionFields.length === 1) {\n    const [declaredLabel] = declaredPartitionFields[0]!;\n    const missingLabel = declaredLabel === 'partitionUnitLocalField' ? 'partitionKeyLocalField' : 'partitionUnitLocalField';\n    throw new Error(\n      `${declaredLabel} is declared without ${missingLabel} — the two partition fields answer different questions and neither is useful alone. `\n      + 'The unit is what narrowing confines a caller by; the remote key is what keeps an unassigned partition out of the orphan comparison, '\n      + 'because after an unassignment the unit id still resolves and says nothing.',\n    );\n  }\n  if (\n    declaration.partitionUnitLocalField !== undefined\n    && declaration.partitionUnitLocalField === declaration.partitionKeyLocalField\n  ) {\n    throw new Error(\n      'partitionUnitLocalField and partitionKeyLocalField name the same field — one would overwrite the other, and which survived would decide either who sees the row or whether it is deleted.',\n    );\n  }\n  for (const [label, partitionField] of [\n    ['partitionUnitLocalField', declaration.partitionUnitLocalField],\n    ['partitionKeyLocalField', declaration.partitionKeyLocalField],\n  ] as const) {\n    if (partitionField !== undefined && partitionField === declaration.remoteKeyLocalField) {\n      throw new Error(\n        `${label} names the remoteKeyLocalField — the row's IDENTITY and its PARTITION are different facts, and sharing a field would make the business key change when a row moves company.`,\n      );\n    }\n  }\n}\n\n/** Which side owns one mapping entry of a BIDIRECTIONAL pipeline (#1723): its declared `owner`, REMOTE when omitted. */\nexport function resolveExternalDataFieldOwner(entry: ExternalDataPipelineDeclaration['mapping'][number]): ExternalDataFieldOwner {\n  return 'owner' in entry && entry.owner !== undefined ? entry.owner : ExternalDataFieldOwner.REMOTE;\n}\n\n/** The conflict policy a BIDIRECTIONAL pipeline applies (#1723): its declared one, REFUSE_AND_REPORT when omitted. */\nexport function resolveExternalDataConflictPolicy(declaration: Pick<ExternalDataPipelineDeclaration, 'conflictPolicy'>): ExternalDataConflictPolicy {\n  return declaration.conflictPolicy ?? ExternalDataConflictPolicy.REFUSE_AND_REPORT;\n}\n\n/**\n * Whether a pipeline LOADS this entry: every entry of an INBOUND pipeline, and the REMOTE- and BOTH-owned entries of a\n * BIDIRECTIONAL one (#1723). An OUTBOUND pipeline loads nothing.\n */\nexport function externalDataEntryIsLoaded(direction: ExternalDataPipelineDirection, entry: ExternalDataPipelineDeclaration['mapping'][number]): boolean {\n  if (direction === ExternalDataPipelineDirection.OUTBOUND) return false;\n  if (direction === ExternalDataPipelineDirection.INBOUND) return true;\n  return resolveExternalDataFieldOwner(entry) !== ExternalDataFieldOwner.LOCAL;\n}\n\n/**\n * Whether a pipeline SENDS this entry: every entry of an OUTBOUND pipeline, and the LOCAL- and BOTH-owned entries of a\n * BIDIRECTIONAL one (#1723). An INBOUND pipeline sends nothing.\n */\nexport function externalDataEntryIsSent(direction: ExternalDataPipelineDirection, entry: ExternalDataPipelineDeclaration['mapping'][number]): boolean {\n  if (direction === ExternalDataPipelineDirection.INBOUND) return false;\n  if (direction === ExternalDataPipelineDirection.OUTBOUND) return true;\n  return resolveExternalDataFieldOwner(entry) !== ExternalDataFieldOwner.REMOTE;\n}\n\n/**\n * The SENDING half of a BIDIRECTIONAL pipeline's coherence (#1723) — the OUTBOUND rules, applied to the entries it sends.\n * Its loading half is an INBOUND pipeline's and is checked by the rules that follow in\n * {@link assertExternalDataPipelineDeclarationCoherence}.\n */\nfunction assertExternalDataBidirectionalSendingCoherence(declaration: ExternalDataPipelineDeclaration): void {\n  const opened = declaration.binding.writableVerbs;\n  if (!opened.includes(HttpApiWriteVerb.UPDATE)) {\n    throw new Error(\n      'binding.writableVerbs: a BIDIRECTIONAL pipeline sends the application\\'s changes of rows the system of record already holds, so it must '\n      + 'open UPDATE. Open CREATE as well to send rows born locally.',\n    );\n  }\n  const refusedVerbs = opened.filter((verb) => !EXTERNAL_DATA_OUTBOUND_WRITE_VERBS.has(verb));\n  if (refusedVerbs.length > 0) {\n    throw new Error(\n      `binding.writableVerbs: ${refusedVerbs.join(', ')} cannot be sent by a pipeline. A local delete is never sent: removing a record of the `\n      + \"system of record is its operator's decision, not the side effect of a local edit.\",\n    );\n  }\n  if (declaration.population === ExternalDataDestinationPopulation.CLOSED && opened.includes(HttpApiWriteVerb.CREATE)) {\n    throw new Error(\n      'binding.writableVerbs: CREATE sends rows born locally, and population CLOSED says every row comes from the system of record. Declare '\n      + 'population: OPEN if rows may be born here, or remove CREATE.',\n    );\n  }\n  if (declaration.binding.writeConcurrency?.mode === HttpApiWriteConcurrencyMode.VERSION_CHECKED) {\n    throw new Error(\n      `binding.writeConcurrency: '${HttpApiWriteConcurrencyMode.VERSION_CHECKED}' compares a version a CALLER read. A BIDIRECTIONAL pipeline checks `\n      + \"every update against the version it last reconciled with the system of record — the vendor's own row version — so there is no \"\n      + `caller version to declare. Declare '${HttpApiWriteConcurrencyMode.LAST_WRITER_WINS}'; a change on both sides is a conflict, decided by conflictPolicy.`,\n    );\n  }\n  if (declaration.binding.erasure.stance !== HttpApiErasureStance.NO_SUBJECT_DATA) {\n    throw new Error(\n      `binding.erasure: '${declaration.binding.erasure.stance}' promises what a subject erasure does to the records this pipeline sends, and `\n      + `no erasure reaches a sent record yet (#2030). Declare '${HttpApiErasureStance.NO_SUBJECT_DATA}' and send no field that describes a person.`,\n    );\n  }\n  const sent = declaration.mapping.filter((entry) => externalDataEntryIsSent(declaration.direction, entry));\n  if (sent.length === 0) {\n    throw new Error(\n      'mapping: a BIDIRECTIONAL pipeline declares at least one field it sends (owner: LOCAL or BOTH). With every field REMOTE it only loads — '\n      + 'declare it INBOUND.',\n    );\n  }\n  for (const entry of sent) {\n    const at = `mapping('${entry.localField}')`;\n    const owner = resolveExternalDataFieldOwner(entry);\n    if (!EXTERNAL_DATA_OUTBOUND_MAPPING_ENTRY_KINDS.has(entry.kind)) {\n      throw new Error(`${at}: a '${entry.kind}' entry has no inverse, so its field cannot be sent. Declare it owner: REMOTE (loaded only).`);\n    }\n    if (owner === ExternalDataFieldOwner.LOCAL && entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD) {\n      if (entry.required) throw new Error(`${at}.required: rejects a row whose REMOTE value is absent when loaded, and a LOCAL field is never loaded. Remove it.`);\n      if (entry.coercion !== ExternalDataFieldCoercion.NONE) {\n        throw new Error(`${at}.coercion: converts a value READ from the source, and a LOCAL field is never loaded. Remove it.`);\n      }\n    }\n    if (owner === ExternalDataFieldOwner.LOCAL && entry.kind === ExternalDataMappingEntryKind.REMOTE_REFERENCE\n      && entry.unresolved !== ExternalDataUnresolvedReferencePolicy.LEAVE_PENDING) {\n      throw new Error(`${at}.unresolved: rejects a row being LOADED, and a LOCAL reference is never loaded. Remove it.`);\n    }\n    if (declaration.partitionUnitLocalField !== undefined && entry.localField === declaration.partitionUnitLocalField) {\n      throw new Error(`${at}: '${entry.localField}' is the partitionUnitLocalField, which the engine derives; it is never sent as a field.`);\n    }\n    if (declaration.partitionKeyLocalField !== undefined && entry.localField === declaration.partitionKeyLocalField) {\n      throw new Error(`${at}: '${entry.localField}' is the partitionKeyLocalField, which the engine stamps; it is never sent as a field.`);\n    }\n  }\n}\n\n/**\n * The schema-INDEPENDENT coherence of an OUTBOUND pipeline (#1690); the destination-schema half (the sent fields are\n * the application's own and writable, the remote key accepts absence) is the resource factory's, and what needs the\n * system of record (the dialect can write, the facet's write prerequisites, the partition) is the resources\n * registry's, at startup. Every refusal names a declaration that would either send nothing or send something the\n * author cannot see.\n */\nfunction assertExternalDataOutboundPipelineCoherence(declaration: ExternalDataPipelineDeclaration): void {\n  const opened = declaration.binding.writableVerbs;\n  if (opened.length === 0) {\n    throw new Error(\n      \"binding.writableVerbs: an OUTBOUND pipeline sends writes, so its binding must open them — CREATE for a row with no remote key \"\n      + 'yet, UPDATE for one that has one. Declare the verbs this pipeline may send.',\n    );\n  }\n  // A row reaches the system of record by being CREATED there; its remote key comes only from that answer. An\n  // update-only pipeline would therefore never have a key to update, and would send nothing, ever.\n  if (!opened.includes(HttpApiWriteVerb.CREATE)) {\n    throw new Error(\n      'binding.writableVerbs: an OUTBOUND pipeline must open CREATE — a local row gets its remote key only from the create that sends it, '\n      + 'so an update-only pipeline would never have a key to update.',\n    );\n  }\n  /*\n   * Fail closed until an erasure reaches what an outbound pipeline SENT (#2030). A system of record receiving rows about\n   * people is their RECIPIENT, and nothing on the erasure path reaches the copy it holds yet — so the only stance this\n   * direction may declare is NO_SUBJECT_DATA, which the factory refuses beside any sent field declaring a personal-data\n   * category (#2010). Lifted by #2030, which wires the other two stances for sent rows.\n   */\n  if (declaration.binding.erasure.stance !== HttpApiErasureStance.NO_SUBJECT_DATA) {\n    throw new Error(\n      `binding.erasure: '${declaration.binding.erasure.stance}' promises what a subject erasure does to the records this pipeline sends, and `\n      + `no erasure reaches an OUTBOUND pipeline's records yet (#2030). Declare '${HttpApiErasureStance.NO_SUBJECT_DATA}' and send no field that `\n      + 'describes a person.',\n    );\n  }\n  const refusedVerbs = opened.filter((verb) => !EXTERNAL_DATA_OUTBOUND_WRITE_VERBS.has(verb));\n  if (refusedVerbs.length > 0) {\n    throw new Error(\n      `binding.writableVerbs: ${refusedVerbs.join(', ')} cannot be sent by an OUTBOUND pipeline. It sends a create for a row the system `\n      + 'of record does not have yet and an update for one it has; a local delete is never sent, because removing a record of the system '\n      + \"of record is its operator's decision, not the side effect of a local edit.\",\n    );\n  }\n  /*\n   * VERSION_CHECKED compares a version a CALLER read with the remote's. An outbound pass has no caller who read the\n   * remote row — it sends what the application holds — so the only honest stance is LAST_WRITER_WINS. Detecting that\n   * the remote changed since the last pass is a conflict, and deciding it is the BIDIRECTIONAL direction's (#1723).\n   */\n  if (declaration.binding.writeConcurrency?.mode === HttpApiWriteConcurrencyMode.VERSION_CHECKED) {\n    throw new Error(\n      `binding.writeConcurrency: '${HttpApiWriteConcurrencyMode.VERSION_CHECKED}' compares a version a caller read, and an OUTBOUND pass `\n      + `sends what the application holds without reading the remote row first for a caller. Declare '${HttpApiWriteConcurrencyMode.LAST_WRITER_WINS}': `\n      + 'the local row is the source. A row changed on both sides needs a conflict policy, which is a different direction.',\n    );\n  }\n\n  const inboundOnly: Array<[string, unknown]> = [\n    ['sourceFilter', declaration.sourceFilter],\n    ['incremental', declaration.incremental],\n    ['archivedRecords', declaration.archivedRecords],\n    ['partitionKeyLocalField', declaration.partitionKeyLocalField],\n  ];\n  for (const [field, value] of inboundOnly) {\n    if (value !== undefined) {\n      throw new Error(\n        `${field}: describes READING a source, and an OUTBOUND pipeline reads none — it sends the destination's rows. Remove it.`\n        + (field === 'partitionKeyLocalField'\n          ? ' The partition a created row lands in is derived at send time from the row\\'s organization unit (partitionUnitLocalField).'\n          : ''),\n      );\n    }\n  }\n\n  const localTargets = new Set<string>();\n  for (const entry of declaration.mapping) {\n    const at = `mapping('${entry.localField}')`;\n    if (!EXTERNAL_DATA_OUTBOUND_MAPPING_ENTRY_KINDS.has(entry.kind)) {\n      throw new Error(\n        `${at}: a '${entry.kind}' entry derives a local value from remote ones and has no inverse, so an OUTBOUND pipeline cannot send `\n        + `it. Declare '${ExternalDataMappingEntryKind.REMOTE_FIELD}' (a local field sent as one remote field) or `\n        + `'${ExternalDataMappingEntryKind.REMOTE_REFERENCE}' (a local foreign key sent as its target's remote key).`,\n      );\n    }\n    if (localTargets.has(entry.localField)) {\n      throw new Error(`mapping: local field '${entry.localField}' is sent by more than one entry — one remote field per local field.`);\n    }\n    localTargets.add(entry.localField);\n    if (entry.localField === declaration.remoteKeyLocalField) {\n      throw new Error(`${at}: '${entry.localField}' is the remoteKeyLocalField, which holds the remote key and is never sent as a field.`);\n    }\n    if (declaration.partitionUnitLocalField !== undefined && entry.localField === declaration.partitionUnitLocalField) {\n      throw new Error(\n        `${at}: '${entry.localField}' is the partitionUnitLocalField — the partition a created row lands in is derived from it at send time, `\n        + 'never sent as a field.',\n      );\n    }\n    if (entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD && entry.required) {\n      throw new Error(\n        `${at}.required: rejects a row whose REMOTE value is absent when it is loaded, and an OUTBOUND pipeline loads nothing. A local `\n        + 'field that must have a value says so on the destination schema, where every caller write is checked. Remove it.',\n      );\n    }\n    if (entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD && entry.coercion !== ExternalDataFieldCoercion.NONE) {\n      throw new Error(\n        `${at}.coercion: '${entry.coercion}' converts a value READ from the source, and an OUTBOUND pipeline reads nothing. The write `\n        + \"dialect sends each value in the vendor's own form (an Odoo datetime as 'YYYY-MM-DD HH:MM:SS'). Remove it.\",\n      );\n    }\n    if (entry.kind === ExternalDataMappingEntryKind.REMOTE_REFERENCE) {\n      if (entry.unresolved !== ExternalDataUnresolvedReferencePolicy.LEAVE_PENDING) {\n        throw new Error(\n          `${at}.unresolved: '${entry.unresolved}' rejects a row being LOADED, and an OUTBOUND pipeline loads none. A row whose reference `\n          + 'target has no remote key yet waits for a later pass, which is the only behaviour that sends it once it can be.',\n        );\n      }\n      /*\n       * `orphanCascadeAcknowledged` is ADMITTED here and means what it means inbound: the deletion it acknowledges is\n       * caused by the TARGET's pipeline (its orphan policy DELETE, cascading through this relationship's\n       * `onParentDelete`), which reaches an outbound destination's own rows just the same — the startup check\n       * (`describeExternalDataRemoteReferenceViolations`) demands it on either direction. It was refused here once, on\n       * the false ground that an outbound pipeline \"causes none\"; that left an author no way to state the intent the\n       * startup check asks for.\n       */\n      if (\n        entry.valueShape === ExternalDataRemoteReferenceValueShape.ODOO_MANY2ONE\n        && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC\n      ) {\n        throw new Error(\n          `${at}.valueShape: '${ExternalDataRemoteReferenceValueShape.ODOO_MANY2ONE}' is Odoo's many2one and is refused on a ${declaration.binding.dialect} target — declare '${ExternalDataRemoteReferenceValueShape.SCALAR}'.`,\n        );\n      }\n    }\n  }\n}\n"]}

package/dist/esm/external-data/external-data-provenance.shared.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Where a pipeline-written value came from, and how current it is (#1997) — the contract shared by the per-resource
+ * provenance route and the field chrome that shows it.
+ *
+ * ## What a reader is told, and why at PIPELINE grain
+ *
+ * A field an external-data pipeline writes renders exactly like any other read-only field, so nothing told the person
+ * reading it that the value belongs to a system of record rather than to this application, nor how old the local copy
+ * is. The cue answers both: "synced from ⟨instance⟩ · as of ⟨last completed pass⟩".
+ *
+ * The "as of" is the START of the pipeline's most recent COMPLETED PASS, never a per-row instant, because no honest
+ * per-row instant exists: the load reconciles by CONTENT, so an unchanged row is skipped and never written; the row's
+ * seed metadata records only the FIRST stamp; and `updatedAt` also moves when a member edits an application-owned field.
+ * After a completed pass, a row the pass loaded was current as of the moment the pass BEGAN reading — so the start of
+ * the pass, not the start of the run that finished it: a full pass bounded by `maxRowsPerRun` spans several runs, and a
+ * row read by the first of them is only as current as that first run. An incremental pass counts too: it re-read every
+ * row that changed, so present rows are current as of it (deletion detection is what a FULL pass adds).
+ *
+ * What the cue does NOT promise, stated so nobody reads more into it: it describes the PASS, not the row. A row the pass
+ * REJECTED keeps its previous version, and a row the source deleted stays in place under the REPORT orphan policy; both
+ * are older than the cue says. The run history names both (#1740).
+ */
+import { z } from 'zod';
+import { type ExternalDataPipelineDeclaration } from './external-data-pipeline.shared.schemas';
+/**
+ * Every LOCAL field whose value is a function of the remote row — the fields the provenance cue belongs on (#1997).
+ *
+ * - the remote key (`remoteKeyLocalField`);
+ * - every mapping entry that READS at least one remote field, whatever its kind — REMOTE_FIELD, REMOTE_REFERENCE and
+ *   the four declared expressions. Decided by {@link listExternalDataMappingEntryRemoteFields}, which is total over the
+ *   entry kinds, so a kind added tomorrow is classified by what it reads rather than by a list kept here;
+ * - both partition stamps: `partitionKeyLocalField` copies the remote partition verbatim, and
+ *   `partitionUnitLocalField` is the unit the remote partition is assigned to, so both change when the remote row does.
+ *
+ * Deliberately EXCLUDED:
+ * - a CONSTANT entry: the pipeline writes it, but its value is declared here, not synced from anywhere — saying
+ *   "synced from Odoo" over it would be false;
+ * - the tenant stamp (`organizationId`): engine-written from the owner organization, never from the remote row, and
+ *   never named by a declaration at all;
+ * - every field no mapping names (`internalNote` on Wonder Todos' `externalCustomers`): application-owned, the reason
+ *   the resource is a pipeline rather than a read-through.
+ *
+ * Only TOP-LEVEL field names: a mapping entry targets a top-level local field, so a nested path is never pipeline-written.
+ *
+ * EMPTY for an OUTBOUND pipeline (#1690): its mapped fields are the application's own and are SENT to the system of
+ * record, never synced from it, so "synced from ⟨instance⟩" would be false on every one of them — and the route is not
+ * mounted for it either. The remote key it holds is the address of the copy the system of record keeps, not a value
+ * read from it.
+ */
+export declare function listExternalDataPipelineSyncedLocalFields(declaration: ExternalDataPipelineDeclaration): readonly string[];
+/**
+ * The path segment of the provenance route, appended to the destination's LIST collection URL:
+ * `GET /api/v1/…/<resource>/external-data-provenance`. One constant, so the backend that mounts the route and the
+ * frontend that composes its URL describe one path rather than two that happen to agree.
+ */
+export declare const EXTERNAL_DATA_PROVENANCE_ROUTE_SEGMENT = "external-data-provenance";
+/**
+ * What the provenance route answers.
+ *
+ * `system` is the declared instance NAME, not words: a reader resolves the words through
+ * `buildSystemOfRecordDisplayNameLabelKey(system)`. `currentAsOf` is when the most recent COMPLETED pass began reading
+ * (ISO 8601) — the first run of that pass, not the run that finished it — or null when the pipeline has never completed
+ * one, or when its history no longer reaches back to where that pass began; a surface then says nothing rather than
+ * implying a currency the copy does not have.
+ */
+export declare const ExternalDataProvenanceResponseSchema: z.ZodObject<{
+    system: z.ZodString;
+    currentAsOf: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type ExternalDataProvenanceResponse = z.infer<typeof ExternalDataProvenanceResponseSchema>;
+//# sourceMappingURL=external-data-provenance.shared.d.ts.map

package/dist/esm/external-data/external-data-provenance.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-data-provenance.shared.d.ts","sourceRoot":"","sources":["../../../../src/external-data/external-data-provenance.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAKL,KAAK,+BAA+B,EACrC,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yCAAyC,CAAC,WAAW,EAAE,+BAA+B,GAAG,SAAS,MAAM,EAAE,CAYzH;AAED;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,6BAA6B,CAAC;AAEjF;;;;;;;;GAQG;AACH,eAAO,MAAM,oCAAoC;;;kBAG/C,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}

package/dist/esm/external-data/external-data-provenance.shared.js

@@ -0,0 +1,88 @@
+/**
+ * Where a pipeline-written value came from, and how current it is (#1997) — the contract shared by the per-resource
+ * provenance route and the field chrome that shows it.
+ *
+ * ## What a reader is told, and why at PIPELINE grain
+ *
+ * A field an external-data pipeline writes renders exactly like any other read-only field, so nothing told the person
+ * reading it that the value belongs to a system of record rather than to this application, nor how old the local copy
+ * is. The cue answers both: "synced from ⟨instance⟩ · as of ⟨last completed pass⟩".
+ *
+ * The "as of" is the START of the pipeline's most recent COMPLETED PASS, never a per-row instant, because no honest
+ * per-row instant exists: the load reconciles by CONTENT, so an unchanged row is skipped and never written; the row's
+ * seed metadata records only the FIRST stamp; and `updatedAt` also moves when a member edits an application-owned field.
+ * After a completed pass, a row the pass loaded was current as of the moment the pass BEGAN reading — so the start of
+ * the pass, not the start of the run that finished it: a full pass bounded by `maxRowsPerRun` spans several runs, and a
+ * row read by the first of them is only as current as that first run. An incremental pass counts too: it re-read every
+ * row that changed, so present rows are current as of it (deletion detection is what a FULL pass adds).
+ *
+ * What the cue does NOT promise, stated so nobody reads more into it: it describes the PASS, not the row. A row the pass
+ * REJECTED keeps its previous version, and a row the source deleted stays in place under the REPORT orphan policy; both
+ * are older than the cue says. The run history names both (#1740).
+ */
+import { z } from 'zod';
+import { SystemOfRecordNameSchema } from '../systems-of-record/system-of-record-declaration.shared.schemas.js';
+import { ExternalDataFieldOwner, ExternalDataPipelineDirection, listExternalDataMappingEntryRemoteFields, resolveExternalDataFieldOwner, } from './external-data-pipeline.shared.schemas.js';
+/**
+ * Every LOCAL field whose value is a function of the remote row — the fields the provenance cue belongs on (#1997).
+ *
+ * - the remote key (`remoteKeyLocalField`);
+ * - every mapping entry that READS at least one remote field, whatever its kind — REMOTE_FIELD, REMOTE_REFERENCE and
+ *   the four declared expressions. Decided by {@link listExternalDataMappingEntryRemoteFields}, which is total over the
+ *   entry kinds, so a kind added tomorrow is classified by what it reads rather than by a list kept here;
+ * - both partition stamps: `partitionKeyLocalField` copies the remote partition verbatim, and
+ *   `partitionUnitLocalField` is the unit the remote partition is assigned to, so both change when the remote row does.
+ *
+ * Deliberately EXCLUDED:
+ * - a CONSTANT entry: the pipeline writes it, but its value is declared here, not synced from anywhere — saying
+ *   "synced from Odoo" over it would be false;
+ * - the tenant stamp (`organizationId`): engine-written from the owner organization, never from the remote row, and
+ *   never named by a declaration at all;
+ * - every field no mapping names (`internalNote` on Wonder Todos' `externalCustomers`): application-owned, the reason
+ *   the resource is a pipeline rather than a read-through.
+ *
+ * Only TOP-LEVEL field names: a mapping entry targets a top-level local field, so a nested path is never pipeline-written.
+ *
+ * EMPTY for an OUTBOUND pipeline (#1690): its mapped fields are the application's own and are SENT to the system of
+ * record, never synced from it, so "synced from ⟨instance⟩" would be false on every one of them — and the route is not
+ * mounted for it either. The remote key it holds is the address of the copy the system of record keeps, not a value
+ * read from it.
+ */
+export function listExternalDataPipelineSyncedLocalFields(declaration) {
+    if (declaration.direction === ExternalDataPipelineDirection.OUTBOUND)
+        return [];
+    const fields = new Set([declaration.remoteKeyLocalField]);
+    if (declaration.partitionKeyLocalField)
+        fields.add(declaration.partitionKeyLocalField);
+    if (declaration.partitionUnitLocalField)
+        fields.add(declaration.partitionUnitLocalField);
+    for (const entry of declaration.mapping) {
+        // A BIDIRECTIONAL pipeline's LOCAL and BOTH fields are written here too (#1723): only a REMOTE field is the system
+        // of record's copy, so only it carries the "synced from" note.
+        if (declaration.direction === ExternalDataPipelineDirection.BIDIRECTIONAL && resolveExternalDataFieldOwner(entry) !== ExternalDataFieldOwner.REMOTE)
+            continue;
+        if (listExternalDataMappingEntryRemoteFields(entry).length > 0)
+            fields.add(entry.localField);
+    }
+    return [...fields];
+}
+/**
+ * The path segment of the provenance route, appended to the destination's LIST collection URL:
+ * `GET /api/v1/…/<resource>/external-data-provenance`. One constant, so the backend that mounts the route and the
+ * frontend that composes its URL describe one path rather than two that happen to agree.
+ */
+export const EXTERNAL_DATA_PROVENANCE_ROUTE_SEGMENT = 'external-data-provenance';
+/**
+ * What the provenance route answers.
+ *
+ * `system` is the declared instance NAME, not words: a reader resolves the words through
+ * `buildSystemOfRecordDisplayNameLabelKey(system)`. `currentAsOf` is when the most recent COMPLETED pass began reading
+ * (ISO 8601) — the first run of that pass, not the run that finished it — or null when the pipeline has never completed
+ * one, or when its history no longer reaches back to where that pass began; a surface then says nothing rather than
+ * implying a currency the copy does not have.
+ */
+export const ExternalDataProvenanceResponseSchema = z.strictObject({
+    system: SystemOfRecordNameSchema,
+    currentAsOf: z.iso.datetime().nullable(),
+});
+//# sourceMappingURL=external-data-provenance.shared.js.map

package/dist/esm/external-data/external-data-provenance.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-data-provenance.shared.js","sourceRoot":"","sources":["../../../../src/external-data/external-data-provenance.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,wCAAwC,EACxC,6BAA6B,GAE9B,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yCAAyC,CAAC,WAA4C;IACpG,IAAI,WAAW,CAAC,SAAS,KAAK,6BAA6B,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAClE,IAAI,WAAW,CAAC,sBAAsB;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;IACvF,IAAI,WAAW,CAAC,uBAAuB;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IACzF,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACxC,mHAAmH;QACnH,+DAA+D;QAC/D,IAAI,WAAW,CAAC,SAAS,KAAK,6BAA6B,CAAC,aAAa,IAAI,6BAA6B,CAAC,KAAK,CAAC,KAAK,sBAAsB,CAAC,MAAM;YAAE,SAAS;QAC9J,IAAI,wCAAwC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,0BAA0B,CAAC;AAEjF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,MAAM,EAAE,wBAAwB;IAChC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC","sourcesContent":["/**\n * Where a pipeline-written value came from, and how current it is (#1997) — the contract shared by the per-resource\n * provenance route and the field chrome that shows it.\n *\n * ## What a reader is told, and why at PIPELINE grain\n *\n * A field an external-data pipeline writes renders exactly like any other read-only field, so nothing told the person\n * reading it that the value belongs to a system of record rather than to this application, nor how old the local copy\n * is. The cue answers both: \"synced from ⟨instance⟩ · as of ⟨last completed pass⟩\".\n *\n * The \"as of\" is the START of the pipeline's most recent COMPLETED PASS, never a per-row instant, because no honest\n * per-row instant exists: the load reconciles by CONTENT, so an unchanged row is skipped and never written; the row's\n * seed metadata records only the FIRST stamp; and `updatedAt` also moves when a member edits an application-owned field.\n * After a completed pass, a row the pass loaded was current as of the moment the pass BEGAN reading — so the start of\n * the pass, not the start of the run that finished it: a full pass bounded by `maxRowsPerRun` spans several runs, and a\n * row read by the first of them is only as current as that first run. An incremental pass counts too: it re-read every\n * row that changed, so present rows are current as of it (deletion detection is what a FULL pass adds).\n *\n * What the cue does NOT promise, stated so nobody reads more into it: it describes the PASS, not the row. A row the pass\n * REJECTED keeps its previous version, and a row the source deleted stays in place under the REPORT orphan policy; both\n * are older than the cue says. The run history names both (#1740).\n */\nimport { z } from 'zod';\nimport { SystemOfRecordNameSchema } from '../systems-of-record/system-of-record-declaration.shared.schemas';\nimport {\n  ExternalDataFieldOwner,\n  ExternalDataPipelineDirection,\n  listExternalDataMappingEntryRemoteFields,\n  resolveExternalDataFieldOwner,\n  type ExternalDataPipelineDeclaration,\n} from './external-data-pipeline.shared.schemas';\n\n/**\n * Every LOCAL field whose value is a function of the remote row — the fields the provenance cue belongs on (#1997).\n *\n * - the remote key (`remoteKeyLocalField`);\n * - every mapping entry that READS at least one remote field, whatever its kind — REMOTE_FIELD, REMOTE_REFERENCE and\n *   the four declared expressions. Decided by {@link listExternalDataMappingEntryRemoteFields}, which is total over the\n *   entry kinds, so a kind added tomorrow is classified by what it reads rather than by a list kept here;\n * - both partition stamps: `partitionKeyLocalField` copies the remote partition verbatim, and\n *   `partitionUnitLocalField` is the unit the remote partition is assigned to, so both change when the remote row does.\n *\n * Deliberately EXCLUDED:\n * - a CONSTANT entry: the pipeline writes it, but its value is declared here, not synced from anywhere — saying\n *   \"synced from Odoo\" over it would be false;\n * - the tenant stamp (`organizationId`): engine-written from the owner organization, never from the remote row, and\n *   never named by a declaration at all;\n * - every field no mapping names (`internalNote` on Wonder Todos' `externalCustomers`): application-owned, the reason\n *   the resource is a pipeline rather than a read-through.\n *\n * Only TOP-LEVEL field names: a mapping entry targets a top-level local field, so a nested path is never pipeline-written.\n *\n * EMPTY for an OUTBOUND pipeline (#1690): its mapped fields are the application's own and are SENT to the system of\n * record, never synced from it, so \"synced from ⟨instance⟩\" would be false on every one of them — and the route is not\n * mounted for it either. The remote key it holds is the address of the copy the system of record keeps, not a value\n * read from it.\n */\nexport function listExternalDataPipelineSyncedLocalFields(declaration: ExternalDataPipelineDeclaration): readonly string[] {\n  if (declaration.direction === ExternalDataPipelineDirection.OUTBOUND) return [];\n  const fields = new Set<string>([declaration.remoteKeyLocalField]);\n  if (declaration.partitionKeyLocalField) fields.add(declaration.partitionKeyLocalField);\n  if (declaration.partitionUnitLocalField) fields.add(declaration.partitionUnitLocalField);\n  for (const entry of declaration.mapping) {\n    // A BIDIRECTIONAL pipeline's LOCAL and BOTH fields are written here too (#1723): only a REMOTE field is the system\n    // of record's copy, so only it carries the \"synced from\" note.\n    if (declaration.direction === ExternalDataPipelineDirection.BIDIRECTIONAL && resolveExternalDataFieldOwner(entry) !== ExternalDataFieldOwner.REMOTE) continue;\n    if (listExternalDataMappingEntryRemoteFields(entry).length > 0) fields.add(entry.localField);\n  }\n  return [...fields];\n}\n\n/**\n * The path segment of the provenance route, appended to the destination's LIST collection URL:\n * `GET /api/v1/…/<resource>/external-data-provenance`. One constant, so the backend that mounts the route and the\n * frontend that composes its URL describe one path rather than two that happen to agree.\n */\nexport const EXTERNAL_DATA_PROVENANCE_ROUTE_SEGMENT = 'external-data-provenance';\n\n/**\n * What the provenance route answers.\n *\n * `system` is the declared instance NAME, not words: a reader resolves the words through\n * `buildSystemOfRecordDisplayNameLabelKey(system)`. `currentAsOf` is when the most recent COMPLETED pass began reading\n * (ISO 8601) — the first run of that pass, not the run that finished it — or null when the pipeline has never completed\n * one, or when its history no longer reaches back to where that pass began; a surface then says nothing rather than\n * implying a currency the copy does not have.\n */\nexport const ExternalDataProvenanceResponseSchema = z.strictObject({\n  system: SystemOfRecordNameSchema,\n  currentAsOf: z.iso.datetime().nullable(),\n});\nexport type ExternalDataProvenanceResponse = z.infer<typeof ExternalDataProvenanceResponseSchema>;\n"]}

package/dist/esm/external-data.exports.d.ts

@@ -26,6 +26,11 @@
  * it from shared code. Identity is not an integration concern.
  */
 export * from './http-api-binding/http-api-binding.shared.schemas';
+export * from './http-api-binding/http-api-rest-write-operations.shared.schemas';
 export * from './systems-of-record/system-of-record-facet.shared.schemas';
+export * from './systems-of-record/system-of-record-actions.shared.schemas';
 export * from './external-data/external-data-pipeline.shared.schemas';
+export * from './external-data/external-data-pipeline-description.shared';
+export * from './external-data/external-data-provenance.shared';
+export * from './resources/utils/http-api-write-declaration.shared.utils';
 //# sourceMappingURL=external-data.exports.d.ts.map

package/dist/esm/external-data.exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-data.exports.d.ts","sourceRoot":"","sources":["../../../src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AACnE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,uDAAuD,CAAC"}
+{"version":3,"file":"external-data.exports.d.ts","sourceRoot":"","sources":["../../../src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AAEnE,cAAc,kEAAkE,CAAC;AACjF,cAAc,2DAA2D,CAAC;AAE1E,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AAEtE,cAAc,2DAA2D,CAAC;AAE1E,cAAc,iDAAiD,CAAC;AAGhE,cAAc,2DAA2D,CAAC"}

package/dist/esm/external-data.exports.js

@@ -26,6 +26,17 @@
  * it from shared code. Identity is not an integration concern.
  */
 export * from './http-api-binding/http-api-binding.shared.schemas.js';
+// How a REST_JSON binding declares its row writes (#1728): method, path and where a create answers its key.
+export * from './http-api-binding/http-api-rest-write-operations.shared.schemas.js';
 export * from './systems-of-record/system-of-record-facet.shared.schemas.js';
+// Declared vendor ACTIONS of a system of record (#1678): the declaration a binding carries and its authoring checks.
+export * from './systems-of-record/system-of-record-actions.shared.schemas.js';
 export * from './external-data/external-data-pipeline.shared.schemas.js';
+// A pipeline declaration described for a reader — the resource specification's derived pipeline slice (#1685).
+export * from './external-data/external-data-pipeline-description.shared.js';
+// Where a pipeline-written value came from and how current it is (#1997): the synced-field set, the route segment, the answer.
+export * from './external-data/external-data-provenance.shared.js';
+// The write-declaration contract of a read-through resource (#1679): the verb ↔ core-operation map the
+// repository dispatches by, and the authoring rules the resource factory applies.
+export * from './resources/utils/http-api-write-declaration.shared.utils.js';
 //# sourceMappingURL=external-data.exports.js.map

package/dist/esm/external-data.exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-data.exports.js","sourceRoot":"","sources":["../../../src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AACnE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,uDAAuD,CAAC","sourcesContent":["/**\n * `@wildo-ai/saas-models/external-data` — the AUTHORING contract for data that lives in another\n * system: the read-through VIRTUAL binding (`httpApiBinding`) and the copy-in PIPELINE\n * (`externalDataPipeline`).\n *\n * ## Why this is a subpath rather than root, and why it is not in `saas-backend-lib`\n *\n * Both questions were measured on 2026-08-29 rather than argued.\n *\n * It is NOT backend-lib, even though only the backend has a runtime for it, because an application\n * author writes these declarations in `*.resources-config.ts` — which lives in the app's\n * `shared-lib`, a package that depends on `@wildo-ai/saas-models` and deliberately NOT on\n * `@wildo-ai/saas-backend-lib` (the frontend imports `shared-lib`, so a backend dependency there\n * would drag the backend graph browser-ward). Nothing in these modules is runtime: every symbol —\n * dialects, tenancy, erasure, key fields, population, orphan policy, coercions — is typed by a\n * human in a schema file. The runtime that consumes them (read client, extraction source,\n * transform, run service, batch) is already backend-only.\n *\n * It IS a subpath rather than the root barrel because only two audiences need it — the app author\n * declaring a resource, and the backend executing it — while the root is imported by every\n * consumer of the resource model, including packages that will never speak to a remote system.\n * Keeping it out of the root shrinks what they see without moving where it lives.\n *\n * ROW IDENTITY deliberately stays in the ROOT (`http-api-binding-id.shared.utils`): a synthesized\n * id appears in URLs and frontend routing, and `ResourcesConfigUtils.isHttpApiSynthesizedId` reads\n * it from shared code. Identity is not an integration concern.\n */\nexport * from './http-api-binding/http-api-binding.shared.schemas';\nexport * from './systems-of-record/system-of-record-facet.shared.schemas';\nexport * from './external-data/external-data-pipeline.shared.schemas';\n"]}
+{"version":3,"file":"external-data.exports.js","sourceRoot":"","sources":["../../../src/external-data.exports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,cAAc,oDAAoD,CAAC;AACnE,4GAA4G;AAC5G,cAAc,kEAAkE,CAAC;AACjF,cAAc,2DAA2D,CAAC;AAC1E,qHAAqH;AACrH,cAAc,6DAA6D,CAAC;AAC5E,cAAc,uDAAuD,CAAC;AACtE,+GAA+G;AAC/G,cAAc,2DAA2D,CAAC;AAC1E,+HAA+H;AAC/H,cAAc,iDAAiD,CAAC;AAChE,uGAAuG;AACvG,kFAAkF;AAClF,cAAc,2DAA2D,CAAC","sourcesContent":["/**\n * `@wildo-ai/saas-models/external-data` — the AUTHORING contract for data that lives in another\n * system: the read-through VIRTUAL binding (`httpApiBinding`) and the copy-in PIPELINE\n * (`externalDataPipeline`).\n *\n * ## Why this is a subpath rather than root, and why it is not in `saas-backend-lib`\n *\n * Both questions were measured on 2026-08-29 rather than argued.\n *\n * It is NOT backend-lib, even though only the backend has a runtime for it, because an application\n * author writes these declarations in `*.resources-config.ts` — which lives in the app's\n * `shared-lib`, a package that depends on `@wildo-ai/saas-models` and deliberately NOT on\n * `@wildo-ai/saas-backend-lib` (the frontend imports `shared-lib`, so a backend dependency there\n * would drag the backend graph browser-ward). Nothing in these modules is runtime: every symbol —\n * dialects, tenancy, erasure, key fields, population, orphan policy, coercions — is typed by a\n * human in a schema file. The runtime that consumes them (read client, extraction source,\n * transform, run service, batch) is already backend-only.\n *\n * It IS a subpath rather than the root barrel because only two audiences need it — the app author\n * declaring a resource, and the backend executing it — while the root is imported by every\n * consumer of the resource model, including packages that will never speak to a remote system.\n * Keeping it out of the root shrinks what they see without moving where it lives.\n *\n * ROW IDENTITY deliberately stays in the ROOT (`http-api-binding-id.shared.utils`): a synthesized\n * id appears in URLs and frontend routing, and `ResourcesConfigUtils.isHttpApiSynthesizedId` reads\n * it from shared code. Identity is not an integration concern.\n */\nexport * from './http-api-binding/http-api-binding.shared.schemas';\n// How a REST_JSON binding declares its row writes (#1728): method, path and where a create answers its key.\nexport * from './http-api-binding/http-api-rest-write-operations.shared.schemas';\nexport * from './systems-of-record/system-of-record-facet.shared.schemas';\n// Declared vendor ACTIONS of a system of record (#1678): the declaration a binding carries and its authoring checks.\nexport * from './systems-of-record/system-of-record-actions.shared.schemas';\nexport * from './external-data/external-data-pipeline.shared.schemas';\n// A pipeline declaration described for a reader — the resource specification's derived pipeline slice (#1685).\nexport * from './external-data/external-data-pipeline-description.shared';\n// Where a pipeline-written value came from and how current it is (#1997): the synced-field set, the route segment, the answer.\nexport * from './external-data/external-data-provenance.shared';\n// The write-declaration contract of a read-through resource (#1679): the verb ↔ core-operation map the\n// repository dispatches by, and the authoring rules the resource factory applies.\nexport * from './resources/utils/http-api-write-declaration.shared.utils';\n"]}