@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/systems-of-record/system-of-record-declaration.shared.schemas.d.ts

@@ -54,13 +54,53 @@ import { SystemOfRecordCredentialKind } from './system-of-record-credential-kind
 export declare const SYSTEM_OF_RECORD_NAME_PATTERN: RegExp;
 /** 32 characters, because the name is a stem of an environment-variable name rather than a label. */
 export declare const SYSTEM_OF_RECORD_NAME_MAX_LENGTH = 32;
+/**
+ * Whether the personal data held in a system-of-record INSTANCE can have originated from publicly
+ * accessible sources (#1745) — the half of GDPR Art. 14(2)(f) nothing else in an application can
+ * derive.
+ *
+ * A privacy notice owes, for personal data not collected from the person, "from which source the
+ * personal data originate, and if applicable, whether it came from publicly accessible sources".
+ * spec-cite: GDPR Art. 14(2)(f), https://gdpr-info.eu/art-14-gdpr/.
+ * The binding already makes the first half true: the source is this instance, a deployment the
+ * operator runs. The second half is about how records got INTO that deployment — an ERP contact
+ * may have been typed in from a public register, a website or a bought list — and only the
+ * operator knows. So the operator states it here, once per instance, as a typed value a reviewer
+ * can diff, rather than answering a question or leaving it to a drafter's guess.
+ *
+ * Omitting it is legitimate and is NOT read as "no": the notice's source statement then marks the
+ * public-origin half owed for every resource read from the instance.
+ */
+export declare enum SystemOfRecordPersonalDataOrigin {
+    /** Every person's data in this instance was collected by the operator — from the person, their organisation or the operator's own dealings with them — and none from a publicly accessible source. */
+    NO_PUBLICLY_ACCESSIBLE_SOURCES = "no-publicly-accessible-sources",
+    /** Some of it may come from publicly accessible sources: company registers, websites, social profiles, enrichment services. The notice says so. */
+    INCLUDES_PUBLICLY_ACCESSIBLE_SOURCES = "includes-publicly-accessible-sources"
+}
 export declare const SystemOfRecordNameSchema: z.ZodString;
+/**
+ * The i18n bucket holding every instance's display words — the first segment of
+ * {@link buildSystemOfRecordDisplayNameLabelKey}'s keys.
+ */
+export declare const SYSTEM_OF_RECORD_LABEL_BUCKET = "systems_of_record";
+/**
+ * The label key naming ONE declared instance to a person: `systems_of_record.<name>.displayName` (#1997).
+ *
+ * An instance NAME is an environment-variable stem (`odoo`, `sap-fr`), not words: it cannot be translated, and the
+ * words a reader recognises ("Odoo", "SAP France") are not derivable from it. So a surface that names an instance —
+ * the provenance cue on a field a pipeline wrote, "synced from Odoo" — resolves this key, and the labelling pipeline
+ * plans it for every declared instance, total over `systemsOfRecord`. There is deliberately no `displayName` on the
+ * declaration: display text comes from the i18n tree, never from configuration. A key nobody generated renders the
+ * raw name, which is the missing label looking missing.
+ */
+export declare function buildSystemOfRecordDisplayNameLabelKey(name: string): string;
 /** ONE declared instance. */
 export declare const SystemOfRecordDeclarationSchema: z.ZodObject<{
     /**
-     * Which vendor this is an instance of — the `vendor` of a facet the deployment ships (engine-shipped
-     * today, package-shipped once #1057 lands). Refused at boot when no facet answers to it, rather
-     * than here, because the facet map is not in scope in `wildo.saas.config.ts`.
+     * Which vendor this is an instance of — the `vendor` of a facet the deployment ships: the framework's facets
+     * come from the opt-in library `@wildo-ai/systems-of-record`, which `wildo config sync` declares on the backend
+     * as soon as an instance is declared (#2013). Refused at boot when no facet answers to it, rather than here,
+     * because the facet map is not in scope in `wildo.saas.config.ts`.
      */
     vendor: z.ZodString;
     /**
@@ -68,6 +108,21 @@ export declare const SystemOfRecordDeclarationSchema: z.ZodObject<{
      * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST
      * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong
      * to, checked at boot.
+     *
+     * ## One instance per SERVICE ROOT — so a system serving OData v2 and v4 is two instances (#1687)
+     *
+     * An instance has ONE dialect and ONE base URL, and for OData that URL is a service root: an SAP
+     * system's `/sap/opu/odata/sap/API_BUSINESS_PARTNER` (v2) and `/sap/opu/odata4/sap/<service>/…` (v4)
+     * are different roots, as two v4 services of the same system already are. So a system reached over
+     * both versions is declared as two instances, one per root, each with its own dialect, credential
+     * and `maxRequestsPerMinute`.
+     *
+     * Decided rather than asked, because the model already answered it: an instance naming several roots
+     * would need a root per binding, which is what two instances are, and a budget SHARED across
+     * instances would be a new cross-instance ledger for a ceiling the operator can already honour by
+     * splitting it between the instances' `maxRequestsPerMinute`. Both were rejected on that ground.
+     * The cost, stated: two instances against one vendor account are paced separately, so their sum —
+     * not either one — is what must stay under the vendor's allowance.
      */
     dialect: z.ZodEnum<typeof HttpApiTransportDialect>;
     /**
@@ -79,7 +134,7 @@ export declare const SystemOfRecordDeclarationSchema: z.ZodObject<{
      * The framework derives before it asks: a declaration with one legal value is a question whose
      * answer the mechanism already holds.
      *
-     * This stays additive when #1056 widens the catalogue: an instance that omitted the field is
+     * This stays additive when #1056 widens the facet set: an instance that omitted the field is
      * refused on the day its facet gains a second kind, which is exactly the day its author acquires a
      * real decision.
      */
@@ -125,6 +180,27 @@ export declare const SystemOfRecordDeclarationSchema: z.ZodObject<{
      * prevent in the first place.
      */
     partition: z.ZodOptional<z.ZodBoolean>;
+    /**
+     * The PACKAGES whose facet augmentation applies to this instance (#1675) — npm package names, each of which
+     * must ship an augmentation for this instance's vendor from its `./systems-of-record` export.
+     *
+     * An explicit opt-in per INSTANCE, never implied by installation, because what an augmentation adds can be a
+     * partition declaration, and the facet is the single authority on how a tenant's rows are confined. Two
+     * instances of one vendor may therefore differ: one opts a package's partition in, the other does not.
+     * A package named here that ships no augmentation for the vendor refuses at startup, naming it.
+     *
+     * Naming a package here is also what ADMITS its `./systems-of-record` module to discovery (#2013): apart from the
+     * framework library `@wildo-ai/systems-of-record`, a facet module is recorded only from a package some instance
+     * names. The package must still be walked — named `<scope>/provider-*`, or listed in `providers.packages`.
+     */
+    facetAugmentations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    /**
+     * Whether the personal data in THIS deployment can have come from publicly accessible sources — see
+     * {@link SystemOfRecordPersonalDataOrigin}. A property of the deployment, not the vendor: two Odoo
+     * instances may be fed differently. Optional; omitted, the privacy notice marks that statement owed
+     * for every resource read from this instance, and never states "not from public sources" by default.
+     */
+    personalDataOrigin: z.ZodOptional<z.ZodEnum<typeof SystemOfRecordPersonalDataOrigin>>;
 }, z.core.$strict>;
 export type SystemOfRecordDeclaration = z.infer<typeof SystemOfRecordDeclarationSchema>;
 /**
@@ -136,9 +212,10 @@ export type SystemOfRecordDeclaration = z.infer<typeof SystemOfRecordDeclaration
  */
 export declare const SystemsOfRecordConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     /**
-     * Which vendor this is an instance of — the `vendor` of a facet the deployment ships (engine-shipped
-     * today, package-shipped once #1057 lands). Refused at boot when no facet answers to it, rather
-     * than here, because the facet map is not in scope in `wildo.saas.config.ts`.
+     * Which vendor this is an instance of — the `vendor` of a facet the deployment ships: the framework's facets
+     * come from the opt-in library `@wildo-ai/systems-of-record`, which `wildo config sync` declares on the backend
+     * as soon as an instance is declared (#2013). Refused at boot when no facet answers to it, rather than here,
+     * because the facet map is not in scope in `wildo.saas.config.ts`.
      */
     vendor: z.ZodString;
     /**
@@ -146,6 +223,21 @@ export declare const SystemsOfRecordConfigSchema: z.ZodRecord<z.ZodString, z.Zod
      * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST
      * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong
      * to, checked at boot.
+     *
+     * ## One instance per SERVICE ROOT — so a system serving OData v2 and v4 is two instances (#1687)
+     *
+     * An instance has ONE dialect and ONE base URL, and for OData that URL is a service root: an SAP
+     * system's `/sap/opu/odata/sap/API_BUSINESS_PARTNER` (v2) and `/sap/opu/odata4/sap/<service>/…` (v4)
+     * are different roots, as two v4 services of the same system already are. So a system reached over
+     * both versions is declared as two instances, one per root, each with its own dialect, credential
+     * and `maxRequestsPerMinute`.
+     *
+     * Decided rather than asked, because the model already answered it: an instance naming several roots
+     * would need a root per binding, which is what two instances are, and a budget SHARED across
+     * instances would be a new cross-instance ledger for a ceiling the operator can already honour by
+     * splitting it between the instances' `maxRequestsPerMinute`. Both were rejected on that ground.
+     * The cost, stated: two instances against one vendor account are paced separately, so their sum —
+     * not either one — is what must stay under the vendor's allowance.
      */
     dialect: z.ZodEnum<typeof HttpApiTransportDialect>;
     /**
@@ -157,7 +249,7 @@ export declare const SystemsOfRecordConfigSchema: z.ZodRecord<z.ZodString, z.Zod
      * The framework derives before it asks: a declaration with one legal value is a question whose
      * answer the mechanism already holds.
      *
-     * This stays additive when #1056 widens the catalogue: an instance that omitted the field is
+     * This stays additive when #1056 widens the facet set: an instance that omitted the field is
      * refused on the day its facet gains a second kind, which is exactly the day its author acquires a
      * real decision.
      */
@@ -203,6 +295,27 @@ export declare const SystemsOfRecordConfigSchema: z.ZodRecord<z.ZodString, z.Zod
      * prevent in the first place.
      */
     partition: z.ZodOptional<z.ZodBoolean>;
+    /**
+     * The PACKAGES whose facet augmentation applies to this instance (#1675) — npm package names, each of which
+     * must ship an augmentation for this instance's vendor from its `./systems-of-record` export.
+     *
+     * An explicit opt-in per INSTANCE, never implied by installation, because what an augmentation adds can be a
+     * partition declaration, and the facet is the single authority on how a tenant's rows are confined. Two
+     * instances of one vendor may therefore differ: one opts a package's partition in, the other does not.
+     * A package named here that ships no augmentation for the vendor refuses at startup, naming it.
+     *
+     * Naming a package here is also what ADMITS its `./systems-of-record` module to discovery (#2013): apart from the
+     * framework library `@wildo-ai/systems-of-record`, a facet module is recorded only from a package some instance
+     * names. The package must still be walked — named `<scope>/provider-*`, or listed in `providers.packages`.
+     */
+    facetAugmentations: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    /**
+     * Whether the personal data in THIS deployment can have come from publicly accessible sources — see
+     * {@link SystemOfRecordPersonalDataOrigin}. A property of the deployment, not the vendor: two Odoo
+     * instances may be fed differently. Optional; omitted, the privacy notice marks that statement owed
+     * for every resource read from this instance, and never states "not from public sources" by default.
+     */
+    personalDataOrigin: z.ZodOptional<z.ZodEnum<typeof SystemOfRecordPersonalDataOrigin>>;
 }, z.core.$strict>>;
 export type SystemsOfRecordConfig = z.infer<typeof SystemsOfRecordConfigSchema>;
 /** @wildo_source:part:end saas.models.systems-of-record */

package/dist/esm/systems-of-record/system-of-record-declaration.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-declaration.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-declaration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,6GAA6G;AAE7G;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,QAAsB,CAAC;AAEjE,qGAAqG;AACrG,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD,eAAO,MAAM,wBAAwB,aAGG,CAAC;AAEzC,6BAA6B;AAC7B,eAAO,MAAM,+BAA+B;IAC1C;;;;OAIG;;IAGH;;;;;OAKG;;IAGH;;;;;;;;;;;;OAYG;;;;IAGH;;;;;;;;;;;;;;;OAeG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;kBAEH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;IAhFtC;;;;OAIG;;IAGH;;;;;OAKG;;IAGH;;;;;;;;;;;;OAYG;;;;IAGH;;;;;;;;;;;;;;;OAeG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;mBAwBD,CAAC;AACL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,2DAA2D"}
+{"version":3,"file":"system-of-record-declaration.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-declaration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,6GAA6G;AAE7G;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,QAAsB,CAAC;AAEjE,qGAAqG;AACrG,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,oBAAY,gCAAgC;IAC1C,sMAAsM;IACtM,8BAA8B,mCAAmC;IACjE,mJAAmJ;IACnJ,oCAAoC,yCAAyC;CAC9E;AAED,eAAO,MAAM,wBAAwB,aAGG,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,6BAA6B,sBAAsB,CAAC;AAEjE;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,6BAA6B;AAC7B,eAAO,MAAM,+BAA+B;IAC1C;;;;;OAKG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;;;IAGH;;;;;;;;;;;;;;;OAeG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;IAMH;;;;;OAKG;;kBAEH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B;IA1HtC;;;;;OAKG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;;;IAGH;;;;;;;;;;;;;;;OAeG;;IAGH;;;;;;;;;;;;;;;;;;;;OAoBG;;IAGH;;;;;;;;;;;;OAYG;;IAMH;;;;;OAKG;;mBAwBD,CAAC;AACL,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,2DAA2D"}

package/dist/esm/systems-of-record/system-of-record-declaration.shared.schemas.js

@@ -54,16 +54,59 @@ import { SystemOfRecordCredentialKind } from './system-of-record-credential-kind
 export const SYSTEM_OF_RECORD_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
 /** 32 characters, because the name is a stem of an environment-variable name rather than a label. */
 export const SYSTEM_OF_RECORD_NAME_MAX_LENGTH = 32;
+/**
+ * Whether the personal data held in a system-of-record INSTANCE can have originated from publicly
+ * accessible sources (#1745) — the half of GDPR Art. 14(2)(f) nothing else in an application can
+ * derive.
+ *
+ * A privacy notice owes, for personal data not collected from the person, "from which source the
+ * personal data originate, and if applicable, whether it came from publicly accessible sources".
+ * spec-cite: GDPR Art. 14(2)(f), https://gdpr-info.eu/art-14-gdpr/.
+ * The binding already makes the first half true: the source is this instance, a deployment the
+ * operator runs. The second half is about how records got INTO that deployment — an ERP contact
+ * may have been typed in from a public register, a website or a bought list — and only the
+ * operator knows. So the operator states it here, once per instance, as a typed value a reviewer
+ * can diff, rather than answering a question or leaving it to a drafter's guess.
+ *
+ * Omitting it is legitimate and is NOT read as "no": the notice's source statement then marks the
+ * public-origin half owed for every resource read from the instance.
+ */
+export var SystemOfRecordPersonalDataOrigin;
+(function (SystemOfRecordPersonalDataOrigin) {
+    /** Every person's data in this instance was collected by the operator — from the person, their organisation or the operator's own dealings with them — and none from a publicly accessible source. */
+    SystemOfRecordPersonalDataOrigin["NO_PUBLICLY_ACCESSIBLE_SOURCES"] = "no-publicly-accessible-sources";
+    /** Some of it may come from publicly accessible sources: company registers, websites, social profiles, enrichment services. The notice says so. */
+    SystemOfRecordPersonalDataOrigin["INCLUDES_PUBLICLY_ACCESSIBLE_SOURCES"] = "includes-publicly-accessible-sources";
+})(SystemOfRecordPersonalDataOrigin || (SystemOfRecordPersonalDataOrigin = {}));
 export const SystemOfRecordNameSchema = z
     .string()
     .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')
     .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH);
+/**
+ * The i18n bucket holding every instance's display words — the first segment of
+ * {@link buildSystemOfRecordDisplayNameLabelKey}'s keys.
+ */
+export const SYSTEM_OF_RECORD_LABEL_BUCKET = 'systems_of_record';
+/**
+ * The label key naming ONE declared instance to a person: `systems_of_record.<name>.displayName` (#1997).
+ *
+ * An instance NAME is an environment-variable stem (`odoo`, `sap-fr`), not words: it cannot be translated, and the
+ * words a reader recognises ("Odoo", "SAP France") are not derivable from it. So a surface that names an instance —
+ * the provenance cue on a field a pipeline wrote, "synced from Odoo" — resolves this key, and the labelling pipeline
+ * plans it for every declared instance, total over `systemsOfRecord`. There is deliberately no `displayName` on the
+ * declaration: display text comes from the i18n tree, never from configuration. A key nobody generated renders the
+ * raw name, which is the missing label looking missing.
+ */
+export function buildSystemOfRecordDisplayNameLabelKey(name) {
+    return `${SYSTEM_OF_RECORD_LABEL_BUCKET}.${name}.displayName`;
+}
 /** ONE declared instance. */
 export const SystemOfRecordDeclarationSchema = z.strictObject({
     /**
-     * Which vendor this is an instance of — the `vendor` of a facet the deployment ships (engine-shipped
-     * today, package-shipped once #1057 lands). Refused at boot when no facet answers to it, rather
-     * than here, because the facet map is not in scope in `wildo.saas.config.ts`.
+     * Which vendor this is an instance of — the `vendor` of a facet the deployment ships: the framework's facets
+     * come from the opt-in library `@wildo-ai/systems-of-record`, which `wildo config sync` declares on the backend
+     * as soon as an instance is declared (#2013). Refused at boot when no facet answers to it, rather than here,
+     * because the facet map is not in scope in `wildo.saas.config.ts`.
      */
     vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),
     /**
@@ -71,6 +114,21 @@ export const SystemOfRecordDeclarationSchema = z.strictObject({
      * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST
      * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong
      * to, checked at boot.
+     *
+     * ## One instance per SERVICE ROOT — so a system serving OData v2 and v4 is two instances (#1687)
+     *
+     * An instance has ONE dialect and ONE base URL, and for OData that URL is a service root: an SAP
+     * system's `/sap/opu/odata/sap/API_BUSINESS_PARTNER` (v2) and `/sap/opu/odata4/sap/<service>/…` (v4)
+     * are different roots, as two v4 services of the same system already are. So a system reached over
+     * both versions is declared as two instances, one per root, each with its own dialect, credential
+     * and `maxRequestsPerMinute`.
+     *
+     * Decided rather than asked, because the model already answered it: an instance naming several roots
+     * would need a root per binding, which is what two instances are, and a budget SHARED across
+     * instances would be a new cross-instance ledger for a ceiling the operator can already honour by
+     * splitting it between the instances' `maxRequestsPerMinute`. Both were rejected on that ground.
+     * The cost, stated: two instances against one vendor account are paced separately, so their sum —
+     * not either one — is what must stay under the vendor's allowance.
      */
     dialect: z.enum(HttpApiTransportDialect),
     /**
@@ -82,7 +140,7 @@ export const SystemOfRecordDeclarationSchema = z.strictObject({
      * The framework derives before it asks: a declaration with one legal value is a question whose
      * answer the mechanism already holds.
      *
-     * This stays additive when #1056 widens the catalogue: an instance that omitted the field is
+     * This stays additive when #1056 widens the facet set: an instance that omitted the field is
      * refused on the day its facet gains a second kind, which is exactly the day its author acquires a
      * real decision.
      */
@@ -126,6 +184,27 @@ export const SystemOfRecordDeclarationSchema = z.strictObject({
      * prevent in the first place.
      */
     partition: z.boolean().optional(),
+    /**
+     * The PACKAGES whose facet augmentation applies to this instance (#1675) — npm package names, each of which
+     * must ship an augmentation for this instance's vendor from its `./systems-of-record` export.
+     *
+     * An explicit opt-in per INSTANCE, never implied by installation, because what an augmentation adds can be a
+     * partition declaration, and the facet is the single authority on how a tenant's rows are confined. Two
+     * instances of one vendor may therefore differ: one opts a package's partition in, the other does not.
+     * A package named here that ships no augmentation for the vendor refuses at startup, naming it.
+     *
+     * Naming a package here is also what ADMITS its `./systems-of-record` module to discovery (#2013): apart from the
+     * framework library `@wildo-ai/systems-of-record`, a facet module is recorded only from a package some instance
+     * names. The package must still be walked — named `<scope>/provider-*`, or listed in `providers.packages`.
+     */
+    facetAugmentations: z.array(z.string().min(1).max(214)).min(1).refine((packages) => new Set(packages).size === packages.length, 'A package is named twice in facetAugmentations.').optional(),
+    /**
+     * Whether the personal data in THIS deployment can have come from publicly accessible sources — see
+     * {@link SystemOfRecordPersonalDataOrigin}. A property of the deployment, not the vendor: two Odoo
+     * instances may be fed differently. Optional; omitted, the privacy notice marks that statement owed
+     * for every resource read from this instance, and never states "not from public sources" by default.
+     */
+    personalDataOrigin: z.enum(SystemOfRecordPersonalDataOrigin).optional(),
 });
 /**
  * Every instance this application declares, keyed by name.

package/dist/esm/systems-of-record/system-of-record-declaration.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-declaration.shared.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-declaration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,6GAA6G;AAE7G;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE,qGAAqG;AACrG,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,EAAE;KACR,KAAK,CAAC,6BAA6B,EAAE,sEAAsE,CAAC;KAC5G,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAEzC,6BAA6B;AAC7B,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzF;;;;;OAKG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAExC;;;;;;;;;;;;OAYG;IACH,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErF;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAErE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC,wBAAwB,EAAE,+BAA+B,CAAC;KACjE,WAAW,CAAC,CAAC,eAAe,EAAE,GAAG,EAAE,EAAE;IACpC,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,2GAA2G;kBACzG,iCAAiC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,2DAA2D","sourcesContent":["/**\n * `systemsOfRecord` — the application's declared INSTANCES of the systems it reads its own business\n * rows out of.\n *\n * ```ts\n * systemsOfRecord: {\n *   odoo: { vendor: 'odoo', dialect: HttpApiTransportDialect.ODOO_JSONRPC },\n * }\n * ```\n *\n * ## The name is the whole point\n *\n * Before this, a resource addressed a remote system by `httpApiBinding.providerRef` — a free string\n * naming a PROVIDER whose env-var names were literals inside its module, so one ref was one\n * deployment and a second Odoo could not be expressed at all. A name here is an INSTANCE: two\n * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in their addresses and secrets.\n *\n * The name is also the stem of every environment variable the instance needs —\n * `WILDO_SOR_<NAME>__<SLOT>` — which is why it is capped at 32 characters and admits only\n * lower-kebab-case. Renaming an instance therefore renames its variables, and there is deliberately\n * no rename door for secrets: `wildo config sync` reports every now-missing slot and an operator\n * re-authors them (#1055 E6).\n *\n * ## What is validated HERE, and what is not\n *\n * Here: the SHAPE, and only what a single configuration file can see. That `vendor` names a facet\n * the deployment actually ships, and that `dialect` is one the facet speaks, are checked at BOOT by\n * the systems-of-record registry — the earliest place where the declaration and the facet map are in\n * the same scope. Splitting it that way is the same honest split `httpApiBinding` already makes:\n * the factory checks shape, the registry checks agreement.\n *\n * Also not here: that the environment actually supplies each slot. The saas config and the infra env\n * config parse independently, so cross-file coherence is checked at the seams where both are in\n * scope — `wildo config sync` and the backend startup validator.\n *\n * ## Why declaring one requires an owner organization (#1054)\n *\n * A system of record is read with the APPLICATION's own service identity, and its rows are stamped\n * with the owning organization's id so the per-row tenant gate passes without an exemption. An\n * application that declares no organization type carrying `ownsApplication` has no organization to\n * stamp with, so every read of every bound resource would refuse at request time. That refusal is\n * a statement about two top-level blocks, so it lives in `WildoSaasConfigSchema`'s own refinement,\n * where both are visible.\n */\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\nimport { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';\n\n/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */\n\n/**\n * The charset law for an instance name, exported because the environment-variable derivation and\n * every tool that parses a derived name back into a `(name, slot)` pair depend on it: a name may\n * not contain `_`, so the `__` delimiter is unambiguous (#1055 R4).\n */\nexport const SYSTEM_OF_RECORD_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;\n\n/** 32 characters, because the name is a stem of an environment-variable name rather than a label. */\nexport const SYSTEM_OF_RECORD_NAME_MAX_LENGTH = 32;\n\nexport const SystemOfRecordNameSchema = z\n  .string()\n  .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')\n  .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH);\n\n/** ONE declared instance. */\nexport const SystemOfRecordDeclarationSchema = z.strictObject({\n  /**\n   * Which vendor this is an instance of — the `vendor` of a facet the deployment ships (engine-shipped\n   * today, package-shipped once #1057 lands). Refused at boot when no facet answers to it, rather\n   * than here, because the facet map is not in scope in `wildo.saas.config.ts`.\n   */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n\n  /**\n   * How this instance is READ. Declared per instance rather than taken from the facet because a\n   * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST\n   * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong\n   * to, checked at boot.\n   */\n  dialect: z.enum(HttpApiTransportDialect),\n\n  /**\n   * How the engine proves who it is.\n   *\n   * OPTIONAL, and the absence is DERIVED rather than defaulted: when the instance's facet offers\n   * exactly one credential kind there is nothing for an author to decide, so the registry takes it;\n   * when a facet offers more than one and the instance names none, boot refuses and lists them.\n   * The framework derives before it asks: a declaration with one legal value is a question whose\n   * answer the mechanism already holds.\n   *\n   * This stays additive when #1056 widens the catalogue: an instance that omitted the field is\n   * refused on the day its facet gains a second kind, which is exactly the day its author acquires a\n   * real decision.\n   */\n  credential: z.strictObject({ kind: z.enum(SystemOfRecordCredentialKind) }).optional(),\n\n  /**\n   * The pace this deployment may call the instance at, across EVERY resource bound to it (#1056 §3).\n   *\n   * Per INSTANCE because that is the unit the vendor accounts for: two resources bound to one\n   * Dataverse are one application user to Dataverse, so two independent per-binding budgets would\n   * each believe they were within a limit the pair together exceeds.\n   *\n   * A binding's own `remoteCallSemantics.maxRequestsPerMinute` stays, and becomes a CEILING UNDER\n   * this one: it answers a different question — how much of the shared allowance may ONE resource\n   * take — which matters when a pipeline load and an interactive read share an instance. Both are\n   * consumed for every call, and a call proceeds only if both have room.\n   *\n   * Omitted means unlimited HERE, which is the honest default: the framework does not know the\n   * vendor's contract, and inventing a number would either throttle a deployment that paid for more\n   * or fail to protect one that has less.\n   */\n  maxRequestsPerMinute: z.number().int().min(1).max(600_000).optional(),\n\n  /**\n   * Whether THIS deployment's data is partitioned, and its rows therefore confined to organization\n   * units of the owner organization (#1058).\n   *\n   * ## The reservation this replaces\n   *\n   * #1055 declared this field `z.never()` and refused it by name, because accepting a declaration the\n   * mechanism could not honour would let an author believe their rows were narrowed while every\n   * member still saw every row. That refusal did its job and is now lifted.\n   *\n   * ## Why the VENDOR says how and the INSTANCE says whether\n   *\n   * How a vendor partitions — which field, what shape, what codec — is a property of the vendor and\n   * lives on its facet. Whether a given deployment's data is partitioned is a property of the\n   * deployment: a single-company Odoo has a `company_id` on every row and nothing to confine, and\n   * asking its operator to restate the field name would be asking a question the facet answers.\n   *\n   * Opting in against a facet that declares no partitioning is refused at boot, naming the vendor —\n   * the alternative is a `true` that does nothing, which is the shape the reservation existed to\n   * prevent in the first place.\n   */\n  partition: z.boolean().optional(),\n});\nexport type SystemOfRecordDeclaration = z.infer<typeof SystemOfRecordDeclarationSchema>;\n\n/**\n * Every instance this application declares, keyed by name.\n *\n * Optional as a whole: an application that reads nothing out of another system declares nothing, and\n * declaring this block is what ENABLES the external-data lane (#1055 D3) rather than an engine\n * capability flag — the lane has no meaning without an instance to point at.\n */\nexport const SystemsOfRecordConfigSchema = z\n  .record(SystemOfRecordNameSchema, SystemOfRecordDeclarationSchema)\n  .superRefine((systemsOfRecord, ctx) => {\n    if (Object.keys(systemsOfRecord).length === 0) {\n      ctx.addIssue({\n        code: 'custom',\n        path: [],\n        message:\n          'An empty `systemsOfRecord` declares nothing and enables nothing. Omit the block entirely, or declare the '\n          + 'instance the application reads.',\n      });\n    }\n  });\nexport type SystemsOfRecordConfig = z.infer<typeof SystemsOfRecordConfigSchema>;\n/** @wildo_source:part:end saas.models.systems-of-record */\n"]}
+{"version":3,"file":"system-of-record-declaration.shared.schemas.js","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-declaration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,6GAA6G;AAE7G;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE,qGAAqG;AACrG,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,gCAKX;AALD,WAAY,gCAAgC;IAC1C,sMAAsM;IACtM,qGAAiE,CAAA;IACjE,mJAAmJ;IACnJ,iHAA6E,CAAA;AAC/E,CAAC,EALW,gCAAgC,KAAhC,gCAAgC,QAK3C;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,EAAE;KACR,KAAK,CAAC,6BAA6B,EAAE,sEAAsE,CAAC;KAC5G,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,UAAU,sCAAsC,CAAC,IAAY;IACjE,OAAO,GAAG,6BAA6B,IAAI,IAAI,cAAc,CAAC;AAChE,CAAC;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAExC;;;;;;;;;;;;OAYG;IACH,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErF;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAErE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC;;;;;;;;;;;;OAYG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CACnE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EACxD,iDAAiD,CAClD,CAAC,QAAQ,EAAE;IAEZ;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC,wBAAwB,EAAE,+BAA+B,CAAC;KACjE,WAAW,CAAC,CAAC,eAAe,EAAE,GAAG,EAAE,EAAE;IACpC,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,2GAA2G;kBACzG,iCAAiC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,2DAA2D","sourcesContent":["/**\n * `systemsOfRecord` — the application's declared INSTANCES of the systems it reads its own business\n * rows out of.\n *\n * ```ts\n * systemsOfRecord: {\n *   odoo: { vendor: 'odoo', dialect: HttpApiTransportDialect.ODOO_JSONRPC },\n * }\n * ```\n *\n * ## The name is the whole point\n *\n * Before this, a resource addressed a remote system by `httpApiBinding.providerRef` — a free string\n * naming a PROVIDER whose env-var names were literals inside its module, so one ref was one\n * deployment and a second Odoo could not be expressed at all. A name here is an INSTANCE: two\n * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in their addresses and secrets.\n *\n * The name is also the stem of every environment variable the instance needs —\n * `WILDO_SOR_<NAME>__<SLOT>` — which is why it is capped at 32 characters and admits only\n * lower-kebab-case. Renaming an instance therefore renames its variables, and there is deliberately\n * no rename door for secrets: `wildo config sync` reports every now-missing slot and an operator\n * re-authors them (#1055 E6).\n *\n * ## What is validated HERE, and what is not\n *\n * Here: the SHAPE, and only what a single configuration file can see. That `vendor` names a facet\n * the deployment actually ships, and that `dialect` is one the facet speaks, are checked at BOOT by\n * the systems-of-record registry — the earliest place where the declaration and the facet map are in\n * the same scope. Splitting it that way is the same honest split `httpApiBinding` already makes:\n * the factory checks shape, the registry checks agreement.\n *\n * Also not here: that the environment actually supplies each slot. The saas config and the infra env\n * config parse independently, so cross-file coherence is checked at the seams where both are in\n * scope — `wildo config sync` and the backend startup validator.\n *\n * ## Why declaring one requires an owner organization (#1054)\n *\n * A system of record is read with the APPLICATION's own service identity, and its rows are stamped\n * with the owning organization's id so the per-row tenant gate passes without an exemption. An\n * application that declares no organization type carrying `ownsApplication` has no organization to\n * stamp with, so every read of every bound resource would refuse at request time. That refusal is\n * a statement about two top-level blocks, so it lives in `WildoSaasConfigSchema`'s own refinement,\n * where both are visible.\n */\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\nimport { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';\n\n/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */\n\n/**\n * The charset law for an instance name, exported because the environment-variable derivation and\n * every tool that parses a derived name back into a `(name, slot)` pair depend on it: a name may\n * not contain `_`, so the `__` delimiter is unambiguous (#1055 R4).\n */\nexport const SYSTEM_OF_RECORD_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;\n\n/** 32 characters, because the name is a stem of an environment-variable name rather than a label. */\nexport const SYSTEM_OF_RECORD_NAME_MAX_LENGTH = 32;\n\n/**\n * Whether the personal data held in a system-of-record INSTANCE can have originated from publicly\n * accessible sources (#1745) — the half of GDPR Art. 14(2)(f) nothing else in an application can\n * derive.\n *\n * A privacy notice owes, for personal data not collected from the person, \"from which source the\n * personal data originate, and if applicable, whether it came from publicly accessible sources\".\n * spec-cite: GDPR Art. 14(2)(f), https://gdpr-info.eu/art-14-gdpr/.\n * The binding already makes the first half true: the source is this instance, a deployment the\n * operator runs. The second half is about how records got INTO that deployment — an ERP contact\n * may have been typed in from a public register, a website or a bought list — and only the\n * operator knows. So the operator states it here, once per instance, as a typed value a reviewer\n * can diff, rather than answering a question or leaving it to a drafter's guess.\n *\n * Omitting it is legitimate and is NOT read as \"no\": the notice's source statement then marks the\n * public-origin half owed for every resource read from the instance.\n */\nexport enum SystemOfRecordPersonalDataOrigin {\n  /** Every person's data in this instance was collected by the operator — from the person, their organisation or the operator's own dealings with them — and none from a publicly accessible source. */\n  NO_PUBLICLY_ACCESSIBLE_SOURCES = 'no-publicly-accessible-sources',\n  /** Some of it may come from publicly accessible sources: company registers, websites, social profiles, enrichment services. The notice says so. */\n  INCLUDES_PUBLICLY_ACCESSIBLE_SOURCES = 'includes-publicly-accessible-sources',\n}\n\nexport const SystemOfRecordNameSchema = z\n  .string()\n  .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')\n  .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH);\n\n/**\n * The i18n bucket holding every instance's display words — the first segment of\n * {@link buildSystemOfRecordDisplayNameLabelKey}'s keys.\n */\nexport const SYSTEM_OF_RECORD_LABEL_BUCKET = 'systems_of_record';\n\n/**\n * The label key naming ONE declared instance to a person: `systems_of_record.<name>.displayName` (#1997).\n *\n * An instance NAME is an environment-variable stem (`odoo`, `sap-fr`), not words: it cannot be translated, and the\n * words a reader recognises (\"Odoo\", \"SAP France\") are not derivable from it. So a surface that names an instance —\n * the provenance cue on a field a pipeline wrote, \"synced from Odoo\" — resolves this key, and the labelling pipeline\n * plans it for every declared instance, total over `systemsOfRecord`. There is deliberately no `displayName` on the\n * declaration: display text comes from the i18n tree, never from configuration. A key nobody generated renders the\n * raw name, which is the missing label looking missing.\n */\nexport function buildSystemOfRecordDisplayNameLabelKey(name: string): string {\n  return `${SYSTEM_OF_RECORD_LABEL_BUCKET}.${name}.displayName`;\n}\n\n/** ONE declared instance. */\nexport const SystemOfRecordDeclarationSchema = z.strictObject({\n  /**\n   * Which vendor this is an instance of — the `vendor` of a facet the deployment ships: the framework's facets\n   * come from the opt-in library `@wildo-ai/systems-of-record`, which `wildo config sync` declares on the backend\n   * as soon as an instance is declared (#2013). Refused at boot when no facet answers to it, rather than here,\n   * because the facet map is not in scope in `wildo.saas.config.ts`.\n   */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n\n  /**\n   * How this instance is READ. Declared per instance rather than taken from the facet because a\n   * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST\n   * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong\n   * to, checked at boot.\n   *\n   * ## One instance per SERVICE ROOT — so a system serving OData v2 and v4 is two instances (#1687)\n   *\n   * An instance has ONE dialect and ONE base URL, and for OData that URL is a service root: an SAP\n   * system's `/sap/opu/odata/sap/API_BUSINESS_PARTNER` (v2) and `/sap/opu/odata4/sap/<service>/…` (v4)\n   * are different roots, as two v4 services of the same system already are. So a system reached over\n   * both versions is declared as two instances, one per root, each with its own dialect, credential\n   * and `maxRequestsPerMinute`.\n   *\n   * Decided rather than asked, because the model already answered it: an instance naming several roots\n   * would need a root per binding, which is what two instances are, and a budget SHARED across\n   * instances would be a new cross-instance ledger for a ceiling the operator can already honour by\n   * splitting it between the instances' `maxRequestsPerMinute`. Both were rejected on that ground.\n   * The cost, stated: two instances against one vendor account are paced separately, so their sum —\n   * not either one — is what must stay under the vendor's allowance.\n   */\n  dialect: z.enum(HttpApiTransportDialect),\n\n  /**\n   * How the engine proves who it is.\n   *\n   * OPTIONAL, and the absence is DERIVED rather than defaulted: when the instance's facet offers\n   * exactly one credential kind there is nothing for an author to decide, so the registry takes it;\n   * when a facet offers more than one and the instance names none, boot refuses and lists them.\n   * The framework derives before it asks: a declaration with one legal value is a question whose\n   * answer the mechanism already holds.\n   *\n   * This stays additive when #1056 widens the facet set: an instance that omitted the field is\n   * refused on the day its facet gains a second kind, which is exactly the day its author acquires a\n   * real decision.\n   */\n  credential: z.strictObject({ kind: z.enum(SystemOfRecordCredentialKind) }).optional(),\n\n  /**\n   * The pace this deployment may call the instance at, across EVERY resource bound to it (#1056 §3).\n   *\n   * Per INSTANCE because that is the unit the vendor accounts for: two resources bound to one\n   * Dataverse are one application user to Dataverse, so two independent per-binding budgets would\n   * each believe they were within a limit the pair together exceeds.\n   *\n   * A binding's own `remoteCallSemantics.maxRequestsPerMinute` stays, and becomes a CEILING UNDER\n   * this one: it answers a different question — how much of the shared allowance may ONE resource\n   * take — which matters when a pipeline load and an interactive read share an instance. Both are\n   * consumed for every call, and a call proceeds only if both have room.\n   *\n   * Omitted means unlimited HERE, which is the honest default: the framework does not know the\n   * vendor's contract, and inventing a number would either throttle a deployment that paid for more\n   * or fail to protect one that has less.\n   */\n  maxRequestsPerMinute: z.number().int().min(1).max(600_000).optional(),\n\n  /**\n   * Whether THIS deployment's data is partitioned, and its rows therefore confined to organization\n   * units of the owner organization (#1058).\n   *\n   * ## The reservation this replaces\n   *\n   * #1055 declared this field `z.never()` and refused it by name, because accepting a declaration the\n   * mechanism could not honour would let an author believe their rows were narrowed while every\n   * member still saw every row. That refusal did its job and is now lifted.\n   *\n   * ## Why the VENDOR says how and the INSTANCE says whether\n   *\n   * How a vendor partitions — which field, what shape, what codec — is a property of the vendor and\n   * lives on its facet. Whether a given deployment's data is partitioned is a property of the\n   * deployment: a single-company Odoo has a `company_id` on every row and nothing to confine, and\n   * asking its operator to restate the field name would be asking a question the facet answers.\n   *\n   * Opting in against a facet that declares no partitioning is refused at boot, naming the vendor —\n   * the alternative is a `true` that does nothing, which is the shape the reservation existed to\n   * prevent in the first place.\n   */\n  partition: z.boolean().optional(),\n\n  /**\n   * The PACKAGES whose facet augmentation applies to this instance (#1675) — npm package names, each of which\n   * must ship an augmentation for this instance's vendor from its `./systems-of-record` export.\n   *\n   * An explicit opt-in per INSTANCE, never implied by installation, because what an augmentation adds can be a\n   * partition declaration, and the facet is the single authority on how a tenant's rows are confined. Two\n   * instances of one vendor may therefore differ: one opts a package's partition in, the other does not.\n   * A package named here that ships no augmentation for the vendor refuses at startup, naming it.\n   *\n   * Naming a package here is also what ADMITS its `./systems-of-record` module to discovery (#2013): apart from the\n   * framework library `@wildo-ai/systems-of-record`, a facet module is recorded only from a package some instance\n   * names. The package must still be walked — named `<scope>/provider-*`, or listed in `providers.packages`.\n   */\n  facetAugmentations: z.array(z.string().min(1).max(214)).min(1).refine(\n    (packages) => new Set(packages).size === packages.length,\n    'A package is named twice in facetAugmentations.',\n  ).optional(),\n\n  /**\n   * Whether the personal data in THIS deployment can have come from publicly accessible sources — see\n   * {@link SystemOfRecordPersonalDataOrigin}. A property of the deployment, not the vendor: two Odoo\n   * instances may be fed differently. Optional; omitted, the privacy notice marks that statement owed\n   * for every resource read from this instance, and never states \"not from public sources\" by default.\n   */\n  personalDataOrigin: z.enum(SystemOfRecordPersonalDataOrigin).optional(),\n});\nexport type SystemOfRecordDeclaration = z.infer<typeof SystemOfRecordDeclarationSchema>;\n\n/**\n * Every instance this application declares, keyed by name.\n *\n * Optional as a whole: an application that reads nothing out of another system declares nothing, and\n * declaring this block is what ENABLES the external-data lane (#1055 D3) rather than an engine\n * capability flag — the lane has no meaning without an instance to point at.\n */\nexport const SystemsOfRecordConfigSchema = z\n  .record(SystemOfRecordNameSchema, SystemOfRecordDeclarationSchema)\n  .superRefine((systemsOfRecord, ctx) => {\n    if (Object.keys(systemsOfRecord).length === 0) {\n      ctx.addIssue({\n        code: 'custom',\n        path: [],\n        message:\n          'An empty `systemsOfRecord` declares nothing and enables nothing. Omit the block entirely, or declare the '\n          + 'instance the application reads.',\n      });\n    }\n  });\nexport type SystemsOfRecordConfig = z.infer<typeof SystemsOfRecordConfigSchema>;\n/** @wildo_source:part:end saas.models.systems-of-record */\n"]}

package/dist/esm/systems-of-record/system-of-record-env.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-env.shared.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,+FAA+F;AAC/F,eAAO,MAAM,2BAA2B,eAAe,CAAC;AAExD,qGAAqG;AACrG,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,mGAAmG;AACnG,eAAO,MAAM,kCAAkC,QAAwB,CAAC;AAExE;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,YAAY,CAAC;AAYvD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ7F;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElF;AAQD,gDAAgD;AAChD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAgBlG"}
+{"version":3,"file":"system-of-record-env.shared.d.ts","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,+FAA+F;AAC/F,eAAO,MAAM,2BAA2B,eAAe,CAAC;AAExD,qGAAqG;AACrG,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,mGAAmG;AACnG,eAAO,MAAM,kCAAkC,QAAwB,CAAC;AAExE;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,YAAY,CAAC;AAYvD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ7F;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElF;AAQD,gDAAgD;AAChD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAgBlG"}

package/dist/esm/systems-of-record/system-of-record-env.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-env.shared.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAE9F,+FAA+F;AAC/F,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AAExD,qGAAqG;AACrG,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,mGAAmG;AACnG,MAAM,CAAC,MAAM,kCAAkC,GAAG,qBAAqB,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC;AAEvD,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,mGAAmG;AACnG,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,YAAoB,EAAE,QAAgB;IACnF,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,IAAI,YAAY,6FAA6F,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,IAAI,QAAQ,8EAA8E,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,GAAG,2BAA2B,GAAG,kBAAkB,CAAC,YAAY,CAAC,GAAG,8BAA8B,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzI,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB;IACxE,OAAO,8BAA8B,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;AACrF,CAAC;AAED,wGAAwG;AACxG,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrH,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAAkB;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACpE,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,uFAAuF;IACvF,IAAI,WAAW,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC","sourcesContent":["/**\n * `WILDO_SOR_<NAME>__<SLOT>` — the ONE derivation of a system-of-record environment-variable name.\n *\n * ## Derived, never authored, and why that is the whole design\n *\n * The lane this replaces put the variable NAMES in the vendor's module — `ODOO_BASE_URL`,\n * `ODOO_DB`, `ODOO_LOGIN`, `ODOO_API_KEY` — so a second Odoo was unrepresentable: the name space was\n * the vendor's, not the instance's. Deriving from the instance NAME instead means two instances of\n * one vendor cost nothing (`WILDO_SOR_ODOO_FR__BASE_URL` beside `WILDO_SOR_ODOO_DE__BASE_URL`), and\n * an author never invents a variable name that some other layer then has to guess.\n *\n * ## Why the delimiter is a DOUBLE underscore (#1055 R4)\n *\n * The pair must be RECOVERABLE — the secrets section is a flat map keyed by variable name (R5), and\n * per-instance structure is recovered by parsing the key back. With a single underscore,\n * `odoo-api` + `key` and `odoo` + `apiKey` both derive `WILDO_SOR_ODOO_API_KEY` and nothing could\n * tell them apart. `__` cannot be produced by either half: an instance name admits only\n * `[a-z0-9-]` and a slot slug only `[a-zA-Z0-9]`, so neither can emit an underscore at all, and the\n * only `__` in a derived name is the delimiter. The collision is impossible by construction rather\n * than checked for.\n *\n * That property is load-bearing, so the two charset laws are not cosmetic: widening either one\n * silently reintroduces the ambiguity. `SYSTEM_OF_RECORD_NAME_PATTERN` and the slot-slug regex are\n * pinned against this file's round trip for that reason.\n *\n * ## Four readers, one authority\n *\n * The backend `.env` writer, the k8s secrets generator, the CI secret collector and the backend\n * registry all need the same name, and three of them live in different packages. Re-deriving it at\n * each would be the enumeration failure `invariant-call-site-enumeration.md` records — so this module\n * is the authority and every one of them imports it.\n */\n\nimport { SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas';\n\n/** Every system-of-record variable starts here, which is what makes a prefix scan possible. */\nexport const SYSTEM_OF_RECORD_ENV_PREFIX = 'WILDO_SOR_';\n\n/** The delimiter between the instance name and the slot. See the module header for why it is two. */\nexport const SYSTEM_OF_RECORD_ENV_DELIMITER = '__';\n\n/** The charset law for a slot slug, shared with the facet schema so the two cannot drift apart. */\nexport const SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN = /^[a-z][a-zA-Z0-9]*$/;\n\n/**\n * The slot slug an instance may never declare, because the environment builder emits it itself.\n *\n * `WILDO_SOR_<NAME>__ENABLED=false` is how an environment says it has NO access to this system —\n * a developer laptop, a staging with no ERP (#1055 E3, R6). A facet declaring a slot named `enabled`\n * would produce the same variable and make \"declared absent\" indistinguishable from \"an address slot\n * whose value happens to be false\", so the name is reserved and the facet schema refuses it.\n */\nexport const SYSTEM_OF_RECORD_ENABLED_SLOT = 'enabled';\n\n/** `odoo-fr` → `ODOO_FR`. The only transformation a name undergoes. */\nfunction encodeInstanceName(instanceName: string): string {\n  return instanceName.toUpperCase().replaceAll('-', '_');\n}\n\n/** `apiKey` → `API_KEY`, `baseUrl` → `BASE_URL`. lowerCamelCase to UPPER_SNAKE, and back below. */\nfunction encodeSlotSlug(slotSlug: string): string {\n  return slotSlug.replace(/([A-Z])/g, '_$1').toUpperCase();\n}\n\n/**\n * The name of the environment variable carrying one slot of one instance.\n *\n * Throws on a name or slug outside its charset law rather than emitting a name that cannot be parsed\n * back: both halves are validated where they are authored, so reaching here with a bad one means a\n * caller skipped a schema, and a silently unparseable variable is worse than a loud refusal.\n */\nexport function deriveSystemOfRecordEnvVarName(instanceName: string, slotSlug: string): string {\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName)) {\n    throw new Error(`\"${instanceName}\" is not a valid system-of-record instance name (lower-kebab-case, starting with a letter).`);\n  }\n  if (!SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) {\n    throw new Error(`\"${slotSlug}\" is not a valid system-of-record slot slug (lowerCamelCase, no separators).`);\n  }\n  return `${SYSTEM_OF_RECORD_ENV_PREFIX}${encodeInstanceName(instanceName)}${SYSTEM_OF_RECORD_ENV_DELIMITER}${encodeSlotSlug(slotSlug)}`;\n}\n\n/**\n * `WILDO_SOR_<NAME>__ENABLED` — present and `false` when an environment declares it has no access to\n * this instance (E3). Its ABSENCE, with required slots missing, is the different and louder case:\n * an environment that simply forgot (E4). Silence is never a declaration, which is why the two are\n * distinguishable at all.\n */\nexport function deriveSystemOfRecordEnabledEnvVarName(instanceName: string): string {\n  return deriveSystemOfRecordEnvVarName(instanceName, SYSTEM_OF_RECORD_ENABLED_SLOT);\n}\n\n/** `API_KEY` → `apiKey`. The inverse of `encodeSlotSlug`, exact because a slug carries no separator. */\nfunction decodeSlotSlug(encoded: string): string {\n  const [head, ...rest] = encoded.toLowerCase().split('_');\n  return [head, ...rest.map((part) => (part.length === 0 ? part : part[0]!.toUpperCase() + part.slice(1)))].join('');\n}\n\n/** What a derived variable name was made of. */\nexport interface SystemOfRecordEnvVarParts {\n  readonly instanceName: string;\n  readonly slotSlug: string;\n}\n\n/**\n * Recover the `(instance, slot)` pair from a derived variable name, or `null` when the name is not\n * one of ours.\n *\n * `null` rather than a throw because the callers scan a MIXED environment — every variable a\n * deployment carries goes past this function, and most of them are not system-of-record variables.\n * A name that starts with the prefix and still does not parse is also `null`: it is not ours either,\n * and refusing an operator's unrelated `WILDO_SOR_SOMETHING` would be this module deciding what an\n * environment may contain.\n */\nexport function parseSystemOfRecordEnvVarName(envVarName: string): SystemOfRecordEnvVarParts | null {\n  if (!envVarName.startsWith(SYSTEM_OF_RECORD_ENV_PREFIX)) return null;\n  const body = envVarName.slice(SYSTEM_OF_RECORD_ENV_PREFIX.length);\n  const delimiterIndex = body.indexOf(SYSTEM_OF_RECORD_ENV_DELIMITER);\n  if (delimiterIndex <= 0) return null;\n\n  const instanceName = body.slice(0, delimiterIndex).toLowerCase().replaceAll('_', '-');\n  const encodedSlot = body.slice(delimiterIndex + SYSTEM_OF_RECORD_ENV_DELIMITER.length);\n  if (encodedSlot.length === 0) return null;\n  // A second delimiter means the name was not produced here: neither half can emit `__`.\n  if (encodedSlot.includes(SYSTEM_OF_RECORD_ENV_DELIMITER)) return null;\n\n  const slotSlug = decodeSlotSlug(encodedSlot);\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName) || !SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) return null;\n\n  return { instanceName, slotSlug };\n}\n"]}
+{"version":3,"file":"system-of-record-env.shared.js","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAE9F,+FAA+F;AAC/F,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AAExD,qGAAqG;AACrG,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,mGAAmG;AACnG,MAAM,CAAC,MAAM,kCAAkC,GAAG,qBAAqB,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC;AAEvD,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,mGAAmG;AACnG,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,YAAoB,EAAE,QAAgB;IACnF,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,IAAI,YAAY,6FAA6F,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,IAAI,QAAQ,8EAA8E,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,GAAG,2BAA2B,GAAG,kBAAkB,CAAC,YAAY,CAAC,GAAG,8BAA8B,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzI,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB;IACxE,OAAO,8BAA8B,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;AACrF,CAAC;AAED,wGAAwG;AACxG,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrH,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAAkB;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACpE,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,uFAAuF;IACvF,IAAI,WAAW,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC","sourcesContent":["/**\n * `WILDO_SOR_<NAME>__<SLOT>` — the ONE derivation of a system-of-record environment-variable name.\n *\n * ## Derived, never authored, and why that is the whole design\n *\n * The lane this replaces put the variable NAMES in the vendor's module — `ODOO_BASE_URL`,\n * `ODOO_DB`, `ODOO_LOGIN`, `ODOO_API_KEY` — so a second Odoo was unrepresentable: the name space was\n * the vendor's, not the instance's. Deriving from the instance NAME instead means two instances of\n * one vendor cost nothing (`WILDO_SOR_ODOO_FR__BASE_URL` beside `WILDO_SOR_ODOO_DE__BASE_URL`), and\n * an author never invents a variable name that some other layer then has to guess.\n *\n * ## Why the delimiter is a DOUBLE underscore (#1055 R4)\n *\n * The pair must be RECOVERABLE — the secrets section is a flat map keyed by variable name (R5), and\n * per-instance structure is recovered by parsing the key back. With a single underscore,\n * `odoo-api` + `key` and `odoo` + `apiKey` both derive `WILDO_SOR_ODOO_API_KEY` and nothing could\n * tell them apart. `__` cannot be produced by either half: an instance name admits only\n * `[a-z0-9-]` and a slot slug only `[a-zA-Z0-9]`, so neither can emit an underscore at all, and the\n * only `__` in a derived name is the delimiter. The collision is impossible by construction rather\n * than checked for.\n *\n * That property is load-bearing, so the two charset laws are not cosmetic: widening either one\n * silently reintroduces the ambiguity. `SYSTEM_OF_RECORD_NAME_PATTERN` and the slot-slug regex are\n * pinned against this file's round trip for that reason.\n *\n * ## Four readers, one authority\n *\n * The backend `.env` writer, the k8s secrets generator, the CI secret collector and the backend\n * registry all need the same name, and three of them live in different packages. Re-deriving it at\n * each would be the enumeration failure `invariant-call-site-enumeration.md` records — so this module\n * is the authority and every one of them imports it.\n */\n\nimport { SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas';\n\n/** Every system-of-record variable starts here, which is what makes a prefix scan possible. */\nexport const SYSTEM_OF_RECORD_ENV_PREFIX = 'WILDO_SOR_';\n\n/** The delimiter between the instance name and the slot. See the module header for why it is two. */\nexport const SYSTEM_OF_RECORD_ENV_DELIMITER = '__';\n\n/** The charset law for a slot slug, shared with the facet schema so the two cannot drift apart. */\nexport const SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN = /^[a-z][a-zA-Z0-9]*$/;\n\n/**\n * The slot slug an instance may never declare, because the environment builder emits it itself.\n *\n * `WILDO_SOR_<NAME>__ENABLED=false` is how an environment says it has NO access to this system —\n * a developer laptop, a staging with no ERP (#1055 E3, R6). A facet declaring a slot named `enabled`\n * would produce the same variable and make \"declared absent\" indistinguishable from \"an address slot\n * whose value happens to be false\", so the name is reserved and the facet schema refuses it.\n */\nexport const SYSTEM_OF_RECORD_ENABLED_SLOT = 'enabled';\n\n/** `odoo-fr` → `ODOO_FR`. The only transformation a name undergoes. */\nfunction encodeInstanceName(instanceName: string): string {\n  return instanceName.toUpperCase().replaceAll('-', '_');\n}\n\n/** `apiKey` → `API_KEY`, `baseUrl` → `BASE_URL`. lowerCamelCase to UPPER_SNAKE, and back below. */\nfunction encodeSlotSlug(slotSlug: string): string {\n  return slotSlug.replace(/([A-Z])/g, '_$1').toUpperCase();\n}\n\n/**\n * The name of the environment variable carrying one slot of one instance.\n *\n * Throws on a name or slug outside its charset law rather than emitting a name that cannot be parsed\n * back: both halves are validated where they are authored, so reaching here with a bad one means a\n * caller skipped a schema, and a silently unparseable variable is worse than a loud refusal.\n */\nexport function deriveSystemOfRecordEnvVarName(instanceName: string, slotSlug: string): string {\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName)) {\n    throw new Error(`\"${instanceName}\" is not a valid system-of-record instance name (lower-kebab-case, starting with a letter).`);\n  }\n  if (!SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) {\n    throw new Error(`\"${slotSlug}\" is not a valid system-of-record slot slug (lowerCamelCase, no separators).`);\n  }\n  return `${SYSTEM_OF_RECORD_ENV_PREFIX}${encodeInstanceName(instanceName)}${SYSTEM_OF_RECORD_ENV_DELIMITER}${encodeSlotSlug(slotSlug)}`;\n}\n\n/**\n * `WILDO_SOR_<NAME>__ENABLED` — present and `false` when an environment declares it has no access to\n * this instance (E3). Its ABSENCE, with required slots missing, is the different and louder case:\n * an environment that simply forgot (E4). Silence is never a declaration, which is why the two are\n * distinguishable at all.\n */\nexport function deriveSystemOfRecordEnabledEnvVarName(instanceName: string): string {\n  return deriveSystemOfRecordEnvVarName(instanceName, SYSTEM_OF_RECORD_ENABLED_SLOT);\n}\n\n/** `API_KEY` → `apiKey`. The inverse of `encodeSlotSlug`, exact because a slug carries no separator. */\nfunction decodeSlotSlug(encoded: string): string {\n  const [head, ...rest] = encoded.toLowerCase().split('_');\n  return [head, ...rest.map((part) => (part.length === 0 ? part : part[0]!.toUpperCase() + part.slice(1)))].join('');\n}\n\n/** What a derived variable name was made of. */\nexport interface SystemOfRecordEnvVarParts {\n  readonly instanceName: string;\n  readonly slotSlug: string;\n}\n\n/**\n * Recover the `(instance, slot)` pair from a derived variable name, or `null` when the name is not\n * one of ours.\n *\n * `null` rather than a throw because the callers scan a MIXED environment — every variable a\n * deployment carries goes past this function, and most of them are not system-of-record variables.\n * A name that starts with the prefix and still does not parse is also `null`: it is not ours either,\n * and refusing an operator's unrelated `WILDO_SOR_SOMETHING` would be this module deciding what an\n * environment may contain.\n */\nexport function parseSystemOfRecordEnvVarName(envVarName: string): SystemOfRecordEnvVarParts | null {\n  if (!envVarName.startsWith(SYSTEM_OF_RECORD_ENV_PREFIX)) return null;\n  const body = envVarName.slice(SYSTEM_OF_RECORD_ENV_PREFIX.length);\n  const delimiterIndex = body.indexOf(SYSTEM_OF_RECORD_ENV_DELIMITER);\n  if (delimiterIndex <= 0) return null;\n\n  const instanceName = body.slice(0, delimiterIndex).toLowerCase().replaceAll('_', '-');\n  const encodedSlot = body.slice(delimiterIndex + SYSTEM_OF_RECORD_ENV_DELIMITER.length);\n  if (encodedSlot.length === 0) return null;\n  // A second delimiter means the name was not produced here: neither half can emit `__`.\n  if (encodedSlot.includes(SYSTEM_OF_RECORD_ENV_DELIMITER)) return null;\n\n  const slotSlug = decodeSlotSlug(encodedSlot);\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName) || !SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) return null;\n\n  return { instanceName, slotSlug };\n}\n"]}