npm - @wildo-ai/saas-models - Versions diffs - 1.1.5 → 1.1.6 - Mend

@wildo-ai/saas-models 1.1.5 → 1.1.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (888) hide show

package/dist/esm/http-api-binding/http-api-binding.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"http-api-binding.shared.schemas.js","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-binding.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,mCAAmC;AACnC,oBAAoB;AACpB,mCAAmC;AAEnC,4GAA4G;AAE5G,mCAAmC;AACnC,oCAAoC;AACpC,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,mCAAmC;AACnC,sDAAsD;AACtD,mCAAmC;AAEnC;;;;;GAKG;AACH,MAAM,CAAN,IAAY,oBAsBX;AAtBD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,2DAAmC,CAAA;IAEnC;;;;OAIG;IACH,iFAAyD,CAAA;IAEzD;;;;;OAKG;IACH,mGAA2E,CAAA;AAC7E,CAAC,EAtBW,oBAAoB,KAApB,oBAAoB,QAsB/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,mCAAmC;AACnC,+CAA+C;AAC/C,mCAAmC;AAEnC;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,wBAgBX;AAhBD,WAAY,wBAAwB;IAClC,+FAA+F;IAC/F,6CAAiB,CAAA;IAEjB,kFAAkF;IAClF,+CAAmB,CAAA;IAEnB,2EAA2E;IAC3E,yCAAa,CAAA;IAEb;;;;OAIG;IACH,yDAA6B,CAAA;AAC/B,CAAC,EAhBW,wBAAwB,KAAxB,wBAAwB,QAgBnC;AACD,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,+EAA+E;IAC/E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B,4DAA4D;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;CACxC,CAAC,CAAC;AAIH,mCAAmC;AACnC,gBAAgB;AAChB,mCAAmC;AAEnC;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAIH,mCAAmC;AACnC,yDAAyD;AACzD,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,wBAAwB;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEnE;;;OAGG;IACH,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KAChE,CAAC;SACD,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAE9C;;;OAGG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE5D;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9D;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CACzE,CAAC,CAAC;AAIH,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,yCAAW,CAAA;IACX,2CAAa,CAAA;AACf,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,6BAsBX;AAtBD,WAAY,6BAA6B;IACvC;;;;;;;;;OASG;IACH,8CAAa,CAAA;IACb;;;;;;;;OAQG;IACH,oDAAmB,CAAA;AACrB,CAAC,EAtBW,6BAA6B,KAA7B,6BAA6B,QAsBxC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAC/C;;;;;;;;;OASG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,kDAAkD;IAClD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE1C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,iFAAiF;IACjF,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,QAAQ,EAAE;IAEb;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvE;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEzC;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC,2EAA2E;IAC3E,eAAe,EAAE,CAAC;SACf,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;SACD,QAAQ,EAAE;IAEb;;;;;;;OAOG;IACH,SAAS,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAErD;;;;;;;;;;OAUG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,8BAA8B,CAAC;AAIpF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,qCAAqC;IAC3C,2FAA2F;IAC3F,KAAK,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACvD,mDAAmD;IACnD,MAAM,EAAE,qCAAqC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAIH,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,8CAAa,CAAA;IACb,kDAAiB,CAAA;AACnB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAE7C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B;;;OAGG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAIH,qFAAqF;AACrF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC5E,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,eAAe,CAAC;KACxD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC;QAClE;;;;;WAKG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,iCAAiC;SAClC,CAAC;QACF;;;;;;;;;;WAUG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAChD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,mCAAmC,CAAC;QAC3E;;;;;;WAMG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;CACH,CAAC,CAAC;AAIH,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC,MAAM,+BAA+B,GAAG;IACtC;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzB;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B;;;;;;;;;;OAUG;IAEH,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,oEAAoE;IACpE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D;;;;;;;;;;;;OAYG;IAEH,yDAAyD;IACzD,OAAO,EAAE,+BAA+B;IAExC,uCAAuC;IACvC,mBAAmB,EAAE,gCAAgC,CAAC,OAAO,CAAC;QAC5D,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACzC,YAAY,EAAE,EAAE;QAChB,mBAAmB,EAAE,GAAG;KACzB,CAAC;CACH,CAAC;AAEF;;;;;;;;GAQG;AACH,4GAA4G;AAC5G,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC1E,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACjD,GAAG,+BAA+B;QAClC;;;;;;;;;;;WAWG;KACJ,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC;QACrD,GAAG,+BAA+B;QAClC,8EAA8E;QAC9E,UAAU,EAAE,2BAA2B;KACxC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,YAAY,CAAC;QACxD,GAAG,+BAA+B;QAClC,4FAA4F;QAC5F,6FAA6F;QAC7F,0FAA0F;QAC1F,6FAA6F;QAC7F,uDAAuD;KACxD,CAAC;CACH,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAA+B;IAClF,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EAAE,CAAC;QAC7D,0FAA0F;QAC1F,6BAA6B;QAC7B,IACE,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;eAC3B,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,wBAAwB,CAAC,OAAO,EAClE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kIAAkI,CACnI,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,IAAI,WAAW,KAAK,SAAS;gBAAE,SAAS;YACxC,IAAK,WAAuC,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;gBAC/E,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,2EAA2E;sBAC7F,kGAAkG;sBAClG,+DAA+D,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,gGAAgG;IAChG,iEAAiE;IACjE,yFAAyF;IACzF,6FAA6F;IAC7F,mDAAmD;IACnD,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,0BAA0B,EAAE,CAAC;QAC/E,MAAM,mBAAmB,GAAG,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9E,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,mBAAmB,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CACb,iKAAiK,CAClK,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,OAAO,qKAAqK,CAC7M,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAcD,mCAAmC;AACnC,4BAA4B;AAC5B,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,wBAAwB,GAAwC;IACpE,wBAAwB,CAAC,OAAO;IAChC,wBAAwB,CAAC,IAAI;CAC9B,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAkD;IAElD,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;WAC3B,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CACjE,CAAC;AACJ,CAAC","sourcesContent":["/*\n HTTP-API persistence binding — the declaration model for resources whose rows live in a system\n * reached over an authenticated HTTP API (`PersistenceAdapter.HTTP_API`) rather than in a\n * platform-provisioned database.\n \n Design source of truth: `.claude/plans/etl-post-repository.md` (decisions D0/D1/D6/D9/D10,\n * requirements R7/R12/R15/R16) plus the two companion papers\n * `.claude/plans/etl-composite-key-synthesis.md` (key declaration + id codec) and\n * `.claude/plans/etl-filter-dialect-scope-down.md` (declared filter/sort/search surface).\n \n The binding is a REQUIRED companion declaration on any resource configuration that selects\n * `PersistenceAdapter.HTTP_API`. It answers, statically and per resource:\n * - WHICH declared system of record the rows live in (`system`), and WHICH remote entity inside it;\n * - HOW a row is identified (ordered key components → the synthesized engine-facing `_id`);\n * - WHAT the erasure story is (all three stances are first-class; none is silently defaulted);\n * - WHICH remote-call semantics apply (timeout, retry, rate budget, id-set bound).\n \n ## Three questions this used to answer and no longer does (#1055)\n \n WHOSE ACCOUNT (`connection`), WHERE the deployment is (`providerRef`) and HOW TENANCY is expressed\n * remotely (`tenancy`) all left in the same change, and none of them was replaced by a smaller field:\n \n - WHOSE ACCOUNT has one legal answer for a system of record — the application's own service\n * identity (D12). The customer-connection case is case 2 of #1049 and keeps the connector lane.\n * - WHERE is a property of the declared INSTANCE (`systemsOfRecord.<name>`) and of the ENVIRONMENT,\n * not of each resource. That is what lets two instances of one vendor exist at all.\n * - TENANCY became a STAMP rather than a declaration: the row projector writes the owner\n * organization's id onto every remote row, so the per-row gate passes with no exemption.\n \n Credentials are NEVER declared here. They resolve at runtime through the systems-of-record\n * registry, from environment variables DERIVED from the instance name — the binding carries only the\n * name.\n /\n\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from './http-api-transport-dialect.shared';\n\n// --------------------------------\n// Transport dialect\n// --------------------------------\n\n/* @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer /\n\n// --------------------------------\n// Whose identity reaches the target\n// --------------------------------\n\n/\n * ─── `HttpApiIdentityMode` was REMOVED here (#333), and replaced rather than widened ────────────\n \n It had two values — `SERVICE_PRINCIPAL` and `USER_DELEGATED` — and its own docstring said it\n * stayed declared \"so bindings need no reshape when it arrives\". That is the one thing it got\n * wrong. `USER_DELEGATED` names a delegation without naming WHOSE ACCOUNT is spent, and those are\n * two independent questions with five real answers (`ExternalProvider_ConnectionShape`):\n \n - a user's own personal grant is `USER × SERVICE`;\n * - one member's own account, linked for the whole organization, is `ORGANIZATION × USER`\n * (decided on wildo-ai/wildo-ai#18: every member spends it, and the linking member is named in\n * the audit trail).\n \n Both are \"per-user OAuth against the target\", they resolve DIFFERENT credentials, and the single\n * field cannot distinguish them. So mapping it onto a target would have silently picked a lane —\n * which is why `connectionTargetForBinding` refused instead of guessing, and why the fix is the\n * richer vocabulary rather than a translation table.\n \n The audit contract is unchanged and was never the identity mode's to keep: every row carries the\n * REAL initiating user whatever the connection, so the shared-principal attribution failure\n * documented for Power Platform (\"credential-sharing as a service\") stays closed (requirement R12).\n /\n\n// --------------------------------\n// Erasure stance (GDPR Art. 17 on rows we do not own)\n// --------------------------------\n\n/\n The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class\n * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a\n * registration refusal, because `exportSubject` is a fail-closed obligation on every resource and\n * \"we cannot delete rows we do not own\" is not an answer the framework may imply silently.\n /\nexport enum HttpApiErasureStance {\n /\n (6a) The resource declares it holds NO personal/subject data. Registration verifies the\n * declaration is coherent (e.g. `exportSubject` posture) and erasure is structurally N/A for\n * the remote rows.\n /\n NO_SUBJECT_DATA = 'no-subject-data',\n\n /\n (6b) The binding declares HOW erasure reaches the foreign system: one named API operation the\n * engine invokes on a subject-erasure request. This is a single declared write and does NOT\n * require general write support (slice 1 stays read-only otherwise).\n /\n EXTERNAL_ERASURE_OPERATION = 'external-erasure-operation',\n\n /\n (6c) Erasure REFUSES by default; an explicit, per-request, audited controller acknowledgement\n * lets it proceed and records the un-erased remote rows at high severity. Mirrors the existing\n * administrative-floor acknowledgement shape (`administrative-continuity-floors.md`): the record\n * is the control. NEVER a standing default — the acknowledgement is per erasure request.\n /\n CONTROLLER_ACKNOWLEDGED_NON_ERASURE = 'controller-acknowledged-non-erasure',\n}\n\n/\n * ─── `HttpApiTenancyStance` was REMOVED here (#1055), and NOT replaced by a narrower vocabulary ──\n \n It had two members and both were wrong for a system of record.\n \n `SCOPE_FILTER_PUSHDOWN` pushed the engine's contextual scope predicate into the remote query —\n * which means sending WILDO's own organization id to a system that has never heard of it, as a\n * filter value. Nothing on the far side could match it, so the stance could only ever have worked\n * against a remote that happened to store Wildo ids.\n \n `SINGLE_TENANT_BINDING` then became the only truth, and a declaration with one legal value is a\n * question nobody should be asked — plus it carried a `justification` string, which made every\n * binding restate the same sentence.\n \n What replaced it is a different MECHANISM rather than a smaller field: the row projector stamps\n * the owner organization's id onto each remote row, so the per-row tenant gate passes with no\n * exemption and a request under another organization's URL is refused by the branch that already\n * existed. Narrowing a system of record BY organization unit is #1058, and it belongs to the\n * INSTANCE and its vendor facet — one declaration for every resource that reads that system,\n * rather than one per binding.\n /\n\n// --------------------------------\n// Key declaration + component codecs (paper A)\n// --------------------------------\n\n/\n Per-component value normalization for key synthesis. The codec is what makes the synthesized\n * `_id` STABLE: every component must round-trip byte-identically between the remote\n * representation and the encoded id, or the same remote row would answer to different ids.\n \n `INTEGER` and `GUID` are the two codecs whose entire value space is URL-unreserved-safe, which\n * is what qualifies a single-key binding for the VERBATIM id form (see\n * `httpApiBindingUsesVerbatimKey`).\n /\nexport enum HttpApiKeyComponentCodec {\n /* Arbitrary remote string. NOT charset-safe → always participates via the encoded id form. /\n STRING = 'string',\n\n /* Integer key (Odoo `id`, SAP numeric keys). Digits only → verbatim-eligible. /\n INTEGER = 'integer',\n\n /* GUID/UUID key (Dataverse row ids). Hex + dashes → verbatim-eligible. /\n GUID = 'guid',\n\n /\n Date/time key component, normalized to the RFC 3339 / ISO 8601 UTC string form before\n * encoding. NOT verbatim-eligible (`:` is forbidden in ids — websocket room names are\n * colon-parsed).\n /\n DATETIME_ISO = 'datetime-iso',\n}\n/* @wildo_source:part:end saas.models.http-api-binding /\n\n/\n One ordered component of the remote entity's key. `keyFields` order is the ENCODING order —\n * declared, committed, and boot-verified against `$metadata` where the dialect provides one;\n * never inferred at runtime (a silently adopted key change would orphan every stored FK value\n * and bookmark).\n /\nexport const HttpApiKeyFieldSchema = z.object({\n /* The field name on the Wildo resource schema that carries this component. /\n localField: z.string().min(1),\n\n /* The remote entity's property name for this component. /\n remoteField: z.string().min(1),\n\n /* Value normalization for stable synthesis. /\n codec: z.enum(HttpApiKeyComponentCodec),\n});\n\nexport type HttpApiKeyField = z.infer<typeof HttpApiKeyFieldSchema>;\n\n// --------------------------------\n// Field mapping\n// --------------------------------\n\n/\n Local-to-remote field name mapping for fields whose names differ. Fields not listed map by\n * identity (same name both sides). Key components are declared in `keyFields`, not here.\n /\nexport const HttpApiFieldMappingSchema = z.object({\n localField: z.string().min(1),\n remoteField: z.string().min(1),\n});\n\nexport type HttpApiFieldMapping = z.infer<typeof HttpApiFieldMappingSchema>;\n\n// --------------------------------\n// Remote-call semantics (decision D10 / requirement R15)\n// --------------------------------\n\n/\n Declared remote-call semantics. An enterprise API is 100ms–2s, rate-limited, and sometimes\n * down; these are DECISIONS, not inherited pipeline defaults. Defaults are conservative on\n * purpose — a binding that needs more declares more.\n /\nexport const HttpApiRemoteCallSemanticsSchema = z.object({\n /* Per-call timeout. /\n timeoutMs: z.number().int().positive().max(120_000).default(10_000),\n\n /\n Retry policy for idempotent READ-family calls only. Writes (when D4 lands) never retry\n * implicitly.\n /\n retry: z\n .object({\n maxAttempts: z.number().int().min(1).max(5).default(2),\n backoffMs: z.number().int().positive().max(30_000).default(500),\n })\n .default({ maxAttempts: 2, backoffMs: 500 }),\n\n /\n Rate budget toward the target, per process. `undefined` = no local throttle (the target's own\n * limits still apply and surface as refusals).\n /\n maxRequestsPerMinute: z.number().int().positive().optional(),\n\n /\n Upper bound for translated id-set predicates (`_id ∈ {…}` → key-predicate disjunction /\n * `in`). Above the bound the adapter REFUSES rather than emitting an unbounded URL\n * (scope-down paper, shape T2).\n /\n maxIdSetSize: z.number().int().positive().max(500).default(50),\n\n /\n Upper bound for the translated PARTITION confinement (#1058 E7) — `key ∈ {every partition this\n * caller may touch}`, compiled per dialect.\n \n Its own knob rather than a reuse of `maxIdSetSize`, because the two bound different things and\n * would be tuned against different facts. An id set is a CALLER's request and its size is a\n * property of what they asked for; a partition set is a property of the DEPLOYMENT — how many\n * legal entities live inside one system of record — and of the caller's grant. An operator raising\n * one for a bulk read has no reason to raise the other, and lowering `maxIdSetSize` to tame a URL\n * would silently cut the confinement off at the knees: above the bound the adapter REFUSES, so a\n * confinement that cannot compile is a read that cannot happen.\n \n The default is deliberately far above `maxIdSetSize`'s. A corporate with more than two hundred\n * legal entities inside ONE system of record exists, and when it does the honest answer is a\n * refusal that NAMES the bound rather than a request the target truncates or rejects with a 414.\n * Refused rather than paged: splitting one read into N requests is a different mechanism, and one\n * that would make a single `total` impossible to compute.\n /\n maxPartitionSetSize: z.number().int().positive().max(1_000).default(200),\n});\n\nexport type HttpApiRemoteCallSemantics = z.infer<typeof HttpApiRemoteCallSemanticsSchema>;\n\n// --------------------------------\n// Dialect-specific declarations\n// --------------------------------\n\n/\n HTTP methods a declared read-family operation may use. Deliberately NOT the full HTTP verb set\n * (`API_HttpMethod` in `@wildo-ai/external-connectors-models` describes provider-protocol\n * operations): slice 1 is read-only, so the closed vocabulary is the read-safe verb plus POST —\n * because JSON-RPC (Odoo) and many enterprise search endpoints are POST-shaped even for reads.\n * Write verbs (PUT/PATCH/DELETE) enter only with the D4 write story, as their own decision.\n /\nexport enum HttpApiRestOperationMethod {\n GET = 'GET',\n POST = 'POST',\n}\n\n/\n REST_JSON per-operation declaration: how one read-family member maps onto a concrete HTTP\n * operation. Deliberately minimal in slice 1 — pagination/filter parameter NAMES are declared,\n * their VALUES are supplied by the adapter from the translated query.\n \n Related but distinct: `ProviderRestOperation` on a provider's `rest` runtime contract describes a\n * VENDOR operation — one entry in the catalogue a reference below names. This schema describes a\n * RESOURCE read surface, which is a different thing and stays here.\n \n (An earlier revision pointed at `REST_API_OperationSpecSchema` in\n * `@wildo-ai/external-connectors-models` \"for capability transformers\". Both are gone: the\n * transformer layer was retired with `features/` in #327, and that OpenAPI-shaped operations layer\n * — ten exported symbols with zero code readers — was deleted in #331 rather than wired up, so\n * \"what a provider can do\" has one description instead of two.)\n \n The convergence performed in S3a (#331) — a member naming an operation in a PROVIDER's own\n * catalogue — was UNDONE in #1055. A system of record is not a connector (D10), and a read that\n * depends on a provider catalogue being loadable is the crossing that decision forbids. An inline\n * spec is now the only form, which is what every authored binding used anyway.\n /\n/\n A query LANGUAGE a REST system of record reads through, rather than a set of filter parameters\n * (#1293).\n \n Two vendors read this way and neither can be expressed as parameters: Salesforce takes SOQL and\n * NetSuite takes SuiteQL, each as ONE statement naming the fields, the entity, the predicates and\n * the order. A `filterParams` map cannot say \"SELECT these columns FROM that object\", so without this\n * neither vendor can be declared at all.\n \n ## Why this is a closed vocabulary and not a template string\n \n A statement is BUILT, and building means escaping. Each language has its own literal rules and its\n * own paging spelling, and a template with `{filter}` holes would put the escaping in the author's\n * hands — an injection surface in a file nobody reviews as one. The engine builds the statement and\n * the vocabulary names which grammar to build.\n \n This is the same trade the OData compiler already makes for `$filter`: expressions are composed\n * here, literals are escaped by one function, and no authored string reaches the wire uninspected.\n /\nexport enum HttpApiQueryStatementLanguage {\n /\n Salesforce Object Query Language.\n \n spec-cite: Salesforce Developers, \"SOQL and SOSL Reference\" —\n * https://developer.salesforce.com/docs/atlas.en-us.soql_sosl.meta/soql_sosl/\n \n `SELECT ` does not exist: every field is named, which the binding's `fieldMappings` and key\n fields already supply. Paging is by the response's own continuation rather than by `OFFSET`,\n * which SOQL bounds at 2000 rows.\n /\n SOQL = 'soql',\n /\n NetSuite SuiteQL — an SQL-92 dialect over its analytics schema.\n \n spec-cite: Oracle NetSuite, \"SuiteQL\" —\n * https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_156257770590.html\n \n Paged by `limit` / `offset` QUERY parameters rather than inside the statement, which is why the\n * statement declaration and `pagingParams` are independent.\n /\n SUITEQL = 'suiteql',\n}\n\n/\n How a read member builds and sends a query STATEMENT (#1293).\n \n Declared per operation rather than per binding, because a vendor's `read` and `list` genuinely\n * differ: Salesforce addresses one record at `/sobjects/Account/{key}` and queries collections\n * through `/query`, and only the second is a statement at all.\n /\nexport const HttpApiQueryStatementSpecSchema = z.object({\n language: z.enum(HttpApiQueryStatementLanguage),\n /\n The parameter or body member the statement is placed in (`q` for both vendors surveyed).\n \n WHERE it lands is not declared, because the operation's own `method` already decides: a GET puts\n * parameters in the query string and a POST puts them in the JSON body, which is what the request\n * builder has always done. A `placement` field was drafted here and removed before it shipped — it\n * would have been a second declaration of something the method already says, free to disagree with\n * it. Salesforce is a GET with `?q=`, NetSuite a POST with `{\"q\": …}`, and neither needs to be told\n * twice.\n /\n parameterName: z.string().min(1),\n /\n The object the statement selects FROM. Absent = the binding's `entityRef`, which is the ordinary\n * case; present when the vendor's query schema names an object differently from its REST resource.\n /\n fromEntity: z.string().min(1).optional(),\n});\nexport type HttpApiQueryStatementSpec = z.infer<typeof HttpApiQueryStatementSpecSchema>;\n\nexport const HttpApiRestOperationSpecSchema = z.object({\n /* HTTP method for this read-family operation. /\n method: z.enum(HttpApiRestOperationMethod),\n\n /\n Path template relative to the provider's base URL. `{key}` interpolates the synthesized\n * key's remote addressing form; other `{param}` tokens must be declared parameter names.\n /\n pathTemplate: z.string().min(1),\n\n /* Query/body parameter names for pagination, when the operation supports it. /\n pagingParams: z\n .object({\n limitParam: z.string().min(1),\n offsetParam: z.string().min(1),\n })\n .optional(),\n\n /\n Declared filter parameter name per LOCAL field. Only fields listed here are translatable for\n * this operation (scope-down paper, shape T3); everything else is refused at the adapter\n * boundary.\n /\n filterParams: z.record(z.string().min(1), z.string().min(1)).optional(),\n\n /\n The parameter that receives the SEARCH text (T4), for a `search` operation. Absent =\n * search is refused for this binding even when the operation exists.\n /\n searchParam: z.string().min(1).optional(),\n\n /\n Dot-path to the payload inside the response body — the rows array (list/search), the entity\n * object (read), or the number (count). Absent = the body IS the payload. Declared, never\n * sniffed: response shapes vary per target (`items`, `result`, `value`, raw array) and a wrong\n * guess would silently read zero rows.\n /\n resultPath: z.string().min(1).optional(),\n\n /* Wrap request/response in a JSON-RPC 2.0 envelope (the Odoo variant). /\n jsonRpcEnvelope: z\n .object({\n rpcMethod: z.string().min(1),\n })\n .optional(),\n\n /\n Read through a query STATEMENT rather than through filter parameters (#1293).\n \n Mutually exclusive with `filterParams` and `searchParam` in practice rather than by schema: a\n * statement expresses its own predicates, so a declaration carrying both has said the same thing\n * twice in two grammars. The compiler refuses that pairing, where it can name which one it was\n * about to ignore.\n /\n statement: HttpApiQueryStatementSpecSchema.optional(),\n\n /\n Dot-path to a CONTINUATION URL in the response — Salesforce's `nextRecordsUrl` (#1293).\n \n Declared rather than sniffed, for the same reason `resultPath` is: response shapes vary per\n * target and a wrong guess reads zero rows silently. Absent means the operation pages by\n * `pagingParams` or not at all.\n \n A continuation is followed only on the target's OWN origin, exactly as the OData one is — the\n * link comes from a remote response body and carries this deployment's credentials wherever it\n * points.\n /\n cursorPath: z.string().min(1).optional(),\n\n /\n Headers this vendor requires on the request — NetSuite's `Prefer: transient` (#1293).\n \n VENDOR headers only. A credential never goes here: credentials come from the instance's access,\n * and a header authored in a binding would be a second credential channel in a file that is\n * committed. The compiler refuses an `authorization` key by name rather than trusting the author.\n /\n staticHeaders: z.record(z.string().min(1), z.string().min(1)).optional(),\n});\n\nexport type HttpApiRestOperationSpec = z.infer<typeof HttpApiRestOperationSpecSchema>;\n\n/\n * ─── The catalogue REFERENCE form was REMOVED here (#1055 D10) ──────────────────────────────────\n \n A REST_JSON member could name an `operationId` in a PROVIDER's own `rest.operations` catalogue,\n * so a resource's read surface reached into the connector lane for its shape. That is precisely the\n * crossing D10 forbids: no runtime object, stored row, route, secret name, audit subject or\n * specification serves both a system of record and a connector — and this one made a read depend on\n * a provider's catalogue being loadable at request time.\n \n Nothing loses a capability. A REST_JSON binding declares its read members INLINE, typed against its\n * vendor facet, which is what every authored binding does today: no REST_JSON system of record was\n * ever declared against a catalogue, and the generic-REST simulator proof moves to a facet fixture.\n \n The convergence recorded above (#331) is what is being undone, and deliberately rather than by\n * accident: stating the vendor half once per provider is a real saving for a CONNECTOR, and a\n * category error for a system the application reads its OWN rows out of.\n /\n\n/\n One read-surface member. An INLINE spec, and now only that.\n \n Kept as a named alias rather than collapsed into {@link HttpApiRestOperationSpecSchema} at every\n * use site: the members of a read surface are a concept in their own right, and a later form — a\n * facet-declared operation shape — would arrive HERE rather than at each of its consumers.\n /\nexport const HttpApiRestOperationDeclarationSchema = HttpApiRestOperationSpecSchema;\n\nexport type HttpApiRestOperationDeclaration = z.infer<typeof HttpApiRestOperationDeclarationSchema>;\n\n/* The REST_JSON read-surface mapping: which lifecycle members exist remotely, and how. /\nexport const HttpApiRestOperationsSchema = z.object({\n read: HttpApiRestOperationDeclarationSchema,\n list: HttpApiRestOperationDeclarationSchema,\n /* Absent = COUNT is refused for this binding (honest refusal, never an emulated scan). /\n count: HttpApiRestOperationDeclarationSchema.optional(),\n /* Absent = SEARCH is refused for this binding. /\n search: HttpApiRestOperationDeclarationSchema.optional(),\n});\n\nexport type HttpApiRestOperations = z.infer<typeof HttpApiRestOperationsSchema>;\n\n// --------------------------------\n// Stance sub-declarations\n// --------------------------------\n\n/\n HTTP methods a declared EXPLICIT erasure operation (stance 6b, REST_JSON) may use.\n \n A separate vocabulary from {@link HttpApiRestOperationMethod} on purpose: that enum describes\n * READ-family operations (GET/POST), and reusing it here would let an erasure declare `GET` — a\n * read spelled as a deletion. Deletion is expressed as the resource-oriented `DELETE` or an\n * RPC-style `POST`; nothing else is a deletion on the wire.\n /\nexport enum HttpApiErasureOperationMethod {\n POST = 'POST',\n DELETE = 'DELETE',\n}\n\n/\n The EXPLICIT erasure call a REST_JSON binding declares for stance 6b. Deliberately narrower\n * than {@link HttpApiRestOperationSpecSchema}: an erasure addresses ONE row by key — it has no\n * pagination, no filter params, no search, no result path to project.\n /\nexport const HttpApiErasureOperationSpecSchema = z.object({\n method: z.enum(HttpApiErasureOperationMethod),\n\n /\n Path template relative to the provider base URL. `{key}` interpolates the row's remote key\n * addressing form, exactly as in the read-family `pathTemplate`.\n /\n pathTemplate: z.string().min(1),\n\n /\n JSON-RPC envelope for RPC-style targets (pairs with `method: POST`), mirroring the\n * read-family declaration.\n /\n jsonRpcEnvelope: z.object({ rpcMethod: z.string().min(1) }).optional(),\n});\n\nexport type HttpApiErasureOperationSpec = z.infer<typeof HttpApiErasureOperationSpecSchema>;\n\n/* Erasure declaration — discriminated; stance 6b names the operation it invokes. /\nexport const HttpApiErasureDeclarationSchema = z.discriminatedUnion('stance', [\n z.object({\n stance: z.literal(HttpApiErasureStance.NO_SUBJECT_DATA),\n }),\n z.object({\n stance: z.literal(HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION),\n /\n The declared erasure call. ODATA and ODOO_JSONRPC bindings rely on their CANONICAL delete\n * (`DELETE /EntitySet(key)` / `execute_kw('unlink', [[ids]])`) by declaring\n * `useCanonicalDelete`; REST_JSON bindings declare the operation explicitly. The pairing is\n * enforced by {@link assertHttpApiBindingDialectCoherence}.\n /\n operation: z.union([\n z.object({ useCanonicalDelete: z.literal(true) }),\n HttpApiErasureOperationSpecSchema,\n ]),\n /\n The LOCAL field naming the DATA SUBJECT whose erasure deletes a remote row — the rows the\n * declared operation applies to are exactly `{ [subjectLinkLocalField]: <erased subject id> }`.\n \n DECLARED, never inferred, for the same reason `dataSubjectPolicy` exists on retention: a\n * foreign key usually names an OWNER or an ACTOR, not the subject — inferring from \"any FK to\n * the erased user\" would delete a purchase-order row because the erased user merely CREATED\n * it, destroying a business record no erasure asked for. One field, mirroring\n * `sessionPrincipalField`'s \"one field names the person\". Registration verifies a declared\n * relationship carries this field as its FK (so the subject type it links is known).\n /\n subjectLinkLocalField: z.string().trim().min(1),\n }),\n z.object({\n stance: z.literal(HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE),\n /\n Optional evidence link: the LOCAL field naming the data subject, used ONLY to COUNT the\n * remaining remote rows for the acknowledgement's CRITICAL audit record (`remainingRowCount`).\n * Optional because 6c legitimately covers linkage no FK expresses (an email inside remote\n * rows) — absent, the record carries no count rather than a fabricated zero. Never used to\n * delete anything.\n /\n subjectLinkLocalField: z.string().trim().min(1).optional(),\n }),\n]);\n\nexport type HttpApiErasureDeclaration = z.infer<typeof HttpApiErasureDeclarationSchema>;\n\n// --------------------------------\n// The binding declaration\n// --------------------------------\n\nconst httpApiResourceBindingBaseShape = {\n /\n The SYSTEM OF RECORD this resource lives in, by the NAME the application declared it under in\n * `wildo.saas.config.ts` (`systemsOfRecord.<name>`, #1055).\n \n ## Why a name, and not a provider ref\n \n `providerRef` named a PROVIDER, and a provider's env-var names live in its module — so one ref\n * was one deployment, and a second Odoo was unrepresentable. A name here is an INSTANCE: two\n * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in the environment variables their\n * names derive. It is also not a provider in any other sense (D10): nothing here is selected\n * through the capability plane, carries a person's lent credential, or has an operation catalogue.\n \n ## What validates it, and where\n \n Not here, and not in the resource factory — the factory runs in the application's `shared-lib`,\n * where the saas configuration is not in scope. The factory checks SHAPE; the boot registry checks\n * that this name is DECLARED and that `dialect` below equals the instance's, at the first moment\n * both are visible. That split is the honest one rather than a compromise.\n /\n system: z.string().min(1),\n\n /\n The remote entity addressed by this binding — an OData entity-set name, or a logical name for\n * a REST_JSON surface. One binding, one remote entity set.\n /\n entityRef: z.string().min(1),\n\n /\n * `connection` was here, and it is GONE (#1055 D12).\n \n It declared WHOSE ACCOUNT a binding spends — `ORGANIZATION × USER` and its siblings — which is a\n * real question for a CONNECTOR, where a customer connects their own account. A system of record is\n * not that: it is a deployment the application reads its own business rows out of, with its own\n * service identity, and the only honest answer was always `APPLICATION × SERVICE`. A field with one\n * legal value is a question nobody should be asked.\n \n The customer-connection case is case 2 of #1049 and keeps the connector resolver, untouched.\n /\n\n /* Ordered key declaration — the source of the synthesized engine-facing `_id` (paper A). /\n keyFields: z.array(HttpApiKeyFieldSchema).min(1),\n\n /* Non-key field name mappings; unlisted fields map by identity. /\n fieldMappings: z.array(HttpApiFieldMappingSchema).default([]),\n\n /\n * `tenancy` was here, and it is GONE (#1055 §5).\n \n Both of its stances were wrong for a system of record. `SCOPE_FILTER_PUSHDOWN` sent WILDO's own\n * organization id to the remote as a filter value — an id the remote has never heard of — and\n * `SINGLE_TENANT_BINDING` became the only truth, which makes it a declaration with one legal answer.\n \n What replaced it is not a smaller field but a different mechanism: the row projector STAMPS the\n * owner organization's id onto every remote row, so the per-row tenant gate passes with no exemption\n * and a read under another organization's URL is refused by the gate that already existed.\n * Partitioning a system of record BY organization unit returns in #1058, as a property of the\n * INSTANCE and its vendor facet rather than of each binding.\n /\n\n /* Erasure stance (D6) — required; no silent default. /\n erasure: HttpApiErasureDeclarationSchema,\n\n /* Remote-call semantics (D10/R15). /\n remoteCallSemantics: HttpApiRemoteCallSemanticsSchema.default({\n timeoutMs: 10_000,\n retry: { maxAttempts: 2, backoffMs: 500 },\n maxIdSetSize: 50,\n maxPartitionSetSize: 200,\n }),\n};\n\n/\n The HTTP_API resource binding — discriminated on the transport dialect so each dialect carries\n * exactly its own obligations: ODATA and ODOO_JSONRPC are generic (the model name IS `entityRef`, and\n * read/list/count map mechanically); REST_JSON must declare its whole read surface INLINE.\n \n Every arm carries `system` — the declared instance this resource lives in — and none carries a\n * provider, a connection shape or a tenancy stance. See the base shape above for what each of those\n * was and why none was replaced by a smaller field (#1055).\n /\n/* @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer /\nexport const HttpApiResourceBindingSchema = z.discriminatedUnion('dialect', [\n z.object({\n dialect: z.literal(HttpApiTransportDialect.ODATA),\n ...httpApiResourceBindingBaseShape,\n /\n * `verifyMetadataAtBoot` was here, and it is GONE (#1055 §5).\n \n It had ZERO non-test readers — measured, not assumed — so nothing ever probed `$metadata` at\n * boot whatever it was set to. It also asked for exactly what the registry above it must never\n * do: dial the remote during startup, where an ERP outage would stop an application booting\n * (`continuity-drift-and-cas-basis.md` Rule 3).\n \n The drift probe it promised EXISTS, on the extraction source, reached through the operator door\n * (`external-data-extraction-source.backend.ts`) — where a human is present and a refusal is\n * something somebody can act on.\n /\n }),\n z.object({\n dialect: z.literal(HttpApiTransportDialect.REST_JSON),\n ...httpApiResourceBindingBaseShape,\n /* The declared read surface — absent members are refused, never emulated. /\n operations: HttpApiRestOperationsSchema,\n }),\n z.object({\n dialect: z.literal(HttpApiTransportDialect.ODOO_JSONRPC),\n ...httpApiResourceBindingBaseShape,\n // Generic like ODATA — no per-binding operation declarations: `entityRef` is the Odoo model\n // (e.g. 'res.partner'); read/list/count map onto read/search_read/search_count mechanically.\n // The single-INTEGER-key constraint is enforced by `assertHttpApiBindingDialectCoherence`\n // (called by the resource-configuration factory) — a refine here would wrap the union member\n // in effects, which discriminated unions do not admit.\n }),\n]);\n\n/\n Dialect-specific structural constraints that a discriminated union cannot express member-side.\n * Called by the resource-configuration factory AFTER the schema parse; throws with the offending\n * path named.\n /\nexport function assertHttpApiBindingDialectCoherence(binding: HttpApiResourceBinding): void {\n if (binding.dialect === HttpApiTransportDialect.ODOO_JSONRPC) {\n // Odoo row ids are INTEGERS, always — one key field, INTEGER codec, or the synthesized id\n // could never address a row.\n if (\n binding.keyFields.length !== 1\n \|\| binding.keyFields[0].codec !== HttpApiKeyComponentCodec.INTEGER\n ) {\n throw new Error(\n \"keyFields: an ODOO_JSONRPC binding must declare exactly one key field with the INTEGER codec — Odoo row ids are integers ('id').\",\n );\n }\n }\n\n /\n * A member naming a PROVIDER's catalogue operation is refused, and refused EXPLICITLY (#1055 D10).\n \n The schema alone would refuse it as an unknown key, with a message about `providerOperationId`\n * not being expected — true, and useless to an author who reasonably believes the form still\n * exists, because it did until this slice. So the refusal names what happened and where the shape\n * went instead of letting the parse error carry it.\n \n This replaces an ambiguity check that existed for the opposite reason: while BOTH forms were\n * legal, a member carrying both parsed as the inline one and dropped the reference silently.\n /\n if (binding.dialect === HttpApiTransportDialect.REST_JSON) {\n for (const [member, declaration] of Object.entries(binding.operations)) {\n if (declaration === undefined) continue;\n if ((declaration as Record<string, unknown>).providerOperationId !== undefined) {\n throw new Error(\n `operations.${member}: a read member can no longer REFERENCE a provider's operation catalogue `\n + '(`providerOperationId`). A system of record is not a connector, so its read surface is declared '\n + 'INLINE here (method + pathTemplate) against the vendor facet.',\n );\n }\n }\n }\n\n // D6 stance 6b — the declared erasure operation's FORM is dialect-specific. The union schema\n // admits both forms; only the pairing below is executable, so an incoherent pairing must refuse\n // at authoring rather than on the first subject-erasure request:\n // - ODATA → `useCanonicalDelete` only (the canonical `DELETE /EntitySet(key)`);\n // - ODOO_JSONRPC → `useCanonicalDelete` only (compiles to `execute_kw('unlink', [[ids]])`,\n // Odoo's own canonical delete);\n // - REST_JSON → an explicit operation spec only (there IS no canonical delete to rely on —\n // the binding declares the exact call, like every other REST_JSON operation).\n if (binding.erasure.stance === HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION) {\n const usesCanonicalDelete = 'useCanonicalDelete' in binding.erasure.operation;\n if (binding.dialect === HttpApiTransportDialect.REST_JSON && usesCanonicalDelete) {\n throw new Error(\n 'erasure.operation: a REST_JSON binding has no canonical delete — declare the explicit erasure operation spec (method/path), like its other declared operations.',\n );\n }\n if (binding.dialect !== HttpApiTransportDialect.REST_JSON && !usesCanonicalDelete) {\n throw new Error(\n `erasure.operation: a ${binding.dialect} binding executes erasure through its CANONICAL delete (declare { useCanonicalDelete: true }) — an explicit REST operation spec has no translation on this dialect.`,\n );\n }\n }\n}\n\n/* @wildo_source:part:end saas.models.http-api-binding /\nexport type HttpApiResourceBinding = z.infer<typeof HttpApiResourceBindingSchema>;\n\n/\n What an APPLICATION AUTHOR writes — the INPUT shape, so defaulted fields (`verifyMetadataAtBoot`,\n * `connection`, the remote-call semantics) are optional to type. Consumers read the parsed shape\n * above. Same split, and same reason, as `ExternalDataPipelineDeclarationAuthored`: a config field\n * typed with the PARSED shape makes every default mandatory for the one person the default exists\n * to serve.\n /\nexport type HttpApiResourceBindingAuthored = z.input<typeof HttpApiResourceBindingSchema>;\n\n// --------------------------------\n// Static binding properties\n// --------------------------------\n\n/\n Codecs whose ENTIRE value space stays within the synthesized-id charset law\n * (`^[A-Za-z0-9._~-]+$`, see `http-api-binding-id.shared.utils.ts`). Membership here is what\n * qualifies a single-key binding for the verbatim id form.\n /\nconst VERBATIM_ELIGIBLE_CODECS: readonly HttpApiKeyComponentCodec[] = [\n HttpApiKeyComponentCodec.INTEGER,\n HttpApiKeyComponentCodec.GUID,\n];\n\n/\n Whether this binding's synthesized `_id` is the single key value VERBATIM (legible ids for\n * Dataverse GUIDs / Odoo integers) versus the encoded composite form. A STATIC property of the\n * declaration — never sniffed per row — which is what keeps decode unambiguous (paper A).\n */\nexport function httpApiBindingUsesVerbatimKey(\n binding: { keyFields: readonly HttpApiKeyField[] },\n): boolean {\n return (\n binding.keyFields.length === 1\n && VERBATIM_ELIGIBLE_CODECS.includes(binding.keyFields[0].codec)\n );\n}\n"]}
1	+ {"version":3,"file":"http-api-binding.shared.schemas.js","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-binding.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,mCAAmC,EACnC,oCAAoC,GACrC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,sCAAsC,EACtC,+CAA+C,GAChD,MAAM,8DAA8D,CAAC;AAEtE,mCAAmC;AACnC,oBAAoB;AACpB,mCAAmC;AAEnC,4GAA4G;AAE5G,mCAAmC;AACnC,oCAAoC;AACpC,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,mCAAmC;AACnC,sDAAsD;AACtD,mCAAmC;AAEnC;;;;;GAKG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,mCAAmC;AACnC,+CAA+C;AAC/C,mCAAmC;AAEnC;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,wBAgBX;AAhBD,WAAY,wBAAwB;IAClC,+FAA+F;IAC/F,6CAAiB,CAAA;IAEjB,kFAAkF;IAClF,+CAAmB,CAAA;IAEnB,2EAA2E;IAC3E,yCAAa,CAAA;IAEb;;;;OAIG;IACH,yDAA6B,CAAA;AAC/B,CAAC,EAhBW,wBAAwB,KAAxB,wBAAwB,QAgBnC;AAED,mCAAmC;AACnC,sCAAsC;AACtC,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,gBAOX;AAPD,WAAY,gBAAgB;IAC1B,8FAA8F;IAC9F,qCAAiB,CAAA;IACjB,6FAA6F;IAC7F,qCAAiB,CAAA;IACjB,gGAAgG;IAChG,qCAAiB,CAAA;AACnB,CAAC,EAPW,gBAAgB,KAAhB,gBAAgB,QAO3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAN,IAAY,2BAaX;AAbD,WAAY,2BAA2B;IACrC;;;OAGG;IACH,kEAAmC,CAAA;IACnC;;;;;OAKG;IACH,oEAAqC,CAAA;AACvC,CAAC,EAbW,2BAA2B,KAA3B,2BAA2B,QAatC;AACD,0DAA0D;AAE1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,+EAA+E;IAC/E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7B,4DAA4D;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,gDAAgD;IAChD,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;CACxC,CAAC,CAAC;AAIH,mCAAmC;AACnC,gBAAgB;AAChB,mCAAmC;AAEnC,4GAA4G;AAC5G;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAN,IAAY,yBAKX;AALD,WAAY,yBAAyB;IACnC,0EAA0E;IAC1E,0CAAa,CAAA;IACb,gEAAgE;IAChE,oDAAuB,CAAA;AACzB,CAAC,EALW,yBAAyB,KAAzB,yBAAyB,QAKpC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,2HAA2H;IAC3H,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAKH,mCAAmC;AACnC,yDAAyD;AACzD,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,wBAAwB;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAEnE;;;;OAIG;IACH,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KAChE,CAAC;SACD,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAE9C;;;OAGG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE5D;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE9D;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CACzE,CAAC,CAAC;AAIH,mCAAmC;AACnC,gCAAgC;AAChC,mCAAmC;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IACpC,yCAAW,CAAA;IACX,2CAAa,CAAA;AACf,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AAED,4GAA4G;AAC5G;;GAEG;AACH,MAAM,CAAN,IAAY,6BAOX;AAPD,WAAY,6BAA6B;IACvC;;;;OAIG;IACH,8DAA6B,CAAA;AAC/B,CAAC,EAPW,6BAA6B,KAA7B,6BAA6B,QAOxC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAN,IAAY,6BAsBX;AAtBD,WAAY,6BAA6B;IACvC;;;;;;;;;OASG;IACH,8CAAa,CAAA;IACb;;;;;;;;OAQG;IACH,oDAAmB,CAAA;AACrB,CAAC,EAtBW,6BAA6B,KAA7B,6BAA6B,QAsBxC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,sBA4BX;AA5BD,WAAY,sBAAsB;IAChC;;;;;;;;;;;;OAYG;IACH,2EAAiD,CAAA;IACjD;;;;;;;;;;;OAWG;IACH,6DAAmC,CAAA;AACrC,CAAC,EA5BW,sBAAsB,KAAtB,sBAAsB,QA4BjC;AAED,kIAAkI;AAClI,MAAM,CAAC,MAAM,0BAA0B,GAA4E;IACjH,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,sBAAsB;IACnF,CAAC,6BAA6B,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC,eAAe;CAChF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAwC;IAClF,wBAAwB,CAAC,OAAO;IAChC,wBAAwB,CAAC,MAAM;CAChC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClC,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC;;;OAGG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC;;;;OAIG;IACH,MAAM,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,kDAAkD;IAClD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC;IAE1C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B,iFAAiF;IACjF,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B;;;;;;;WAOG;QACH,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE;KAC5D,CAAC;SACD,QAAQ,EAAE;IAEb;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvE;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEzC;;;;;OAKG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC,2EAA2E;IAC3E,eAAe,EAAE,CAAC;SACf,MAAM,CAAC;QACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC7B,CAAC;SACD,QAAQ,EAAE;IAEb;;;;;;;OAOG;IACH,SAAS,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAErD;;;;;;;;;;OAUG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAExC;;;;;;OAMG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC;AAGH,0DAA0D;AAE1D;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,8BAA8B,CAAC;AAIpF,sHAAsH;AACtH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,qCAAqC;IAC3C,2FAA2F;IAC3F,KAAK,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACvD,mDAAmD;IACnD,MAAM,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACxD;;;OAGG;IACH,MAAM,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACtD,MAAM,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACtD,MAAM,EAAE,mCAAmC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,gCAAgC,GAGhC;IACJ,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE;IAChG,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE;IAC7H,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE;CAC/H,CAAC;AAEF,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,8CAAa,CAAA;IACb,kDAAiB,CAAA;AACnB,CAAC,EAHW,6BAA6B,KAA7B,6BAA6B,QAGxC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAE7C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/B;;;OAGG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAIH,qFAAqF;AACrF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC5E,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,eAAe,CAAC;KACxD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,0BAA0B,CAAC;QAClE;;;;;WAKG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,iCAAiC;SAClC,CAAC;QACF;;;;;;;;;;WAUG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAChD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,mCAAmC,CAAC;QAC3E;;;;;;WAMG;QACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;CACH,CAAC,CAAC;AAIH,mCAAmC;AACnC,0BAA0B;AAC1B,mCAAmC;AAEnC,4GAA4G;AAC5G;;GAEG;AACH,MAAM,+BAA+B,GAAG;IACtC;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzB;;;OAGG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B;;;;;;;;;;OAUG;IAEH,6FAA6F;IAC7F,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEhD,oEAAoE;IACpE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE7D;;;;;;;;;;;;OAYG;IAEH,yDAAyD;IACzD,OAAO,EAAE,+BAA+B;IAExC;;;;;;;;;;;;;OAaG;IACH,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEzD;;;;;;;;;OASG;IACH,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE5D;;;;;;;;;OASG;IACH,gBAAgB,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;QAC7C,CAAC,CAAC,YAAY,CAAC;YACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,eAAe,CAAC;YAC5D,8FAA8F;YAC9F,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;SAChC,CAAC;QACF,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,CAAC;KAClF,CAAC,CAAC,QAAQ,EAAE;IAEb;;;;;;;;;OASG;IACH,OAAO,EAAE,sCAAsC,CAAC,QAAQ,EAAE;IAE1D,uCAAuC;IACvC,mBAAmB,EAAE,gCAAgC,CAAC,OAAO,CAAC;QAC5D,SAAS,EAAE,MAAM;QACjB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;QACzC,YAAY,EAAE,EAAE;QAChB,mBAAmB,EAAE,GAAG;KACzB,CAAC;CACH,CAAC;AACF,0DAA0D;AAE1D;;;;;;;;GAQG;AACH,4GAA4G;AAC5G,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC1E,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC;QACjD,GAAG,+BAA+B;QAClC;;;;;;;;;;;WAWG;KACJ,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP;;;WAGG;QACH,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC;QACpD,GAAG,+BAA+B;KACnC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,SAAS,CAAC;QACrD,GAAG,+BAA+B;QAClC;;;WAGG;QACH,UAAU,EAAE,2BAA2B;KACxC,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,YAAY,CAAC;QACxD,GAAG,+BAA+B;QAClC,4FAA4F;QAC5F,6FAA6F;QAC7F,0FAA0F;QAC1F,6FAA6F;QAC7F,uDAAuD;KACxD,CAAC;CACH,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAS,6BAA6B,CAAC,SAAqC,EAAE,UAAiC;IAC7G,KAAK,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAA0D,EAAE,CAAC;QACxH;;;;WAIG;QACH,IAAI,MAAM,KAAK,MAAM,IAAI,WAAW,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,2HAA2H;kBACzH,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD;;;;;;WAMG;QACH,IAAI,WAAW,EAAE,SAAS,EAAE,QAAQ,KAAK,6BAA6B,CAAC,OAAO;eACzE,WAAW,CAAC,MAAM,KAAK,0BAA0B,CAAC,IAAI;eACtD,WAAW,CAAC,YAAY,KAAK,SAAS;eACtC,WAAW,CAAC,YAAY,CAAC,SAAS,KAAK,6BAA6B,CAAC,YAAY,EAAE,CAAC;YACvF,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,kGAAkG;kBACpH,iBAAiB,6BAA6B,CAAC,YAAY,yDAAyD,CACvH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC;QAC9C,IAAI,WAAW,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QAChE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,oHAAoH,CACzI,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,2DAA2D,SAAS,CAAC,MAAM,0DAA0D;kBACnI,gHAAgH,CACnH,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,CAAC,cAAc,uCAAuC,QAAQ,CAAC,WAAW,MAAM;kBACzI,sHAAsH,CACzH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACb,oDAAoD,QAAQ,CAAC,WAAW,aAAa,QAAQ,CAAC,KAAK,6BAA6B;kBAC9H,GAAG,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC,6EAA6E;kBAC5H,iCAAiC,CACpC,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,0BAA0B,CAAC,WAAW,CAAC,SAAU,CAAC,QAAQ,CAAC,CAAC;QAC1E,QAAQ,KAAK,EAAE,CAAC;YACd,KAAK,sBAAsB,CAAC,sBAAsB;gBAChD,IAAI,WAAW,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CACb,sBAAsB,WAAW,CAAC,SAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,+DAA+D;0BAChI,8HAA8H;0BAC9H,iGAAiG,CACpG,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,KAAK,sBAAsB,CAAC,eAAe;gBACzC,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;oBAC3C,MAAM,IAAI,KAAK,CACb,sBAAsB,WAAW,CAAC,SAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,iEAAiE;0BAClI,oFAAoF,CACvF,CAAC;gBACJ,CAAC;gBACD,MAAM;QACV,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oCAAoC,CAAC,OAA+B;IAClF,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EAAE,CAAC;QAC7D,0FAA0F;QAC1F,6BAA6B;QAC7B,IACE,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;eAC3B,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,wBAAwB,CAAC,OAAO,EAClE,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kIAAkI,CACnI,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,IAAI,WAAW,KAAK,SAAS;gBAAE,SAAS;YACxC,IAAK,WAAuC,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;gBAC/E,MAAM,IAAI,KAAK,CACb,cAAc,MAAM,2EAA2E;sBAC7F,kGAAkG;sBAClG,+DAA+D,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,6BAA6B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IAED,qHAAqH;IACrH,6FAA6F;IAC7F,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;IACrG,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,qBAAqB,GAAG,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS;eAC9E,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAE,MAA+C,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC;QACnI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,kBAAkB,gBAAgB,CAAC,UAAU,kCAAkC,OAAO,CAAC,OAAO,uCAAuC;kBACnI,2IAA2I,CAC9I,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oGAAoG;IACpG,qFAAqF;IACrF,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,sDAAsD,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9G,CAAC;IAED,sHAAsH;IACtH,iHAAiH;IACjH,MAAM,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,YAAY,EAAE,CAAC;QACtH,MAAM,IAAI,KAAK,CACb,uDAAuD,OAAO,CAAC,MAAM,wDAAwD;cAC3H,iGAAiG;cACjG,YAAY,2BAA2B,CAAC,eAAe,oEAAoE;cAC3H,wGAAwG,2BAA2B,CAAC,gBAAgB,MAAM,CAC7J,CAAC;IACJ,CAAC;IACD,mHAAmH;IACnH,2GAA2G;IAC3G,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,EAAE,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,wBAAwB,IAAI,CAAC,WAAW,EAAE,YAAY,OAAO,CAAC,MAAM,mCAAmC;sBACvH,4CAA4C,IAAI,0BAA0B,IAAI,KAAK,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,CACxI,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,8CAA8C,IAAI,CAAC,WAAW,EAAE,iCAAiC;sBACjH,iDAAiD,CACpD,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,oCAAoC,CAAC,MAAM,EAAE;oBAC3C,MAAM,EAAE,IAAI;oBACZ,GAAG,gCAAgC,CAAC,IAAI,CAAC;oBACzC,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;iBAC3E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,0HAA0H;QAC1H,IAAI,WAAW,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,OAAO,CAAC,MAAM,oDAAoD;kBACvH,4CAA4C,2BAA2B,CAAC,gBAAgB,UAAU;kBAClG,YAAY,2BAA2B,CAAC,eAAe,iEAAiE;kBACxH,uFAAuF,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,6GAA6G;IAC7G,wEAAwE;IACxE,IAAI,WAAW,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,KAAK,EAAE,CAAC;QAC/G,MAAM,IAAI,KAAK,CACb,uDAAuD,OAAO,CAAC,MAAM,kCAAkC;cACrG,YAAY,2BAA2B,CAAC,eAAe,uEAAuE;cAC9H,uHAAuH;cACvH,yEAAyE,2BAA2B,CAAC,gBAAgB,MAAM,CAC9H,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,EAAE,IAAI,KAAK,2BAA2B,CAAC,eAAe,EAAE,CAAC;QACnF,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,YAAY,CAAC;QAC3D,IAAI,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,KAAK,YAAY,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,mCAAmC,YAAY,wDAAwD,CAAC,CAAC;QAC3H,CAAC;IACH,CAAC;IAED,qGAAqG;IACrG,+CAA+C,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExG,6FAA6F;IAC7F,gGAAgG;IAChG,iEAAiE;IACjE,yFAAyF;IACzF,6FAA6F;IAC7F,mDAAmD;IACnD,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,oBAAoB,CAAC,0BAA0B,EAAE,CAAC;QAC/E;;;;WAIG;QACH,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,QAAQ,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,6HAA6H;kBAC3H,sIAAsI,CACzI,CAAC;QACJ,CAAC;QACD,MAAM,mBAAmB,GAAG,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9E,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,mBAAmB,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CACb,iKAAiK,CAClK,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB,CAAC,SAAS,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CACb,wBAAwB,OAAO,CAAC,OAAO,qKAAqK,CAC7M,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAcD,mCAAmC;AACnC,4BAA4B;AAC5B,mCAAmC;AAEnC;;;;GAIG;AACH,MAAM,wBAAwB,GAAwC;IACpE,wBAAwB,CAAC,OAAO;IAChC,wBAAwB,CAAC,IAAI;CAC9B,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAkD;IAElD,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;WAC3B,wBAAwB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CACjE,CAAC;AACJ,CAAC","sourcesContent":["/*\n HTTP-API persistence binding — the declaration model for resources whose rows live in a system\n * reached over an authenticated HTTP API (`PersistenceAdapter.HTTP_API`) rather than in a\n * platform-provisioned database.\n \n Design source of truth: `.claude/plans/etl-post-repository.md` (decisions D0/D1/D6/D9/D10,\n * requirements R7/R12/R15/R16) plus the two companion papers\n * `.claude/plans/etl-composite-key-synthesis.md` (key declaration + id codec) and\n * `.claude/plans/etl-filter-dialect-scope-down.md` (declared filter/sort/search surface).\n \n The binding is a REQUIRED companion declaration on any resource configuration that selects\n * `PersistenceAdapter.HTTP_API`. It answers, statically and per resource:\n * - WHICH declared system of record the rows live in (`system`), and WHICH remote entity inside it;\n * - HOW a row is identified (ordered key components → the synthesized engine-facing `_id`);\n * - WHAT the erasure story is (all three stances are first-class; none is silently defaulted);\n * - WHICH remote-call semantics apply (timeout, retry, rate budget, id-set bound).\n \n ## Three questions this used to answer and no longer does (#1055)\n \n WHOSE ACCOUNT (`connection`), WHERE the deployment is (`providerRef`) and HOW TENANCY is expressed\n * remotely (`tenancy`) all left in the same change, and none of them was replaced by a smaller field:\n \n - WHOSE ACCOUNT has one legal answer for a system of record — the application's own service\n * identity (D12). The customer-connection case is case 2 of #1049 and keeps the connector lane.\n * - WHERE is a property of the declared INSTANCE (`systemsOfRecord.<name>`) and of the ENVIRONMENT,\n * not of each resource. That is what lets two instances of one vendor exist at all.\n * - TENANCY became a STAMP rather than a declaration: the row projector writes the owner\n * organization's id onto every remote row, so the per-row gate passes with no exemption.\n \n Credentials are NEVER declared here. They resolve at runtime through the systems-of-record\n * registry, from environment variables DERIVED from the instance name — the binding carries only the\n * name.\n /\n\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from './http-api-transport-dialect.shared';\nimport { HttpApiErasureStance } from './http-api-erasure-stance.shared';\nimport {\n HttpApiRestWriteMethod,\n HttpApiRestWriteOperationSpecSchema,\n assertHttpApiRestWriteOperationShape,\n} from './http-api-rest-write-operations.shared.schemas';\nimport {\n SystemOfRecordActionDeclarationsSchema,\n assertSystemOfRecordActionDeclarationsCoherence,\n} from '../systems-of-record/system-of-record-actions.shared.schemas';\n\n// --------------------------------\n// Transport dialect\n// --------------------------------\n\n/* @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer /\n\n// --------------------------------\n// Whose identity reaches the target\n// --------------------------------\n\n/\n * ─── `HttpApiIdentityMode` was REMOVED here (#333), and replaced rather than widened ────────────\n \n It had two values — `SERVICE_PRINCIPAL` and `USER_DELEGATED` — and its own docstring said it\n * stayed declared \"so bindings need no reshape when it arrives\". That is the one thing it got\n * wrong. `USER_DELEGATED` names a delegation without naming WHOSE ACCOUNT is spent, and those are\n * two independent questions with five real answers (`ExternalProvider_ConnectionShape`):\n \n - a user's own personal grant is `USER × SERVICE`;\n * - one member's own account, linked for the whole organization, is `ORGANIZATION × USER`\n * (decided on wildo-ai/wildo-ai#18: every member spends it, and the linking member is named in\n * the audit trail).\n \n Both are \"per-user OAuth against the target\", they resolve DIFFERENT credentials, and the single\n * field cannot distinguish them. So mapping it onto a target would have silently picked a lane —\n * which is why `connectionTargetForBinding` refused instead of guessing, and why the fix is the\n * richer vocabulary rather than a translation table.\n \n The audit contract is unchanged and was never the identity mode's to keep: every row carries the\n * REAL initiating user whatever the connection, so the shared-principal attribution failure\n * documented for Power Platform (\"credential-sharing as a service\") stays closed (requirement R12).\n /\n\n// --------------------------------\n// Erasure stance (GDPR Art. 17 on rows we do not own)\n// --------------------------------\n\n/\n * `HttpApiErasureStance` lives in `./http-api-erasure-stance.shared` and is published from the package ROOT\n * (#1710): three root-exported contracts name it, and a nominal enum reachable only through this subpath\n * made their inferred types unnameable for a root-only consumer (TS2742). The binding arms below still\n * discriminate on it.\n /\n\n/\n * ─── `HttpApiTenancyStance` was REMOVED here (#1055), and NOT replaced by a narrower vocabulary ──\n \n It had two members and both were wrong for a system of record.\n \n `SCOPE_FILTER_PUSHDOWN` pushed the engine's contextual scope predicate into the remote query —\n * which means sending WILDO's own organization id to a system that has never heard of it, as a\n * filter value. Nothing on the far side could match it, so the stance could only ever have worked\n * against a remote that happened to store Wildo ids.\n \n `SINGLE_TENANT_BINDING` then became the only truth, and a declaration with one legal value is a\n * question nobody should be asked — plus it carried a `justification` string, which made every\n * binding restate the same sentence.\n \n What replaced it is a different MECHANISM rather than a smaller field: the row projector stamps\n * the owner organization's id onto each remote row, so the per-row tenant gate passes with no\n * exemption and a request under another organization's URL is refused by the branch that already\n * existed. Narrowing a system of record BY organization unit is #1058, and it belongs to the\n * INSTANCE and its vendor facet — one declaration for every resource that reads that system,\n * rather than one per binding.\n /\n\n// --------------------------------\n// Key declaration + component codecs (paper A)\n// --------------------------------\n\n/\n Per-component value normalization for key synthesis. The codec is what makes the synthesized\n * `_id` STABLE: every component must round-trip byte-identically between the remote\n * representation and the encoded id, or the same remote row would answer to different ids.\n \n `INTEGER` and `GUID` are the two codecs whose entire value space is URL-unreserved-safe, which\n * is what qualifies a single-key binding for the VERBATIM id form (see\n * `httpApiBindingUsesVerbatimKey`).\n /\nexport enum HttpApiKeyComponentCodec {\n /* Arbitrary remote string. NOT charset-safe → always participates via the encoded id form. /\n STRING = 'string',\n\n /* Integer key (Odoo `id`, SAP numeric keys). Digits only → verbatim-eligible. /\n INTEGER = 'integer',\n\n /* GUID/UUID key (Dataverse row ids). Hex + dashes → verbatim-eligible. /\n GUID = 'guid',\n\n /\n Date/time key component, normalized to the RFC 3339 / ISO 8601 UTC string form before\n * encoding. NOT verbatim-eligible (`:` is forbidden in ids — websocket room names are\n * colon-parsed).\n /\n DATETIME_ISO = 'datetime-iso',\n}\n\n// --------------------------------\n// Write verbs a binding OPENS (#1679)\n// --------------------------------\n\n/\n A row-level write a read-through resource may send to its system of record.\n \n Three members and no bulk ones, deliberately. A bulk write against a system the platform does not\n * own has no atomicity to offer — ten rows are ten remote calls, any of which can fail after the ones\n * before it landed — so the engine opens single-row create, update and delete by key, and nothing\n * else. `createMany`, `updateMany`, `deleteMany`, the guarded atomic primitives and the raw-filter\n * doors stay refused by name on the repository.\n \n ## Why the binding declares them at all, when the resource already lists its operations\n \n Because opening a write door into somebody else's ERP is a decision of its own, taken where the\n * remote contract is written. The resource's operation list says which HTTP routes exist; this says\n * the binding may WRITE through them. The resource factory refuses the two disagreeing in EITHER\n * direction — a write operation whose verb the binding does not open, and an opened verb no operation\n * uses — so the second declaration can never drift from the first into an inert door or an open one.\n \n Absent is empty: every binding written before #1679 stays read-only without a change.\n /\nexport enum HttpApiWriteVerb {\n /* A new remote row. The engine derives its partition from the caller's organization unit. /\n CREATE = 'create',\n /* A change to one remote row, addressed by its synthesized id. Read first, then written. /\n UPDATE = 'update',\n /* The removal of one remote row, addressed by its synthesized id. Read first, then deleted. /\n DELETE = 'delete',\n}\n\n/\n What protects an UPDATE against overwriting a change made since its author read the row (#1724, #1726, #1728) —\n * declared by every binding that opens UPDATE, whatever its dialect (ODOO_JSONRPC, ODATA, REST_JSON).\n \n ## Why a binding must say this at all\n \n An update that carries no version is last-writer-wins, whatever the vendor could have offered: Odoo's external API\n * applies `write(ids, vals)` unconditionally, a REST_JSON write is sent with no precondition, and an OData service\n * applies a `PATCH` whose `If-Match` matches — which a caller who never read the row cannot make match anything but\n * ``. A default nobody chose is a lost update nobody expects, so a binding that opens UPDATE states which of the two it\n accepts, and the factory refuses the omission.\n \n ## What VERSION_CHECKED is, honestly — it depends on the dialect\n \n The caller sends the row version it read (the local field named by `versionField`, mapped onto the vendor's\n * `rowVersionField` — Odoo `write_date`, an OData service's `@odata.etag`). The engine reads the row just before\n * writing it — the read it already makes to check the partition — and refuses the update when the versions differ,\n * before anything is sent. Then:\n \n - Odoo: best-effort. Odoo takes no precondition, so the comparison and the write are two calls. That NARROWS the\n * race to the gap between them; it does NOT close it. A change landing inside that gap is overwritten, and a vendor\n * that serves its version coarsely (Odoo: to the second) cannot tell two changes in the same second apart.\n * - REST_JSON: best-effort, as on Odoo — the write is sent as declared, with no precondition. It is available only\n * where the vendor facet declares a `rowVersionField`; neither the Salesforce nor the NetSuite facet does, so a\n * binding against them states LAST_WRITER_WINS (startup refuses VERSION_CHECKED there).\n * - OData: atomic. The version is also sent as `If-Match`, so the SERVICE compares it with the row it is about to\n * change and answers `412 Precondition Failed` without applying anything when it moved — the gap is closed by the\n * vendor, not narrowed by the engine.\n * spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match).\n /\nexport enum HttpApiWriteConcurrencyMode {\n /\n Every UPDATE carries the version its author read, and a stale one is refused before sending. Best-effort on Odoo\n * and REST_JSON; atomic on OData, where the version also travels as `If-Match`.\n /\n VERSION_CHECKED = 'version-checked',\n /\n No check against the version the CALLER read: the last update sent wins. Stated, so it is a decision rather than an\n * accident. On OData the engine still sends the entity tag of the row it read first (or `` when the row carries\n none), so a row that moved between that read and the write is refused, and a row deleted in between is never\n * re-created by an upsert.\n /\n LAST_WRITER_WINS = 'last-writer-wins',\n}\n/* @wildo_source:part:end saas.models.http-api-binding /\n\n/\n One ordered component of the remote entity's key. `keyFields` order is the ENCODING order —\n * declared, committed, and boot-verified against `$metadata` where the dialect provides one;\n * never inferred at runtime (a silently adopted key change would orphan every stored FK value\n * and bookmark).\n /\nexport const HttpApiKeyFieldSchema = z.object({\n /* The field name on the Wildo resource schema that carries this component. /\n localField: z.string().min(1),\n\n /* The remote entity's property name for this component. /\n remoteField: z.string().min(1),\n\n /* Value normalization for stable synthesis. /\n codec: z.enum(HttpApiKeyComponentCodec),\n});\n\nexport type HttpApiKeyField = z.infer<typeof HttpApiKeyFieldSchema>;\n\n// --------------------------------\n// Field mapping\n// --------------------------------\n\n/* @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer /\n/\n What kind of TEMPORAL value a remote field holds, when a query statement compares it (#1972).\n \n A statement language spells a date and a date-time differently, and neither accepts a quoted string:\n \n \| language \| `DATE` \| `DATE_TIME` \|\n * \|---\|---\|---\|\n * \| SOQL \| `2026-01-05` (unquoted) \| `2026-01-05T10:00:00Z` (unquoted, whole seconds) \|\n * \| SuiteQL \| `TO_DATE('2026-01-05', 'YYYY-MM-DD')` ¹ \| `TO_DATE('2026-01-05 10:00:00', 'YYYY-MM-DD HH24:MI:SS')` \|\n \n ¹ spec-cite: N/A — the date-only mask is Oracle SQL's `TO_DATE` convention (SuiteQL is SQL-92 / Oracle SQL);\n * NetSuite's page shows only the date-time mask cited below.\n \n Which one a field needs is a fact about the REMOTE column that nothing in a local `Date` carries, so a\n * statement read that filters a date field DECLARES it; a date compared with an undeclared field is refused\n * rather than guessed, because the wrong form is refused by the vendor or silently compares as text.\n * spec-cite: Salesforce, \"SOQL and SOSL Reference\" v68.0, WHERE › \"Date Formats and Date Literals in WHERE\" —\n * `WHERE CreatedDate > 2005-10-08T01:02:03Z`; `date YYYY-MM-DD`; `dateTime YYYY-MM-DDThh:mm:ss+hh:mm,\n * YYYY-MM-DDThh:mm:ss-hh:mm, or YYYY-MM-DDThh:mm:ssZ`.\n * spec-cite: Oracle NetSuite, \"SuiteQL Performance and Best Practices\" (article_0824094533) — \"You can't use date\n * literals. You must encapsulate dates using the `to_date()` function.\"; \"Do not use plain string values for date\n * comparisons.\"; `where lastmodifieddate >= TO_DATE('2024-01-01 00:00:00', 'yyyy-mm-dd hh24:mi:ss')`.\n \n Read by the REST_JSON STATEMENT compilers only; declared on another dialect, or on a REST_JSON binding none of\n * whose read members is a statement, it would change nothing, so the binding coherence refuses it there.\n /\nexport enum HttpApiRemoteTemporalKind {\n /* A calendar date with no time — SOQL `date`, a NetSuite date column. /\n DATE = 'date',\n /* An instant — SOQL `dateTime`, a NetSuite datetime column. /\n DATE_TIME = 'date-time',\n}\n\n/\n Local-to-remote field name mapping for fields whose names differ. Fields not listed map by\n * identity (same name both sides). Key components are declared in `keyFields`, not here.\n \n A REST_JSON statement read that FILTERS a temporal field lists it here — with the same name on both sides\n * when they agree — to declare its `temporalKind`.\n /\nexport const HttpApiFieldMappingSchema = z.object({\n localField: z.string().min(1),\n remoteField: z.string().min(1),\n /* The remote column's temporal kind, when a statement compares it with a date — see {@link HttpApiRemoteTemporalKind}. /\n temporalKind: z.enum(HttpApiRemoteTemporalKind).optional(),\n});\n/* @wildo_source:part:end saas.models.http-api-binding /\n\nexport type HttpApiFieldMapping = z.infer<typeof HttpApiFieldMappingSchema>;\n\n// --------------------------------\n// Remote-call semantics (decision D10 / requirement R15)\n// --------------------------------\n\n/\n Declared remote-call semantics. An enterprise API is 100ms–2s, rate-limited, and sometimes\n * down; these are DECISIONS, not inherited pipeline defaults. Defaults are conservative on\n * purpose — a binding that needs more declares more.\n /\nexport const HttpApiRemoteCallSemanticsSchema = z.object({\n /* Per-call timeout. /\n timeoutMs: z.number().int().positive().max(120_000).default(10_000),\n\n /\n Retry policy for idempotent READ-family calls. A WRITE (#1679) is retried only when its dialect\n * declares a remote idempotency mechanism; otherwise it is sent exactly once, and a timeout on it\n * is reported as an UNKNOWN outcome rather than retried into a duplicate.\n /\n retry: z\n .object({\n maxAttempts: z.number().int().min(1).max(5).default(2),\n backoffMs: z.number().int().positive().max(30_000).default(500),\n })\n .default({ maxAttempts: 2, backoffMs: 500 }),\n\n /\n Rate budget toward the target, per process. `undefined` = no local throttle (the target's own\n * limits still apply and surface as refusals).\n /\n maxRequestsPerMinute: z.number().int().positive().optional(),\n\n /\n Upper bound for translated id-set predicates (`_id ∈ {…}` → key-predicate disjunction /\n * `in`). Above the bound the adapter REFUSES rather than emitting an unbounded URL\n * (scope-down paper, shape T2).\n /\n maxIdSetSize: z.number().int().positive().max(500).default(50),\n\n /\n Upper bound for the translated PARTITION confinement (#1058 E7) — `key ∈ {every partition this\n * caller may touch}`, compiled per dialect.\n \n Its own knob rather than a reuse of `maxIdSetSize`, because the two bound different things and\n * would be tuned against different facts. An id set is a CALLER's request and its size is a\n * property of what they asked for; a partition set is a property of the DEPLOYMENT — how many\n * legal entities live inside one system of record — and of the caller's grant. An operator raising\n * one for a bulk read has no reason to raise the other, and lowering `maxIdSetSize` to tame a URL\n * would silently cut the confinement off at the knees: above the bound the adapter REFUSES, so a\n * confinement that cannot compile is a read that cannot happen.\n \n The default is deliberately far above `maxIdSetSize`'s. A corporate with more than two hundred\n * legal entities inside ONE system of record exists, and when it does the honest answer is a\n * refusal that NAMES the bound rather than a request the target truncates or rejects with a 414.\n * Refused rather than paged: splitting one read into N requests is a different mechanism, and one\n * that would make a single `total` impossible to compute.\n /\n maxPartitionSetSize: z.number().int().positive().max(1_000).default(200),\n});\n\nexport type HttpApiRemoteCallSemantics = z.infer<typeof HttpApiRemoteCallSemanticsSchema>;\n\n// --------------------------------\n// Dialect-specific declarations\n// --------------------------------\n\n/\n HTTP methods a declared read-family operation may use. Deliberately NOT the full HTTP verb set\n * (`API_HttpMethod` in `@wildo-ai/external-connectors-models` describes provider-protocol\n * operations): these are READ members, so the closed vocabulary is the read-safe verb plus POST —\n * because JSON-RPC (Odoo) and many enterprise search endpoints are POST-shaped even for reads.\n * Row writes are opened by `writableVerbs` (#1679) and framed by each dialect's write compiler; a\n * REST_JSON write surface is its own declaration (#1728), never a widening of this enum.\n /\nexport enum HttpApiRestOperationMethod {\n GET = 'GET',\n POST = 'POST',\n}\n\n/* @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer /\n/\n Where a declared REST parameter is placed on the request, when the method's own answer is wrong for it (#1686).\n /\nexport enum HttpApiRestParameterPlacement {\n /\n The URL query string, whatever the method — NetSuite's SuiteQL `limit` and `offset` on a POST.\n * spec-cite: Oracle NetSuite, \"Executing SuiteQL Queries Through REST Web Services\" (section_157909186990) — the\n * statement is POSTed as `{\"q\": …}` and paged by `?limit=10&offset=10` on the request URL.\n /\n QUERY_STRING = 'query-string',\n}\n\n/\n REST_JSON per-operation declaration: how one read-family member maps onto a concrete HTTP\n * operation. Deliberately minimal in slice 1 — pagination/filter parameter NAMES are declared,\n * their VALUES are supplied by the adapter from the translated query.\n \n Related but distinct: `ProviderRestOperation` on a provider's `rest` runtime contract describes a\n * VENDOR operation — one entry in the catalogue a reference below names. This schema describes a\n * RESOURCE read surface, which is a different thing and stays here.\n \n (An earlier revision pointed at `REST_API_OperationSpecSchema` in\n * `@wildo-ai/external-connectors-models` \"for capability transformers\". Both are gone: the\n * transformer layer was retired with `features/` in #327, and that OpenAPI-shaped operations layer\n * — ten exported symbols with zero code readers — was deleted in #331 rather than wired up, so\n * \"what a provider can do\" has one description instead of two.)\n \n The convergence performed in S3a (#331) — a member naming an operation in a PROVIDER's own\n * catalogue — was UNDONE in #1055. A system of record is not a connector (D10), and a read that\n * depends on a provider catalogue being loadable is the crossing that decision forbids. An inline\n * spec is now the only form, which is what every authored binding used anyway.\n /\n/\n A query LANGUAGE a REST system of record reads through, rather than a set of filter parameters\n * (#1293).\n \n Two vendors read this way and neither can be expressed as parameters: Salesforce takes SOQL and\n * NetSuite takes SuiteQL, each as ONE statement naming the fields, the entity, the predicates and\n * the order. A `filterParams` map cannot say \"SELECT these columns FROM that object\", so without this\n * neither vendor can be declared at all.\n \n ## Why this is a closed vocabulary and not a template string\n \n A statement is BUILT, and building means escaping. Each language has its own literal rules and its\n * own paging spelling, and a template with `{filter}` holes would put the escaping in the author's\n * hands — an injection surface in a file nobody reviews as one. The engine builds the statement and\n * the vocabulary names which grammar to build.\n \n This is the same trade the OData compiler already makes for `$filter`: expressions are composed\n * here, literals are escaped by one function, and no authored string reaches the wire uninspected.\n /\nexport enum HttpApiQueryStatementLanguage {\n /\n Salesforce Object Query Language.\n \n spec-cite: Salesforce Developers, \"SOQL and SOSL Reference\" —\n * https://developer.salesforce.com/docs/atlas.en-us.soql_sosl.meta/soql_sosl/\n \n `SELECT ` does not exist: every field is named, which the binding's `fieldMappings` and key\n fields already supply. Paging is by the response's own continuation rather than by `OFFSET`,\n * which SOQL bounds at 2000 rows.\n /\n SOQL = 'soql',\n /\n NetSuite SuiteQL — an SQL-92 dialect over its analytics schema.\n \n spec-cite: Oracle NetSuite, \"SuiteQL\" —\n * https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_156257770590.html\n \n Paged by `limit` / `offset` QUERY parameters rather than inside the statement, which is why the\n * statement declaration and `pagingParams` are independent.\n /\n SUITEQL = 'suiteql',\n}\n\n/\n Where a KEYSET page's size bound goes, per statement language (#1686).\n \n A keyset page is \"the next N rows after the last key\", so the statement's predicate and order are\n * the same in every language — `<key> > <last key> … ORDER BY <key> ASC` — and only the size bound\n * differs. Decided by the LANGUAGE, never declared by an author: it is a fact about the grammar.\n /\nexport enum HttpApiKeysetPageBound {\n /\n The statement carries `LIMIT <n>` itself — SOQL, which has no size parameter on `/query`.\n \n The vendor may still split the limited result into several BATCHES and answer the first one with\n * a continuation (`nextRecordsUrl`), so a keyset page on this bound follows the operation's declared\n * `cursorPath` inside the page until the result is exhausted — which is why the bound requires one.\n * Without it, a batch shorter than the limit would read as the end of the pass and every row after\n * it would go unread, and a DELETE orphan policy would then delete them.\n * spec-cite: Salesforce REST API Developer Guide v68.0, \"Query\" — \"up to 2,000 records can be returned\n * at a time … the returned batch can include fewer records than the limit or what's set in the\n * request … If the total number of results exceeds the limit or the requested number of results, the\n * response contains the first batch of records, a false value for done, and a query locator.\"\n /\n STATEMENT_LIMIT_CLAUSE = 'statement-limit-clause',\n /\n The operation's declared `pagingParams.limitParam` carries the size, and its `offsetParam` is sent\n * as 0 on every page — SuiteQL, which pages by `limit`/`offset` query parameters.\n \n Offset 0 always: each page is a NEW query that starts after the last key, so no offset is ever\n * needed, and none of the offset rules (an offset divisible by the limit, the result ceiling) is\n * ever reached.\n * spec-cite: Oracle NetSuite, \"Collection Paging\" (section_156414087576) — \"You can only set offset\n * and limit values in a way that the offset is divisible by the limit\"; \"Executing SuiteQL Queries\n * Through REST Web Services\" (section_157909186990) — \"Using SuiteQL queries, you can return a\n * maximum of 100,000 results.\"\n /\n LIMIT_PARAMETER = 'limit-parameter',\n}\n\n/* The page bound of each statement language. A `Record` over the enum, so a new language is a compile error until it has one. /\nexport const HTTP_API_KEYSET_PAGE_BOUND: Readonly<Record<HttpApiQueryStatementLanguage, HttpApiKeysetPageBound>> = {\n [HttpApiQueryStatementLanguage.SOQL]: HttpApiKeysetPageBound.STATEMENT_LIMIT_CLAUSE,\n [HttpApiQueryStatementLanguage.SUITEQL]: HttpApiKeysetPageBound.LIMIT_PARAMETER,\n};\n\n/\n The key codecs a keyset may walk (#1686): an INTEGER compares as a number and a STRING by code\n * unit, and the engine CHECKS every served page against that order before trusting its last key.\n \n GUID and DATETIME_ISO are refused. A GUID has no order the vendors agree on — SQL Server sorts a\n * `uniqueidentifier` by its last bytes first — so a page could never be checked; a datetime is not\n * unique, and a keyset on a non-unique column skips the rows that share the boundary value.\n /\nexport const HTTP_API_KEYSET_ELIGIBLE_CODECS: readonly HttpApiKeyComponentCodec[] = [\n HttpApiKeyComponentCodec.INTEGER,\n HttpApiKeyComponentCodec.STRING,\n];\n\n/\n A declared KEYSET on a statement read (#1686) — what lets a REST system of record feed a pipeline.\n \n ## What it makes the engine build\n \n For the pipeline's extraction, the `list` member's statement becomes\n \n ```\n * SELECT <mapped fields> FROM <entity> WHERE <sourceFilter> AND <key> > <last key> ORDER BY <key> ASC\n * ```\n \n with the page size bounded per {@link HttpApiKeysetPageBound} (SOQL `LIMIT <n>`; SuiteQL\n * `limit=<n>&offset=0`). The last key of each page is the pipeline's persisted cursor, and a page\n * shorter than asked ends the pass — the Odoo id-keyset discipline, drift-safe for the same reason: a\n * row inserted or deleted mid-pass never shifts the rows after the cursor, so none is skipped or read\n * twice. Offset paging has neither property, which is why a REST source without a keyset stays\n * refused.\n \n ## Why there is no cursor PLACEHOLDER to write\n \n The statement is BUILT by the engine (#1293), never templated by an author, so there is nowhere for a\n * `:cursor` placeholder to go and no ORDER BY an author could forget: declaring the keyset is what puts\n * both into the statement, and the engine writes them itself. What an author declares is only which\n * column the walk runs on.\n \n ## Which column\n \n The binding's ONE key field — unique and immutable, which is what a keyset needs. Named by its\n * remote field; its codec is the key field's own, so the two cannot disagree. A composite key is\n * refused: one component of it is not unique.\n \n ## A vendor continuation is followed INSIDE a page, never persisted\n \n Salesforce's `nextRecordsUrl` names a server-side query locator. How long a locator lives is not\n * stated in the REST API guide (UNVERIFIED), so it is never the cross-run cursor: the key is.\n /\nexport const HttpApiQueryStatementKeysetSchema = z.strictObject({\n /* The remote field of the binding's single key field — Salesforce `Id`, NetSuite `id`. /\n keyRemoteField: z.string().min(1),\n});\nexport type HttpApiQueryStatementKeyset = z.infer<typeof HttpApiQueryStatementKeysetSchema>;\n\n/\n How a read member builds and sends a query STATEMENT (#1293).\n \n Declared per operation rather than per binding, because a vendor's `read` and `list` genuinely\n * differ: Salesforce addresses one record at `/sobjects/Account/{key}` and queries collections\n * through `/query`, and only the second is a statement at all.\n /\nexport const HttpApiQueryStatementSpecSchema = z.object({\n language: z.enum(HttpApiQueryStatementLanguage),\n /\n The parameter or body member the statement is placed in (`q` for both vendors surveyed).\n \n WHERE it lands is not declared, because the operation's own `method` already decides: a GET puts\n * parameters in the query string and a POST puts them in the JSON body, which is what the request\n * builder has always done. A `placement` field was drafted here and removed before it shipped — it\n * would have been a second declaration of something the method already says, free to disagree with\n * it. Salesforce is a GET with `?q=`, NetSuite a POST with `{\"q\": …}`, and neither needs to be told\n * twice. PAGING is the one parameter the method places wrongly for a vendor — NetSuite reads its\n * `limit`/`offset` from the URL of that POST — which is why `pagingParams` carries its own\n * `placement` (#1686) while the statement does not.\n /\n parameterName: z.string().min(1),\n /\n The object the statement selects FROM. Absent = the binding's `entityRef`, which is the ordinary\n * case; present when the vendor's query schema names an object differently from its REST resource.\n /\n fromEntity: z.string().min(1).optional(),\n /\n The KEYSET a pipeline extraction walks (#1686) — see {@link HttpApiQueryStatementKeysetSchema}.\n * Declared on the `list` member only. Absent = the binding can be read through, and cannot feed a\n * pipeline.\n /\n keyset: HttpApiQueryStatementKeysetSchema.optional(),\n});\nexport type HttpApiQueryStatementSpec = z.infer<typeof HttpApiQueryStatementSpecSchema>;\n\nexport const HttpApiRestOperationSpecSchema = z.object({\n /* HTTP method for this read-family operation. /\n method: z.enum(HttpApiRestOperationMethod),\n\n /\n Path template relative to the provider's base URL. `{key}` interpolates the synthesized\n * key's remote addressing form; other `{param}` tokens must be declared parameter names.\n /\n pathTemplate: z.string().min(1),\n\n /* Query/body parameter names for pagination, when the operation supports it. /\n pagingParams: z\n .object({\n limitParam: z.string().min(1),\n offsetParam: z.string().min(1),\n /\n Where the two paging parameters go (#1686). Absent = where the operation's method puts every\n * parameter: the query string of a GET, the JSON body of a POST.\n \n NetSuite is why this exists: its SuiteQL read is a POST whose BODY is the statement and whose\n * paging is in the URL, so a method-placed `limit` lands in the body, where the vendor does not\n * read it, and the page is not bounded at all.\n /\n placement: z.enum(HttpApiRestParameterPlacement).optional(),\n })\n .optional(),\n\n /\n Declared filter parameter name per LOCAL field. Only fields listed here are translatable for\n * this operation (scope-down paper, shape T3); everything else is refused at the adapter\n * boundary.\n /\n filterParams: z.record(z.string().min(1), z.string().min(1)).optional(),\n\n /\n The parameter that receives the SEARCH text (T4), for a `search` operation. Absent =\n * search is refused for this binding even when the operation exists.\n /\n searchParam: z.string().min(1).optional(),\n\n /\n Dot-path to the payload inside the response body — the rows array (list/search), the entity\n * object (read), or the number (count). Absent = the body IS the payload. Declared, never\n * sniffed: response shapes vary per target (`items`, `result`, `value`, raw array) and a wrong\n * guess would silently read zero rows.\n /\n resultPath: z.string().min(1).optional(),\n\n /* Wrap request/response in a JSON-RPC 2.0 envelope (the Odoo variant). /\n jsonRpcEnvelope: z\n .object({\n rpcMethod: z.string().min(1),\n })\n .optional(),\n\n /\n Read through a query STATEMENT rather than through filter parameters (#1293).\n \n Mutually exclusive with `filterParams` and `searchParam` in practice rather than by schema: a\n * statement expresses its own predicates, so a declaration carrying both has said the same thing\n * twice in two grammars. The compiler refuses that pairing, where it can name which one it was\n * about to ignore.\n /\n statement: HttpApiQueryStatementSpecSchema.optional(),\n\n /\n Dot-path to a CONTINUATION URL in the response — Salesforce's `nextRecordsUrl` (#1293).\n \n Declared rather than sniffed, for the same reason `resultPath` is: response shapes vary per\n * target and a wrong guess reads zero rows silently. Absent means the operation pages by\n * `pagingParams` or not at all.\n \n A continuation is followed only on the target's OWN origin, exactly as the OData one is — the\n * link comes from a remote response body and carries this deployment's credentials wherever it\n * points.\n /\n cursorPath: z.string().min(1).optional(),\n\n /\n Headers this vendor requires on the request — NetSuite's `Prefer: transient` (#1293).\n \n VENDOR headers only. A credential never goes here: credentials come from the instance's access,\n * and a header authored in a binding would be a second credential channel in a file that is\n * committed. The compiler refuses an `authorization` key by name rather than trusting the author.\n /\n staticHeaders: z.record(z.string().min(1), z.string().min(1)).optional(),\n});\n\nexport type HttpApiRestOperationSpec = z.infer<typeof HttpApiRestOperationSpecSchema>;\n/* @wildo_source:part:end saas.models.http-api-binding /\n\n/\n * ─── The catalogue REFERENCE form was REMOVED here (#1055 D10) ──────────────────────────────────\n \n A REST_JSON member could name an `operationId` in a PROVIDER's own `rest.operations` catalogue,\n * so a resource's read surface reached into the connector lane for its shape. That is precisely the\n * crossing D10 forbids: no runtime object, stored row, route, secret name, audit subject or\n * specification serves both a system of record and a connector — and this one made a read depend on\n * a provider's catalogue being loadable at request time.\n \n Nothing loses a capability. A REST_JSON binding declares its read members INLINE, typed against its\n * vendor facet, which is what every authored binding does today: no REST_JSON system of record was\n * ever declared against a catalogue, and the generic-REST simulator proof moves to a facet fixture.\n \n The convergence recorded above (#331) is what is being undone, and deliberately rather than by\n * accident: stating the vendor half once per provider is a real saving for a CONNECTOR, and a\n * category error for a system the application reads its OWN rows out of.\n /\n\n/\n One read-surface member. An INLINE spec, and now only that.\n \n Kept as a named alias rather than collapsed into {@link HttpApiRestOperationSpecSchema} at every\n * use site: the members of a read surface are a concept in their own right, and a later form — a\n * facet-declared operation shape — would arrive HERE rather than at each of its consumers.\n /\nexport const HttpApiRestOperationDeclarationSchema = HttpApiRestOperationSpecSchema;\n\nexport type HttpApiRestOperationDeclaration = z.infer<typeof HttpApiRestOperationDeclarationSchema>;\n\n/* The REST_JSON operation mapping: which read members and opened row writes exist remotely, and how each is sent. /\nexport const HttpApiRestOperationsSchema = z.object({\n read: HttpApiRestOperationDeclarationSchema,\n list: HttpApiRestOperationDeclarationSchema,\n /* Absent = COUNT is refused for this binding (honest refusal, never an emulated scan). /\n count: HttpApiRestOperationDeclarationSchema.optional(),\n /* Absent = SEARCH is refused for this binding. /\n search: HttpApiRestOperationDeclarationSchema.optional(),\n /\n The declared row WRITES (#1728) — see `http-api-rest-write-operations.shared.schemas.ts`. Each is present exactly\n * when `writableVerbs` opens its verb; `assertHttpApiBindingDialectCoherence` refuses either without the other.\n /\n create: HttpApiRestWriteOperationSpecSchema.optional(),\n update: HttpApiRestWriteOperationSpecSchema.optional(),\n delete: HttpApiRestWriteOperationSpecSchema.optional(),\n});\n\nexport type HttpApiRestOperations = z.infer<typeof HttpApiRestOperationsSchema>;\n\n/\n What each opened verb's REST_JSON write member must be (#1728). Total over {@link HttpApiWriteVerb}, so a verb added to\n * the vocabulary is a compile error here until somebody decides how REST_JSON declares it. The member name IS the verb.\n /\nconst HTTP_API_REST_WRITE_MEMBER_RULES: Readonly<Record<HttpApiWriteVerb, {\n readonly methods: readonly HttpApiRestWriteMethod[];\n readonly addressesOneRecord: boolean;\n}>> = {\n [HttpApiWriteVerb.CREATE]: { methods: [HttpApiRestWriteMethod.POST], addressesOneRecord: false },\n [HttpApiWriteVerb.UPDATE]: { methods: [HttpApiRestWriteMethod.PATCH, HttpApiRestWriteMethod.POST], addressesOneRecord: true },\n [HttpApiWriteVerb.DELETE]: { methods: [HttpApiRestWriteMethod.DELETE, HttpApiRestWriteMethod.POST], addressesOneRecord: true },\n};\n\n// --------------------------------\n// Stance sub-declarations\n// --------------------------------\n\n/\n HTTP methods a declared EXPLICIT erasure operation (stance 6b, REST_JSON) may use.\n \n A separate vocabulary from {@link HttpApiRestOperationMethod} on purpose: that enum describes\n * READ-family operations (GET/POST), and reusing it here would let an erasure declare `GET` — a\n * read spelled as a deletion. Deletion is expressed as the resource-oriented `DELETE` or an\n * RPC-style `POST`; nothing else is a deletion on the wire.\n /\nexport enum HttpApiErasureOperationMethod {\n POST = 'POST',\n DELETE = 'DELETE',\n}\n\n/\n The EXPLICIT erasure call a REST_JSON binding declares for stance 6b. Deliberately narrower\n * than {@link HttpApiRestOperationSpecSchema}: an erasure addresses ONE row by key — it has no\n * pagination, no filter params, no search, no result path to project.\n /\nexport const HttpApiErasureOperationSpecSchema = z.object({\n method: z.enum(HttpApiErasureOperationMethod),\n\n /\n Path template relative to the provider base URL. `{key}` interpolates the row's remote key\n * addressing form, exactly as in the read-family `pathTemplate`.\n /\n pathTemplate: z.string().min(1),\n\n /\n JSON-RPC envelope for RPC-style targets (pairs with `method: POST`), mirroring the\n * read-family declaration.\n /\n jsonRpcEnvelope: z.object({ rpcMethod: z.string().min(1) }).optional(),\n});\n\nexport type HttpApiErasureOperationSpec = z.infer<typeof HttpApiErasureOperationSpecSchema>;\n\n/* Erasure declaration — discriminated; stance 6b names the operation it invokes. /\nexport const HttpApiErasureDeclarationSchema = z.discriminatedUnion('stance', [\n z.object({\n stance: z.literal(HttpApiErasureStance.NO_SUBJECT_DATA),\n }),\n z.object({\n stance: z.literal(HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION),\n /\n The declared erasure call. ODATA and ODOO_JSONRPC bindings rely on their CANONICAL delete\n * (`DELETE /EntitySet(key)` / `execute_kw('unlink', [[ids]])`) by declaring\n * `useCanonicalDelete`; REST_JSON bindings declare the operation explicitly. The pairing is\n * enforced by {@link assertHttpApiBindingDialectCoherence}.\n /\n operation: z.union([\n z.object({ useCanonicalDelete: z.literal(true) }),\n HttpApiErasureOperationSpecSchema,\n ]),\n /\n The LOCAL field naming the DATA SUBJECT whose erasure deletes a remote row — the rows the\n * declared operation applies to are exactly `{ [subjectLinkLocalField]: <erased subject id> }`.\n \n DECLARED, never inferred, for the same reason `dataSubjectPolicy` exists on retention: a\n * foreign key usually names an OWNER or an ACTOR, not the subject — inferring from \"any FK to\n * the erased user\" would delete a purchase-order row because the erased user merely CREATED\n * it, destroying a business record no erasure asked for. One field, mirroring\n * `sessionPrincipalField`'s \"one field names the person\". Registration verifies a declared\n * relationship carries this field as its FK (so the subject type it links is known).\n /\n subjectLinkLocalField: z.string().trim().min(1),\n }),\n z.object({\n stance: z.literal(HttpApiErasureStance.CONTROLLER_ACKNOWLEDGED_NON_ERASURE),\n /\n Optional evidence link: the LOCAL field naming the data subject, used ONLY to COUNT the\n * remaining remote rows for the acknowledgement's CRITICAL audit record (`remainingRowCount`).\n * Optional because 6c legitimately covers linkage no FK expresses (an email inside remote\n * rows) — absent, the record carries no count rather than a fabricated zero. Never used to\n * delete anything.\n /\n subjectLinkLocalField: z.string().trim().min(1).optional(),\n }),\n]);\n\nexport type HttpApiErasureDeclaration = z.infer<typeof HttpApiErasureDeclarationSchema>;\n\n// --------------------------------\n// The binding declaration\n// --------------------------------\n\n/* @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer /\n/\n The fields EVERY binding carries, whatever its dialect — spread into each arm of the union below.\n /\nconst httpApiResourceBindingBaseShape = {\n /\n The SYSTEM OF RECORD this resource lives in, by the NAME the application declared it under in\n * `wildo.saas.config.ts` (`systemsOfRecord.<name>`, #1055).\n \n ## Why a name, and not a provider ref\n \n `providerRef` named a PROVIDER, and a provider's env-var names live in its module — so one ref\n * was one deployment, and a second Odoo was unrepresentable. A name here is an INSTANCE: two\n * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in the environment variables their\n * names derive. It is also not a provider in any other sense (D10): nothing here is selected\n * through the capability plane, carries a person's lent credential, or has an operation catalogue.\n \n ## What validates it, and where\n \n Not here, and not in the resource factory — the factory runs in the application's `shared-lib`,\n * where the saas configuration is not in scope. The factory checks SHAPE; the boot registry checks\n * that this name is DECLARED and that `dialect` below equals the instance's, at the first moment\n * both are visible. That split is the honest one rather than a compromise.\n /\n system: z.string().min(1),\n\n /\n The remote entity addressed by this binding — an OData entity-set name, or a logical name for\n * a REST_JSON surface. One binding, one remote entity set.\n /\n entityRef: z.string().min(1),\n\n /\n * `connection` was here, and it is GONE (#1055 D12).\n \n It declared WHOSE ACCOUNT a binding spends — `ORGANIZATION × USER` and its siblings — which is a\n * real question for a CONNECTOR, where a customer connects their own account. A system of record is\n * not that: it is a deployment the application reads its own business rows out of, with its own\n * service identity, and the only honest answer was always `APPLICATION × SERVICE`. A field with one\n * legal value is a question nobody should be asked.\n \n The customer-connection case is case 2 of #1049 and keeps the connector resolver, untouched.\n /\n\n /* Ordered key declaration — the source of the synthesized engine-facing `_id` (paper A). /\n keyFields: z.array(HttpApiKeyFieldSchema).min(1),\n\n /* Non-key field name mappings; unlisted fields map by identity. /\n fieldMappings: z.array(HttpApiFieldMappingSchema).default([]),\n\n /\n * `tenancy` was here, and it is GONE (#1055 §5).\n \n Both of its stances were wrong for a system of record. `SCOPE_FILTER_PUSHDOWN` sent WILDO's own\n * organization id to the remote as a filter value — an id the remote has never heard of — and\n * `SINGLE_TENANT_BINDING` became the only truth, which makes it a declaration with one legal answer.\n \n What replaced it is not a smaller field but a different mechanism: the row projector STAMPS the\n * owner organization's id onto every remote row, so the per-row tenant gate passes with no exemption\n * and a read under another organization's URL is refused by the gate that already existed.\n * Partitioning a system of record BY organization unit returns in #1058, as a property of the\n * INSTANCE and its vendor facet rather than of each binding.\n /\n\n /* Erasure stance (D6) — required; no silent default. /\n erasure: HttpApiErasureDeclarationSchema,\n\n /\n The processing PURPOSES this data flow serves (#1745) — each a `purposeRef` of\n * `operatorComplianceIdentity.lawfulBases` in `wildo.saas.config.ts`. Absent = none linked.\n \n A system of record is where an application OBTAINS personal data it did not collect from the person, and a\n * privacy notice then owes the purpose and the legal basis for it (GDPR Art. 14(1)(c)) beside the source (Art.\n * 14(2)(f)). The source and the categories are derived from this binding; the purpose is the one thing the\n * framework cannot infer from what the data is, so it is LINKED here, per binding, rather than typed into a\n * notice. The same link a provider's compliance choice carries (#1709), for the same reason.\n \n Checked where both halves are visible — the document facts and the evidence collector — and a ref naming no\n * declared purpose is REPORTED there as a broken link, never refused: the factory runs in `shared-lib`, where the\n * lawful bases are not in scope, and a compliance link must never stop the application from starting.\n /\n purposeRefs: z.array(z.string().trim().min(1)).optional(),\n\n /\n The row-level writes this binding OPENS toward its system of record (#1679). Absent = none: the\n * binding is read-only, which is what every binding authored before #1679 declared implicitly.\n \n Opening a verb is not enough to write. The resource must also declare the matching operation\n * (the factory refuses either without the other), the dialect must implement writes (the boot\n * registration refuses a verb its dialect cannot send, naming the dialect), and every write\n * variant carries a REQUIRED `Idempotency-Key`, because a remote write cannot be rolled back and\n * a retried request must replay its first outcome rather than write twice.\n /\n writableVerbs: z.array(z.enum(HttpApiWriteVerb)).default([]),\n\n /\n How an opened UPDATE is protected against overwriting a change made since its author read the row (#1724). See\n * {@link HttpApiWriteConcurrencyMode} for the two answers and the limit of the first.\n \n REQUIRED when the binding opens UPDATE — on ODOO_JSONRPC (#1724), ODATA (#1726) and REST_JSON (#1728) alike — and\n * refused when the binding opens no UPDATE — a concurrency stance on a door that is shut decides nothing. `versionField` names the LOCAL field that\n * carries the version: it must map onto the vendor facet's `rowVersionField` (checked at boot, where the facet is\n * visible) — Odoo `write_date`, an OData service's `@odata.etag` — and the resource's schema must let an UPDATE carry\n * it and keep a CREATE from sending it (checked by the resource factory).\n /\n writeConcurrency: z.discriminatedUnion('mode', [\n z.strictObject({\n mode: z.literal(HttpApiWriteConcurrencyMode.VERSION_CHECKED),\n /* The LOCAL field carrying the row version the caller read — never written to the remote. /\n versionField: z.string().min(1),\n }),\n z.strictObject({ mode: z.literal(HttpApiWriteConcurrencyMode.LAST_WRITER_WINS) }),\n ]).optional(),\n\n /\n The vendor ACTIONS this binding declares toward its system of record (#1678) — named operations that are not row\n * writes: posting an invoice, confirming an order, an OData bound or unbound action. Absent = none.\n \n Declared here rather than on the instance for the reasons `system-of-record-actions.shared.schemas.ts` records: an\n * action carries a Zod input schema and the roles admitted to it, both of which live in `shared-lib` beside this\n * binding. An action runs only through the system-of-record action executor, under the instance's service identity,\n * confined to the owner organization and to the caller's partition, and audited on every outcome. It is reached over\n * HTTP only through a custom operation of this resource whose implementation calls the executor.\n /\n actions: SystemOfRecordActionDeclarationsSchema.optional(),\n\n /* Remote-call semantics (D10/R15). /\n remoteCallSemantics: HttpApiRemoteCallSemanticsSchema.default({\n timeoutMs: 10_000,\n retry: { maxAttempts: 2, backoffMs: 500 },\n maxIdSetSize: 50,\n maxPartitionSetSize: 200,\n }),\n};\n/* @wildo_source:part:end saas.models.http-api-binding /\n\n/\n The HTTP_API resource binding — discriminated on the transport dialect so each dialect carries\n * exactly its own obligations: ODATA and ODOO_JSONRPC are generic (the model name IS `entityRef`, and\n * read/list/count map mechanically); REST_JSON must declare its whole read surface INLINE.\n \n Every arm carries `system` — the declared instance this resource lives in — and none carries a\n * provider, a connection shape or a tenancy stance. See the base shape above for what each of those\n * was and why none was replaced by a smaller field (#1055).\n /\n/* @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer /\nexport const HttpApiResourceBindingSchema = z.discriminatedUnion('dialect', [\n z.object({\n dialect: z.literal(HttpApiTransportDialect.ODATA),\n ...httpApiResourceBindingBaseShape,\n /\n * `verifyMetadataAtBoot` was here, and it is GONE (#1055 §5).\n \n It had ZERO non-test readers — measured, not assumed — so nothing ever probed `$metadata` at\n * boot whatever it was set to. It also asked for exactly what the registry above it must never\n * do: dial the remote during startup, where an ERP outage would stop an application booting\n * (`continuity-drift-and-cas-basis.md` Rule 3).\n \n The drift probe it promised EXISTS, on the extraction source, reached through the operator door\n * (`external-data-extraction-source.backend.ts`) — where a human is present and a refusal is\n * something somebody can act on.\n /\n }),\n z.object({\n /\n * OData v2 (#1687) — generic like ODATA: the entity set IS `entityRef`, and read/list/count map mechanically. Its\n * own arm rather than a flag on ODATA because the compiler, the envelope and the value encoding all differ.\n /\n dialect: z.literal(HttpApiTransportDialect.ODATA_V2),\n ...httpApiResourceBindingBaseShape,\n }),\n z.object({\n dialect: z.literal(HttpApiTransportDialect.REST_JSON),\n ...httpApiResourceBindingBaseShape,\n /\n The declared read surface, and the declared request of each row write the binding opens (#1728) — absent members\n * are refused, never emulated.\n /\n operations: HttpApiRestOperationsSchema,\n }),\n z.object({\n dialect: z.literal(HttpApiTransportDialect.ODOO_JSONRPC),\n ...httpApiResourceBindingBaseShape,\n // Generic like ODATA — no per-binding operation declarations: `entityRef` is the Odoo model\n // (e.g. 'res.partner'); read/list/count map onto read/search_read/search_count mechanically.\n // The single-INTEGER-key constraint is enforced by `assertHttpApiBindingDialectCoherence`\n // (called by the resource-configuration factory) — a refine here would wrap the union member\n // in effects, which discriminated unions do not admit.\n }),\n]);\n\n/\n A declared statement keyset must be one the engine can walk (#1686). Every refusal names the fix.\n \n Checked on the BINDING rather than only on a pipeline, so a keyset declared on a read-through\n * resource is refused the same way: a declaration that says something false is refused wherever it\n * is written, not only where it is used.\n /\nfunction assertRestJsonKeysetCoherence(keyFields: readonly HttpApiKeyField[], operations: HttpApiRestOperations): void {\n for (const [member, declaration] of Object.entries(operations) as Array<[string, HttpApiRestOperationSpec \| undefined]>) {\n /\n * A statement on `read` is never sent (#1972 review): a key-addressed read is a path with `{key}` — Salesforce's\n * `/sobjects/Account/{key}` — and `compileRestJsonKeyAddressedRead` reads no statement. Declared there it would\n * look like it shapes the read and shape nothing, and it would admit a `temporalKind` that nothing reads.\n /\n if (member === 'read' && declaration?.statement !== undefined) {\n throw new Error(\n 'operations.read.statement: a key-addressed read is its `pathTemplate` with `{key}`, and sends no statement — declare the '\n + 'statement on `list` (or `search` / `count`), where collection reads are built.',\n );\n }\n /\n * SuiteQL is NetSuite's, and NetSuite reads a SuiteQL POST's paging from the URL (#1686). Placed by method, the\n * `limit` lands in the body, the vendor applies its own default, and the page is not bounded — a read-through LIST\n * then serves whole results, and a keyset page is refused at every run. Refused here, where the declaration is.\n * spec-cite: Oracle NetSuite, \"Executing SuiteQL Queries Through REST Web Services\" (section_157909186990) — the\n * statement is POSTed as `{\"q\": …}` and paged by `?limit=10&offset=10` on the request URL.\n /\n if (declaration?.statement?.language === HttpApiQueryStatementLanguage.SUITEQL\n && declaration.method === HttpApiRestOperationMethod.POST\n && declaration.pagingParams !== undefined\n && declaration.pagingParams.placement !== HttpApiRestParameterPlacement.QUERY_STRING) {\n throw new Error(\n `operations.${member}.pagingParams: a SuiteQL read POSTs its statement in the body and is paged in the URL — declare `\n + `\\`placement: '${HttpApiRestParameterPlacement.QUERY_STRING}'\\`, or the limit lands in the body and bounds nothing.`,\n );\n }\n const keyset = declaration?.statement?.keyset;\n if (declaration === undefined \|\| keyset === undefined) continue;\n if (member !== 'list') {\n throw new Error(\n `operations.${member}.statement.keyset: a keyset is what a pipeline walks a COLLECTION by, so it is declared on the 'list' member only.`,\n );\n }\n if (keyFields.length !== 1) {\n throw new Error(\n `operations.list.statement.keyset: this binding declares ${keyFields.length} key components, and a keyset needs ONE unique column — `\n + 'one component of a composite key is not unique, and a walk on it skips the rows that share its boundary value.',\n );\n }\n const keyField = keyFields[0];\n if (keyset.keyRemoteField !== keyField.remoteField) {\n throw new Error(\n `operations.list.statement.keyset.keyRemoteField: '${keyset.keyRemoteField}' is not this binding's key field ('${keyField.remoteField}'). `\n + 'A keyset walks the row identity, which is the key field: unique and immutable, so no row can move behind the cursor.',\n );\n }\n if (!HTTP_API_KEYSET_ELIGIBLE_CODECS.includes(keyField.codec)) {\n throw new Error(\n `operations.list.statement.keyset: the key field '${keyField.remoteField}' has the ${keyField.codec} codec, and a keyset walks `\n + `${HTTP_API_KEYSET_ELIGIBLE_CODECS.join(' or ')} keys only — the engine checks each page against the key's order, and that `\n + 'order must be one it can state.',\n );\n }\n const bound = HTTP_API_KEYSET_PAGE_BOUND[declaration.statement!.language];\n switch (bound) {\n case HttpApiKeysetPageBound.STATEMENT_LIMIT_CLAUSE:\n if (declaration.cursorPath === undefined) {\n throw new Error(\n `operations.list: a ${declaration.statement!.language.toUpperCase()} keyset bounds its page with LIMIT, and the vendor may still `\n + 'answer the limited result in several batches. Declare the continuation (`cursorPath`, e.g. \\'nextRecordsUrl\\') so a page is '\n + 'read to its end — a batch shorter than the limit would otherwise end the pass with rows unread.',\n );\n }\n break;\n case HttpApiKeysetPageBound.LIMIT_PARAMETER:\n if (declaration.pagingParams === undefined) {\n throw new Error(\n `operations.list: a ${declaration.statement!.language.toUpperCase()} keyset bounds its page with the operation's limit parameter — `\n + 'declare `pagingParams` (limitParam / offsetParam; the offset is always sent as 0).',\n );\n }\n break;\n }\n }\n}\n\n/\n Dialect-specific structural constraints that a discriminated union cannot express member-side.\n * Called by the resource-configuration factory AFTER the schema parse; throws with the offending\n * path named.\n /\nexport function assertHttpApiBindingDialectCoherence(binding: HttpApiResourceBinding): void {\n if (binding.dialect === HttpApiTransportDialect.ODOO_JSONRPC) {\n // Odoo row ids are INTEGERS, always — one key field, INTEGER codec, or the synthesized id\n // could never address a row.\n if (\n binding.keyFields.length !== 1\n \|\| binding.keyFields[0].codec !== HttpApiKeyComponentCodec.INTEGER\n ) {\n throw new Error(\n \"keyFields: an ODOO_JSONRPC binding must declare exactly one key field with the INTEGER codec — Odoo row ids are integers ('id').\",\n );\n }\n }\n\n /\n * A member naming a PROVIDER's catalogue operation is refused, and refused EXPLICITLY (#1055 D10).\n \n The schema alone would refuse it as an unknown key, with a message about `providerOperationId`\n * not being expected — true, and useless to an author who reasonably believes the form still\n * exists, because it did until this slice. So the refusal names what happened and where the shape\n * went instead of letting the parse error carry it.\n \n This replaces an ambiguity check that existed for the opposite reason: while BOTH forms were\n * legal, a member carrying both parsed as the inline one and dropped the reference silently.\n /\n if (binding.dialect === HttpApiTransportDialect.REST_JSON) {\n for (const [member, declaration] of Object.entries(binding.operations)) {\n if (declaration === undefined) continue;\n if ((declaration as Record<string, unknown>).providerOperationId !== undefined) {\n throw new Error(\n `operations.${member}: a read member can no longer REFERENCE a provider's operation catalogue `\n + '(`providerOperationId`). A system of record is not a connector, so its read surface is declared '\n + 'INLINE here (method + pathTemplate) against the vendor facet.',\n );\n }\n }\n assertRestJsonKeysetCoherence(binding.keyFields, binding.operations);\n }\n\n // #1972 — a temporal kind is read by the REST_JSON statement compilers only; anywhere no statement is built it would\n // decide nothing — a setting that looks like it controls date spelling and controls nothing.\n const declaredTemporal = binding.fieldMappings.find((mapping) => mapping.temporalKind !== undefined);\n if (declaredTemporal !== undefined) {\n const readsThroughStatement = binding.dialect === HttpApiTransportDialect.REST_JSON\n && Object.values(binding.operations).some((member) => (member as HttpApiRestOperationSpec \| undefined)?.statement !== undefined);\n if (!readsThroughStatement) {\n throw new Error(\n `fieldMappings('${declaredTemporal.localField}').temporalKind: declared on a ${binding.dialect} binding that reads through no query `\n + 'statement — it tells a SOQL or SuiteQL statement how to spell a date, and nothing here builds one, so it would change nothing. Remove it.',\n );\n }\n }\n\n // #1679 — each opened verb once. A duplicate is not harmful by itself, but it is a declaration that\n // says the same thing twice, which is the shape that drifts when one copy is edited.\n if (new Set(binding.writableVerbs).size !== binding.writableVerbs.length) {\n throw new Error(`writableVerbs: each verb may be opened once — got [${binding.writableVerbs.join(', ')}].`);\n }\n\n // #1724 — the concurrency stance of an opened UPDATE. A stance with no UPDATE decides nothing; an Odoo UPDATE with no\n // stance would be last-writer-wins by an omission nobody reviewed, because Odoo's `write` takes no precondition.\n const opensUpdate = binding.writableVerbs.includes(HttpApiWriteVerb.UPDATE);\n if (binding.writeConcurrency !== undefined && !opensUpdate) {\n throw new Error(\n 'writeConcurrency: declared on a binding that opens no UPDATE — it governs updates only. Remove it, or open the update.',\n );\n }\n if (opensUpdate && binding.writeConcurrency === undefined && binding.dialect === HttpApiTransportDialect.ODOO_JSONRPC) {\n throw new Error(\n `writeConcurrency: this binding opens UPDATE toward '${binding.system}', and Odoo's external API has no conditional write — `\n + '`write(ids, vals)` applies the values whatever changed since they were read. State the stance: '\n + `{ mode: '${HttpApiWriteConcurrencyMode.VERSION_CHECKED}', versionField: '<local field mapped to write_date>' } to refuse `\n + `a stale version before sending (best-effort: it narrows the race, it does not close it), or { mode: '${HttpApiWriteConcurrencyMode.LAST_WRITER_WINS}' }.`,\n );\n }\n // #1728 — a REST_JSON write is sent exactly as the binding declares it, so each opened verb needs its member and a\n // member of a verb that is not opened is a declaration nothing sends. Both are refused, naming the member.\n if (binding.dialect === HttpApiTransportDialect.REST_JSON) {\n for (const verb of Object.values(HttpApiWriteVerb)) {\n const member = binding.operations[verb];\n const opened = binding.writableVerbs.includes(verb);\n if (opened && member === undefined) {\n throw new Error(\n `operations.${verb}: this binding opens ${verb.toUpperCase()} toward '${binding.system}', and a REST_JSON write is sent `\n + `exactly as declared — declare operations.${verb} (method + pathTemplate${verb === HttpApiWriteVerb.CREATE ? ' + createdKey' : ''}).`,\n );\n }\n if (!opened && member !== undefined) {\n throw new Error(\n `operations.${verb}: declared on a binding that does not open ${verb.toUpperCase()} — nothing would ever send it. `\n + `Open it in writableVerbs, or remove the member.`,\n );\n }\n if (member !== undefined) {\n assertHttpApiRestWriteOperationShape(member, {\n member: verb,\n ...HTTP_API_REST_WRITE_MEMBER_RULES[verb],\n keyRemoteFields: binding.keyFields.map((keyField) => keyField.remoteField),\n });\n }\n }\n // Neither REST_JSON vendor's record API is written with a precondition, so an update's stance must be stated, as on Odoo.\n if (opensUpdate && binding.writeConcurrency === undefined) {\n throw new Error(\n `writeConcurrency: this binding opens UPDATE toward '${binding.system}' over REST_JSON, which the engine writes with no `\n + `precondition. State the stance: { mode: '${HttpApiWriteConcurrencyMode.LAST_WRITER_WINS}' }, or `\n + `{ mode: '${HttpApiWriteConcurrencyMode.VERSION_CHECKED}', versionField: '<local field mapped to the row version>' } — `\n + 'best-effort, and available only when the vendor facet declares its row version field.',\n );\n }\n }\n // #1726 — an OData UPDATE is conditional only on a version the caller supplies; without a stance it would be\n // last-writer-wins by an omission nobody reviewed, exactly as for Odoo.\n if (opensUpdate && binding.writeConcurrency === undefined && binding.dialect === HttpApiTransportDialect.ODATA) {\n throw new Error(\n `writeConcurrency: this binding opens UPDATE toward '${binding.system}' over OData. State the stance: `\n + `{ mode: '${HttpApiWriteConcurrencyMode.VERSION_CHECKED}', versionField: '<local field mapped to @odata.etag>' } to send the `\n + 'entity tag the caller read as If-Match, so the service itself refuses a stale update (412) — available only when the '\n + `vendor facet declares its entity tag as rowVersionField — or { mode: '${HttpApiWriteConcurrencyMode.LAST_WRITER_WINS}' }.`,\n );\n }\n if (binding.writeConcurrency?.mode === HttpApiWriteConcurrencyMode.VERSION_CHECKED) {\n const versionField = binding.writeConcurrency.versionField;\n if (binding.keyFields.some((keyField) => keyField.localField === versionField)) {\n throw new Error(`writeConcurrency.versionField: '${versionField}' is a key field — a row's version is not its address.`);\n }\n }\n\n // #1678 — every declared action must be one this binding's dialect can call, on the target it names.\n assertSystemOfRecordActionDeclarationsCoherence({ dialect: binding.dialect, actions: binding.actions });\n\n // D6 stance 6b — the declared erasure operation's FORM is dialect-specific. The union schema\n // admits both forms; only the pairing below is executable, so an incoherent pairing must refuse\n // at authoring rather than on the first subject-erasure request:\n // - ODATA → `useCanonicalDelete` only (the canonical `DELETE /EntitySet(key)`);\n // - ODOO_JSONRPC → `useCanonicalDelete` only (compiles to `execute_kw('unlink', [[ids]])`,\n // Odoo's own canonical delete);\n // - REST_JSON → an explicit operation spec only (there IS no canonical delete to rely on —\n // the binding declares the exact call, like every other REST_JSON operation).\n if (binding.erasure.stance === HttpApiErasureStance.EXTERNAL_ERASURE_OPERATION) {\n /\n * #1687 — an OData v2 binding reads only. The explicit-erasure stance is a remote DELETE, which on SAP Gateway needs\n * the CSRF-token handshake the engine does not perform, and v2's write shapes are the write path's (#1679). Refused\n * here rather than at the first erasure request, where a subject's Art. 17 answer would be the one to fail.\n /\n if (binding.dialect === HttpApiTransportDialect.ODATA_V2) {\n throw new Error(\n 'erasure: an ODATA_V2 binding reads only, and the explicit-erasure stance is a remote DELETE the engine does not send on v2 '\n + '(SAP Gateway requires a CSRF-token handshake). Declare NO_SUBJECT_DATA or CONTROLLER_ACKNOWLEDGED_NON_ERASURE, or bind a v4 service.',\n );\n }\n const usesCanonicalDelete = 'useCanonicalDelete' in binding.erasure.operation;\n if (binding.dialect === HttpApiTransportDialect.REST_JSON && usesCanonicalDelete) {\n throw new Error(\n 'erasure.operation: a REST_JSON binding has no canonical delete — declare the explicit erasure operation spec (method/path), like its other declared operations.',\n );\n }\n if (binding.dialect !== HttpApiTransportDialect.REST_JSON && !usesCanonicalDelete) {\n throw new Error(\n `erasure.operation: a ${binding.dialect} binding executes erasure through its CANONICAL delete (declare { useCanonicalDelete: true }) — an explicit REST operation spec has no translation on this dialect.`,\n );\n }\n }\n}\n\n/* @wildo_source:part:end saas.models.http-api-binding /\nexport type HttpApiResourceBinding = z.infer<typeof HttpApiResourceBindingSchema>;\n\n/\n What an APPLICATION AUTHOR writes — the INPUT shape, so defaulted fields (`verifyMetadataAtBoot`,\n * `connection`, the remote-call semantics) are optional to type. Consumers read the parsed shape\n * above. Same split, and same reason, as `ExternalDataPipelineDeclarationAuthored`: a config field\n * typed with the PARSED shape makes every default mandatory for the one person the default exists\n * to serve.\n /\nexport type HttpApiResourceBindingAuthored = z.input<typeof HttpApiResourceBindingSchema>;\n\n// --------------------------------\n// Static binding properties\n// --------------------------------\n\n/\n Codecs whose ENTIRE value space stays within the synthesized-id charset law\n * (`^[A-Za-z0-9._~-]+$`, see `http-api-binding-id.shared.utils.ts`). Membership here is what\n * qualifies a single-key binding for the verbatim id form.\n /\nconst VERBATIM_ELIGIBLE_CODECS: readonly HttpApiKeyComponentCodec[] = [\n HttpApiKeyComponentCodec.INTEGER,\n HttpApiKeyComponentCodec.GUID,\n];\n\n/\n Whether this binding's synthesized `_id` is the single key value VERBATIM (legible ids for\n * Dataverse GUIDs / Odoo integers) versus the encoded composite form. A STATIC property of the\n * declaration — never sniffed per row — which is what keeps decode unambiguous (paper A).\n */\nexport function httpApiBindingUsesVerbatimKey(\n binding: { keyFields: readonly HttpApiKeyField[] },\n): boolean {\n return (\n binding.keyFields.length === 1\n && VERBATIM_ELIGIBLE_CODECS.includes(binding.keyFields[0].codec)\n );\n}\n"]}

package/dist/esm/http-api-binding/http-api-erasure-stance.shared.d.ts ADDED Viewed

@@ -0,0 +1,62 @@
+/**
+ * `HttpApiErasureStance` — what a subject erasure owes rows the application does not own.
+ *
+ * A boundary module, for the same package-contract reason as `http-api-transport-dialect.shared.ts`.
+ *
+ * ## Why this is not in `http-api-binding.shared.schemas.ts` any more (#1710)
+ *
+ * That module is published ONLY through the `@wildo-ai/saas-models/external-data` subpath, and #1710 made
+ * three ROOT-exported contracts name this enum: a provider's compliance profile (`subjectErasure.stance`,
+ * the D6 vocabulary narrowed to a vendor's two stances), the application configuration
+ * (`compliance.subjectDataRecipients[].erasureStance`), and the frontend bootstrap that carries both. A
+ * TypeScript `enum` is NOMINAL, so a root-only consumer inferring any of those types has to write the enum
+ * by name and cannot.
+ *
+ * It was first kept on the subpath under an `entrypoint-closure-waiver`, reasoning that explicit
+ * annotations would emit a relative intra-package import. Two of the crossings were INFERRED
+ * (`z.enum({ NO_SUBJECT_DATA: HttpApiErasureStance.NO_SUBJECT_DATA, … })` and
+ * `z.enum(HttpApiErasureStance)`), so saas-models' own declarations named the enum through a type-position
+ * import of the `external-data.exports` barrel in all three root contracts, and
+ * `platform-config-lib` failed with `TS2742 … cannot be named without a reference to
+ * …/saas-models/src/external-data.exports` on `SaasRuntimeProvidersArtifactSchema` (2026-09-29).
+ *
+ * `package-public-entrypoints.md` prescribes MOVING THE BOUNDARY, never re-exporting across it: adding
+ * this module to the subpath barrel as well would be `root-barrel-overlap`. So the enum lives here, the
+ * root exports it, the binding schema imports it, and the subpath does NOT re-export it. Consumers that
+ * took it from `@wildo-ai/saas-models/external-data` now take it from `@wildo-ai/saas-models`.
+ *
+ * Only the closed vocabulary moved. The per-stance binding arms and their coherence checks are the SHAPE of
+ * a declaration and stay with the binding schema.
+ */
+/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
+/**
+ * The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class
+ * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a
+ * registration refusal, because `exportSubject` is a fail-closed obligation on every resource and
+ * "we cannot delete rows we do not own" is not an answer the framework may imply silently.
+ *
+ * Import it from `@wildo-ai/saas-models` (the package root), not from the `external-data` subpath.
+ */
+export declare enum HttpApiErasureStance {
+    /**
+     * (6a) The resource declares it holds NO personal/subject data. Registration verifies the
+     * declaration is coherent (e.g. `exportSubject` posture) and erasure is structurally N/A for
+     * the remote rows.
+     */
+    NO_SUBJECT_DATA = "no-subject-data",
+    /**
+     * (6b) The binding declares HOW erasure reaches the foreign system: one named API operation the
+     * engine invokes on a subject-erasure request. This is a single declared write and does NOT
+     * require general write support (slice 1 stays read-only otherwise).
+     */
+    EXTERNAL_ERASURE_OPERATION = "external-erasure-operation",
+    /**
+     * (6c) Erasure REFUSES by default; an explicit, per-request, audited controller acknowledgement
+     * lets it proceed and records the un-erased remote rows at high severity. Mirrors the existing
+     * administrative-floor acknowledgement shape (`administrative-continuity-floors.md`): the record
+     * is the control. NEVER a standing default — the acknowledgement is per erasure request.
+     */
+    CONTROLLER_ACKNOWLEDGED_NON_ERASURE = "controller-acknowledged-non-erasure"
+}
+/** @wildo_source:part:end saas.models.http-api-binding */
+//# sourceMappingURL=http-api-erasure-stance.shared.d.ts.map

package/dist/esm/http-api-binding/http-api-erasure-stance.shared.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"http-api-erasure-stance.shared.d.ts","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-erasure-stance.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAMH,4GAA4G;AAC5G;;;;;;;GAOG;AACH,oBAAY,oBAAoB;IAC9B;;;;OAIG;IACH,eAAe,oBAAoB;IAEnC;;;;OAIG;IACH,0BAA0B,+BAA+B;IAEzD;;;;;OAKG;IACH,mCAAmC,wCAAwC;CAC5E;AACD,0DAA0D"}

package/dist/esm/http-api-binding/http-api-erasure-stance.shared.js ADDED Viewed

@@ -0,0 +1,66 @@
+/**
+ * `HttpApiErasureStance` — what a subject erasure owes rows the application does not own.
+ *
+ * A boundary module, for the same package-contract reason as `http-api-transport-dialect.shared.ts`.
+ *
+ * ## Why this is not in `http-api-binding.shared.schemas.ts` any more (#1710)
+ *
+ * That module is published ONLY through the `@wildo-ai/saas-models/external-data` subpath, and #1710 made
+ * three ROOT-exported contracts name this enum: a provider's compliance profile (`subjectErasure.stance`,
+ * the D6 vocabulary narrowed to a vendor's two stances), the application configuration
+ * (`compliance.subjectDataRecipients[].erasureStance`), and the frontend bootstrap that carries both. A
+ * TypeScript `enum` is NOMINAL, so a root-only consumer inferring any of those types has to write the enum
+ * by name and cannot.
+ *
+ * It was first kept on the subpath under an `entrypoint-closure-waiver`, reasoning that explicit
+ * annotations would emit a relative intra-package import. Two of the crossings were INFERRED
+ * (`z.enum({ NO_SUBJECT_DATA: HttpApiErasureStance.NO_SUBJECT_DATA, … })` and
+ * `z.enum(HttpApiErasureStance)`), so saas-models' own declarations named the enum through a type-position
+ * import of the `external-data.exports` barrel in all three root contracts, and
+ * `platform-config-lib` failed with `TS2742 … cannot be named without a reference to
+ * …/saas-models/src/external-data.exports` on `SaasRuntimeProvidersArtifactSchema` (2026-09-29).
+ *
+ * `package-public-entrypoints.md` prescribes MOVING THE BOUNDARY, never re-exporting across it: adding
+ * this module to the subpath barrel as well would be `root-barrel-overlap`. So the enum lives here, the
+ * root exports it, the binding schema imports it, and the subpath does NOT re-export it. Consumers that
+ * took it from `@wildo-ai/saas-models/external-data` now take it from `@wildo-ai/saas-models`.
+ *
+ * Only the closed vocabulary moved. The per-stance binding arms and their coherence checks are the SHAPE of
+ * a declaration and stay with the binding schema.
+ */
+// --------------------------------
+// Erasure stance (GDPR Art. 17 on rows we do not own)
+// --------------------------------
+/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */
+/**
+ * The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class
+ * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a
+ * registration refusal, because `exportSubject` is a fail-closed obligation on every resource and
+ * "we cannot delete rows we do not own" is not an answer the framework may imply silently.
+ *
+ * Import it from `@wildo-ai/saas-models` (the package root), not from the `external-data` subpath.
+ */
+export var HttpApiErasureStance;
+(function (HttpApiErasureStance) {
+    /**
+     * (6a) The resource declares it holds NO personal/subject data. Registration verifies the
+     * declaration is coherent (e.g. `exportSubject` posture) and erasure is structurally N/A for
+     * the remote rows.
+     */
+    HttpApiErasureStance["NO_SUBJECT_DATA"] = "no-subject-data";
+    /**
+     * (6b) The binding declares HOW erasure reaches the foreign system: one named API operation the
+     * engine invokes on a subject-erasure request. This is a single declared write and does NOT
+     * require general write support (slice 1 stays read-only otherwise).
+     */
+    HttpApiErasureStance["EXTERNAL_ERASURE_OPERATION"] = "external-erasure-operation";
+    /**
+     * (6c) Erasure REFUSES by default; an explicit, per-request, audited controller acknowledgement
+     * lets it proceed and records the un-erased remote rows at high severity. Mirrors the existing
+     * administrative-floor acknowledgement shape (`administrative-continuity-floors.md`): the record
+     * is the control. NEVER a standing default — the acknowledgement is per erasure request.
+     */
+    HttpApiErasureStance["CONTROLLER_ACKNOWLEDGED_NON_ERASURE"] = "controller-acknowledged-non-erasure";
+})(HttpApiErasureStance || (HttpApiErasureStance = {}));
+/** @wildo_source:part:end saas.models.http-api-binding */
+//# sourceMappingURL=http-api-erasure-stance.shared.js.map

package/dist/esm/http-api-binding/http-api-erasure-stance.shared.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"http-api-erasure-stance.shared.js","sourceRoot":"","sources":["../../../../src/http-api-binding/http-api-erasure-stance.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,mCAAmC;AACnC,sDAAsD;AACtD,mCAAmC;AAEnC,4GAA4G;AAC5G;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,oBAsBX;AAtBD,WAAY,oBAAoB;IAC9B;;;;OAIG;IACH,2DAAmC,CAAA;IAEnC;;;;OAIG;IACH,iFAAyD,CAAA;IAEzD;;;;;OAKG;IACH,mGAA2E,CAAA;AAC7E,CAAC,EAtBW,oBAAoB,KAApB,oBAAoB,QAsB/B;AACD,0DAA0D","sourcesContent":["/**\n * `HttpApiErasureStance` — what a subject erasure owes rows the application does not own.\n *\n * A boundary module, for the same package-contract reason as `http-api-transport-dialect.shared.ts`.\n *\n * ## Why this is not in `http-api-binding.shared.schemas.ts` any more (#1710)\n *\n * That module is published ONLY through the `@wildo-ai/saas-models/external-data` subpath, and #1710 made\n * three ROOT-exported contracts name this enum: a provider's compliance profile (`subjectErasure.stance`,\n * the D6 vocabulary narrowed to a vendor's two stances), the application configuration\n * (`compliance.subjectDataRecipients[].erasureStance`), and the frontend bootstrap that carries both. A\n * TypeScript `enum` is NOMINAL, so a root-only consumer inferring any of those types has to write the enum\n * by name and cannot.\n *\n * It was first kept on the subpath under an `entrypoint-closure-waiver`, reasoning that explicit\n * annotations would emit a relative intra-package import. Two of the crossings were INFERRED\n * (`z.enum({ NO_SUBJECT_DATA: HttpApiErasureStance.NO_SUBJECT_DATA, … })` and\n * `z.enum(HttpApiErasureStance)`), so saas-models' own declarations named the enum through a type-position\n * import of the `external-data.exports` barrel in all three root contracts, and\n * `platform-config-lib` failed with `TS2742 … cannot be named without a reference to\n * …/saas-models/src/external-data.exports` on `SaasRuntimeProvidersArtifactSchema` (2026-09-29).\n *\n * `package-public-entrypoints.md` prescribes MOVING THE BOUNDARY, never re-exporting across it: adding\n * this module to the subpath barrel as well would be `root-barrel-overlap`. So the enum lives here, the\n * root exports it, the binding schema imports it, and the subpath does NOT re-export it. Consumers that\n * took it from `@wildo-ai/saas-models/external-data` now take it from `@wildo-ai/saas-models`.\n *\n * Only the closed vocabulary moved. The per-stance binding arms and their coherence checks are the SHAPE of\n * a declaration and stay with the binding schema.\n */\n\n// --------------------------------\n// Erasure stance (GDPR Art. 17 on rows we do not own)\n// --------------------------------\n\n/** @wildo_source:part:start saas.models.http-api-binding facet:layer:shared facet:audience:app-developer */\n/**\n * The declared erasure stance of an HTTP_API-backed resource. All three stances are first-class\n * from slice 1 (decision D6, 2026-08-26); a binding MUST declare one — an undeclared stance is a\n * registration refusal, because `exportSubject` is a fail-closed obligation on every resource and\n * \"we cannot delete rows we do not own\" is not an answer the framework may imply silently.\n *\n * Import it from `@wildo-ai/saas-models` (the package root), not from the `external-data` subpath.\n */\nexport enum HttpApiErasureStance {\n /**\n * (6a) The resource declares it holds NO personal/subject data. Registration verifies the\n * declaration is coherent (e.g. `exportSubject` posture) and erasure is structurally N/A for\n * the remote rows.\n */\n NO_SUBJECT_DATA = 'no-subject-data',\n\n /**\n * (6b) The binding declares HOW erasure reaches the foreign system: one named API operation the\n * engine invokes on a subject-erasure request. This is a single declared write and does NOT\n * require general write support (slice 1 stays read-only otherwise).\n */\n EXTERNAL_ERASURE_OPERATION = 'external-erasure-operation',\n\n /**\n * (6c) Erasure REFUSES by default; an explicit, per-request, audited controller acknowledgement\n * lets it proceed and records the un-erased remote rows at high severity. Mirrors the existing\n * administrative-floor acknowledgement shape (`administrative-continuity-floors.md`): the record\n * is the control. NEVER a standing default — the acknowledgement is per erasure request.\n */\n CONTROLLER_ACKNOWLEDGED_NON_ERASURE = 'controller-acknowledged-non-erasure',\n}\n/** @wildo_source:part:end saas.models.http-api-binding */\n"]}

package/dist/esm/http-api-binding/http-api-rest-write-operations.shared.schemas.d.ts ADDED Viewed

@@ -0,0 +1,133 @@
+/**
+ * How a REST_JSON binding SENDS a row write (#1728): one declared request per opened verb.
+ *
+ * ODATA and ODOO_JSONRPC each have a protocol, so their write dialects know the wire and a binding only opens verbs
+ * (`writableVerbs`). REST_JSON has no protocol — the thing it names is "a vendor's own JSON API" — so, exactly as for its
+ * reads, the binding DECLARES what a create, an update and a delete look like: a method and a path template, and for a
+ * create, where the vendor answers the new record's key. Nothing is emulated and nothing is guessed.
+ *
+ * ## The two vendors this was measured against
+ *
+ * | | create | update | delete | the new key |
+ * |---|---|---|---|---|
+ * | Salesforce sObject rows | `POST …/sobjects/<Object>` → `201` | `PATCH …/sobjects/<Object>/<id>` → `204` | `DELETE …/sobjects/<Object>/<id>` → `204` | the body's `id` |
+ * | NetSuite record service | `POST …/record/v1/<type>` → `204`, no body | `PATCH …/record/v1/<type>/<id>` → `204` | `DELETE …/record/v1/<type>/<id>` → `204` | the `Location` header |
+ *
+ * spec-cite: Oracle NetSuite, "Creating a Record Instance"
+ * (https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1545141395.html) — the create answers
+ * `HTTP Code 204` and "The URL of the newly created record is given in the Location header of the response."
+ * spec-cite: Oracle NetSuite, "Updating a Record Instance" (section_1545142173.html) and "Deleting a Record Instance"
+ * (section_1545142287.html) — `PATCH` and `DELETE` on `/record/v1/<type>/<id>`, each answering 204 with no body.
+ * spec-cite: N/A for Salesforce's own pages, which refuse an unauthenticated fetch (403) — the shapes above are read from
+ * jsforce's `Connection` (`_createSingle` POSTs to `sobjects/<type>` and reads the answer; `_updateSingle` PATCHes and
+ * `_destroySingle` DELETEs `sobjects/<type>/<id>`, both answered with no content), the most used client of that API.
+ *
+ * ## Why a declared METHOD, and why never `PUT`
+ *
+ * An update carries only the fields the caller changed. A `PUT` REPLACES the resource on every API that follows HTTP's own
+ * definition, so a partial `PUT` resets whatever it omitted — the reason the OData dialect never sends one. So `PUT` is not
+ * in {@link HttpApiRestWriteMethod} at all: a vendor whose only update is a full replacement cannot be written through a
+ * field-level change, and the honest answer is to leave the binding read-only. `POST` is admitted for an update and a
+ * delete because RPC-shaped APIs spell every change that way (the same reason the declared erasure call admits it).
+ *
+ * ## Why no idempotency and no retry
+ *
+ * Neither vendor deduplicates a synchronous write by a request id: NetSuite's `X-NetSuite-Idempotency-Key` is documented
+ * for ASYNCHRONOUS requests (`Prefer: respond-async`), and Salesforce's sObject rows take none. So every write is sent
+ * ONCE, and an interrupted one is an unknown outcome — as for Odoo and OData, and for the same reason: a `POST` re-sent
+ * after a lost answer creates a second record.
+ * spec-cite: Oracle NetSuite, "Sending an Asynchronous Request Using an Idempotency Key"
+ * (https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/subsect_164494900632.html) — the only request shape the
+ * header is documented on carries `Prefer: respond-async`.
+ *
+ * ## No conditional write
+ *
+ * Neither vendor's record API is written here with a precondition, so a `VERSION_CHECKED` stance on a REST_JSON binding is
+ * best-effort exactly as it is on Odoo: the engine compares before sending, and a change landing between that read and
+ * the write is not seen. It also needs a vendor facet that declares the row version field, which neither facet does today.
+ *
+ * Deliberately a module of its own rather than a block of `http-api-binding.shared.schemas.ts`: it names no binding type,
+ * so the binding module can import it without the two importing each other. The per-VERB rules — which member each
+ * opened verb needs, which methods each may use — live beside `HttpApiWriteVerb` in that module
+ * (`assertHttpApiBindingDialectCoherence`), and call {@link assertHttpApiRestWriteOperationShape} for each member.
+ */
+import { z } from 'zod';
+/** @wildo_source:part:start saas.models.http-api-binding.rest-write-operations facet:layer:shared facet:audience:app-developer */
+/**
+ * The methods a declared REST_JSON row write may use. Never `PUT` (it replaces the resource, so a partial update would
+ * reset every field it omits) and never `GET` (a read is not a write). Which of these each verb admits is decided per verb:
+ * a create is a `POST`; an update a `PATCH` or an RPC-style `POST`; a delete a `DELETE` or an RPC-style `POST`.
+ */
+export declare enum HttpApiRestWriteMethod {
+    POST = "POST",
+    PATCH = "PATCH",
+    DELETE = "DELETE"
+}
+/** Where a vendor answers the KEY of a record a create just made. */
+export declare enum HttpApiRestCreatedKeySource {
+    /**
+     * A value in the JSON answer, at a declared dot-path — Salesforce's `{ "id": "001…", "success": true, "errors": [] }`
+     * answers `path: 'id'`. The answer need not be the record: only its key is read, and the row is then read back by it.
+     */
+    RESPONSE_BODY = "response-body",
+    /**
+     * The LAST path segment of the answer's `Location` header — NetSuite answers `204` with no body and
+     * `Location: https://<account>.suitetalk.api.netsuite.com/services/rest/record/v1/customer/647`. The header must name a
+     * record of the path the create was sent to (`<create path>/<key>`), or the answer is not read as a key.
+     */
+    LOCATION_HEADER = "location-header"
+}
+/** Where a create's answer carries the new record's key. A single-key binding only: one answer names one value. */
+export declare const HttpApiRestCreatedKeySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    source: z.ZodLiteral<HttpApiRestCreatedKeySource.RESPONSE_BODY>;
+    path: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    source: z.ZodLiteral<HttpApiRestCreatedKeySource.LOCATION_HEADER>;
+}, z.core.$strip>], "source">;
+export type HttpApiRestCreatedKey = z.infer<typeof HttpApiRestCreatedKeySchema>;
+/**
+ * One declared REST_JSON row write: `operations.create`, `operations.update` or `operations.delete` — each present exactly
+ * when the binding opens that verb in `writableVerbs`.
+ *
+ * @example
+ * ```ts
+ * // Salesforce: a create answers the id in its body; an update and a delete answer 204.
+ * create: { method: HttpApiRestWriteMethod.POST, pathTemplate: '/services/data/v62.0/sobjects/Account',
+ *           createdKey: { source: HttpApiRestCreatedKeySource.RESPONSE_BODY, path: 'id' } },
+ * update: { method: HttpApiRestWriteMethod.PATCH, pathTemplate: '/services/data/v62.0/sobjects/Account/{key}' },
+ * delete: { method: HttpApiRestWriteMethod.DELETE, pathTemplate: '/services/data/v62.0/sobjects/Account/{key}' },
+ * ```
+ */
+export declare const HttpApiRestWriteOperationSpecSchema: z.ZodObject<{
+    method: z.ZodEnum<typeof HttpApiRestWriteMethod>;
+    pathTemplate: z.ZodString;
+    createdKey: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<HttpApiRestCreatedKeySource.RESPONSE_BODY>;
+        path: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        source: z.ZodLiteral<HttpApiRestCreatedKeySource.LOCATION_HEADER>;
+    }, z.core.$strip>], "source">>;
+    staticHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export type HttpApiRestWriteOperationSpec = z.infer<typeof HttpApiRestWriteOperationSpecSchema>;
+/** @wildo_source:part:end saas.models.http-api-binding.rest-write-operations */
+/** What one member's shape must satisfy, decided per verb by the binding module. */
+export interface HttpApiRestWriteMemberRules {
+    /** `operations.<member>`, for the message. */
+    readonly member: string;
+    /** The methods this verb admits. */
+    readonly methods: readonly HttpApiRestWriteMethod[];
+    /** `true` for an update or a delete (the path must address one record), `false` for a create (it must not). */
+    readonly addressesOneRecord: boolean;
+    /**
+     * The binding's key fields' REMOTE names, in order. `{key}` needs exactly one; `{key.<RemoteField>}` must name one of
+     * them; a created key is readable for a single-key binding only.
+     */
+    readonly keyRemoteFields: readonly string[];
+}
+/**
+ * Throws, naming the member, when one declared REST_JSON write cannot be sent as declared. Called by
+ * `assertHttpApiBindingDialectCoherence` for each opened verb's member.
+ */
+export declare function assertHttpApiRestWriteOperationShape(spec: HttpApiRestWriteOperationSpec, rules: HttpApiRestWriteMemberRules): void;
+//# sourceMappingURL=http-api-rest-write-operations.shared.schemas.d.ts.map