@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/external-data/external-data-pipeline.shared.schemas.js

@@ -14,19 +14,65 @@
  * these members, and the paper's ledger rows (PR-…) are cited per surface.
  */
 import { z } from 'zod';
-import { HttpApiResourceBindingSchema } from '../http-api-binding/http-api-binding.shared.schemas.js';
+import { HttpApiResourceBindingSchema, HttpApiWriteConcurrencyMode, HttpApiWriteVerb } from '../http-api-binding/http-api-binding.shared.schemas.js';
 import { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared.js';
+import { HttpApiErasureStance } from '../http-api-binding/http-api-erasure-stance.shared.js';
+import { ExternalDataConflictPolicy } from './external-data-pipeline-pass-mode.shared.js';
 /**
- * Pipeline direction (PR-19). A SINGLE-member enum on purpose: reverse ETL (local→remote) and
- * bidirectional sync belong to the outbound-writes gate (ETL plan Step 5, concurrency contract),
- * but the DECLARATION is direction-extensible NOW so those arrive as new members instead of a
- * schema reshape — the immutability-needs-a-paired-path lesson applied to a vocabulary.
+ * Pipeline direction (PR-19). Declared per pipeline; `INBOUND` when omitted.
+ *
+ * The vocabulary was single-member until the write path (#1679) existed, so reverse ETL arrived as a new member
+ * rather than a schema reshape. Keeping one row correct when BOTH sides change it is a third member, with its own
+ * conflict policy (#1723) — neither of these two decides a conflict.
  */
 /** @wildo_source:part:start saas.models.external-data-pipeline facet:layer:shared facet:audience:app-developer */
 export var ExternalDataPipelineDirection;
 (function (ExternalDataPipelineDirection) {
+    /**
+     * The system of record is the source: a pass reads its rows and loads them into the destination. The mapped fields
+     * are remote-authoritative, so callers may not write them.
+     */
     ExternalDataPipelineDirection["INBOUND"] = "inbound";
+    /**
+     * The destination is the source (#1690): a row created or changed locally is sent to the system of record on the
+     * next pass — created there when it has no remote key yet, updated when it has one. The mapped fields are the
+     * application's own, so callers write them; the remote key is written by the engine, once, from the create's answer.
+     *
+     * Only rows of the organization that owns the application are ever sent (a system of record belongs to it alone),
+     * and on a partitioned instance only rows whose organization unit is assigned to a partition. A local DELETE is not
+     * sent: a system of record keeps its own records, and removing one is its operator's decision, not a side effect of
+     * a local edit.
+     */
+    ExternalDataPipelineDirection["OUTBOUND"] = "outbound";
+    /**
+     * Both sides change the row (#1723): a pass LOADS what the system of record changed and SENDS what the application
+     * changed, field by field, as each mapping entry's `owner` declares — REMOTE fields are loaded and read-only locally,
+     * LOCAL fields are sent and never loaded, BOTH fields are loaded AND sent. A row whose BOTH fields changed on both
+     * sides since they last agreed is a CONFLICT, decided by the declared `conflictPolicy`.
+     *
+     * "Since they last agreed" is the system of record's own row version (Odoo `write_date`, an OData entity tag), kept
+     * per row by the engine — so the direction is legal only on an instance whose vendor declares one. A local DELETE is
+     * not sent, as on OUTBOUND.
+     */
+    ExternalDataPipelineDirection["BIDIRECTIONAL"] = "bidirectional";
 })(ExternalDataPipelineDirection || (ExternalDataPipelineDirection = {}));
+/**
+ * Which side OWNS a mapped field of a BIDIRECTIONAL pipeline (#1723). Declared on each `REMOTE_FIELD` / `REMOTE_REFERENCE`
+ * entry as `owner`, and refused on any other direction (an INBOUND pipeline's fields are all the system of record's, an
+ * OUTBOUND pipeline's all the application's).
+ *
+ * Only BOTH fields can conflict, which keeps the common case — remote master data plus a few locally-owned fields —
+ * out of conflict handling entirely.
+ */
+export var ExternalDataFieldOwner;
+(function (ExternalDataFieldOwner) {
+    /** The system of record's: loaded, read-only for callers, never sent. The default when `owner` is omitted. */
+    ExternalDataFieldOwner["REMOTE"] = "remote";
+    /** The application's: written by callers, sent, never loaded. */
+    ExternalDataFieldOwner["LOCAL"] = "local";
+    /** Both sides': written by callers AND loaded, sent AND read back — the only kind of field that can conflict. */
+    ExternalDataFieldOwner["BOTH"] = "both";
+})(ExternalDataFieldOwner || (ExternalDataFieldOwner = {}));
 /**
  * Who owns the destination's row population (D-P8, v3.1 §1).
  *
@@ -69,18 +115,162 @@ export var ExternalDataOrphanPolicy;
     /** Touch nothing; surface the diff in the run ledger. The DEFAULT — least surprise. */
     ExternalDataOrphanPolicy["REPORT"] = "report";
 })(ExternalDataOrphanPolicy || (ExternalDataOrphanPolicy = {}));
-/** The two shapes a mapping entry can take — a closed discriminator, never inferred from keys. */
+/**
+ * The shapes a mapping entry can take — a closed discriminator, never inferred from keys.
+ *
+ * ## The DECLARED EXPRESSIONS (#1685), and the open function slot they replace
+ *
+ * `ENUM_MAP`, `CONCATENATION`, `ARITHMETIC` and `CONDITIONAL` derive a local value from remote values. They are
+ * the first of the T's recorded widenings (D-P4: computed transforms, then multi-source joins, then transforms
+ * authored by the app-creation lane's agents) and they are DATA: every one names the remote fields it reads, the
+ * local field it writes, and a closed operation with declared constants. Nothing in them executes code the
+ * declaration does not show, so each is checked at startup against the destination schema (target type, enum
+ * membership, absence) and requested by the extraction like any mapped field.
+ *
+ * An open function slot (`transform: (row) => value`) is refused on purpose: it would put arbitrary code inside the
+ * load with no declaration anyone can review, validate or fingerprint. A derivation beyond these four stays a
+ * pre-load step in the application's own code, run by its own job.
+ */
 export var ExternalDataMappingEntryKind;
 (function (ExternalDataMappingEntryKind) {
     /** Copy (and coerce) one remote field into one local field. */
     ExternalDataMappingEntryKind["REMOTE_FIELD"] = "remote-field";
     /** Fill one local field with a declared constant (destination-required fields with no remote source). */
     ExternalDataMappingEntryKind["CONSTANT"] = "constant";
+    /**
+     * Turn a remote REFERENCE into a real local foreign key (#1684) — an Odoo many2one (`parent_id`,
+     * `partner_id`), an OData navigation key. The remote value names a row of ANOTHER remote entity (or of
+     * the same one); the pipeline writes the local foreign key to that row's LOCAL copy, never the remote
+     * id. See {@link ExternalDataRemoteReferenceMappingEntrySchema}.
+     */
+    ExternalDataMappingEntryKind["REMOTE_REFERENCE"] = "remote-reference";
+    /**
+     * Map a remote CODE onto a member of a local enum (#1685) — an Odoo selection (`draft`/`posted`), a vendor status
+     * code. Every mapped code is declared; a code the declaration does not name either rejects the row or lands a
+     * declared default. See {@link ExternalDataEnumMappingEntrySchema}.
+     */
+    ExternalDataMappingEntryKind["ENUM_MAP"] = "enum-map";
+    /**
+     * Join remote fields and literals into one local string (#1685) — a display name from a first and a last name.
+     * See {@link ExternalDataConcatenationMappingEntrySchema}.
+     */
+    ExternalDataMappingEntryKind["CONCATENATION"] = "concatenation";
+    /**
+     * `remote × factor + offset` on one numeric remote field (#1685) — a unit conversion, or a currency conversion at
+     * a DECLARED constant rate. See {@link ExternalDataArithmeticMappingEntrySchema}.
+     */
+    ExternalDataMappingEntryKind["ARITHMETIC"] = "arithmetic";
+    /**
+     * Choose the local value by ONE remote field's value (#1685): a list of cases, each an exact value, and an
+     * `otherwise`. See {@link ExternalDataConditionalMappingEntrySchema}.
+     */
+    ExternalDataMappingEntryKind["CONDITIONAL"] = "conditional";
 })(ExternalDataMappingEntryKind || (ExternalDataMappingEntryKind = {}));
+/**
+ * The mapping entry kinds an OUTBOUND pipeline may declare (#1690): a local field sent as one remote field, and a local
+ * foreign key sent as the target row's REMOTE key. The declared expressions (#1685) derive one local value from remote
+ * ones and have no inverse — a concatenation cannot be split back into its parts — and a CONSTANT names no remote field.
+ */
+export const EXTERNAL_DATA_OUTBOUND_MAPPING_ENTRY_KINDS = new Set([
+    ExternalDataMappingEntryKind.REMOTE_FIELD,
+    ExternalDataMappingEntryKind.REMOTE_REFERENCE,
+]);
+/**
+ * The write verbs an OUTBOUND pipeline may open on its binding (#1690): a create for a row with no remote key yet, and
+ * an update for one that has one. DELETE is not among them — see {@link ExternalDataPipelineDirection.OUTBOUND}.
+ */
+export const EXTERNAL_DATA_OUTBOUND_WRITE_VERBS = new Set([HttpApiWriteVerb.CREATE, HttpApiWriteVerb.UPDATE]);
+/**
+ * What an `ENUM_MAP` does with a remote code its declaration does not name (#1685).
+ */
+export var ExternalDataUnmappedValuePolicy;
+(function (ExternalDataUnmappedValuePolicy) {
+    /**
+     * The DEFAULT. The row is REJECTED and reported, and its previous local version survives. A vendor that adds a
+     * code is then visible on the next run's report instead of being folded silently into some other member.
+     */
+    ExternalDataUnmappedValuePolicy["REJECT_ROW"] = "reject-row";
+    /** The row lands the declared `localValue`. Choose it only where every future code genuinely means the same thing. */
+    ExternalDataUnmappedValuePolicy["USE_DEFAULT"] = "use-default";
+})(ExternalDataUnmappedValuePolicy || (ExternalDataUnmappedValuePolicy = {}));
+/** The two things a `CONCATENATION` part can be (#1685). */
+export var ExternalDataConcatenationPartKind;
+(function (ExternalDataConcatenationPartKind) {
+    /** The value of one remote field. An absent or empty value drops the part. */
+    ExternalDataConcatenationPartKind["REMOTE_FIELD"] = "remote-field";
+    /** A declared literal, written as-is. */
+    ExternalDataConcatenationPartKind["LITERAL"] = "literal";
+})(ExternalDataConcatenationPartKind || (ExternalDataConcatenationPartKind = {}));
+/** The two things a `CONDITIONAL` outcome can be (#1685). */
+export var ExternalDataConditionalOutcomeKind;
+(function (ExternalDataConditionalOutcomeKind) {
+    /** A declared constant, checked against the local field's type at startup. */
+    ExternalDataConditionalOutcomeKind["CONSTANT"] = "constant";
+    /** Another remote field's value, copied as a `REMOTE_FIELD` entry copies it. */
+    ExternalDataConditionalOutcomeKind["REMOTE_FIELD"] = "remote-field";
+})(ExternalDataConditionalOutcomeKind || (ExternalDataConditionalOutcomeKind = {}));
+/**
+ * How a REMOTE_REFERENCE's remote value becomes the target's key (#1684). A closed vocabulary, one
+ * member per wire shape, because the shapes differ in kind and guessing between them silently resolves
+ * nothing.
+ */
+export var ExternalDataRemoteReferenceValueShape;
+(function (ExternalDataRemoteReferenceValueShape) {
+    /**
+     * Odoo's many2one: `search_read` answers `[id, display_name]`, or `false` when the reference is empty.
+     * The key is the pair's FIRST element; the display name is ignored (it is a label, not an identity).
+     * spec-cite: Odoo 18.0 developer reference, External API — "Read records" / "Search and read"
+     * (`odoo/documentation/18.0/content/developer/reference/external_api.rst`) — a many2one reads as
+     * `[21, 'Belgium']`; `false` for an unset one is the ORM's null spelling (measured shape recorded on the
+     * provider simulator, `odoo-jsonrpc-mock.ts`).
+     */
+    ExternalDataRemoteReferenceValueShape["ODOO_MANY2ONE"] = "odoo-many2one";
+    /**
+     * The remote value IS the target's key component, as a plain scalar — an OData navigation property's
+     * foreign-key field (`ParentAccountID`), a REST id column. `null` or an empty string is an empty reference.
+     */
+    ExternalDataRemoteReferenceValueShape["SCALAR"] = "scalar";
+})(ExternalDataRemoteReferenceValueShape || (ExternalDataRemoteReferenceValueShape = {}));
+/**
+ * What a run does with a reference whose target has no local row yet (#1684).
+ *
+ * Resolution happens AFTER the load, in its own phase, so a reference to a row loaded by the same run —
+ * including a child extracted before its parent, and a self-reference — always resolves. What remains
+ * "unresolved" is a target the destination does not hold at all: outside the pipeline's `sourceFilter`,
+ * in a partition nobody assigned, not yet loaded by the target's own pipeline.
+ */
+export var ExternalDataUnresolvedReferencePolicy;
+(function (ExternalDataUnresolvedReferencePolicy) {
+    /**
+     * The DEFAULT. The row loads with the foreign key EMPTY, and the reference is kept in the pipeline's
+     * pending-resolution set. The set is retried at the end of EVERY later run of the pipeline, incremental
+     * ones included — which is the only way such a row is ever resolved under incremental extraction (#1682),
+     * because a child that did not change is never re-read. Counted on every run's report and summary.
+     */
+    ExternalDataUnresolvedReferencePolicy["LEAVE_PENDING"] = "leave-pending";
+    /**
+     * The row is REJECTED (reported per row; its previous local version survives) when its target is not
+     * already loaded and not among the rows of the same PAGE — a run loads page by page (#1689), so a target
+     * on a LATER page of the same run is not loaded yet. It is retried only when the row is extracted again
+     * — every full pass, or an incremental pass after it changes — and a pass that reads parents before their
+     * children never meets the case. For a self-referencing entity whose source order you do not control,
+     * `LEAVE_PENDING` resolves the link at the end of the same run instead. A reference to a VIRTUAL (read-through)
+     * target never rejects: its key is its local id, and there is nothing local to be missing.
+     *
+     * The check runs BEFORE the load, against the target as it stands then. A self-referenced target that the same
+     * full pass's orphan walk deletes (`orphanPolicy: DELETE`) saved the row from rejection and is then gone, so that
+     * row loads with its foreign key empty and pending — the one case this policy cannot rule out.
+     */
+    ExternalDataUnresolvedReferencePolicy["REJECT_ROW"] = "reject-row";
+})(ExternalDataUnresolvedReferencePolicy || (ExternalDataUnresolvedReferencePolicy = {}));
 /**
  * Built-in, closed coercion vocabulary for REMOTE_FIELD entries (v3.1 §3 / PR-8). Slice 1 ships
- * exactly the coercions the two generic dialects force; arbitrary transforms are the recorded
- * widenings (W-FK resolution, W-AGENT authored transforms) — never an open function slot here.
+ * exactly the coercions the two generic dialects force. A value COMPUTED from remote fields is one of
+ * the declared expressions (#1685 — D-P4's first widening: `ENUM_MAP`, `CONCATENATION`, `ARITHMETIC`,
+ * `CONDITIONAL`), and transforms authored by the app-creation lane's agents remain a recorded widening
+ * (W-AGENT) — never an open function slot here. Foreign-key resolution,
+ * once recorded as the W-FK widening beside it, is not a coercion at all: it is its own entry kind,
+ * {@link ExternalDataMappingEntryKind.REMOTE_REFERENCE} (#1684).
  */
 export var ExternalDataFieldCoercion;
 (function (ExternalDataFieldCoercion) {
@@ -95,9 +285,224 @@ export var ExternalDataFieldCoercion;
     /** Parse a strict-ISO datetime string into a Date for a date-typed local field. */
     ExternalDataFieldCoercion["ISO_STRING_TO_DATE"] = "iso-string-to-date";
 })(ExternalDataFieldCoercion || (ExternalDataFieldCoercion = {}));
-/** One declared T-step: remote field → local field with a built-in coercion, or a constant. */
+/**
+ * What a pipeline does with a remote row its source has ARCHIVED rather than deleted (#1732).
+ *
+ * ## Why this exists: archived is not deleted, and absence reads as deletion
+ *
+ * Odoo archives a record by setting its `active` field to `false`, and an archived record is then
+ * "invisible in most searches and listing" — a plain `search_read` leaves it out, exactly as if it
+ * had been deleted.
+ * spec-cite: Odoo 17.0 ORM API reference, "Reserved Field names" → `Model.active`
+ * (https://www.odoo.com/documentation/17.0/developer/reference/backend/orm.html).
+ *
+ * A pipeline's orphan walk reads "absent from a complete pass" as "deleted remotely", so an extraction
+ * that inherited Odoo's default visibility turned every archive into a deletion: `REPORT` reported
+ * it, `DEPRECATE` deprecated it, and `DELETE` hard-deleted the local row together with its local
+ * extension fields, files and RAG chunks. Un-archiving later re-created a bare row.
+ *
+ * So extraction ALWAYS asks Odoo for archived rows too (the `active_test: false` context), and an
+ * archived row is always OBSERVED — present in the source, never an orphan. What remains a choice is
+ * only whether it is LOADED, and that is this vocabulary. Every member keeps the row observed; no
+ * member can turn an archive into a deletion.
+ *
+ * Declared on Odoo sources only (`archivedRecords`); an OData source has no protocol-level archive
+ * state, and the declaration coherence refuses the field there.
+ */
+export var ExternalDataArchivedRecordTreatment;
+(function (ExternalDataArchivedRecordTreatment) {
+    /**
+     * The DEFAULT. An archived row is loaded like any other row. Map the source's archive flag
+     * (`active` on most Odoo models) onto a local boolean like any other field, and the destination can
+     * show or filter archived rows — and an un-archive changes exactly that one value.
+     */
+    ExternalDataArchivedRecordTreatment["LOAD"] = "load";
+    /**
+     * An archived row is NOT loaded, but still counts as observed, so it is never an orphan — the same
+     * treatment rows of an unassigned partition get. A local row loaded while the record was live KEEPS
+     * its last loaded version (it is neither updated nor deleted) until the record is un-archived.
+     * Choose it to keep archived records out of a destination that never held them; choose `LOAD` with
+     * the flag mapped when the destination must reflect archival.
+     */
+    ExternalDataArchivedRecordTreatment["EXCLUDE_FROM_LOAD"] = "exclude-from-load";
+})(ExternalDataArchivedRecordTreatment || (ExternalDataArchivedRecordTreatment = {}));
+/**
+ * A REMOTE_REFERENCE mapping entry (#1684): a remote reference field written as a real LOCAL foreign key.
+ *
+ * ## What the local field holds
+ *
+ * - a target that is another PIPELINE destination on the same system of record (or this one — a
+ *   self-reference such as Odoo `res.partner.parent_id`): the target's local row id, found by synthesizing
+ *   the target's key with THE TARGET BINDING's key codec and looking it up on the target's
+ *   `remoteKeyLocalField`;
+ * - a target that is a VIRTUAL (read-through) resource bound to the same system of record: the synthesized
+ *   key itself — a virtual row's `_id` IS that value, so nothing is looked up.
+ *
+ * ## When it is written
+ *
+ * After the load, in its own phase — never inside the row transform. So a child extracted before its
+ * parent, a self-reference, and a cycle between two pipelines all resolve without ordering anything. The
+ * resolution phase is the ONLY writer of the local field: the load never touches it, which is why the field
+ * is left out of the load's managed fields.
+ *
+ * ## What the declaration owes (checked at authoring and at startup)
+ *
+ * - `localField` is the foreign key of a declared relationship between this resource and `targetResourceType`,
+ *   a STRING field that accepts absence (an unresolved reference leaves it empty), and — like every
+ *   pipeline-written field — `.excludeFromCreate().excludeFromUpdate()`;
+ * - the target is a pipeline destination or a virtual resource on THIS pipeline's system of record, keyed by
+ *   ONE key field (a composite target key is a recorded widening);
+ * - when the target's orphan policy DELETES rows and the relationship tears children down with their parent,
+ *   `orphanCascadeAcknowledged: true` — a row vanishing from the target's source would otherwise take this
+ *   resource's rows with it through the ordinary `onParentDelete` rules, and nothing about this declaration
+ *   says so unless the author does.
+ */
+export const ExternalDataRemoteReferenceMappingEntrySchema = z.strictObject({
+    kind: z.literal(ExternalDataMappingEntryKind.REMOTE_REFERENCE),
+    /** The remote field carrying the reference (`parent_id` on Odoo `res.partner`). */
+    remoteField: z.string().trim().min(1),
+    /** The local foreign-key field the resolved reference is written to. */
+    localField: z.string().trim().min(1),
+    /** The LOCAL resource the reference resolves to — a pipeline destination or a virtual resource. */
+    targetResourceType: z.string().trim().min(1),
+    /**
+     * How the remote value becomes the target's key. Absent = resolved at AUTHORING from the source dialect:
+     * `ODOO_MANY2ONE` on an Odoo source, `SCALAR` otherwise — the resource factory writes the resolved value
+     * into the declaration, exactly as it resolves the Odoo absent-as-false coercion.
+     */
+    valueShape: z.enum(ExternalDataRemoteReferenceValueShape).optional(),
+    unresolved: z.enum(ExternalDataUnresolvedReferencePolicy).default(ExternalDataUnresolvedReferencePolicy.LEAVE_PENDING),
+    /**
+     * The author has read that the target's `orphanPolicy: DELETE` will cascade into this resource's rows
+     * through the relationship's `onParentDelete` teardown, and wants that. Only meaningful — and only
+     * demanded — when both are true; see the schema's header.
+     */
+    orphanCascadeAcknowledged: z.boolean().default(false),
+    /** Which side owns the reference — BIDIRECTIONAL pipelines only (#1723). Absent = REMOTE. */
+    owner: z.enum(ExternalDataFieldOwner).optional(),
+});
+/**
+ * A remote SCALAR a declared expression compares against or maps from (#1685) — the value shapes a remote field
+ * carries that can be matched exactly. An Odoo selection is a string, a status code may be a number, a flag a
+ * boolean. Objects and arrays (an Odoo many2one pair) cannot be matched and are not declarable.
+ */
+const externalDataExpressionScalarSchema = z.union([z.string(), z.number().finite(), z.boolean()]);
+/**
+ * An `ENUM_MAP` entry (#1685): one remote code → one member of the local field's enum.
+ *
+ * - the local field is an ENUM, and every declared `localValue` (and the default's) is one of its members — checked
+ *   at startup, so a renamed member fails the boot rather than every row;
+ * - an ABSENT remote value (the field unset: `null`, missing, or Odoo's `false` when `false` is not itself a declared
+ *   code) lands null, or rejects the row when `required`;
+ * - a PRESENT code the declaration does not name follows `unmapped`: rejected by default, or the declared member.
+ */
+export const ExternalDataEnumMappingEntrySchema = z.strictObject({
+    kind: z.literal(ExternalDataMappingEntryKind.ENUM_MAP),
+    /** The remote field carrying the code (`state` on Odoo `account.move`). */
+    remoteField: z.string().trim().min(1),
+    localField: z.string().trim().min(1),
+    /** Every code the declaration maps, each to one member of the local enum. Codes are unique. */
+    values: z.array(z.strictObject({
+        remoteValue: externalDataExpressionScalarSchema,
+        localValue: z.union([z.string().min(1), z.number().finite()]),
+    })).min(1),
+    /** A PRESENT code no `values` entry names. Absent = reject the row. */
+    unmapped: z.discriminatedUnion('policy', [
+        z.strictObject({ policy: z.literal(ExternalDataUnmappedValuePolicy.REJECT_ROW) }),
+        z.strictObject({ policy: z.literal(ExternalDataUnmappedValuePolicy.USE_DEFAULT), localValue: z.union([z.string().min(1), z.number().finite()]) }),
+    ]).default({ policy: ExternalDataUnmappedValuePolicy.REJECT_ROW }),
+    /** `true`: a row whose remote code is ABSENT is rejected. `false` (default): absence lands null. */
+    required: z.boolean().default(false),
+});
+/**
+ * A `CONCATENATION` entry (#1685): remote fields and literals joined into one local STRING.
+ *
+ * Every part with a value is written, in order, joined by `separator`; a remote part whose value is absent or empty
+ * (`null`, missing, `''`, or Odoo's `false`) is DROPPED with its separator, the way SQL's `concat_ws` ignores a NULL
+ * argument — so `first` + `last` joined by a space yields `'Ada'`, never `'Ada '`, when the last name is unset. A
+ * number is written as JavaScript's shortest round-trip text (`42`, `12.5`; exponent notation only beyond `1e21` or
+ * below `1e-6`); any other value (a boolean off Odoo, a many2one pair) rejects the row.
+ *
+ * spec-cite: PostgreSQL 17 documentation, §9.4 "String Functions and Operators", `concat_ws` — "NULL arguments are
+ * ignored" (https://www.postgresql.org/docs/17/functions-string.html).
+ *
+ * When NO remote part has a value, the result is ABSENT — literals alone are decoration, not data — and lands null,
+ * or rejects the row when `required`.
+ */
+export const ExternalDataConcatenationMappingEntrySchema = z.strictObject({
+    kind: z.literal(ExternalDataMappingEntryKind.CONCATENATION),
+    localField: z.string().trim().min(1),
+    /** At least two parts, at least one of them a remote field. */
+    parts: z.array(z.discriminatedUnion('kind', [
+        z.strictObject({ kind: z.literal(ExternalDataConcatenationPartKind.REMOTE_FIELD), remoteField: z.string().trim().min(1) }),
+        z.strictObject({ kind: z.literal(ExternalDataConcatenationPartKind.LITERAL), literal: z.string().min(1) }),
+    ])).min(2),
+    /** Written between two parts that both have a value. Default: nothing. */
+    separator: z.string().default(''),
+    required: z.boolean().default(false),
+});
+/**
+ * An `ARITHMETIC` entry (#1685): `remote × factor + offset` onto a local NUMBER.
+ *
+ * A currency conversion is legal only as a DECLARED rate (`factor`): a live exchange rate is a second source, which
+ * is a join, and joins are a later widening. The declaration is the rate's record, so changing it changes the
+ * pipeline's extraction fingerprint and an incremental pipeline re-reads every row under the new rate.
+ *
+ * The remote value is a finite number, or a string holding a plain decimal numeral (`'12.50'` — how OData v2 and
+ * several REST APIs serialize decimals). Anything else rejects the row. `decimalPlaces` rounds the RESULT half away
+ * from zero, in binary floating point: it keeps `0.1 × 3` from landing as `0.30000000000000004`, and it does not make
+ * the value exact — an amount that must be exact to the cent belongs in a type this expression does not produce.
+ */
+export const ExternalDataArithmeticMappingEntrySchema = z.strictObject({
+    kind: z.literal(ExternalDataMappingEntryKind.ARITHMETIC),
+    remoteField: z.string().trim().min(1),
+    localField: z.string().trim().min(1),
+    /** Multiplier. Never 0 — a constant result is a `CONSTANT` entry. */
+    factor: z.number().finite().default(1),
+    /** Added after the multiplication. */
+    offset: z.number().finite().default(0),
+    /** Round the result to this many decimal places. Absent = no rounding. */
+    decimalPlaces: z.number().int().min(0).max(12).optional(),
+    required: z.boolean().default(false),
+});
+/** What a `CONDITIONAL` case (or its `otherwise`) writes (#1685). */
+const ExternalDataConditionalOutcomeSchema = z.discriminatedUnion('kind', [
+    z.strictObject({ kind: z.literal(ExternalDataConditionalOutcomeKind.CONSTANT), constant: externalDataExpressionScalarSchema }),
+    z.strictObject({
+        kind: z.literal(ExternalDataConditionalOutcomeKind.REMOTE_FIELD),
+        remoteField: z.string().trim().min(1),
+        /** As on a `REMOTE_FIELD` entry: Odoo's absent-as-false is resolved at authoring from the local field's type. */
+        coercion: z.enum(ExternalDataFieldCoercion).default(ExternalDataFieldCoercion.NONE),
+    }),
+]);
+/**
+ * A `CONDITIONAL` entry (#1685): the local value chosen by ONE remote field's value.
+ *
+ * The cases are tried in order and the first whose `equals` is exactly (`===`) the remote value wins; no case
+ * matching — an absent value included — takes `otherwise`. On an Odoo source an unset field reads `false`, so a declared
+ * `equals: false` case catches it before `otherwise` does. An outcome is a constant (checked against the local
+ * field's type, and against its members when it is an enum) or another remote field's value. Conditions over two
+ * fields, ranges and patterns are not part of the set: they are exactly what makes an expression language grow into
+ * the open function slot this set exists to avoid.
+ */
+export const ExternalDataConditionalMappingEntrySchema = z.strictObject({
+    kind: z.literal(ExternalDataMappingEntryKind.CONDITIONAL),
+    /** The remote field whose value decides. */
+    remoteField: z.string().trim().min(1),
+    localField: z.string().trim().min(1),
+    cases: z.array(z.strictObject({ equals: externalDataExpressionScalarSchema, then: ExternalDataConditionalOutcomeSchema })).min(1),
+    otherwise: ExternalDataConditionalOutcomeSchema,
+});
+/**
+ * One declared T-step: remote field → local field with a built-in coercion, a constant, a resolved reference, or one
+ * of the four declared expressions (#1685).
+ *
+ * Every entry shape is STRICT: an unknown key is refused, not dropped. That is what makes the refusal of an open
+ * function slot real — `{ kind: 'remote-field', …, transform: (value) => … }` used to parse with `transform` silently
+ * stripped, a declaration that reads as if it ran code and runs none.
+ */
 export const ExternalDataFieldMappingEntrySchema = z.discriminatedUnion('kind', [
-    z.object({
+    z.strictObject({
         kind: z.literal(ExternalDataMappingEntryKind.REMOTE_FIELD),
         remoteField: z.string().trim().min(1),
         localField: z.string().trim().min(1),
@@ -108,12 +513,244 @@ export const ExternalDataFieldMappingEntrySchema = z.discriminatedUnion('kind',
          * which the declaration coherence requires the local field to accept.
          */
         required: z.boolean().default(false),
+        /** Which side owns the field — BIDIRECTIONAL pipelines only (#1723). Absent = REMOTE. */
+        owner: z.enum(ExternalDataFieldOwner).optional(),
     }),
-    z.object({
+    z.strictObject({
         kind: z.literal(ExternalDataMappingEntryKind.CONSTANT),
         localField: z.string().trim().min(1),
         constant: z.union([z.string(), z.number(), z.boolean()]),
     }),
+    ExternalDataRemoteReferenceMappingEntrySchema,
+    ExternalDataEnumMappingEntrySchema,
+    ExternalDataConcatenationMappingEntrySchema,
+    ExternalDataArithmeticMappingEntrySchema,
+    ExternalDataConditionalMappingEntrySchema,
+]);
+/**
+ * HOW a source says what changed — one member per remote change-tracking mechanism (#1682).
+ *
+ * A closed vocabulary shared by two parties: a system-of-record VENDOR FACET declares which modes its
+ * deployments support (`incrementalExtractionModes`), and a pipeline declaration chooses one. A
+ * pipeline asking for a mode its source's facet does not declare is refused at startup, naming both.
+ *
+ * Three modes: Odoo's `write_date`, and the two OData v4 mechanisms (#1722) — a modified-at filter and
+ * the delta-link protocol. The incremental TRACK on the state row is mode-neutral (its watermark and
+ * cursor are opaque, mode-owned text), so a new mode needed no reshape of it.
+ */
+export var ExternalDataIncrementalExtractionMode;
+(function (ExternalDataIncrementalExtractionMode) {
+    /**
+     * Odoo's `write_date` — the "Last Updated on" column the ORM maintains on every model that logs
+     * access. Read in (SECOND, id) order from a watermark, with a declared lookback. See
+     * {@link ExternalDataIncrementalExtractionDeclarationSchema}.
+     */
+    ExternalDataIncrementalExtractionMode["ODOO_WRITE_DATE"] = "odoo-write-date";
+    /**
+     * OData v4, a MODIFIED-AT property the declaration names (`modifiedAtRemoteField` — per entity, not per
+     * vendor: Dataverse's `modifiedon`, Business Central's `lastModifiedDateTime`). Rows with that property at
+     * or after the watermark (less the lookback) are read in KEY order, and the watermark moves only when the
+     * pass completes. Catches no deletions: full passes find those.
+     */
+    ExternalDataIncrementalExtractionMode["ODATA_MODIFIED_AT"] = "odata-modified-at";
+    /**
+     * OData v4 CHANGE TRACKING: the first pass asks for `Prefer: odata.track-changes` and keeps the service's
+     * `@odata.deltaLink`; every later pass follows it and receives changed entities AND deleted ones, so an
+     * incremental pass applies the orphan policy to each deleted key. The vendor must track changes for the
+     * entity set (Dataverse: per table).
+     */
+    ExternalDataIncrementalExtractionMode["ODATA_DELTA_LINK"] = "odata-delta-link";
+})(ExternalDataIncrementalExtractionMode || (ExternalDataIncrementalExtractionMode = {}));
+/**
+ * `incremental` — read only what changed between full passes (#1682).
+ *
+ * ## What an incremental pass does, and what it never does
+ *
+ * - It reads the rows changed since the pipeline's WATERMARK — the largest remote position a previous
+ *   incremental pass actually LOADED, never the local clock (a local clock and a remote clock disagree,
+ *   and the gap is rows nobody reads).
+ * - The watermark advances only after the rows that reached it are loaded. A crash re-reads; it never
+ *   skips.
+ * - It NEVER detects deletions. A row deleted remotely does not "change", so no incremental read can
+ *   see it. Deletions are found by FULL passes only, on `fullPassCron` — which is why that cadence is
+ *   required rather than optional: an incremental-only pipeline would keep deleted rows forever.
+ * - It runs on the pipeline's `scheduleCron`, which is therefore required too.
+ *
+ * ## The Odoo mode — why (second, id), and why a lookback
+ *
+ * Odoo STORES `write_date` with microseconds (the writing transaction's `now()`) and SERVES it cut to
+ * the second, while a domain compares the stored value. Two obvious designs fail on that gap:
+ * `write_date > w` skips the rows that share the last row's second but did not fit on the page, and a
+ * keyset on the served `(write_date, id)` re-reads its own last row forever, because a row served as
+ * `10:00:00` is stored after `10:00:00`. The extraction therefore walks (SECOND, id): it finishes one
+ * second by id (`s <= write_date < s+1s AND id > i`, ordered by id), then finds the next rows from the
+ * following second. Every row is read once per pass, however many rows share a second.
+ * spec-cite: N/A — Odoo 17.0 SOURCE, not a document: `odoo/models.py`
+ * `vals.setdefault('write_date', self.env.cr.now())`, `odoo/sql_db.py` `Cursor.now`
+ * (`SELECT (now() AT TIME ZONE 'UTC')`), `odoo/fields.py` `Datetime.to_string` (`strftime`), and no
+ * `Datetime.convert_to_column` override (the base field stores the full value).
+ *
+ * The lookback re-reads the last `lookbackSeconds` of changes at the START of every incremental pass.
+ * Odoo stamps `write_date` when the writing transaction runs, not when it commits, so a long
+ * transaction can commit a row whose `write_date` is already older than a watermark another pass
+ * advanced past in the meantime; without a lookback that row is never read — and a transaction that
+ * commits later inside the watermark's own second is caught the same way. Re-reads are free where it
+ * matters: the load compares content and writes nothing for an unchanged row. UNVERIFIED against a
+ * live Odoo — the default is a margin, not a measurement; raise it for a deployment with long batch
+ * jobs. `0` is NOT a harmless setting: without a lookback, a row written later inside a second a pass
+ * has already finished is read only when it changes again (or by a full pass).
+ *
+ * ## Changing the declaration resets the incremental track
+ *
+ * An incremental pass never re-reads a row that did not change remotely, so a change to what is
+ * extracted or how it is loaded — the binding, key fields, mapping, `sourceFilter`, partition fields,
+ * archived-record treatment, or the operator's partition ASSIGNMENTS — would otherwise never reach the
+ * rows already loaded. The run fingerprints those inputs; a different fingerprint drops the watermark,
+ * and the next incremental pass reads the whole source again. The run summary says it did.
+ */
+export const ExternalDataIncrementalExtractionDeclarationSchema = z.discriminatedUnion('mode', [
+    z.object({
+        mode: z.literal(ExternalDataIncrementalExtractionMode.ODOO_WRITE_DATE),
+        /**
+         * When FULL passes run (cron). The only deletion detector, so required. A full pass that takes
+         * several runs continues on `scheduleCron` ticks until it completes, interleaved with incremental
+         * passes; neither track waits for the other.
+         */
+        fullPassCron: z.string().trim().min(1),
+        /** Seconds of changes re-read at the start of every incremental pass (see above). Up to one day. */
+        lookbackSeconds: z.number().int().nonnegative().max(86_400).default(300),
+    }),
+    /*
+     * ## The OData modified-at mode (#1722)
+     *
+     * `$filter=<modifiedAtRemoteField> ge <watermark − lookback>`, ordered by the KEY as a full pass is, paged
+     * by the service. Because the pages are in key order and not in modified-at order, a page's largest
+     * timestamp says nothing about the rows still to come, so the watermark moves only when the PASS completes
+     * (to the largest timestamp the pass read), never per page — a per-page watermark would skip the rows of
+     * a later page modified before it. `ge`, not `gt`: two rows sharing the watermark's instant are both read.
+     *
+     * The property must be an `Edm.DateTimeOffset` the service filters on. The lookback plays the role it
+     * plays for Odoo: a row written by a transaction that commits after the pass read past its timestamp is
+     * re-read by the next pass. Changing `modifiedAtRemoteField` starts the track over (the stored watermark
+     * names the property it was read on).
+     */
+    z.object({
+        mode: z.literal(ExternalDataIncrementalExtractionMode.ODATA_MODIFIED_AT),
+        fullPassCron: z.string().trim().min(1),
+        /** The entity's modified-at property (`Edm.DateTimeOffset`), by its REMOTE name. */
+        modifiedAtRemoteField: z.string().trim().min(1),
+        lookbackSeconds: z.number().int().nonnegative().max(86_400).default(300),
+    }),
+    /*
+     * ## The OData delta-link mode (#1722)
+     *
+     * The first incremental pass reads the whole entity set with `Prefer: odata.track-changes` and keeps the
+     * `@odata.deltaLink` the service puts on its last page; each later pass GETs that link and receives what
+     * changed and what was DELETED since. A deleted entity carries only its id, so the orphan policy is applied
+     * to that key — an incremental pass that finds deletions, which the other modes cannot.
+     *
+     * Refused at declaration: a `sourceFilter` (Dataverse refuses `$filter`, `$orderby`, `$expand` and `$top`
+     * with change tracking) and a composite key (a deleted entity names one id). A delta link the service no
+     * longer honours (`410 Gone`) resets the track and the same run falls back to a FULL pass, which is what
+     * finds the deletions the expired link would have reported; the run summary says so.
+     * spec-cite: Microsoft Learn, "Use change tracking to synchronize data with external systems"
+     * (https://learn.microsoft.com/en-us/power-apps/developer/data-platform/use-change-tracking-synchronize-data-external-systems),
+     * "Query options not supported in Change Tracking Web API request" — "System query options $filter,
+     * $orderby, $expand, and $top aren't supported when you use the Prefer: odata.track-changes header".
+     * spec-cite: OData Version 4.01 Part 1: Protocol §9.2.4 — "410 Gone indicates that the requested resource is
+     * no longer available. This can happen if a client has waited too long to follow a delta link".
+     *
+     * No lookback: a delta link is the service's own position, not a clock.
+     */
+    z.object({
+        mode: z.literal(ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK),
+        fullPassCron: z.string().trim().min(1),
+    }),
+]);
+/**
+ * The dialect each incremental mode is spoken over. A `Record` over the enum so a mode added without
+ * its dialect is a compile error rather than a declaration the coherence check silently waves through.
+ */
+export const EXTERNAL_DATA_INCREMENTAL_MODE_DIALECT = {
+    [ExternalDataIncrementalExtractionMode.ODOO_WRITE_DATE]: HttpApiTransportDialect.ODOO_JSONRPC,
+    [ExternalDataIncrementalExtractionMode.ODATA_MODIFIED_AT]: HttpApiTransportDialect.ODATA,
+    [ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK]: HttpApiTransportDialect.ODATA,
+};
+/**
+ * Every remote field one mapping entry READS (#1685) — the one answer to that question, total over the entry kinds.
+ *
+ * The extraction requests exactly these (with the key fields and the archive flag), so a field an expression reads is
+ * never missing from `fields` / `$select` — and a field the remote does not have fails the request loudly instead of
+ * landing null on every row. The run's contract-drift probe checks the same list. A new kind that forgets to say what
+ * it reads is a compile error here, not an extraction that silently omits a field.
+ */
+export function listExternalDataMappingEntryRemoteFields(entry) {
+    switch (entry.kind) {
+        case ExternalDataMappingEntryKind.REMOTE_FIELD:
+        case ExternalDataMappingEntryKind.REMOTE_REFERENCE:
+        case ExternalDataMappingEntryKind.ENUM_MAP:
+        case ExternalDataMappingEntryKind.ARITHMETIC:
+            return [entry.remoteField];
+        case ExternalDataMappingEntryKind.CONSTANT:
+            return [];
+        case ExternalDataMappingEntryKind.CONCATENATION:
+            return [...new Set(entry.parts.flatMap((part) => (part.kind === ExternalDataConcatenationPartKind.REMOTE_FIELD ? [part.remoteField] : [])))];
+        case ExternalDataMappingEntryKind.CONDITIONAL:
+            return [...new Set([
+                    entry.remoteField,
+                    ...[...entry.cases.map((entryCase) => entryCase.then), entry.otherwise]
+                        .flatMap((outcome) => (outcome.kind === ExternalDataConditionalOutcomeKind.REMOTE_FIELD ? [outcome.remoteField] : [])),
+                ])];
+        default: {
+            const unhandled = entry;
+            throw new Error(`listExternalDataMappingEntryRemoteFields: unhandled mapping entry ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
+/** Every remote field a pipeline's mapping reads, deduplicated, in declaration order (#1685). */
+export function listExternalDataMappingRemoteFields(mapping) {
+    return [...new Set(mapping.flatMap(listExternalDataMappingEntryRemoteFields))];
+}
+/** A scalar's identity for uniqueness checks: `1` and `'1'` are different codes, as `===` says they are. */
+function expressionScalarKey(value) {
+    return `${typeof value}:${String(value)}`;
+}
+/**
+ * The value shape a REMOTE_REFERENCE is read with (#1684) — the declared one, or the source dialect's default:
+ * Odoo answers every many2one as a pair, every other dialect names a key as a scalar.
+ *
+ * The ONE place that default lives. The resource factory writes its answer into the declaration at authoring, and
+ * the transform asks the same function, so a declaration parsed without passing through the factory (a test, a
+ * tool) reads the same shape an application does.
+ */
+export function resolveExternalDataRemoteReferenceValueShape(entry, dialect) {
+    if (entry.valueShape !== undefined)
+        return entry.valueShape;
+    return dialect === HttpApiTransportDialect.ODOO_JSONRPC
+        ? ExternalDataRemoteReferenceValueShape.ODOO_MANY2ONE
+        : ExternalDataRemoteReferenceValueShape.SCALAR;
+}
+/**
+ * The archive flag Odoo filters on by default. Odoo's ORM names it `active` (or `x_active` on a
+ * Studio-created field), so the declaration defaults to `active` and lets a model with the other
+ * spelling say so.
+ */
+// semantic-literal-boundary: Odoo's own reserved field name, at the declaration that addresses it.
+const ODOO_DEFAULT_ARCHIVE_FLAG_REMOTE_FIELD = 'active';
+/**
+ * `archivedRecords` — how an Odoo pipeline treats archived rows (#1732). Absent means
+ * {@link ExternalDataArchivedRecordTreatment.LOAD}.
+ *
+ * `EXCLUDE_FROM_LOAD` must read each row's archive flag, so it names the flag's REMOTE field; the
+ * extraction requests that field. `LOAD` reads nothing extra — a pipeline that wants the flag on the
+ * destination maps it, which is an ordinary mapping entry, not part of this declaration.
+ */
+export const ExternalDataArchivedRecordsDeclarationSchema = z.discriminatedUnion('treatment', [
+    z.object({ treatment: z.literal(ExternalDataArchivedRecordTreatment.LOAD) }),
+    z.object({
+        treatment: z.literal(ExternalDataArchivedRecordTreatment.EXCLUDE_FROM_LOAD),
+        archiveFlagRemoteField: z.string().trim().min(1).default(ODOO_DEFAULT_ARCHIVE_FLAG_REMOTE_FIELD),
+    }),
 ]);
 /** Scalar values admissible in the declared source filter (T-set equality conjunctions only). */
 const externalDataPipelineFilterScalarSchema = z.union([z.string(), z.number(), z.boolean()]);
@@ -127,6 +764,16 @@ const externalDataPipelineFilterScalarSchema = z.union([z.string(), z.number(),
  */
 /** @wildo_source:part:start saas.models.external-data-pipeline facet:layer:shared facet:audience:app-developer */
 export const ExternalDataPipelineDeclarationSchema = z.object({
+    /**
+     * Which way rows travel — see {@link ExternalDataPipelineDirection}. `INBOUND` when omitted.
+     *
+     * An OUTBOUND pipeline (#1690) reuses this whole declaration with the arrows reversed: the binding opens the writes
+     * it sends (`writableVerbs: [CREATE, UPDATE]`, with the same `writeConcurrency` a read-through binding states), each
+     * `mapping` entry names the local field SENT and the remote field it lands on, and `remoteKeyLocalField` receives the
+     * key the system of record assigns when it creates the row. The fields that only describe reading a source —
+     * `sourceFilter`, `incremental`, `archivedRecords`, `partitionKeyLocalField`, `population`, `orphanPolicy` — are
+     * refused on it, because nothing would read them.
+     */
     direction: z.enum(ExternalDataPipelineDirection).default(ExternalDataPipelineDirection.INBOUND),
     /**
      * The source half — the SAME binding declaration the VIRTUAL mode uses (the system of record it
@@ -138,6 +785,14 @@ export const ExternalDataPipelineDeclarationSchema = z.object({
      * different thing that no binding names), so a pipeline extracts the operator's rows and the
      * destination's own scope declaration decides who may then read them.
      *
+     * How the source is WALKED is the dialect's, and only drift-safe walks are admitted: OData v4 follows
+     * the server's `@odata.nextLink`; OData v2 (`ODATA_V2`, #1687) walks the binding's key fields and never
+     * follows `__next`, because v2 promises no stability across a partial listing; Odoo walks its id keyset;
+     * and a REST_JSON source walks the KEYSET its `list` statement declares
+     * (`operations.list.statement.keyset: { keyRemoteField }`, #1686) — the engine builds "the next N rows
+     * after the last key, in key order" and stores that key as the cursor.
+     * A REST source with no keyset (offset paging only) is refused.
+     *
      * ⚠ OPERATIONAL HAZARD (PR-16): changing `keyFields` or a component CODEC after rows exist
      * re-keys EVERY business key — the whole destination population orphans and re-creates on the
      * next full pass, detaching local annotations (extension fields, files, chunks) from the rows
@@ -152,6 +807,13 @@ export const ExternalDataPipelineDeclarationSchema = z.object({
      * plain STRING business key. The factory requires it declared `.isBusinessKey()` +
      * `excludeFromCreate/Update`: SYNC's idempotent upsert keys on it, and no caller may mint or
      * move it.
+     *
+     * On an OUTBOUND pipeline (#1690) it is empty until the row is first sent: the engine writes the key the system of
+     * record answers the create with, exactly once, and then updates the remote row it names. It must therefore accept
+     * absence, and it is still excluded from create and update — a caller that could write it could point a local row at
+     * any remote record. It must be `.isUnique()` (global, sparse — the default) and `.optional()`, never `.nullable()`:
+     * one remote record, one local row, enforced by the store on every path that writes the key, while the rows not yet
+     * sent (no key) stay outside the index. No business key is required there: nothing upserts on it.
      */
     remoteKeyLocalField: z.string().trim().min(1),
     /**
@@ -196,25 +858,156 @@ export const ExternalDataPipelineDeclarationSchema = z.object({
      */
     sourceFilter: z.record(z.string().trim().min(1), externalDataPipelineFilterScalarSchema).optional(),
     population: z.enum(ExternalDataDestinationPopulation).default(ExternalDataDestinationPopulation.CLOSED),
+    /**
+     * Odoo sources only: whether ARCHIVED remote rows are loaded (#1732). Absent = `LOAD`. Archived rows
+     * are extracted and counted as observed under every treatment, so archiving a record in Odoo never
+     * reaches the orphan policy — see {@link ExternalDataArchivedRecordTreatment}.
+     */
+    archivedRecords: ExternalDataArchivedRecordsDeclarationSchema.optional(),
     orphanPolicy: z.enum(ExternalDataOrphanPolicy).default(ExternalDataOrphanPolicy.REPORT),
+    /**
+     * What a BIDIRECTIONAL pipeline (#1723) does with a row whose BOTH-owned fields changed on both sides since they last
+     * agreed — see {@link ExternalDataConflictPolicy}. Absent = REFUSE_AND_REPORT: nothing is overwritten that nobody
+     * decided to overwrite. Refused on any other direction, where no field has two owners.
+     */
+    conflictPolicy: z.enum(ExternalDataConflictPolicy).optional(),
     /**
      * Cron expression for the scheduled refresh (crontabs machinery). Absent = on-demand only —
      * legal, and honest for a manually-driven backfill.
      */
     scheduleCron: z.string().trim().min(1).optional(),
+    /**
+     * Read only what changed between full passes (#1682). Absent = every pass is a FULL pass, the
+     * behaviour of every pipeline before this existed. When declared, `scheduleCron` runs incremental
+     * passes and `incremental.fullPassCron` runs the full passes that alone detect deletions — see
+     * {@link ExternalDataIncrementalExtractionDeclarationSchema}.
+     */
+    incremental: ExternalDataIncrementalExtractionDeclarationSchema.optional(),
     /**
      * Extraction bound per run (v3.1 §2): a big backfill progresses across runs via the ledger's
      * resumable cursor instead of owning one unbounded run. The default matches the rate-budget
      * era's "bounded by construction" posture.
+     *
+     * A run ends on a PAGE boundary, so it may carry up to one page more than this — never fewer
+     * rows than the pass has left, and never a page cut short: the source's continuation follows the
+     * whole page, so rows cut from it would be read by no run. An OData v4 source asks for pages of
+     * `min(maxRowsPerRun, 1000)` (`Prefer: odata.maxpagesize`), which a service may honour or not
+     * (#1991). Whether a pass is COMPLETE is never decided from this number — only from the source
+     * answering that nothing is left.
+     *
+     * It bounds a run's WORK, not its memory: a run loads and checkpoints each page (up to 1 000 rows)
+     * before it reads the next (#1689), so it holds one page, and a run that fails part-way keeps the
+     * pages it loaded — the next run resumes after them.
      */
     maxRowsPerRun: z.number().int().positive().default(10_000),
+    /**
+     * How long one run may spend before it stops at a page boundary (#1683) — the run's DEADLINE, in
+     * milliseconds.
+     *
+     * A run PACES against its source's rate budget: when the binding's `remoteCallSemantics
+     * .maxRequestsPerMinute` is full it waits for room instead of failing, and it waits as long as a
+     * throttling source's `Retry-After` asks. This bounds that waiting. No wait that would end past the
+     * deadline is taken and no page starts after it; the run then ends as a PARTIAL pass — every page it
+     * loaded is kept and its cursor continues the pass on the next run — never as a failure.
+     *
+     * It bounds extraction and load together: each page is loaded before the next is read (#1689), so a
+     * run finishes after the page it was working on, by at most one page's extraction and load.
+     *
+     * Fifteen minutes by default: well inside an hourly `scheduleCron`, and long enough that a pass of the
+     * default `maxRowsPerRun` completes at even a small binding ceiling. Six hours at most — a run that
+     * needs longer is a backfill, and resuming across runs is what the cursor is for.
+     */
+    maxRunDurationMs: z.number().int().min(1_000).max(21_600_000).default(900_000),
 });
+/**
+ * The schema-INDEPENDENT half of a declared expression's coherence (#1685); the destination-schema half (target
+ * type, enum membership, absence) is the resource factory's. Each refusal names a declaration that would either do
+ * nothing or decide something the author cannot see.
+ */
+function assertExternalDataExpressionEntryCoherence(entry, dialect) {
+    const at = `mapping('${entry.localField}')`;
+    switch (entry.kind) {
+        case ExternalDataMappingEntryKind.ENUM_MAP: {
+            const seen = new Set();
+            for (const { remoteValue } of entry.values) {
+                const key = expressionScalarKey(remoteValue);
+                // Two entries for one code: the first would win silently, and the second would read as a mapping that happens.
+                if (seen.has(key))
+                    throw new Error(`${at}.values: the remote code ${JSON.stringify(remoteValue)} is mapped more than once — one code, one member.`);
+                seen.add(key);
+            }
+            return;
+        }
+        case ExternalDataMappingEntryKind.CONCATENATION:
+            if (!entry.parts.some((part) => part.kind === ExternalDataConcatenationPartKind.REMOTE_FIELD)) {
+                throw new Error(`${at}.parts: a CONCATENATION of literals only reads nothing from the source — declare a CONSTANT instead.`);
+            }
+            return;
+        case ExternalDataMappingEntryKind.ARITHMETIC:
+            if (entry.factor === 0) {
+                throw new Error(`${at}.factor: 0 makes every row the same value, which is a CONSTANT entry, not arithmetic on a remote field.`);
+            }
+            if (entry.factor === 1 && entry.offset === 0 && entry.decimalPlaces === undefined) {
+                throw new Error(`${at}: factor 1 and offset 0 with no rounding copy the value unchanged — declare a REMOTE_FIELD entry.`);
+            }
+            return;
+        case ExternalDataMappingEntryKind.CONDITIONAL: {
+            const seen = new Set();
+            for (const { equals } of entry.cases) {
+                const key = expressionScalarKey(equals);
+                // A second case for one value can never be reached: cases are tried in order and the first match wins.
+                if (seen.has(key))
+                    throw new Error(`${at}.cases: the value ${JSON.stringify(equals)} has more than one case, and only the first could ever apply.`);
+                seen.add(key);
+            }
+            for (const outcome of [...entry.cases.map((entryCase) => entryCase.then), entry.otherwise]) {
+                if (outcome.kind === ExternalDataConditionalOutcomeKind.REMOTE_FIELD
+                    && outcome.coercion === ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL
+                    && dialect !== HttpApiTransportDialect.ODOO_JSONRPC) {
+                    throw new Error(`${at}: an outcome declares '${ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL}', Odoo's absent-as-false semantics, on a ${dialect} source.`);
+                }
+            }
+            return;
+        }
+        default:
+            return;
+    }
+}
 /**
  * Schema-INDEPENDENT coherence of a parsed declaration — the mainSchema-dependent half lives in
  * the resource-configuration factory (it needs the shape). Throws with the offending path named,
  * mirroring `assertHttpApiBindingDialectCoherence`'s contract.
  */
 export function assertExternalDataPipelineDeclarationCoherence(declaration) {
+    if (declaration.direction === ExternalDataPipelineDirection.OUTBOUND) {
+        assertExternalDataOutboundPipelineCoherence(declaration);
+        return;
+    }
+    const bidirectional = declaration.direction === ExternalDataPipelineDirection.BIDIRECTIONAL;
+    if (bidirectional) {
+        // Its SENDING half here; its LOADING half is an INBOUND pipeline's, checked by everything below.
+        assertExternalDataBidirectionalSendingCoherence(declaration);
+    }
+    else {
+        if (declaration.conflictPolicy !== undefined) {
+            throw new Error(`conflictPolicy: decides a row changed on both sides, which only a BIDIRECTIONAL pipeline has. Remove it, or declare direction: BIDIRECTIONAL.`);
+        }
+        const owned = declaration.mapping.find((entry) => 'owner' in entry && entry.owner !== undefined);
+        if (owned !== undefined) {
+            throw new Error(`mapping('${owned.localField}').owner: field ownership is declared on a BIDIRECTIONAL pipeline, where fields are loaded, sent or both. `
+                + `On an ${declaration.direction.toUpperCase()} pipeline every field travels one way; remove it.`);
+        }
+    }
+    /*
+     * #1679 — an INBOUND pipeline READS its source; nothing in that lane sends a write through its binding. An opened
+     * verb would be a declaration that decides nothing while reading like a write door. An OUTBOUND pipeline (#1690) is
+     * where a pipeline's binding opens writes.
+     */
+    if (!bidirectional && declaration.binding.writableVerbs.length > 0) {
+        throw new Error(`binding.writableVerbs [${declaration.binding.writableVerbs.join(', ')}] opens writes on an INBOUND pipeline's source, which it `
+            + 'never sends. Declare direction: OUTBOUND to send local rows to the system of record, or put the writes on a read-through '
+            + '(HTTP_API) resource; otherwise remove writableVerbs from the pipeline binding.');
+    }
     /*
      * The S1 tenancy confinement was REMOVED here with `tenancy` itself (#1055).
      *
@@ -225,12 +1018,63 @@ export function assertExternalDataPipelineDeclarationCoherence(declaration) {
      * organization, and the rows a LOAD writes are stamped with it (#868) rather than mapped from a
      * remote scope field.
      */
-    // D-P10: extraction uses drift-safe paging ONLY (`@odata.nextLink` / the Odoo id-keyset
-    // cursor). REST_JSON declares offset paging, which skips or doubles rows whenever the remote
-    // set shifts mid-run — so a REST_JSON pipeline SOURCE is refused until a declared cursor
-    // contract exists for the dialect (a recorded widening beside W-DELTA, not an improvisation).
-    if (declaration.binding.dialect === HttpApiTransportDialect.REST_JSON) {
-        throw new Error('binding.dialect: REST_JSON pipeline sources are refused in slice 1 — the dialect declares offset paging, which drifts under concurrent remote change (rows skipped or doubled). ODATA (@odata.nextLink) and ODOO_JSONRPC (id cursor) sources are drift-safe; a declared REST cursor contract is the recorded widening.');
+    /*
+     * D-P10: extraction uses drift-safe paging ONLY — OData v4 follows the server's own `@odata.nextLink`,
+     * OData v2 walks the binding's key fields (#1687), Odoo walks an id keyset, and a REST_JSON source walks
+     * the KEYSET its `list` statement declares
+     * (#1686). Offset paging skips or doubles rows whenever the remote set shifts mid-run, so a REST
+     * source with no keyset — a parameter-based read, or a statement read with none declared — is refused:
+     * offset-only APIs have no drift-safe contract to walk.
+     *
+     * The keyset's own shape (one key field, a walkable codec, the page bound its language needs) is
+     * checked by `assertHttpApiBindingDialectCoherence`, which the factory runs on this binding too.
+     */
+    if (declaration.binding.dialect === HttpApiTransportDialect.REST_JSON && declaration.binding.operations.list.statement?.keyset === undefined) {
+        throw new Error('binding.operations.list: a REST_JSON pipeline source must walk a declared KEYSET — offset paging drifts under concurrent remote change '
+            + '(rows skipped or doubled), so a REST source is refused unless its list member reads through a query statement that declares '
+            + "`keyset: { keyRemoteField: '<the key field>' }` (SOQL, SuiteQL). An API that pages by offset only, with no filterable key, "
+            + 'cannot feed a pipeline; read it through a virtual resource instead.');
+    }
+    // Archive state is Odoo's (`active` / `active_test`); an OData service has no protocol-level
+    // equivalent, so the declaration would describe a mechanism the source does not have — and an
+    // EXCLUDE_FROM_LOAD reading a flag the rows never carry would reject every row.
+    if (declaration.archivedRecords !== undefined
+        && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC) {
+        throw new Error(`archivedRecords: declared on a ${declaration.binding.dialect} source — archived-record handling is Odoo's archive semantics (the 'active' field and the 'active_test' context) and applies to ODOO_JSONRPC sources only.`);
+    }
+    /*
+     * #1682 — an incremental mode is a mechanism of ONE dialect, and it needs a clock to run on.
+     *
+     * The dialect check is the engine's half: the Odoo mode compiles an Odoo domain, so declaring it on
+     * an OData source would compile nothing the source understands. Whether this VENDOR's deployments
+     * support the mode is the facet's half, refused at startup where the facet is in scope.
+     *
+     * `scheduleCron` is required because it is what runs incremental passes. Without it the declaration
+     * would describe a track nothing ever advances, while full passes ran alone on `fullPassCron` — an
+     * `incremental` block that changed nothing is the configuration-that-looks-like-a-control shape.
+     */
+    if (declaration.incremental !== undefined) {
+        const requiredDialect = EXTERNAL_DATA_INCREMENTAL_MODE_DIALECT[declaration.incremental.mode];
+        if (declaration.binding.dialect !== requiredDialect) {
+            throw new Error(`incremental.mode: '${declaration.incremental.mode}' is spoken over ${requiredDialect} and this pipeline's source is `
+                + `${declaration.binding.dialect}. An OData v4 source reads changes through '${ExternalDataIncrementalExtractionMode.ODATA_MODIFIED_AT}' or `
+                + `'${ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK}'; an OData v2 or REST_JSON source has no incremental mode and runs FULL passes only.`);
+        }
+        if (declaration.incremental.mode === ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK) {
+            if (declaration.sourceFilter !== undefined) {
+                throw new Error(`incremental.mode: '${ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK}' reads with change tracking, which refuses a $filter, so a `
+                    + 'sourceFilter cannot be sent with it. Remove sourceFilter, or read changes with '
+                    + `'${ExternalDataIncrementalExtractionMode.ODATA_MODIFIED_AT}', which filters.`);
+            }
+            if (declaration.binding.keyFields.length !== 1) {
+                throw new Error(`incremental.mode: '${ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK}' needs a single key field: a deleted entity is reported by `
+                    + `one id, which a composite key of ${declaration.binding.keyFields.length} components cannot be rebuilt from.`);
+            }
+        }
+        if (declaration.scheduleCron === undefined) {
+            throw new Error('incremental: declared without scheduleCron — incremental passes run on scheduleCron, so nothing would ever run one. '
+                + 'Declare scheduleCron (how often changes are read) beside incremental.fullPassCron (how often deletions are found).');
+        }
     }
     const localTargets = new Set();
     for (const entry of declaration.mapping) {
@@ -262,6 +1106,14 @@ export function assertExternalDataPipelineDeclarationCoherence(declaration) {
             && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC) {
             throw new Error(`mapping('${entry.localField}').coercion: '${ExternalDataFieldCoercion.ODOO_FALSE_AS_NULL}' names Odoo's absent-as-false semantics and is refused on a ${declaration.binding.dialect} source.`);
         }
+        assertExternalDataExpressionEntryCoherence(entry, declaration.binding.dialect);
+        // #1684 — an Odoo many2one pair is Odoo's wire shape; declared on another dialect it would read the first
+        // element of a value that is not a pair and reject (or mis-resolve) every row.
+        if (entry.kind === ExternalDataMappingEntryKind.REMOTE_REFERENCE
+            && entry.valueShape === ExternalDataRemoteReferenceValueShape.ODOO_MANY2ONE
+            && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC) {
+            throw new Error(`mapping('${entry.localField}').valueShape: '${ExternalDataRemoteReferenceValueShape.ODOO_MANY2ONE}' is Odoo's many2one pair and is refused on a ${declaration.binding.dialect} source — declare '${ExternalDataRemoteReferenceValueShape.SCALAR}'.`);
+        }
     }
     /*
      * TOGETHER or not at all (#1058 E4).
@@ -297,4 +1149,200 @@ export function assertExternalDataPipelineDeclarationCoherence(declaration) {
         }
     }
 }
+/** Which side owns one mapping entry of a BIDIRECTIONAL pipeline (#1723): its declared `owner`, REMOTE when omitted. */
+export function resolveExternalDataFieldOwner(entry) {
+    return 'owner' in entry && entry.owner !== undefined ? entry.owner : ExternalDataFieldOwner.REMOTE;
+}
+/** The conflict policy a BIDIRECTIONAL pipeline applies (#1723): its declared one, REFUSE_AND_REPORT when omitted. */
+export function resolveExternalDataConflictPolicy(declaration) {
+    return declaration.conflictPolicy ?? ExternalDataConflictPolicy.REFUSE_AND_REPORT;
+}
+/**
+ * Whether a pipeline LOADS this entry: every entry of an INBOUND pipeline, and the REMOTE- and BOTH-owned entries of a
+ * BIDIRECTIONAL one (#1723). An OUTBOUND pipeline loads nothing.
+ */
+export function externalDataEntryIsLoaded(direction, entry) {
+    if (direction === ExternalDataPipelineDirection.OUTBOUND)
+        return false;
+    if (direction === ExternalDataPipelineDirection.INBOUND)
+        return true;
+    return resolveExternalDataFieldOwner(entry) !== ExternalDataFieldOwner.LOCAL;
+}
+/**
+ * Whether a pipeline SENDS this entry: every entry of an OUTBOUND pipeline, and the LOCAL- and BOTH-owned entries of a
+ * BIDIRECTIONAL one (#1723). An INBOUND pipeline sends nothing.
+ */
+export function externalDataEntryIsSent(direction, entry) {
+    if (direction === ExternalDataPipelineDirection.INBOUND)
+        return false;
+    if (direction === ExternalDataPipelineDirection.OUTBOUND)
+        return true;
+    return resolveExternalDataFieldOwner(entry) !== ExternalDataFieldOwner.REMOTE;
+}
+/**
+ * The SENDING half of a BIDIRECTIONAL pipeline's coherence (#1723) — the OUTBOUND rules, applied to the entries it sends.
+ * Its loading half is an INBOUND pipeline's and is checked by the rules that follow in
+ * {@link assertExternalDataPipelineDeclarationCoherence}.
+ */
+function assertExternalDataBidirectionalSendingCoherence(declaration) {
+    const opened = declaration.binding.writableVerbs;
+    if (!opened.includes(HttpApiWriteVerb.UPDATE)) {
+        throw new Error('binding.writableVerbs: a BIDIRECTIONAL pipeline sends the application\'s changes of rows the system of record already holds, so it must '
+            + 'open UPDATE. Open CREATE as well to send rows born locally.');
+    }
+    const refusedVerbs = opened.filter((verb) => !EXTERNAL_DATA_OUTBOUND_WRITE_VERBS.has(verb));
+    if (refusedVerbs.length > 0) {
+        throw new Error(`binding.writableVerbs: ${refusedVerbs.join(', ')} cannot be sent by a pipeline. A local delete is never sent: removing a record of the `
+            + "system of record is its operator's decision, not the side effect of a local edit.");
+    }
+    if (declaration.population === ExternalDataDestinationPopulation.CLOSED && opened.includes(HttpApiWriteVerb.CREATE)) {
+        throw new Error('binding.writableVerbs: CREATE sends rows born locally, and population CLOSED says every row comes from the system of record. Declare '
+            + 'population: OPEN if rows may be born here, or remove CREATE.');
+    }
+    if (declaration.binding.writeConcurrency?.mode === HttpApiWriteConcurrencyMode.VERSION_CHECKED) {
+        throw new Error(`binding.writeConcurrency: '${HttpApiWriteConcurrencyMode.VERSION_CHECKED}' compares a version a CALLER read. A BIDIRECTIONAL pipeline checks `
+            + "every update against the version it last reconciled with the system of record — the vendor's own row version — so there is no "
+            + `caller version to declare. Declare '${HttpApiWriteConcurrencyMode.LAST_WRITER_WINS}'; a change on both sides is a conflict, decided by conflictPolicy.`);
+    }
+    if (declaration.binding.erasure.stance !== HttpApiErasureStance.NO_SUBJECT_DATA) {
+        throw new Error(`binding.erasure: '${declaration.binding.erasure.stance}' promises what a subject erasure does to the records this pipeline sends, and `
+            + `no erasure reaches a sent record yet (#2030). Declare '${HttpApiErasureStance.NO_SUBJECT_DATA}' and send no field that describes a person.`);
+    }
+    const sent = declaration.mapping.filter((entry) => externalDataEntryIsSent(declaration.direction, entry));
+    if (sent.length === 0) {
+        throw new Error('mapping: a BIDIRECTIONAL pipeline declares at least one field it sends (owner: LOCAL or BOTH). With every field REMOTE it only loads — '
+            + 'declare it INBOUND.');
+    }
+    for (const entry of sent) {
+        const at = `mapping('${entry.localField}')`;
+        const owner = resolveExternalDataFieldOwner(entry);
+        if (!EXTERNAL_DATA_OUTBOUND_MAPPING_ENTRY_KINDS.has(entry.kind)) {
+            throw new Error(`${at}: a '${entry.kind}' entry has no inverse, so its field cannot be sent. Declare it owner: REMOTE (loaded only).`);
+        }
+        if (owner === ExternalDataFieldOwner.LOCAL && entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD) {
+            if (entry.required)
+                throw new Error(`${at}.required: rejects a row whose REMOTE value is absent when loaded, and a LOCAL field is never loaded. Remove it.`);
+            if (entry.coercion !== ExternalDataFieldCoercion.NONE) {
+                throw new Error(`${at}.coercion: converts a value READ from the source, and a LOCAL field is never loaded. Remove it.`);
+            }
+        }
+        if (owner === ExternalDataFieldOwner.LOCAL && entry.kind === ExternalDataMappingEntryKind.REMOTE_REFERENCE
+            && entry.unresolved !== ExternalDataUnresolvedReferencePolicy.LEAVE_PENDING) {
+            throw new Error(`${at}.unresolved: rejects a row being LOADED, and a LOCAL reference is never loaded. Remove it.`);
+        }
+        if (declaration.partitionUnitLocalField !== undefined && entry.localField === declaration.partitionUnitLocalField) {
+            throw new Error(`${at}: '${entry.localField}' is the partitionUnitLocalField, which the engine derives; it is never sent as a field.`);
+        }
+        if (declaration.partitionKeyLocalField !== undefined && entry.localField === declaration.partitionKeyLocalField) {
+            throw new Error(`${at}: '${entry.localField}' is the partitionKeyLocalField, which the engine stamps; it is never sent as a field.`);
+        }
+    }
+}
+/**
+ * The schema-INDEPENDENT coherence of an OUTBOUND pipeline (#1690); the destination-schema half (the sent fields are
+ * the application's own and writable, the remote key accepts absence) is the resource factory's, and what needs the
+ * system of record (the dialect can write, the facet's write prerequisites, the partition) is the resources
+ * registry's, at startup. Every refusal names a declaration that would either send nothing or send something the
+ * author cannot see.
+ */
+function assertExternalDataOutboundPipelineCoherence(declaration) {
+    const opened = declaration.binding.writableVerbs;
+    if (opened.length === 0) {
+        throw new Error("binding.writableVerbs: an OUTBOUND pipeline sends writes, so its binding must open them — CREATE for a row with no remote key "
+            + 'yet, UPDATE for one that has one. Declare the verbs this pipeline may send.');
+    }
+    // A row reaches the system of record by being CREATED there; its remote key comes only from that answer. An
+    // update-only pipeline would therefore never have a key to update, and would send nothing, ever.
+    if (!opened.includes(HttpApiWriteVerb.CREATE)) {
+        throw new Error('binding.writableVerbs: an OUTBOUND pipeline must open CREATE — a local row gets its remote key only from the create that sends it, '
+            + 'so an update-only pipeline would never have a key to update.');
+    }
+    /*
+     * Fail closed until an erasure reaches what an outbound pipeline SENT (#2030). A system of record receiving rows about
+     * people is their RECIPIENT, and nothing on the erasure path reaches the copy it holds yet — so the only stance this
+     * direction may declare is NO_SUBJECT_DATA, which the factory refuses beside any sent field declaring a personal-data
+     * category (#2010). Lifted by #2030, which wires the other two stances for sent rows.
+     */
+    if (declaration.binding.erasure.stance !== HttpApiErasureStance.NO_SUBJECT_DATA) {
+        throw new Error(`binding.erasure: '${declaration.binding.erasure.stance}' promises what a subject erasure does to the records this pipeline sends, and `
+            + `no erasure reaches an OUTBOUND pipeline's records yet (#2030). Declare '${HttpApiErasureStance.NO_SUBJECT_DATA}' and send no field that `
+            + 'describes a person.');
+    }
+    const refusedVerbs = opened.filter((verb) => !EXTERNAL_DATA_OUTBOUND_WRITE_VERBS.has(verb));
+    if (refusedVerbs.length > 0) {
+        throw new Error(`binding.writableVerbs: ${refusedVerbs.join(', ')} cannot be sent by an OUTBOUND pipeline. It sends a create for a row the system `
+            + 'of record does not have yet and an update for one it has; a local delete is never sent, because removing a record of the system '
+            + "of record is its operator's decision, not the side effect of a local edit.");
+    }
+    /*
+     * VERSION_CHECKED compares a version a CALLER read with the remote's. An outbound pass has no caller who read the
+     * remote row — it sends what the application holds — so the only honest stance is LAST_WRITER_WINS. Detecting that
+     * the remote changed since the last pass is a conflict, and deciding it is the BIDIRECTIONAL direction's (#1723).
+     */
+    if (declaration.binding.writeConcurrency?.mode === HttpApiWriteConcurrencyMode.VERSION_CHECKED) {
+        throw new Error(`binding.writeConcurrency: '${HttpApiWriteConcurrencyMode.VERSION_CHECKED}' compares a version a caller read, and an OUTBOUND pass `
+            + `sends what the application holds without reading the remote row first for a caller. Declare '${HttpApiWriteConcurrencyMode.LAST_WRITER_WINS}': `
+            + 'the local row is the source. A row changed on both sides needs a conflict policy, which is a different direction.');
+    }
+    const inboundOnly = [
+        ['sourceFilter', declaration.sourceFilter],
+        ['incremental', declaration.incremental],
+        ['archivedRecords', declaration.archivedRecords],
+        ['partitionKeyLocalField', declaration.partitionKeyLocalField],
+    ];
+    for (const [field, value] of inboundOnly) {
+        if (value !== undefined) {
+            throw new Error(`${field}: describes READING a source, and an OUTBOUND pipeline reads none — it sends the destination's rows. Remove it.`
+                + (field === 'partitionKeyLocalField'
+                    ? ' The partition a created row lands in is derived at send time from the row\'s organization unit (partitionUnitLocalField).'
+                    : ''));
+        }
+    }
+    const localTargets = new Set();
+    for (const entry of declaration.mapping) {
+        const at = `mapping('${entry.localField}')`;
+        if (!EXTERNAL_DATA_OUTBOUND_MAPPING_ENTRY_KINDS.has(entry.kind)) {
+            throw new Error(`${at}: a '${entry.kind}' entry derives a local value from remote ones and has no inverse, so an OUTBOUND pipeline cannot send `
+                + `it. Declare '${ExternalDataMappingEntryKind.REMOTE_FIELD}' (a local field sent as one remote field) or `
+                + `'${ExternalDataMappingEntryKind.REMOTE_REFERENCE}' (a local foreign key sent as its target's remote key).`);
+        }
+        if (localTargets.has(entry.localField)) {
+            throw new Error(`mapping: local field '${entry.localField}' is sent by more than one entry — one remote field per local field.`);
+        }
+        localTargets.add(entry.localField);
+        if (entry.localField === declaration.remoteKeyLocalField) {
+            throw new Error(`${at}: '${entry.localField}' is the remoteKeyLocalField, which holds the remote key and is never sent as a field.`);
+        }
+        if (declaration.partitionUnitLocalField !== undefined && entry.localField === declaration.partitionUnitLocalField) {
+            throw new Error(`${at}: '${entry.localField}' is the partitionUnitLocalField — the partition a created row lands in is derived from it at send time, `
+                + 'never sent as a field.');
+        }
+        if (entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD && entry.required) {
+            throw new Error(`${at}.required: rejects a row whose REMOTE value is absent when it is loaded, and an OUTBOUND pipeline loads nothing. A local `
+                + 'field that must have a value says so on the destination schema, where every caller write is checked. Remove it.');
+        }
+        if (entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD && entry.coercion !== ExternalDataFieldCoercion.NONE) {
+            throw new Error(`${at}.coercion: '${entry.coercion}' converts a value READ from the source, and an OUTBOUND pipeline reads nothing. The write `
+                + "dialect sends each value in the vendor's own form (an Odoo datetime as 'YYYY-MM-DD HH:MM:SS'). Remove it.");
+        }
+        if (entry.kind === ExternalDataMappingEntryKind.REMOTE_REFERENCE) {
+            if (entry.unresolved !== ExternalDataUnresolvedReferencePolicy.LEAVE_PENDING) {
+                throw new Error(`${at}.unresolved: '${entry.unresolved}' rejects a row being LOADED, and an OUTBOUND pipeline loads none. A row whose reference `
+                    + 'target has no remote key yet waits for a later pass, which is the only behaviour that sends it once it can be.');
+            }
+            /*
+             * `orphanCascadeAcknowledged` is ADMITTED here and means what it means inbound: the deletion it acknowledges is
+             * caused by the TARGET's pipeline (its orphan policy DELETE, cascading through this relationship's
+             * `onParentDelete`), which reaches an outbound destination's own rows just the same — the startup check
+             * (`describeExternalDataRemoteReferenceViolations`) demands it on either direction. It was refused here once, on
+             * the false ground that an outbound pipeline "causes none"; that left an author no way to state the intent the
+             * startup check asks for.
+             */
+            if (entry.valueShape === ExternalDataRemoteReferenceValueShape.ODOO_MANY2ONE
+                && declaration.binding.dialect !== HttpApiTransportDialect.ODOO_JSONRPC) {
+                throw new Error(`${at}.valueShape: '${ExternalDataRemoteReferenceValueShape.ODOO_MANY2ONE}' is Odoo's many2one and is refused on a ${declaration.binding.dialect} target — declare '${ExternalDataRemoteReferenceValueShape.SCALAR}'.`);
+            }
+        }
+    }
+}
 //# sourceMappingURL=external-data-pipeline.shared.schemas.js.map