@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/errors/errors.custom-message-ref.shared.definitions.js

@@ -189,6 +189,205 @@ export var ErrorCustomMessageReference;
     ErrorCustomMessageReference["CONSUMABLE_TOKEN_FILE_SHARING_DISABLED"] = "consumable_token_file_sharing_disabled";
     /** W7.3b: ADDITIVE policy requires x-consumable-token header alongside JWT/API-key auth. */
     ErrorCustomMessageReference["ADDITIVE_TOKEN_REQUIRED"] = "additive_token_required";
+    /** revocation-B1: requested one-off session `expiresIn` exceeds this user type's max-duration cap. */
+    ErrorCustomMessageReference["ONE_OFF_SESSION_DURATION_EXCEEDS_MAX"] = "one_off_session_duration_exceeds_max";
+    // Invitation acceptance / registration errors (user-directed)
+    /** Transient failure verifying the invitation's organization during accept; the single-use token is NOT consumed, so the invitee can safely retry. */
+    ErrorCustomMessageReference["INVITATION_ORG_VERIFICATION_FAILED"] = "invitation_org_verification_failed";
+    /** The organization is directory-managed (SCIM): no local credential (password/passkey/magic-link) can be set. The invitee must sign in via SSO. */
+    ErrorCustomMessageReference["AUTHENTICATION_SCIM_LOCAL_CREDENTIAL_BLOCKED"] = "authentication_scim_local_credential_blocked";
+    /**
+     * The invitation link cannot be used: it is unrecognised, has expired, was already used, or the
+     * invitation itself is no longer active. Ask the inviting administrator to send a new invitation.
+     *
+     * DELIBERATELY UNIFORM across every cause (unrecognised / expired / already-consumed token, wrong
+     * token type, missing invitation reference, non-INVITED or orphaned membership, or a revoke that
+     * raced the accept). All three PUBLIC token-based endpoints (`getInvitationInfo`,
+     * `acceptInvitation`, `rejectInvitation`) throw THIS single reference — and all throw
+     * `ErrorType.AUTHENTICATION` — so a token holder cannot distinguish "unrecognised token" from
+     * "recognised-but-superseded invite". A `customMessageReference` is a top-level field that SURVIVES
+     * error sanitization (unlike `context.message`), so a per-cause sibling WOULD be client-visible and
+     * would re-open that oracle: do NOT add one for those endpoints. The granular cause belongs in the
+     * backend logs. (Authenticated, ownership-gated in-app paths may use granular references — they are
+     * gated by userId, not token possession, so they leak nothing.)
+     */
+    ErrorCustomMessageReference["INVITATION_NO_LONGER_VALID"] = "invitation_no_longer_valid";
+    /** The invitation is addressed to a different account than the authenticated caller. */
+    ErrorCustomMessageReference["INVITATION_NOT_ADDRESSED_TO_CALLER"] = "invitation_not_addressed_to_caller";
+    /** The invitee already has an account: accept without setting a password, then sign in with the existing login method. */
+    ErrorCustomMessageReference["INVITATION_EXISTING_ACCOUNT_NO_PASSWORD"] = "invitation_existing_account_no_password";
+    /** Self-service registration is disabled for this application / frontend service / user type. */
+    ErrorCustomMessageReference["REGISTRATION_DISABLED"] = "registration_disabled";
+    /** Registration is by invitation only; a valid invitation is required to create an account. */
+    ErrorCustomMessageReference["REGISTRATION_INVITATION_ONLY"] = "registration_invitation_only";
+    /** Registration for this user type is admin-provisioned only: accounts are created by an administrator, so there is no self-service sign-up or invitation-accept path. Distinct from REGISTRATION_DISABLED (registration off entirely) and REGISTRATION_INVITATION_ONLY (self-complete via an invitation token). */
+    ErrorCustomMessageReference["REGISTRATION_ADMIN_ONLY"] = "registration_admin_only";
+    /** A password is required to complete this registration. */
+    ErrorCustomMessageReference["REGISTRATION_PASSWORD_REQUIRED"] = "registration_password_required";
+    /** Registration could not be completed due to a transient server error; the user may retry. */
+    ErrorCustomMessageReference["REGISTRATION_FAILED"] = "registration_failed";
+    /** The account exists but cannot be activated in its current state. */
+    ErrorCustomMessageReference["ACCOUNT_ACTIVATION_NOT_ALLOWED"] = "account_activation_not_allowed";
+    // Auth / session flow errors (user-directed) — added with the i18n-bypass remediation
+    /** A first authentication factor must be completed before this step. */
+    ErrorCustomMessageReference["AUTHENTICATION_FIRST_FACTOR_REQUIRED"] = "authentication_first_factor_required";
+    /** Magic-link authentication is disabled for this application. */
+    ErrorCustomMessageReference["AUTHENTICATION_MAGIC_LINK_DISABLED"] = "authentication_magic_link_disabled";
+    /** No verified phone number is available for SMS one-time-passcode delivery. */
+    ErrorCustomMessageReference["AUTHENTICATION_NO_VERIFIED_PHONE"] = "authentication_no_verified_phone";
+    /** The current session state does not allow completing organization onboarding. */
+    ErrorCustomMessageReference["AUTHENTICATION_ONBOARDING_STATE_INVALID"] = "authentication_onboarding_state_invalid";
+    /** The session was lost after magic-link verification; the user must restart sign-in. */
+    ErrorCustomMessageReference["AUTHENTICATION_SESSION_LOST"] = "authentication_session_lost";
+    /** The session carries no associated email address. */
+    ErrorCustomMessageReference["AUTHENTICATION_SESSION_NO_EMAIL"] = "authentication_session_no_email";
+    /** The session carries no associated user id. */
+    ErrorCustomMessageReference["AUTHENTICATION_SESSION_NO_USER"] = "authentication_session_no_user";
+    /** SMS one-time-passcode authentication is disabled for this application. */
+    ErrorCustomMessageReference["AUTHENTICATION_SMS_OTP_DISABLED"] = "authentication_sms_otp_disabled";
+    /** The refresh-token cookie is missing from the request. */
+    ErrorCustomMessageReference["AUTHENTICATION_REFRESH_TOKEN_REQUIRED"] = "authentication_refresh_token_required";
+    /** The userId in the URL does not match the authenticated user. */
+    ErrorCustomMessageReference["AUTHORIZATION_USER_ID_MISMATCH"] = "authorization_user_id_mismatch";
+    /**
+     * The scope in the URL (e.g. `/organizations/{id}/…`) does not match the authenticated MACHINE
+     * token's bound scope. Symmetric with {@link AUTHORIZATION_USER_ID_MISMATCH} for the machine arm:
+     * a machine token is bound to exactly one org/app, so a URL naming a different scope is rejected —
+     * this prevents the token's context map (URL-derived) from scoping a query to a different tenant
+     * than the token authorizes.
+     */
+    ErrorCustomMessageReference["AUTHORIZATION_MACHINE_SCOPE_MISMATCH"] = "authorization_machine_scope_mismatch";
+    // MFA flow errors (user-directed)
+    /** The current session state does not allow completing MFA enrollment. */
+    ErrorCustomMessageReference["MFA_ENROLLMENT_STATE_INVALID"] = "mfa_enrollment_state_invalid";
+    /** No MFA method is enrolled for this account yet. */
+    ErrorCustomMessageReference["MFA_NOT_ENROLLED"] = "mfa_not_enrolled";
+    /** A TOTP authenticator is already enrolled for this account. */
+    ErrorCustomMessageReference["MFA_TOTP_ALREADY_ENROLLED"] = "mfa_totp_already_enrolled";
+    /** The provided TOTP code did not verify. */
+    ErrorCustomMessageReference["MFA_TOTP_CODE_INVALID"] = "mfa_totp_code_invalid";
+    /** No pending TOTP setup exists; enrollment must be initiated first. */
+    ErrorCustomMessageReference["MFA_TOTP_SETUP_NOT_INITIATED"] = "mfa_totp_setup_not_initiated";
+    // Config / request-contract errors (user-directed)
+    /** The organization name is required. */
+    ErrorCustomMessageReference["ORG_NAME_REQUIRED"] = "org_name_required";
+    /**
+     * An organization unit cannot be deleted because child units still hang off it.
+     *
+     * Emitted as `ErrorType.CONFLICT` (409). CONFLICT is one of the few error types that expose
+     * `context` to the client, so the blocking dependent is surfaced by name — `blockingChildUnitId`
+     * when a child unit blocks, `blockingUnitMemberId` when a member assignment does. TWO distinct
+     * dependents share this one code; branch on the context key, not on the message.
+     *
+     * Unlike every other `ORGANIZATIONS` child, the unit tree's self-edge
+     * (`ORGANIZATION_UNITS -> ORGANIZATION_UNITS` on `parentUnitId`) declares NO `onParentDelete`
+     * cascade, so deleting an interior node would strand its whole subtree behind a dangling
+     * `parentUnitId` and a stale materialized `path`.
+     *
+     * MOVE is the remedy to point a client at: it re-parents a child onto another node and rewrites
+     * the materialized `path` of its whole subtree in one transaction. (Deleting the subtree
+     * bottom-up also works, leaf by leaf.) Since `parentUnitId` became `.excludeFromUpdate()` in the
+     * same pass that implemented MOVE, MOVE is the ONLY way to re-home a branch — so do not describe
+     * a plain update as an alternative.
+     *
+     * ⚠️ Direct per-unit DELETE only. Deleting the whole ORGANIZATION is a different path: that
+     * cascade IS enabled and removes every unit of the tenant at once (every unit carries the
+     * tenant's `organizationId`), and it runs at the repository level, so this guard is correctly
+     * not consulted there.
+     */
+    ErrorCustomMessageReference["ORGANIZATION_UNIT_HAS_DEPENDENTS"] = "organization_unit_has_dependents";
+    /**
+     * A MOVE names a destination inside the moved unit's own subtree — one of its descendants, or the
+     * unit itself. Either detaches the branch into a cycle: a node below its own descendant has no
+     * route back to the root.
+     *
+     * Distinct from {@link ORGANIZATION_UNIT_CONFLICT}: this one names the re-parenting operation, so
+     * an API client can branch on "the destination is illegal" without re-deriving it from a generic
+     * update conflict. Distinct from {@link ORGANIZATION_UNIT_CODE_EXISTS}, which a MOVE can also
+     * raise: there the destination is legal and the unit's own `code` is what collides, so renaming
+     * the unit is a remedy that picking another destination is not.
+     */
+    ErrorCustomMessageReference["ORGANIZATION_UNIT_MOVE_CONFLICT"] = "organization_unit_move_conflict";
+    /**
+     * An archive/restore is not a legal transition from the node's current state — already archived;
+     * not archived; or a restore whose parent branch is still archived.
+     *
+     * Sibling-code collisions are NOT reported here; they carry
+     * {@link ORGANIZATION_UNIT_CODE_EXISTS}, which names the taken value.
+     */
+    ErrorCustomMessageReference["ORGANIZATION_UNIT_CONFLICT"] = "organization_unit_conflict";
+    /**
+     * A lifecycle verb was invoked from a state it may not transition out of — suspending an
+     * already-suspended row, reactivating one that was never suspended, deactivating a terminal
+     * account.
+     *
+     * Raised by the shared status-transition implementation
+     * (`createResourceStatusTransitionFactory`) and therefore resource-agnostic by design: the same
+     * reference covers organizations, organization members, and users, because "this is not a legal
+     * transition from the current state" is one API-visible outcome regardless of which state machine
+     * refused it. The error context names the resource, operation, current status and permitted
+     * source statuses, so a client has everything it needs without a per-resource reference.
+     *
+     * Distinct from a generic {@link CONFLICT}: a client can branch on "the row is in the wrong state
+     * for this verb" and re-read to show the real state, rather than treating it as an opaque clash.
+     *
+     * NOTE: most of these transitions ALSO declare an `enabledCondition`, which rejects the same
+     * situation earlier with `SERVICE_RESOURCE_OPERATION_DISABLED`. This reference covers the cases
+     * that gate cannot: a transition reached through a non-URL path, and the re-check the
+     * implementation performs against the row it actually loaded.
+     */
+    ErrorCustomMessageReference["RESOURCE_STATUS_TRANSITION_CONFLICT"] = "resource_status_transition_conflict";
+    /**
+     * A unit `code` is already used by a sibling under the same parent.
+     *
+     * Sibling-scoped, not org-wide: two teams called `sales` under different divisions are a
+     * legitimate org chart, so the identity is (`organizationId`, `parentUnitId`, `code`). Units
+     * carrying no `code` at all are unconstrained — any number of them may sit under one parent.
+     *
+     * Raised by every operation that can introduce the collision (CREATE, UPDATE rename, MOVE) and by
+     * the database unique index that backs them. Those must agree: the index cannot know which
+     * operation was running, so an operation-specific code would make the SAME condition report
+     * differently depending on which write won a race.
+     */
+    ErrorCustomMessageReference["ORGANIZATION_UNIT_CODE_EXISTS"] = "organization_unit_code_exists";
+    /**
+     * The requested organization `slug` is already taken.
+     *
+     * The slug is the tenant's URL-safe identity and is `.excludeFromUpdate()` — creation-time
+     * identity, not an editable label. That is why this must be refused at CREATE rather than
+     * reconciled later: a collision that got written could not be resolved through the API at all.
+     *
+     * Raised by the database unique index on `slug`. Uniqueness is collection-wide, which IS
+     * per-application: an application's organizations live in that application's own database.
+     */
+    ErrorCustomMessageReference["ORGANIZATION_SLUG_EXISTS"] = "organization_slug_exists";
+    /**
+     * The requested application `appSlug` is already taken.
+     *
+     * GLOBAL across the platform, deliberately NOT compounded with `organizationId`, even though
+     * `wildoApplication` is an organization-scoped resource. The slug is not a label — it is the sole
+     * input, alongside the environment id, from which every provisioned backing resource takes its
+     * name: `buildApplicationNamespace(appSlug, environmentId)` (no organization component), and from
+     * it the application database, the database username and the RabbitMQ vhost. Two applications
+     * sharing a slug in DIFFERENT organizations would therefore be handed the same database and the
+     * same vhost.
+     *
+     * Raised by the database unique index on `appSlug`, and reachable only at CREATE: the field is
+     * `.excludeFromUpdate()`, so it is creation-time identity rather than an editable name.
+     *
+     * Added 2026-08-19 after the absence of this constraint let a second live `wonder-todos` row be
+     * inserted beside the first. The upsert looks up `{ appSlug }` but the repository applies the
+     * resource's contextual primary-scope filter, so once the platform organization was re-minted the
+     * lookup could no longer see the existing row and INSERTED rather than resolved. The orphaned
+     * lineage then kept publishing into the queues of an application that was no longer live, which
+     * surfaced only as a RabbitMQ `403 ACCESS_REFUSED` — never as anything naming a duplicate.
+     */
+    ErrorCustomMessageReference["APPLICATION_SLUG_EXISTS"] = "application_slug_exists";
+    /** The client must send the X-Frontend-Service-Name header. */
+    ErrorCustomMessageReference["FRONTEND_SERVICE_HEADER_REQUIRED"] = "frontend_service_header_required";
+    // Webhook errors (user-directed)
+    /** Inbound webhook signature verification failed. */
+    ErrorCustomMessageReference["WEBHOOK_SIGNATURE_INVALID"] = "webhook_signature_invalid";
     // Billing errors
     ErrorCustomMessageReference["BILLING_NOT_INITIALIZED"] = "billing_not_initialized";
     ErrorCustomMessageReference["BILLING_ACCOUNT_NOT_FOUND"] = "billing_account_not_found";
@@ -211,7 +410,32 @@ export var ErrorCustomMessageReference;
     ErrorCustomMessageReference["BILLING_CREDIT_POOL_NOT_FOUND"] = "billing_credit_pool_not_found";
     ErrorCustomMessageReference["BILLING_PROMOTION_INVALID"] = "billing_promotion_invalid";
     ErrorCustomMessageReference["BILLING_PRODUCT_SCOPE_MISMATCH"] = "billing_product_scope_mismatch";
+    /**
+     * A purchase named a product and a price that do not belong together.
+     *
+     * `Price.productId` is a declared foreign key, so every price already knows its product. The
+     * purchase paths, however, used to resolve the two INDEPENDENTLY — product by key, price by id —
+     * and never consulted that FK. The provider is billed the price while the local subscription item
+     * records the product, and entitlements derive from the product: a caller pairing a premium
+     * product key with a cheap price id therefore received premium entitlements at the cheap price.
+     *
+     * Raised as `ErrorType.VALIDATION` (400) — the payload is internally inconsistent, not unauthorized.
+     */
+    ErrorCustomMessageReference["BILLING_PRICE_PRODUCT_MISMATCH"] = "billing_price_product_mismatch";
     ErrorCustomMessageReference["BILLING_SCOPE_NOT_ENABLED"] = "billing_scope_not_enabled";
+    /**
+     * Hard removal of a billing account was refused because retained financial children
+     * (subscriptions / invoice refs / usage records / credit pools) still reference it.
+     *
+     * Emitted as `ErrorType.CONFLICT` (409). CONFLICT is one of the few error types that
+     * expose `context` to the client, so the blocking child families are surfaced by name.
+     *
+     * @see the billing-retention rationale at the `Scope -> BillingAccounts` declaration in
+     * `resources-registry.shared.core.definitions.ts` — the children are RETAINED on purpose,
+     * and this account row holds the only local `providerCustomerId` that maps them back to
+     * the provider customer.
+     */
+    ErrorCustomMessageReference["BILLING_ACCOUNT_HAS_DEPENDENTS"] = "billing_account_has_dependents";
     // SAML Protocol Engine errors (AUTH-2)
     ErrorCustomMessageReference["SAML_ASSERTION_INVALID"] = "saml_assertion_invalid";
     ErrorCustomMessageReference["SAML_SIGNATURE_INVALID"] = "saml_signature_invalid";
@@ -244,5 +468,137 @@ export var ErrorCustomMessageReference;
     ErrorCustomMessageReference["AGGREGATION_FIELD_ACCESS_DENIED"] = "aggregation_field_access_denied";
     ErrorCustomMessageReference["AGGREGATION_COMPUTED_EXPRESSION_ERROR"] = "aggregation_computed_expression_error";
     ErrorCustomMessageReference["AGGREGATION_JOIN_ACCESS_DENIED"] = "aggregation_join_access_denied";
+    /** User lacks permission to view a chart's aggregated data (missing LIST access, chart role restriction, or insufficient roles). */
+    ErrorCustomMessageReference["AGGREGATION_ACCESS_DENIED"] = "aggregation_access_denied";
+    /** A required scope/context value (org id, user id, unknown primary scope, or context-filter value) could not be resolved to authorize the aggregation. */
+    ErrorCustomMessageReference["AGGREGATION_SCOPE_UNRESOLVED"] = "aggregation_scope_unresolved";
+    /** A context filter conflicts with or would override the enforced primary-scope lock on the aggregation. */
+    ErrorCustomMessageReference["AGGREGATION_SCOPE_CONFLICT"] = "aggregation_scope_conflict";
+    /** Aggregation execution requires an executionContext unless skipAuthorization is explicitly enabled. */
+    ErrorCustomMessageReference["AGGREGATION_EXECUTION_CONTEXT_REQUIRED"] = "aggregation_execution_context_required";
+    // Agent / flows-actors errors (user-directed)
+    /** Selected AI provider/protocol is not enabled in application configuration. */
+    ErrorCustomMessageReference["AGENT_PROVIDER_NOT_ENABLED"] = "agent_provider_not_enabled";
+    /** Provider not found or its LLM runtime contract is unavailable. */
+    ErrorCustomMessageReference["AGENT_PROVIDER_NOT_FOUND"] = "agent_provider_not_found";
+    /** Requested agent operation key is not supported by the provider/runtime. */
+    ErrorCustomMessageReference["AGENT_OPERATION_NOT_SUPPORTED"] = "agent_operation_not_supported";
+    /** Image provider client does not expose image generation. */
+    ErrorCustomMessageReference["AGENT_IMAGE_GENERATION_NOT_SUPPORTED"] = "agent_image_generation_not_supported";
+    /** Image generation requires a non-empty prompt on the invocation input. */
+    ErrorCustomMessageReference["AGENT_IMAGE_PROMPT_REQUIRED"] = "agent_image_prompt_required";
+    /** CLI runtime returned output that was missing, malformed, or failed schema validation. */
+    ErrorCustomMessageReference["AGENT_CLI_OUTPUT_INVALID"] = "agent_cli_output_invalid";
+    /** Structured-generation operation requires a Zod schema on the invocation input. */
+    ErrorCustomMessageReference["AGENT_STRUCTURED_SCHEMA_REQUIRED"] = "agent_structured_schema_required";
+    /** AI provider client does not support any known model initialization pattern. */
+    ErrorCustomMessageReference["AGENT_MODEL_INITIALIZATION_FAILED"] = "agent_model_initialization_failed";
+    /** No messages provided for the (multimodal) chat completion. */
+    ErrorCustomMessageReference["AGENT_MESSAGES_REQUIRED"] = "agent_messages_required";
+    /** The referenced agent is not active. */
+    ErrorCustomMessageReference["AGENT_NOT_ACTIVE"] = "agent_not_active";
+    /** The referenced system is not a flow. */
+    ErrorCustomMessageReference["FLOW_INVALID_KIND"] = "flow_invalid_kind";
+    /** The referenced flow is not active. */
+    ErrorCustomMessageReference["FLOW_NOT_ACTIVE"] = "flow_not_active";
+    /** The referenced system is not an actor. */
+    ErrorCustomMessageReference["ACTOR_INVALID_KIND"] = "actor_invalid_kind";
+    /** The referenced actor is not active. */
+    ErrorCustomMessageReference["ACTOR_NOT_ACTIVE"] = "actor_not_active";
+    /** Chart parent context resource is not accessible to the caller. */
+    ErrorCustomMessageReference["CHART_PARENT_CONTEXT_INACCESSIBLE"] = "chart_parent_context_inaccessible";
+    // Auth-methods / SSO errors (user-directed)
+    /** Authentication is disabled for this frontend service + user type (a config gate, NOT session invalidation). */
+    ErrorCustomMessageReference["AUTHENTICATION_DISABLED_FOR_SERVICE"] = "authentication_disabled_for_service";
+    /** The requested OAuth2/social provider is not registered or available. */
+    ErrorCustomMessageReference["OAUTH_PROVIDER_NOT_FOUND"] = "oauth_provider_not_found";
+    /** The requested SSO connection was not found or is disabled. */
+    ErrorCustomMessageReference["SSO_CONNECTION_NOT_FOUND"] = "sso_connection_not_found";
+    // Config / data-seeding / email errors (user-directed)
+    /** The frontendServiceName query parameter is required to fetch application configuration. */
+    ErrorCustomMessageReference["APP_CONFIGURATION_FRONTEND_SERVICE_REQUIRED"] = "app_configuration_frontend_service_required";
+    /** The frontendServiceName does not match any configured frontend service identity. */
+    ErrorCustomMessageReference["APP_CONFIGURATION_UNKNOWN_FRONTEND_SERVICE"] = "app_configuration_unknown_frontend_service";
+    /** The data-seeding admin endpoint secret header is missing. */
+    ErrorCustomMessageReference["SEED_ADMIN_SECRET_REQUIRED"] = "seed_admin_secret_required";
+    /** The data-seeding admin endpoint secret header did not match. */
+    ErrorCustomMessageReference["SEED_ADMIN_SECRET_INVALID"] = "seed_admin_secret_invalid";
+    /** Invalid query parameters for the data-seeding admin list-runs endpoint. */
+    ErrorCustomMessageReference["SEED_ADMIN_INVALID_QUERY"] = "seed_admin_invalid_query";
+    /** Invalid request body for the data-seeding admin rerun endpoint. */
+    ErrorCustomMessageReference["SEED_ADMIN_INVALID_PAYLOAD"] = "seed_admin_invalid_payload";
+    /** updateSeedMetadata targeted a row _id that does not exist for the resource. */
+    ErrorCustomMessageReference["REPOSITORY_RESOURCE_SEED_METADATA_NOT_FOUND"] = "repository_resource_seed_metadata_not_found";
+    /** Email recipient/cc/bcc/replyTo list contains an address that failed format validation. */
+    ErrorCustomMessageReference["EMAIL_INVALID_ADDRESS_FORMAT"] = "email_invalid_address_format";
+    // File operation errors (user-directed)
+    /** The requested file does not exist or is not accessible. */
+    ErrorCustomMessageReference["FILE_NOT_FOUND"] = "file_not_found";
+    /** File cannot move to the requested status from its current state. */
+    ErrorCustomMessageReference["FILE_INVALID_STATUS_TRANSITION"] = "file_invalid_status_transition";
+    /** File must be in UPLOADED status before it can be linked to a resource. */
+    ErrorCustomMessageReference["FILE_NOT_IN_UPLOADED_STATUS"] = "file_not_in_uploaded_status";
+    /** File is already linked to a different resource. */
+    ErrorCustomMessageReference["FILE_ALREADY_LINKED"] = "file_already_linked";
+    /** File has already been deleted. */
+    ErrorCustomMessageReference["FILE_ALREADY_DELETED"] = "file_already_deleted";
+    /** Access to the requested file is denied. */
+    ErrorCustomMessageReference["FILE_ACCESS_DENIED"] = "file_access_denied";
+    /** File cannot be deleted while the AV scan is in progress. */
+    ErrorCustomMessageReference["FILE_DELETE_WHILE_PROCESSING"] = "file_delete_while_processing";
+    /** A file linked to a resource cannot be deleted; unlink it first. */
+    ErrorCustomMessageReference["FILE_DELETE_LINKED_BLOCKED"] = "file_delete_linked_blocked";
+    /** Only the original uploader can delete this file. */
+    ErrorCustomMessageReference["FILE_DELETE_UPLOADER_ONLY"] = "file_delete_uploader_only";
+    /** The file share request body is invalid. */
+    ErrorCustomMessageReference["FILE_SHARE_REQUEST_INVALID"] = "file_share_request_invalid";
+    /** No file was provided in the upload request. */
+    ErrorCustomMessageReference["FILE_UPLOAD_NO_FILE"] = "file_upload_no_file";
+    /** Too many files provided for this field (exceeds the configured maximum). */
+    ErrorCustomMessageReference["FILE_TOO_MANY_FILES"] = "file_too_many_files";
+    /** This file field is system-generated and cannot receive uploads/writes. */
+    ErrorCustomMessageReference["FILE_GENERATED_FIELD_NOT_WRITABLE"] = "file_generated_field_not_writable";
+    /** This file field is not overridable; existing files cannot be replaced or removed. */
+    ErrorCustomMessageReference["FILE_FIELD_NOT_OVERRIDABLE"] = "file_field_not_overridable";
+    /** The file field value has an unexpected type (expected string, array, null, or undefined). */
+    ErrorCustomMessageReference["FILE_FIELD_VALUE_INVALID"] = "file_field_value_invalid";
+    /** A nested file field could not be updated safely because multiple array items changed at once. */
+    ErrorCustomMessageReference["FILE_NESTED_UPDATE_AMBIGUOUS"] = "file_nested_update_ambiguous";
+    /** uploadedBy and uploadedByEntityType must both be set or both omitted. */
+    ErrorCustomMessageReference["FILE_UPLOADER_FIELDS_INCONSISTENT"] = "file_uploader_fields_inconsistent";
+    /** Explicit uploader ownership does not match the current execution principal. */
+    ErrorCustomMessageReference["FILE_UPLOADER_MISMATCH"] = "file_uploader_mismatch";
+    /** A required scope identifier (application/organization/user id) is missing for this file operation. */
+    ErrorCustomMessageReference["FILE_SCOPE_IDENTIFIER_MISSING"] = "file_scope_identifier_missing";
+    /** The scope identifiers are invalid for the specified primary scope. */
+    ErrorCustomMessageReference["FILE_SCOPE_IDENTIFIER_INVALID"] = "file_scope_identifier_invalid";
+    /** The file access scope could not be derived from the execution context. */
+    ErrorCustomMessageReference["FILE_SCOPE_DERIVATION_FAILED"] = "file_scope_derivation_failed";
+    /** Text extraction is not supported for this file's MIME type. */
+    ErrorCustomMessageReference["FILE_TEXT_EXTRACTION_UNSUPPORTED_TYPE"] = "file_text_extraction_unsupported_type";
+    /**
+     * The file's MIME type IS supported, but its bytes could not be parsed — corrupt, truncated,
+     * or password-protected.
+     *
+     * Deliberately distinct from every storage/wiring failure that can also arise while extracting.
+     * This one is a permanent property of the BYTES, so a batch consumer may skip the file and move
+     * on; an unreachable storage backend is transient and must NOT be treated the same way. The RAG
+     * ingestion sweep branches on exactly this distinction — see `RagIngestionBackendService`.
+     */
+    ErrorCustomMessageReference["FILE_TEXT_EXTRACTION_FAILED"] = "file_text_extraction_failed";
+    /** The file's blob was not found in the storage backend. */
+    ErrorCustomMessageReference["FILE_NOT_FOUND_IN_STORAGE"] = "file_not_found_in_storage";
+    /** Access to the file in storage was denied. */
+    ErrorCustomMessageReference["FILE_STORAGE_ACCESS_DENIED"] = "file_storage_access_denied";
+    /** The storage key/path could not be composed (missing file name/id). */
+    ErrorCustomMessageReference["FILE_STORAGE_KEY_COMPOSITION_FAILED"] = "file_storage_key_composition_failed";
+    /** The provided storage reference is empty or invalid. */
+    ErrorCustomMessageReference["FILE_STORAGE_REF_INVALID"] = "file_storage_ref_invalid";
+    /** The storage reference does not belong to the current application namespace. */
+    ErrorCustomMessageReference["FILE_STORAGE_REF_FORBIDDEN"] = "file_storage_ref_forbidden";
+    /** The requested file path escapes the allowed storage directory. */
+    ErrorCustomMessageReference["FILE_PATH_TRAVERSAL_DETECTED"] = "file_path_traversal_detected";
+    /** A bulk relationship operation must provide either _ids or a filter selector. */
+    ErrorCustomMessageReference["BULK_RELATIONSHIP_SELECTOR_REQUIRED"] = "bulk_relationship_selector_required";
 })(ErrorCustomMessageReference || (ErrorCustomMessageReference = {}));
-//# sourceMappingURL=errors.custom-message-ref.shared.definitions.js.map
+//# sourceMappingURL=errors.custom-message-ref.shared.definitions.js.map

package/dist/esm/errors/errors.custom-message-ref.shared.definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.custom-message-ref.shared.definitions.js","sourceRoot":"","sources":["../../../src/errors/errors.custom-message-ref.shared.definitions.ts"],"names":[],"mappings":"AAGA,MAAM,CAAN,IAAY,2BAqSX;AArSD,WAAY,2BAA2B;IACrC,kDAAmB,CAAA;IACnB,gDAAiB,CAAA;IACjB,kDAAmB,CAAA;IACnB,gEAAiC,CAAA;IACjC,8DAA+B,CAAA;IAC/B,wDAAyB,CAAA;IACzB,sDAAuB,CAAA;IACvB,oDAAqB,CAAA;IACrB,wDAAyB,CAAA;IACzB,oDAAqB,CAAA;IACrB,oDAAqB,CAAA;IACrB,oEAAqC,CAAA;IACrC,kDAAmB,CAAA;IACnB,wEAAyC,CAAA;IACzC,0EAA2C,CAAA;IAC3C,8DAA+B,CAAA;IAC/B,gEAAiC,CAAA;IACjC,8DAA+B,CAAA;IAE/B,oCAAoC;IACpC,8GAA+E,CAAA;IAC/E,kGAAmE,CAAA;IAEnE,kGAAmE,CAAA;IACnE,0HAA2F,CAAA;IAE3F,4GAA6E,CAAA;IAC7E,sHAAuF,CAAA;IACvF,gHAAiF,CAAA;IACjF,8GAA+E,CAAA;IAE/E,8FAA+D,CAAA;IAE/D,yBAAyB;IACzB,sFAAuD,CAAA;IACvD,oFAAqD,CAAA;IACrD,4FAA6D,CAAA;IAC7D,oGAAqE,CAAA;IACrE,oFAAqD,CAAA;IAErD,wGAAyE,CAAA;IACzE,gHAAiF,CAAA;IACjF,4FAA6D,CAAA;IAC7D,sGAAuE,CAAA;IACvE,0GAA2E,CAAA;IAC3E,kHAAmF,CAAA;IAEnF,kHAAmF,CAAA;IAEnF,sFAAuD,CAAA;IACvD,oFAAqD,CAAA;IACrD,8FAA+D,CAAA;IAE/D,kFAAmD,CAAA;IACnD,gFAAiD,CAAA;IACjD,0FAA2D,CAAA;IAE3D,gHAAiF,CAAA;IACjF,gGAAiE,CAAA;IACjE,oGAAqE,CAAA;IAErE,oHAAqF,CAAA;IACrF,gHAAiF,CAAA;IAEjF,oIAAqG,CAAA;IAErG,8GAA+E,CAAA;IAC/E,kHAAmF,CAAA;IAEnF,sGAAuE,CAAA;IAEvE,kHAAmF,CAAA;IACnF,gHAAiF,CAAA;IACjF,oGAAqE,CAAA;IAErE,oGAAqE,CAAA;IACrE,oGAAqE,CAAA;IACrE,4FAA6D,CAAA;IAC7D,0GAA2E,CAAA;IAE3E,wEAAyC,CAAA;IACzC,kFAAmD,CAAA;IACnD,0FAA2D,CAAA;IAC3D,oFAAqD,CAAA;IACrD,sEAAuC,CAAA;IACvC,sEAAuC,CAAA;IACvC,0EAA2C,CAAA;IAC3C,gFAAiD,CAAA;IACjD,4EAA6C,CAAA;IAE7C,0EAA2C,CAAA;IAE3C,oJAAqH,CAAA;IACrH,sEAAuC,CAAA;IACvC,kFAAmD,CAAA;IACnD,0HAA2F,CAAA;IAC3F,8HAA+F,CAAA;IAC/F,sIAAuG,CAAA;IACvG,8FAA+D,CAAA;IAC/D,kGAAmE,CAAA;IACnE,8GAA+E,CAAA;IAE/E,gGAAiE,CAAA;IACjE,8FAA+D,CAAA;IAE/D,4FAA6D,CAAA;IAE7D,sHAAuF,CAAA;IAEvF,4GAA6E,CAAA;IAC7E,sHAAuF,CAAA;IACvF,oHAAqF,CAAA;IAErF,wFAAyD,CAAA;IACzD,wFAAyD,CAAA;IAEzD,kGAAmE,CAAA;IAEnE,8FAA+D,CAAA;IAC/D,gGAAiE,CAAA;IAEjE,wGAAyE,CAAA;IACzE,sHAAuF,CAAA;IACvF,kHAAmF,CAAA;IAEnF,kDAAkD;IAClD,gGAAiE,CAAA;IACjE,gGAAiE,CAAA;IACjE,8FAA+D,CAAA;IAC/D,0FAA2D,CAAA;IAC3D,4FAA4F;IAC5F,0FAA2D,CAAA;IAC3D,8FAA+D,CAAA;IAC/D,0GAA2E,CAAA;IAC3E,oHAAoH;IACpH,kGAAmE,CAAA;IACnE,mGAAmG;IACnG,sGAAuE,CAAA;IACvE,gGAAiE,CAAA;IACjE,wGAAwG;IACxG,oEAAqC,CAAA;IACrC,8GAA8G;IAC9G,8EAA+C,CAAA;IAE/C,gGAAiE,CAAA;IACjE,sGAAuE,CAAA;IAGvE,uBAAuB;IACvB,wHAAyF,CAAA;IAEzF,6BAA6B;IAC7B,wHAAyF,CAAA;IACzF,kIAAmG,CAAA;IACnG,kIAAmG,CAAA;IAEnG,qCAAqC;IACrC,8GAA+E,CAAA;IAC/E,4HAA6F,CAAA;IAC7F,wHAAyF,CAAA;IACzF,sHAAuF,CAAA;IACvF,kHAAmF,CAAA;IACnF,wHAAyF,CAAA;IACzF,sGAAuE,CAAA;IACvE,4HAA6F,CAAA;IAE7F,iFAAiF;IACjF,sFAAuD,CAAA;IAEvD,8CAA8C;IAC9C,8FAA+D,CAAA;IAC/D,4HAA6F,CAAA;IAC7F,wGAAyE,CAAA;IAEzE,+BAA+B;IAC/B,0GAA2E,CAAA;IAC3E,oGAAqE,CAAA;IACrE,gGAAiE,CAAA;IAEjE,6BAA6B;IAC7B,0FAA2D,CAAA;IAC3D,oEAAqC,CAAA;IAErC,0BAA0B;IAC1B,sFAAuD,CAAA;IACvD,oFAAqD,CAAA;IACrD,kGAAmE,CAAA;IAEnE,+GAA+G;IAC/G,4GAA6E,CAAA;IAE7E,mBAAmB;IACnB,kFAAmD,CAAA;IACnD,4EAA6C,CAAA;IAC7C,4EAA6C,CAAA;IAC7C,4EAA6C,CAAA;IAC7C,0FAA2D,CAAA;IAE3D,4EAA6C,CAAA;IAC7C,0DAA2B,CAAA;IAC3B,oFAAqD,CAAA;IACrD,sEAAuC,CAAA;IACvC,8EAA+C,CAAA;IAC/C,wFAAyD,CAAA;IACzD,4FAA6D,CAAA;IAC7D,8DAA+B,CAAA;IAC/B,8EAA+C,CAAA;IAC/C,8DAA+B,CAAA;IAE/B,kGAAmE,CAAA;IACnE,kGAAmE,CAAA;IACnE,wFAAyD,CAAA;IAEzD,4FAA6D,CAAA;IAC7D,8FAA+D,CAAA;IAC/D,kFAAmD,CAAA;IAEnD,wBAAwB;IACxB,8EAA+C,CAAA;IAC/C,gFAAiD,CAAA;IACjD,4EAA6C,CAAA;IAE7C,0BAA0B;IAC1B,wFAAyD,CAAA;IACzD,oFAAqD,CAAA;IACrD,sGAAuE,CAAA;IACvE,oFAAqD,CAAA;IACrD,gGAAiE,CAAA;IACjE,sGAAuE,CAAA;IACvE,0HAA2F,CAAA;IAC3F,kGAAmE,CAAA;IACnE,gHAAiF,CAAA;IACjF,4FAA4F;IAC5F,kFAAmD,CAAA;IAEnD,iBAAiB;IACjB,kFAAmD,CAAA;IACnD,sFAAuD,CAAA;IACvD,4FAA6D,CAAA;IAC7D,gGAAiE,CAAA;IACjE,gGAAiE,CAAA;IACjE,oGAAqE,CAAA;IACrE,sFAAuD,CAAA;IACvD,sFAAuD,CAAA;IACvD,kFAAmD,CAAA;IACnD,4FAA6D,CAAA;IAC7D,wFAAyD,CAAA;IACzD,sGAAuE,CAAA;IACvE,wFAAyD,CAAA;IACzD,8FAA+D,CAAA;IAC/D,8FAA+D,CAAA;IAC/D,wGAAyE,CAAA;IACzE,0FAA2D,CAAA;IAC3D,4FAA6D,CAAA;IAC7D,8FAA+D,CAAA;IAC/D,sFAAuD,CAAA;IACvD,gGAAiE,CAAA;IACjE,sFAAuD,CAAA;IAEvD,uCAAuC;IACvC,gFAAiD,CAAA;IACjD,gFAAiD,CAAA;IACjD,gFAAiD,CAAA;IACjD,4EAA6C,CAAA;IAC7C,4DAA6B,CAAA;IAC7B,oFAAqD,CAAA;IACrD,sEAAuC,CAAA;IACvC,gFAAiD,CAAA;IACjD,4EAA6C,CAAA;IAC7C,0FAA2D,CAAA;IAC3D,8EAA+C,CAAA;IAC/C,4EAA6C,CAAA;IAC7C,sFAAuD,CAAA;IACvD,oFAAqD,CAAA;IACrD,8EAA+C,CAAA;IAC/C,sFAAuD,CAAA;IACvD,0FAA2D,CAAA;IAC3D,wFAAyD,CAAA;IACzD,gGAAiE,CAAA;IACjE,wEAAyC,CAAA;IACzC,oEAAqC,CAAA;IACrC,sFAAuD,CAAA;IACvD,wHAAwH;IACxH,wEAAyC,CAAA;IAEzC,6BAA6B;IAC7B,kEAAmC,CAAA;IACnC,0EAA2C,CAAA;IAC3C,oGAAqE,CAAA;IACrE,kGAAmE,CAAA;IACnE,8GAA+E,CAAA;IAC/E,gGAAiE,CAAA;AACnE,CAAC,EArSW,2BAA2B,KAA3B,2BAA2B,QAqStC"}
+{"version":3,"file":"errors.custom-message-ref.shared.definitions.js","sourceRoot":"","sources":["../../../../src/errors/errors.custom-message-ref.shared.definitions.ts"],"names":[],"mappings":"AAGA,MAAM,CAAN,IAAY,2BAmpBX;AAnpBD,WAAY,2BAA2B;IACrC,kDAAmB,CAAA;IACnB,gDAAiB,CAAA;IACjB,kDAAmB,CAAA;IACnB,gEAAiC,CAAA;IACjC,8DAA+B,CAAA;IAC/B,wDAAyB,CAAA;IACzB,sDAAuB,CAAA;IACvB,oDAAqB,CAAA;IACrB,wDAAyB,CAAA;IACzB,oDAAqB,CAAA;IACrB,oDAAqB,CAAA;IACrB,oEAAqC,CAAA;IACrC,kDAAmB,CAAA;IACnB,wEAAyC,CAAA;IACzC,0EAA2C,CAAA;IAC3C,8DAA+B,CAAA;IAC/B,gEAAiC,CAAA;IACjC,8DAA+B,CAAA;IAE/B,oCAAoC;IACpC,8GAA+E,CAAA;IAC/E,kGAAmE,CAAA;IAEnE,kGAAmE,CAAA;IACnE,0HAA2F,CAAA;IAE3F,4GAA6E,CAAA;IAC7E,sHAAuF,CAAA;IACvF,gHAAiF,CAAA;IACjF,8GAA+E,CAAA;IAE/E,8FAA+D,CAAA;IAE/D,yBAAyB;IACzB,sFAAuD,CAAA;IACvD,oFAAqD,CAAA;IACrD,4FAA6D,CAAA;IAC7D,oGAAqE,CAAA;IACrE,oFAAqD,CAAA;IAErD,wGAAyE,CAAA;IACzE,gHAAiF,CAAA;IACjF,4FAA6D,CAAA;IAC7D,sGAAuE,CAAA;IACvE,0GAA2E,CAAA;IAC3E,kHAAmF,CAAA;IAEnF,kHAAmF,CAAA;IAEnF,sFAAuD,CAAA;IACvD,oFAAqD,CAAA;IACrD,8FAA+D,CAAA;IAE/D,kFAAmD,CAAA;IACnD,gFAAiD,CAAA;IACjD,0FAA2D,CAAA;IAE3D,gHAAiF,CAAA;IACjF,gGAAiE,CAAA;IACjE,oGAAqE,CAAA;IAErE,oHAAqF,CAAA;IACrF,gHAAiF,CAAA;IAEjF,oIAAqG,CAAA;IAErG,8GAA+E,CAAA;IAC/E,kHAAmF,CAAA;IAEnF,sGAAuE,CAAA;IAEvE,kHAAmF,CAAA;IACnF,gHAAiF,CAAA;IACjF,oGAAqE,CAAA;IAErE,oGAAqE,CAAA;IACrE,oGAAqE,CAAA;IACrE,4FAA6D,CAAA;IAC7D,0GAA2E,CAAA;IAE3E,wEAAyC,CAAA;IACzC,kFAAmD,CAAA;IACnD,0FAA2D,CAAA;IAC3D,oFAAqD,CAAA;IACrD,sEAAuC,CAAA;IACvC,sEAAuC,CAAA;IACvC,0EAA2C,CAAA;IAC3C,gFAAiD,CAAA;IACjD,4EAA6C,CAAA;IAE7C,0EAA2C,CAAA;IAE3C,oJAAqH,CAAA;IACrH,sEAAuC,CAAA;IACvC,kFAAmD,CAAA;IACnD,0HAA2F,CAAA;IAC3F,8HAA+F,CAAA;IAC/F,sIAAuG,CAAA;IACvG,8FAA+D,CAAA;IAC/D,kGAAmE,CAAA;IACnE,8GAA+E,CAAA;IAE/E,gGAAiE,CAAA;IACjE,8FAA+D,CAAA;IAE/D,4FAA6D,CAAA;IAE7D,sHAAuF,CAAA;IAEvF,4GAA6E,CAAA;IAC7E,sHAAuF,CAAA;IACvF,oHAAqF,CAAA;IAErF,wFAAyD,CAAA;IACzD,wFAAyD,CAAA;IAEzD,kGAAmE,CAAA;IAEnE,8FAA+D,CAAA;IAC/D,gGAAiE,CAAA;IAEjE,wGAAyE,CAAA;IACzE,sHAAuF,CAAA;IACvF,kHAAmF,CAAA;IAEnF,kDAAkD;IAClD,gGAAiE,CAAA;IACjE,gGAAiE,CAAA;IACjE,8FAA+D,CAAA;IAC/D,0FAA2D,CAAA;IAC3D,4FAA4F;IAC5F,0FAA2D,CAAA;IAC3D,8FAA+D,CAAA;IAC/D,0GAA2E,CAAA;IAC3E,oHAAoH;IACpH,kGAAmE,CAAA;IACnE,mGAAmG;IACnG,sGAAuE,CAAA;IACvE,gGAAiE,CAAA;IACjE,wGAAwG;IACxG,oEAAqC,CAAA;IACrC,8GAA8G;IAC9G,8EAA+C,CAAA;IAE/C,gGAAiE,CAAA;IACjE,sGAAuE,CAAA;IAGvE,uBAAuB;IACvB,wHAAyF,CAAA;IAEzF,6BAA6B;IAC7B,wHAAyF,CAAA;IACzF,kIAAmG,CAAA;IACnG,kIAAmG,CAAA;IAEnG,qCAAqC;IACrC,8GAA+E,CAAA;IAC/E,4HAA6F,CAAA;IAC7F,wHAAyF,CAAA;IACzF,sHAAuF,CAAA;IACvF,kHAAmF,CAAA;IACnF,wHAAyF,CAAA;IACzF,sGAAuE,CAAA;IACvE,4HAA6F,CAAA;IAE7F,iFAAiF;IACjF,sFAAuD,CAAA;IAEvD,8CAA8C;IAC9C,8FAA+D,CAAA;IAC/D,4HAA6F,CAAA;IAC7F,wGAAyE,CAAA;IAEzE,+BAA+B;IAC/B,0GAA2E,CAAA;IAC3E,oGAAqE,CAAA;IACrE,gGAAiE,CAAA;IAEjE,6BAA6B;IAC7B,0FAA2D,CAAA;IAC3D,oEAAqC,CAAA;IAErC,0BAA0B;IAC1B,sFAAuD,CAAA;IACvD,oFAAqD,CAAA;IACrD,kGAAmE,CAAA;IAEnE,+GAA+G;IAC/G,4GAA6E,CAAA;IAE7E,mBAAmB;IACnB,kFAAmD,CAAA;IACnD,4EAA6C,CAAA;IAC7C,4EAA6C,CAAA;IAC7C,4EAA6C,CAAA;IAC7C,0FAA2D,CAAA;IAE3D,4EAA6C,CAAA;IAC7C,0DAA2B,CAAA;IAC3B,oFAAqD,CAAA;IACrD,sEAAuC,CAAA;IACvC,8EAA+C,CAAA;IAC/C,wFAAyD,CAAA;IACzD,4FAA6D,CAAA;IAC7D,8DAA+B,CAAA;IAC/B,8EAA+C,CAAA;IAC/C,8DAA+B,CAAA;IAE/B,kGAAmE,CAAA;IACnE,kGAAmE,CAAA;IACnE,wFAAyD,CAAA;IAEzD,4FAA6D,CAAA;IAC7D,8FAA+D,CAAA;IAC/D,kFAAmD,CAAA;IAEnD,wBAAwB;IACxB,8EAA+C,CAAA;IAC/C,gFAAiD,CAAA;IACjD,4EAA6C,CAAA;IAE7C,0BAA0B;IAC1B,wFAAyD,CAAA;IACzD,oFAAqD,CAAA;IACrD,sGAAuE,CAAA;IACvE,oFAAqD,CAAA;IACrD,gGAAiE,CAAA;IACjE,sGAAuE,CAAA;IACvE,0HAA2F,CAAA;IAC3F,kGAAmE,CAAA;IACnE,gHAAiF,CAAA;IACjF,4FAA4F;IAC5F,kFAAmD,CAAA;IACnD,sGAAsG;IACtG,4GAA6E,CAAA;IAE7E,8DAA8D;IAC9D,sJAAsJ;IACtJ,wGAAyE,CAAA;IACzE,oJAAoJ;IACpJ,4HAA6F,CAAA;IAC7F;;;;;;;;;;;;;;OAcG;IACH,wFAAyD,CAAA;IACzD,wFAAwF;IACxF,wGAAyE,CAAA;IACzE,0HAA0H;IAC1H,kHAAmF,CAAA;IACnF,iGAAiG;IACjG,8EAA+C,CAAA;IAC/C,+FAA+F;IAC/F,4FAA6D,CAAA;IAC7D,oTAAoT;IACpT,kFAAmD,CAAA;IACnD,4DAA4D;IAC5D,gGAAiE,CAAA;IACjE,+FAA+F;IAC/F,0EAA2C,CAAA;IAC3C,uEAAuE;IACvE,gGAAiE,CAAA;IAEjE,sFAAsF;IACtF,wEAAwE;IACxE,4GAA6E,CAAA;IAC7E,kEAAkE;IAClE,wGAAyE,CAAA;IACzE,gFAAgF;IAChF,oGAAqE,CAAA;IACrE,mFAAmF;IACnF,kHAAmF,CAAA;IACnF,yFAAyF;IACzF,0FAA2D,CAAA;IAC3D,uDAAuD;IACvD,kGAAmE,CAAA;IACnE,iDAAiD;IACjD,gGAAiE,CAAA;IACjE,6EAA6E;IAC7E,kGAAmE,CAAA;IACnE,4DAA4D;IAC5D,8GAA+E,CAAA;IAC/E,mEAAmE;IACnE,gGAAiE,CAAA;IACjE;;;;;;OAMG;IACH,4GAA6E,CAAA;IAE7E,kCAAkC;IAClC,0EAA0E;IAC1E,4FAA6D,CAAA;IAC7D,sDAAsD;IACtD,oEAAqC,CAAA;IACrC,iEAAiE;IACjE,sFAAuD,CAAA;IACvD,6CAA6C;IAC7C,8EAA+C,CAAA;IAC/C,wEAAwE;IACxE,4FAA6D,CAAA;IAE7D,mDAAmD;IACnD,yCAAyC;IACzC,sEAAuC,CAAA;IACvC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,oGAAqE,CAAA;IACrE;;;;;;;;;;OAUG;IACH,kGAAmE,CAAA;IACnE;;;;;;OAMG;IACH,wFAAyD,CAAA;IACzD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,0GAA2E,CAAA;IAC3E;;;;;;;;;;;OAWG;IACH,8FAA+D,CAAA;IAC/D;;;;;;;;;OASG;IACH,oFAAqD,CAAA;IACrD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,kFAAmD,CAAA;IACnD,+DAA+D;IAC/D,oGAAqE,CAAA;IAErE,iCAAiC;IACjC,qDAAqD;IACrD,sFAAuD,CAAA;IAEvD,iBAAiB;IACjB,kFAAmD,CAAA;IACnD,sFAAuD,CAAA;IACvD,4FAA6D,CAAA;IAC7D,gGAAiE,CAAA;IACjE,gGAAiE,CAAA;IACjE,oGAAqE,CAAA;IACrE,sFAAuD,CAAA;IACvD,sFAAuD,CAAA;IACvD,kFAAmD,CAAA;IACnD,4FAA6D,CAAA;IAC7D,wFAAyD,CAAA;IACzD,sGAAuE,CAAA;IACvE,wFAAyD,CAAA;IACzD,8FAA+D,CAAA;IAC/D,8FAA+D,CAAA;IAC/D,wGAAyE,CAAA;IACzE,0FAA2D,CAAA;IAC3D,4FAA6D,CAAA;IAC7D,8FAA+D,CAAA;IAC/D,sFAAuD,CAAA;IACvD,gGAAiE,CAAA;IACjE;;;;;;;;;;OAUG;IACH,gGAAiE,CAAA;IACjE,sFAAuD,CAAA;IACvD;;;;;;;;;;;OAWG;IACH,gGAAiE,CAAA;IAEjE,uCAAuC;IACvC,gFAAiD,CAAA;IACjD,gFAAiD,CAAA;IACjD,gFAAiD,CAAA;IACjD,4EAA6C,CAAA;IAC7C,4DAA6B,CAAA;IAC7B,oFAAqD,CAAA;IACrD,sEAAuC,CAAA;IACvC,gFAAiD,CAAA;IACjD,4EAA6C,CAAA;IAC7C,0FAA2D,CAAA;IAC3D,8EAA+C,CAAA;IAC/C,4EAA6C,CAAA;IAC7C,sFAAuD,CAAA;IACvD,oFAAqD,CAAA;IACrD,8EAA+C,CAAA;IAC/C,sFAAuD,CAAA;IACvD,0FAA2D,CAAA;IAC3D,wFAAyD,CAAA;IACzD,gGAAiE,CAAA;IACjE,wEAAyC,CAAA;IACzC,oEAAqC,CAAA;IACrC,sFAAuD,CAAA;IACvD,wHAAwH;IACxH,wEAAyC,CAAA;IAEzC,6BAA6B;IAC7B,kEAAmC,CAAA;IACnC,0EAA2C,CAAA;IAC3C,oGAAqE,CAAA;IACrE,kGAAmE,CAAA;IACnE,8GAA+E,CAAA;IAC/E,gGAAiE,CAAA;IACjE,oIAAoI;IACpI,sFAAuD,CAAA;IACvD,2JAA2J;IAC3J,4FAA6D,CAAA;IAC7D,4GAA4G;IAC5G,wFAAyD,CAAA;IACzD,yGAAyG;IACzG,gHAAiF,CAAA;IAEjF,8CAA8C;IAC9C,iFAAiF;IACjF,wFAAyD,CAAA;IACzD,qEAAqE;IACrE,oFAAqD,CAAA;IACrD,8EAA8E;IAC9E,8FAA+D,CAAA;IAC/D,8DAA8D;IAC9D,4GAA6E,CAAA;IAC7E,4EAA4E;IAC5E,0FAA2D,CAAA;IAC3D,4FAA4F;IAC5F,oFAAqD,CAAA;IACrD,qFAAqF;IACrF,oGAAqE,CAAA;IACrE,kFAAkF;IAClF,sGAAuE,CAAA;IACvE,iEAAiE;IACjE,kFAAmD,CAAA;IACnD,0CAA0C;IAC1C,oEAAqC,CAAA;IACrC,2CAA2C;IAC3C,sEAAuC,CAAA;IACvC,yCAAyC;IACzC,kEAAmC,CAAA;IACnC,6CAA6C;IAC7C,wEAAyC,CAAA;IACzC,0CAA0C;IAC1C,oEAAqC,CAAA;IACrC,qEAAqE;IACrE,sGAAuE,CAAA;IAEvE,4CAA4C;IAC5C,kHAAkH;IAClH,0GAA2E,CAAA;IAC3E,2EAA2E;IAC3E,oFAAqD,CAAA;IACrD,iEAAiE;IACjE,oFAAqD,CAAA;IAErD,uDAAuD;IACvD,8FAA8F;IAC9F,0HAA2F,CAAA;IAC3F,uFAAuF;IACvF,wHAAyF,CAAA;IACzF,gEAAgE;IAChE,wFAAyD,CAAA;IACzD,mEAAmE;IACnE,sFAAuD,CAAA;IACvD,8EAA8E;IAC9E,oFAAqD,CAAA;IACrD,sEAAsE;IACtE,wFAAyD,CAAA;IACzD,kFAAkF;IAClF,0HAA2F,CAAA;IAC3F,6FAA6F;IAC7F,4FAA6D,CAAA;IAE7D,wCAAwC;IACxC,8DAA8D;IAC9D,gEAAiC,CAAA;IACjC,uEAAuE;IACvE,gGAAiE,CAAA;IACjE,6EAA6E;IAC7E,0FAA2D,CAAA;IAC3D,sDAAsD;IACtD,0EAA2C,CAAA;IAC3C,qCAAqC;IACrC,4EAA6C,CAAA;IAC7C,8CAA8C;IAC9C,wEAAyC,CAAA;IACzC,+DAA+D;IAC/D,4FAA6D,CAAA;IAC7D,sEAAsE;IACtE,wFAAyD,CAAA;IACzD,uDAAuD;IACvD,sFAAuD,CAAA;IACvD,8CAA8C;IAC9C,wFAAyD,CAAA;IACzD,kDAAkD;IAClD,0EAA2C,CAAA;IAC3C,+EAA+E;IAC/E,0EAA2C,CAAA;IAC3C,6EAA6E;IAC7E,sGAAuE,CAAA;IACvE,wFAAwF;IACxF,wFAAyD,CAAA;IACzD,gGAAgG;IAChG,oFAAqD,CAAA;IACrD,oGAAoG;IACpG,4FAA6D,CAAA;IAC7D,4EAA4E;IAC5E,sGAAuE,CAAA;IACvE,kFAAkF;IAClF,gFAAiD,CAAA;IACjD,yGAAyG;IACzG,8FAA+D,CAAA;IAC/D,yEAAyE;IACzE,8FAA+D,CAAA;IAC/D,6EAA6E;IAC7E,4FAA6D,CAAA;IAC7D,kEAAkE;IAClE,8GAA+E,CAAA;IAC/E;;;;;;;;OAQG;IACH,0FAA2D,CAAA;IAC3D,4DAA4D;IAC5D,sFAAuD,CAAA;IACvD,gDAAgD;IAChD,wFAAyD,CAAA;IACzD,yEAAyE;IACzE,0GAA2E,CAAA;IAC3E,0DAA0D;IAC1D,oFAAqD,CAAA;IACrD,kFAAkF;IAClF,wFAAyD,CAAA;IACzD,qEAAqE;IACrE,4FAA6D,CAAA;IAE7D,mFAAmF;IACnF,0GAA2E,CAAA;AAC7E,CAAC,EAnpBW,2BAA2B,KAA3B,2BAA2B,QAmpBtC","sourcesContent":["\n\n\nexport enum ErrorCustomMessageReference {\n  DEFAULT = 'default',\n  CUSTOM = 'custom',\n  NETWORK = 'network',\n  AUTHENTICATION = 'authentication',\n  AUTHORIZATION = 'authorization',\n  VALIDATION = 'validation',\n  NOT_FOUND = 'not_found',\n  CONFLICT = 'conflict',\n  RATE_LIMIT = 'rate_limit',\n  INTERNAL = 'internal',\n  DATABASE = 'database',\n  EXTERNAL_SERVICE = 'external_service',\n  UNKNOWN = 'unknown',\n  UNCAUGHT_EXCEPTION = 'uncaught_exception',\n  UNHANDLED_REJECTION = 'unhandled_rejection',\n  BUSINESS_RULE = 'business_rule',\n  INFRASTRUCTURE = 'infrastructure',\n  CONFIGURATION = 'configuration',\n  \n  // Service-specific error references\n  CONTROLLER_RESOURCE_VALIDATION_FAILED = 'controller_resource_validation_failed',\n  CONTROLLER_RESOURCE_BUILD_ERROR = 'controller_resource_build_error',\n  \n  REPOSITORIES_REGISTRY_NOT_FOUND = 'repositories_registry_not_found',\n  REPOSITORIES_REGISTRY_INITIALIZATION_FAILED = 'repositories_registry_initialization_failed',\n  \n  REPOSITORY_RESOURCE_OPERATION_FAILED = 'repository_resource_operation_failed',\n  REPOSITORY_RESOURCE_SEARCH_NOT_CONFIGURED = 'repository_resource_search_not_configured',\n  REPOSITORY_RESOURCE_SEARCH_NOT_ENABLED = 'repository_resource_search_not_enabled',\n  REPOSITORY_RESOURCE_VALIDATION_FAILED = 'repository_resource_validation_failed',\n  \n  RESOURCE_ID_VALIDATION_FAILED = 'resource_id_validation_failed',\n  \n  // File validation errors\n  FILE_ID_VALIDATION_FAILED = 'file_id_validation_failed',\n  APP_ID_VALIDATION_FAILED = 'app_id_validation_failed',\n  FILENAME_SANITIZATION_FAILED = 'filename_sanitization_failed',\n  CONTENT_LENGTH_VALIDATION_FAILED = 'content_length_validation_failed',\n  STREAM_VALIDATION_FAILED = 'stream_validation_failed',\n  \n  SERVICE_RESOURCE_VALIDATION_FAILED = 'service_resource_validation_failed',\n  SERVICE_RESOURCE_TRANSFORMATION_FAILED = 'service_resource_transformation_failed',\n  SERVICE_RESOURCE_BUILD_ERROR = 'service_resource_build_error',\n  SERVICE_RESOURCE_OPERATION_FAILED = 'service_resource_operation_failed',\n  SERVICE_RESOURCE_OPERATION_DISABLED = 'service_resource_operation_disabled',\n  SERVICE_RESOURCE_REGISTRY_NOT_AVAILABLE = 'service_resource_registry_not_available',\n  \n  SERVICES_REGISTRY_INITIALIZATION_FAILED = 'services_registry_initialization_failed',\n  \n  MONGODB_CONNECTION_FAILED = 'mongodb_connection_failed',\n  MONGODB_OPERATION_FAILED = 'mongodb_operation_failed',\n  MONGODB_INITIALIZATION_FAILED = 'mongodb_initialization_failed',\n  \n  REDIS_CONNECTION_FAILED = 'redis_connection_failed',\n  REDIS_OPERATION_FAILED = 'redis_operation_failed',\n  REDIS_INITIALIZATION_FAILED = 'redis_initialization_failed',\n  \n  ZOD_CONVERTER_SCHEMA_CONVERSION_FAILED = 'zod_converter_schema_conversion_failed',\n  ZOD_CONVERTER_UNSUPPORTED_TYPE = 'zod_converter_unsupported_type',\n  ZOD_CONVERTER_MODEL_BUILD_FAILED = 'zod_converter_model_build_failed',\n  \n  RESOURCES_REGISTRY_INITIALIZATION_FAILED = 'resources_registry_initialization_failed',\n  RESOURCES_REGISTRY_REGISTRATION_FAILED = 'resources_registry_registration_failed',\n  \n  EXTERNAL_PROVIDER_REGISTRY_INITIALIZATION_FAILED = 'external_provider_registry_initialization_failed',\n  \n  EXECUTION_CONTEXT_SEALED_MODIFICATION = 'execution_context_sealed_modification',\n  EXECUTION_CONTEXT_INITIALIZATION_FAILED = 'execution_context_initialization_failed',\n  \n  HTTP_SERVER_INITIALIZATION_FAILED = 'http_server_initialization_failed',\n  \n  START_APPLICATION_INITIALIZATION_FAILED = 'start_application_initialization_failed',\n  START_APPLICATION_CONFIGURATION_FAILED = 'start_application_configuration_failed',\n  START_APPLICATION_STARTUP_FAILED = 'start_application_startup_failed',\n  \n  AUTHORIZATIONS_MISSING_INITIATOR = 'authorizations_missing_initiator',\n  AUTHORIZATIONS_VALIDATION_FAILED = 'authorizations_validation_failed',\n  AUTHORIZATIONS_ACCESS_DENIED = 'authorizations_access_denied',\n  AUTHORIZATIONS_NO_OPERATION_CONTEXT = 'authorizations_no_operation_context',\n\n  JWT_SIGNING_FAILED = 'jwt_signing_failed',\n  JWT_VERIFICATION_FAILED = 'jwt_verification_failed',\n  JWT_TOKEN_GENERATION_FAILED = 'jwt_token_generation_failed',\n  JWT_TOKEN_PARSING_FAILED = 'jwt_token_parsing_failed',\n  JWT_TOKEN_EXPIRED = 'jwt_token_expired',\n  JWT_TOKEN_INVALID = 'jwt_token_invalid',\n  JWT_TOKEN_NOT_FOUND = 'jwt_token_not_found',\n  JWT_TOKEN_NOT_VERIFIED = 'jwt_token_not_verified',\n  JWT_TOKEN_NOT_SIGNED = 'jwt_token_not_signed',\n\n  PLATFORM_HTTP_ERROR = 'platform_http_error',\n\n  RESOURCE_OPERATION_CUSTOM_IMPLEMENTATION_NOT_IMPLEMENTED = 'resource_operation_custom_implementation_not_implemented',\n  SERVICE_NOT_FOUND = 'service_not_found',\n  SERVICE_CREATION_FAILED = 'service_creation_failed',\n  RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND = 'resources_registry_operation_path_not_found',\n  RESOURCES_REGISTRY_FIELD_IDENTIFIER_NOT_FOUND = 'resources_registry_field_identifier_not_found',\n  RESOURCES_REGISTRY_RELATIONSHIP_VALIDATION_FAILED = 'resources_registry_relationship_validation_failed',\n  CONTROLLER_RESOURCE_NOT_FOUND = 'controller_resource_not_found',\n  CONTROLLER_CUSTOM_NAME_CONFLICT = 'controller_custom_name_conflict',\n  CONTROLLER_RESOURCE_ID_MUST_BE_UNIQUE = 'controller_resource_id_must_be_unique',\n\n  AUTHENTICATION_API_KEY_INVALID = 'authentication_api_key_invalid',\n  AUTHENTICATION_API_KEY_FAILED = 'authentication_api_key_failed',\n\n  AUTHENTICATION_INVALID_TOKEN = 'authentication_invalid_token',\n\n  AUTHENTICATION_NO_AUTHENTICATION_PROVIDED = 'authentication_no_authentication_provided',\n\n  API_CALL_INITIATOR_PARAMETER_MISSING = 'api_call_initiator_parameter_missing',\n  API_CALL_INITIATOR_PARAMETER_INCONSISTENT = 'api_call_initiator_parameter_inconsistent',\n  API_CALL_INITIATOR_PARAMETER_UNSUPPORTED = 'api_call_initiator_parameter_unsupported',\n\n  API_ORG_KEY_WITHOUT_ORG_ID = 'api_org_key_without_org_id',\n  API_ORG_KEY_WRONG_RESOURCE = 'api_org_key_wrong_resource',\n\n  AUTHENTICATION_JWT_TOKEN_FAILED = 'authentication_jwt_token_failed',\n\n  AUTHENTICATION_USER_NOT_FOUND = 'authentication_user_not_found',\n  AUTHENTICATION_USER_NOT_ACTIVE = 'authentication_user_not_active',\n\n  AUTHENTICATION_USER_NOT_AUTHORIZED = 'authentication_user_not_authorized',\n  AUTHENTICATION_USER_CREDENTIALS_NOT_FOUND = 'authentication_user_credentials_not_found',\n  AUTHENTICATION_USER_CREDENTIALS_INVALID = 'authentication_user_credentials_invalid',\n\n  // Authentication session and flow specific errors\n  AUTHENTICATION_SESSION_INVALID = 'authentication_session_invalid',\n  AUTHENTICATION_SESSION_EXPIRED = 'authentication_session_expired',\n  AUTHENTICATION_ACCOUNT_LOCKED = 'authentication_account_locked',\n  AUTHENTICATION_MFA_REQUIRED = 'authentication_mfa_required',\n  /** M14: SSO required for this org — password login grace period exhausted or not allowed */\n  AUTHENTICATION_SSO_REQUIRED = 'authentication_sso_required',\n  AUTHENTICATION_EMAIL_REQUIRED = 'authentication_email_required',\n  AUTHENTICATION_METHOD_NOT_SUPPORTED = 'authentication_method_not_supported',\n  /** W2.2: Password has expired per passwordPolicy.expiryDays. User must change password before tokens are issued. */\n  AUTHENTICATION_PASSWORD_EXPIRED = 'authentication_password_expired',\n  /** W3.1b: User's userTypes[] does not include the resolved activeUserType for this application. */\n  AUTHENTICATION_USER_TYPE_MISMATCH = 'authentication_user_type_mismatch',\n  AUTHENTICATION_NOT_IMPLEMENTED = 'authentication_not_implemented',\n  /** W7.1: Operation requires re-authentication (step-up auth). Frontend should prompt re-auth dialog. */\n  STEP_UP_REQUIRED = 'step_up_required',\n  /** W7.2: Cross-organization SSO access is disabled. User already has enterprise SSO link from another org. */\n  CROSS_ORG_SSO_BLOCKED = 'cross_org_sso_blocked',\n\n  APP_CONFIGURATION_UNAUTHORIZED = 'app_configuration_unauthorized',\n  APP_CONFIGURATION_NOT_INITIALIZED = 'app_configuration_not_initialized',\n\n  \n  // Frontend form errors\n  FRONTEND_FORM_READ_OPERATION_NOT_AVAILABLE = 'frontend_form_read_operation_not_available',\n  \n  // Frontend navigation errors\n  FRONTEND_NAVIGATION_INVALID_URL_PARAMETERS = 'frontend_navigation_invalid_url_parameters',\n  FRONTEND_NAVIGATION_MISSING_REQUIRED_PARAMETERS = 'frontend_navigation_missing_required_parameters',\n  FRONTEND_NAVIGATION_UNRESOLVED_ROUTE_PARAMETERS = 'frontend_navigation_unresolved_route_parameters',\n\n  // Frontend resource operation errors\n  FRONTEND_RESOURCE_OPERATION_NOT_FOUND = 'frontend_resource_operation_not_found',\n  FRONTEND_RESOURCE_UNSUPPORTED_OPERATION_TYPE = 'frontend_resource_unsupported_operation_type',\n  FRONTEND_RESOURCE_SEARCH_OPERATION_INVALID = 'frontend_resource_search_operation_invalid',\n  FRONTEND_RESOURCE_UNSUPPORTED_HTTP_METHOD = 'frontend_resource_unsupported_http_method',\n  FRONTEND_RESOURCE_NO_ENDPOINT_AVAILABLE = 'frontend_resource_no_endpoint_available',\n  FRONTEND_RESOURCE_NO_ROUTE_PATHS_AVAILABLE = 'frontend_resource_no_route_paths_available',\n  FRONTEND_RESOURCE_NO_CALLBACK_URL = 'frontend_resource_no_callback_url',\n  FRONTEND_RESOURCE_RESPONSE_VALIDATION_FAILED = 'frontend_resource_response_validation_failed',\n\n  // FK/PK resolution errors (shared: used by both frontend and backend registries)\n  REGISTRY_FK_MAP_COLLISION = 'registry_fk_map_collision',\n\n  // FK/PK resolution errors (frontend-specific)\n  FRONTEND_FK_RESOLUTION_FAILED = 'frontend_fk_resolution_failed',\n  FRONTEND_RESOURCE_FIELD_IDENTIFIER_NOT_FOUND = 'frontend_resource_field_identifier_not_found',\n  FRONTEND_RESOURCES_NOT_INITIALIZED = 'frontend_resources_not_initialized',\n\n  // Schema Family Builder errors\n  SCHEMA_FAMILY_INVALID_DISCRIMINATOR = 'schema_family_invalid_discriminator',\n  SCHEMA_FAMILY_UNACCOUNTED_VALUES = 'schema_family_unaccounted_values',\n  SCHEMA_FAMILY_DUPLICATE_VALUES = 'schema_family_duplicate_values',\n\n  // Database constraint errors\n  UNIQUE_CONSTRAINT_VIOLATION = 'unique_constraint_violation',\n  VERSION_CONFLICT = 'version_conflict',\n\n  // Field validation errors\n  VALIDATE_FIELD_NOT_UNIQUE = 'validate_field_not_unique',\n  VALIDATE_FIELD_NOT_FOUND = 'validate_field_not_found',\n  VALIDATE_FIELD_NOT_UNIQUE_FIELD = 'validate_field_not_unique_field',\n\n  /** Password does not meet policy; context.violations contains i18n label keys (PasswordPolicyViolationCode) */\n  VALIDATION_PASSWORD_POLICY_VIOLATION = 'validation_password_policy_violation',\n\n  // Queue/Job errors\n  QUEUE_CONNECTION_FAILED = 'queue_connection_failed',\n  QUEUE_PUBLISH_FAILED = 'queue_publish_failed',\n  QUEUE_CONSUME_FAILED = 'queue_consume_failed',\n  QUEUE_CHANNEL_CLOSED = 'queue_channel_closed',\n  QUEUE_INITIALIZATION_FAILED = 'queue_initialization_failed',\n  \n  JOB_EXECUTION_FAILED = 'job_execution_failed',\n  JOB_TIMEOUT = 'job_timeout',\n  JOB_MAX_RETRIES_EXCEEDED = 'job_max_retries_exceeded',\n  JOB_DEAD_LETTERED = 'job_dead_lettered',\n  JOB_PAYLOAD_TOO_LARGE = 'job_payload_too_large',\n  JOB_PAYLOAD_STORAGE_FAILED = 'job_payload_storage_failed',\n  JOB_PAYLOAD_RETRIEVAL_FAILED = 'job_payload_retrieval_failed',\n  JOB_NOT_FOUND = 'job_not_found',\n  JOB_ALREADY_PROCESSED = 'job_already_processed',\n  JOB_CANCELLED = 'job_cancelled',\n  \n  JOB_SCHEDULED_SIGNATURE_INVALID = 'job_scheduled_signature_invalid',\n  JOB_SCHEDULED_SIGNATURE_EXPIRED = 'job_scheduled_signature_expired',\n  JOB_SCHEDULED_UNAUTHORIZED = 'job_scheduled_unauthorized',\n  \n  JOB_OPERATION_PATH_NOT_FOUND = 'job_operation_path_not_found',\n  JOB_EXECUTION_CONTEXT_INVALID = 'job_execution_context_invalid',\n  JOB_BATCH_REF_NOT_FOUND = 'job_batch_ref_not_found',\n\n  // Feature gating errors\n  FEATURE_NOT_AVAILABLE = 'feature_not_available',\n  FEATURE_LIMIT_EXCEEDED = 'feature_limit_exceeded',\n  INSUFFICIENT_CREDITS = 'insufficient_credits',\n\n  // Consumable Token errors\n  CONSUMABLE_TOKEN_NOT_FOUND = 'consumable_token_not_found',\n  CONSUMABLE_TOKEN_EXPIRED = 'consumable_token_expired',\n  CONSUMABLE_TOKEN_ALREADY_CONSUMED = 'consumable_token_already_consumed',\n  CONSUMABLE_TOKEN_REVOKED = 'consumable_token_revoked',\n  CONSUMABLE_TOKEN_TYPE_MISMATCH = 'consumable_token_type_mismatch',\n  CONSUMABLE_TOKEN_CONTEXT_MISMATCH = 'consumable_token_context_mismatch',\n  CONSUMABLE_TOKEN_NOT_ACCEPTED_FOR_OPERATION = 'consumable_token_not_accepted_for_operation',\n  CONSUMABLE_TOKEN_RACE_CONDITION = 'consumable_token_race_condition',\n  CONSUMABLE_TOKEN_FILE_SHARING_DISABLED = 'consumable_token_file_sharing_disabled',\n  /** W7.3b: ADDITIVE policy requires x-consumable-token header alongside JWT/API-key auth. */\n  ADDITIVE_TOKEN_REQUIRED = 'additive_token_required',\n  /** revocation-B1: requested one-off session `expiresIn` exceeds this user type's max-duration cap. */\n  ONE_OFF_SESSION_DURATION_EXCEEDS_MAX = 'one_off_session_duration_exceeds_max',\n\n  // Invitation acceptance / registration errors (user-directed)\n  /** Transient failure verifying the invitation's organization during accept; the single-use token is NOT consumed, so the invitee can safely retry. */\n  INVITATION_ORG_VERIFICATION_FAILED = 'invitation_org_verification_failed',\n  /** The organization is directory-managed (SCIM): no local credential (password/passkey/magic-link) can be set. The invitee must sign in via SSO. */\n  AUTHENTICATION_SCIM_LOCAL_CREDENTIAL_BLOCKED = 'authentication_scim_local_credential_blocked',\n  /**\n   * The invitation link cannot be used: it is unrecognised, has expired, was already used, or the\n   * invitation itself is no longer active. Ask the inviting administrator to send a new invitation.\n   *\n   * DELIBERATELY UNIFORM across every cause (unrecognised / expired / already-consumed token, wrong\n   * token type, missing invitation reference, non-INVITED or orphaned membership, or a revoke that\n   * raced the accept). All three PUBLIC token-based endpoints (`getInvitationInfo`,\n   * `acceptInvitation`, `rejectInvitation`) throw THIS single reference — and all throw\n   * `ErrorType.AUTHENTICATION` — so a token holder cannot distinguish \"unrecognised token\" from\n   * \"recognised-but-superseded invite\". A `customMessageReference` is a top-level field that SURVIVES\n   * error sanitization (unlike `context.message`), so a per-cause sibling WOULD be client-visible and\n   * would re-open that oracle: do NOT add one for those endpoints. The granular cause belongs in the\n   * backend logs. (Authenticated, ownership-gated in-app paths may use granular references — they are\n   * gated by userId, not token possession, so they leak nothing.)\n   */\n  INVITATION_NO_LONGER_VALID = 'invitation_no_longer_valid',\n  /** The invitation is addressed to a different account than the authenticated caller. */\n  INVITATION_NOT_ADDRESSED_TO_CALLER = 'invitation_not_addressed_to_caller',\n  /** The invitee already has an account: accept without setting a password, then sign in with the existing login method. */\n  INVITATION_EXISTING_ACCOUNT_NO_PASSWORD = 'invitation_existing_account_no_password',\n  /** Self-service registration is disabled for this application / frontend service / user type. */\n  REGISTRATION_DISABLED = 'registration_disabled',\n  /** Registration is by invitation only; a valid invitation is required to create an account. */\n  REGISTRATION_INVITATION_ONLY = 'registration_invitation_only',\n  /** Registration for this user type is admin-provisioned only: accounts are created by an administrator, so there is no self-service sign-up or invitation-accept path. Distinct from REGISTRATION_DISABLED (registration off entirely) and REGISTRATION_INVITATION_ONLY (self-complete via an invitation token). */\n  REGISTRATION_ADMIN_ONLY = 'registration_admin_only',\n  /** A password is required to complete this registration. */\n  REGISTRATION_PASSWORD_REQUIRED = 'registration_password_required',\n  /** Registration could not be completed due to a transient server error; the user may retry. */\n  REGISTRATION_FAILED = 'registration_failed',\n  /** The account exists but cannot be activated in its current state. */\n  ACCOUNT_ACTIVATION_NOT_ALLOWED = 'account_activation_not_allowed',\n\n  // Auth / session flow errors (user-directed) — added with the i18n-bypass remediation\n  /** A first authentication factor must be completed before this step. */\n  AUTHENTICATION_FIRST_FACTOR_REQUIRED = 'authentication_first_factor_required',\n  /** Magic-link authentication is disabled for this application. */\n  AUTHENTICATION_MAGIC_LINK_DISABLED = 'authentication_magic_link_disabled',\n  /** No verified phone number is available for SMS one-time-passcode delivery. */\n  AUTHENTICATION_NO_VERIFIED_PHONE = 'authentication_no_verified_phone',\n  /** The current session state does not allow completing organization onboarding. */\n  AUTHENTICATION_ONBOARDING_STATE_INVALID = 'authentication_onboarding_state_invalid',\n  /** The session was lost after magic-link verification; the user must restart sign-in. */\n  AUTHENTICATION_SESSION_LOST = 'authentication_session_lost',\n  /** The session carries no associated email address. */\n  AUTHENTICATION_SESSION_NO_EMAIL = 'authentication_session_no_email',\n  /** The session carries no associated user id. */\n  AUTHENTICATION_SESSION_NO_USER = 'authentication_session_no_user',\n  /** SMS one-time-passcode authentication is disabled for this application. */\n  AUTHENTICATION_SMS_OTP_DISABLED = 'authentication_sms_otp_disabled',\n  /** The refresh-token cookie is missing from the request. */\n  AUTHENTICATION_REFRESH_TOKEN_REQUIRED = 'authentication_refresh_token_required',\n  /** The userId in the URL does not match the authenticated user. */\n  AUTHORIZATION_USER_ID_MISMATCH = 'authorization_user_id_mismatch',\n  /**\n   * The scope in the URL (e.g. `/organizations/{id}/…`) does not match the authenticated MACHINE\n   * token's bound scope. Symmetric with {@link AUTHORIZATION_USER_ID_MISMATCH} for the machine arm:\n   * a machine token is bound to exactly one org/app, so a URL naming a different scope is rejected —\n   * this prevents the token's context map (URL-derived) from scoping a query to a different tenant\n   * than the token authorizes.\n   */\n  AUTHORIZATION_MACHINE_SCOPE_MISMATCH = 'authorization_machine_scope_mismatch',\n\n  // MFA flow errors (user-directed)\n  /** The current session state does not allow completing MFA enrollment. */\n  MFA_ENROLLMENT_STATE_INVALID = 'mfa_enrollment_state_invalid',\n  /** No MFA method is enrolled for this account yet. */\n  MFA_NOT_ENROLLED = 'mfa_not_enrolled',\n  /** A TOTP authenticator is already enrolled for this account. */\n  MFA_TOTP_ALREADY_ENROLLED = 'mfa_totp_already_enrolled',\n  /** The provided TOTP code did not verify. */\n  MFA_TOTP_CODE_INVALID = 'mfa_totp_code_invalid',\n  /** No pending TOTP setup exists; enrollment must be initiated first. */\n  MFA_TOTP_SETUP_NOT_INITIATED = 'mfa_totp_setup_not_initiated',\n\n  // Config / request-contract errors (user-directed)\n  /** The organization name is required. */\n  ORG_NAME_REQUIRED = 'org_name_required',\n  /**\n   * An organization unit cannot be deleted because child units still hang off it.\n   *\n   * Emitted as `ErrorType.CONFLICT` (409). CONFLICT is one of the few error types that expose\n   * `context` to the client, so the blocking dependent is surfaced by name — `blockingChildUnitId`\n   * when a child unit blocks, `blockingUnitMemberId` when a member assignment does. TWO distinct\n   * dependents share this one code; branch on the context key, not on the message.\n   *\n   * Unlike every other `ORGANIZATIONS` child, the unit tree's self-edge\n   * (`ORGANIZATION_UNITS -> ORGANIZATION_UNITS` on `parentUnitId`) declares NO `onParentDelete`\n   * cascade, so deleting an interior node would strand its whole subtree behind a dangling\n   * `parentUnitId` and a stale materialized `path`.\n   *\n   * MOVE is the remedy to point a client at: it re-parents a child onto another node and rewrites\n   * the materialized `path` of its whole subtree in one transaction. (Deleting the subtree\n   * bottom-up also works, leaf by leaf.) Since `parentUnitId` became `.excludeFromUpdate()` in the\n   * same pass that implemented MOVE, MOVE is the ONLY way to re-home a branch — so do not describe\n   * a plain update as an alternative.\n   *\n   * ⚠️ Direct per-unit DELETE only. Deleting the whole ORGANIZATION is a different path: that\n   * cascade IS enabled and removes every unit of the tenant at once (every unit carries the\n   * tenant's `organizationId`), and it runs at the repository level, so this guard is correctly\n   * not consulted there.\n   */\n  ORGANIZATION_UNIT_HAS_DEPENDENTS = 'organization_unit_has_dependents',\n  /**\n   * A MOVE names a destination inside the moved unit's own subtree — one of its descendants, or the\n   * unit itself. Either detaches the branch into a cycle: a node below its own descendant has no\n   * route back to the root.\n   *\n   * Distinct from {@link ORGANIZATION_UNIT_CONFLICT}: this one names the re-parenting operation, so\n   * an API client can branch on \"the destination is illegal\" without re-deriving it from a generic\n   * update conflict. Distinct from {@link ORGANIZATION_UNIT_CODE_EXISTS}, which a MOVE can also\n   * raise: there the destination is legal and the unit's own `code` is what collides, so renaming\n   * the unit is a remedy that picking another destination is not.\n   */\n  ORGANIZATION_UNIT_MOVE_CONFLICT = 'organization_unit_move_conflict',\n  /**\n   * An archive/restore is not a legal transition from the node's current state — already archived;\n   * not archived; or a restore whose parent branch is still archived.\n   *\n   * Sibling-code collisions are NOT reported here; they carry\n   * {@link ORGANIZATION_UNIT_CODE_EXISTS}, which names the taken value.\n   */\n  ORGANIZATION_UNIT_CONFLICT = 'organization_unit_conflict',\n  /**\n   * A lifecycle verb was invoked from a state it may not transition out of — suspending an\n   * already-suspended row, reactivating one that was never suspended, deactivating a terminal\n   * account.\n   *\n   * Raised by the shared status-transition implementation\n   * (`createResourceStatusTransitionFactory`) and therefore resource-agnostic by design: the same\n   * reference covers organizations, organization members, and users, because \"this is not a legal\n   * transition from the current state\" is one API-visible outcome regardless of which state machine\n   * refused it. The error context names the resource, operation, current status and permitted\n   * source statuses, so a client has everything it needs without a per-resource reference.\n   *\n   * Distinct from a generic {@link CONFLICT}: a client can branch on \"the row is in the wrong state\n   * for this verb\" and re-read to show the real state, rather than treating it as an opaque clash.\n   *\n   * NOTE: most of these transitions ALSO declare an `enabledCondition`, which rejects the same\n   * situation earlier with `SERVICE_RESOURCE_OPERATION_DISABLED`. This reference covers the cases\n   * that gate cannot: a transition reached through a non-URL path, and the re-check the\n   * implementation performs against the row it actually loaded.\n   */\n  RESOURCE_STATUS_TRANSITION_CONFLICT = 'resource_status_transition_conflict',\n  /**\n   * A unit `code` is already used by a sibling under the same parent.\n   *\n   * Sibling-scoped, not org-wide: two teams called `sales` under different divisions are a\n   * legitimate org chart, so the identity is (`organizationId`, `parentUnitId`, `code`). Units\n   * carrying no `code` at all are unconstrained — any number of them may sit under one parent.\n   *\n   * Raised by every operation that can introduce the collision (CREATE, UPDATE rename, MOVE) and by\n   * the database unique index that backs them. Those must agree: the index cannot know which\n   * operation was running, so an operation-specific code would make the SAME condition report\n   * differently depending on which write won a race.\n   */\n  ORGANIZATION_UNIT_CODE_EXISTS = 'organization_unit_code_exists',\n  /**\n   * The requested organization `slug` is already taken.\n   *\n   * The slug is the tenant's URL-safe identity and is `.excludeFromUpdate()` — creation-time\n   * identity, not an editable label. That is why this must be refused at CREATE rather than\n   * reconciled later: a collision that got written could not be resolved through the API at all.\n   *\n   * Raised by the database unique index on `slug`. Uniqueness is collection-wide, which IS\n   * per-application: an application's organizations live in that application's own database.\n   */\n  ORGANIZATION_SLUG_EXISTS = 'organization_slug_exists',\n  /**\n   * The requested application `appSlug` is already taken.\n   *\n   * GLOBAL across the platform, deliberately NOT compounded with `organizationId`, even though\n   * `wildoApplication` is an organization-scoped resource. The slug is not a label — it is the sole\n   * input, alongside the environment id, from which every provisioned backing resource takes its\n   * name: `buildApplicationNamespace(appSlug, environmentId)` (no organization component), and from\n   * it the application database, the database username and the RabbitMQ vhost. Two applications\n   * sharing a slug in DIFFERENT organizations would therefore be handed the same database and the\n   * same vhost.\n   *\n   * Raised by the database unique index on `appSlug`, and reachable only at CREATE: the field is\n   * `.excludeFromUpdate()`, so it is creation-time identity rather than an editable name.\n   *\n   * Added 2026-08-19 after the absence of this constraint let a second live `wonder-todos` row be\n   * inserted beside the first. The upsert looks up `{ appSlug }` but the repository applies the\n   * resource's contextual primary-scope filter, so once the platform organization was re-minted the\n   * lookup could no longer see the existing row and INSERTED rather than resolved. The orphaned\n   * lineage then kept publishing into the queues of an application that was no longer live, which\n   * surfaced only as a RabbitMQ `403 ACCESS_REFUSED` — never as anything naming a duplicate.\n   */\n  APPLICATION_SLUG_EXISTS = 'application_slug_exists',\n  /** The client must send the X-Frontend-Service-Name header. */\n  FRONTEND_SERVICE_HEADER_REQUIRED = 'frontend_service_header_required',\n\n  // Webhook errors (user-directed)\n  /** Inbound webhook signature verification failed. */\n  WEBHOOK_SIGNATURE_INVALID = 'webhook_signature_invalid',\n\n  // Billing errors\n  BILLING_NOT_INITIALIZED = 'billing_not_initialized',\n  BILLING_ACCOUNT_NOT_FOUND = 'billing_account_not_found',\n  BILLING_NO_PROVIDER_CUSTOMER = 'billing_no_provider_customer',\n  BILLING_SUBSCRIPTION_NOT_FOUND = 'billing_subscription_not_found',\n  BILLING_NO_ACTIVE_SUBSCRIPTION = 'billing_no_active_subscription',\n  BILLING_NO_PROVIDER_SUBSCRIPTION = 'billing_no_provider_subscription',\n  BILLING_NO_PROVIDER_PRICE = 'billing_no_provider_price',\n  BILLING_PRODUCT_NOT_FOUND = 'billing_product_not_found',\n  BILLING_PRICE_NOT_FOUND = 'billing_price_not_found',\n  BILLING_INVALID_PRODUCT_TYPE = 'billing_invalid_product_type',\n  BILLING_PLAN_TIER_REQUIRED = 'billing_plan_tier_required',\n  BILLING_ADDON_NOT_ON_SUBSCRIPTION = 'billing_addon_not_on_subscription',\n  BILLING_LOCAL_WRITE_FAILED = 'billing_local_write_failed',\n  BILLING_SUBSCRIPTION_NO_ITEMS = 'billing_subscription_no_items',\n  BILLING_ACCOUNT_UPDATE_FAILED = 'billing_account_update_failed',\n  BILLING_SUBSCRIPTION_UPDATE_FAILED = 'billing_subscription_update_failed',\n  BILLING_PROMOTION_NOT_FOUND = 'billing_promotion_not_found',\n  BILLING_INSUFFICIENT_CREDITS = 'billing_insufficient_credits',\n  BILLING_CREDIT_POOL_NOT_FOUND = 'billing_credit_pool_not_found',\n  BILLING_PROMOTION_INVALID = 'billing_promotion_invalid',\n  BILLING_PRODUCT_SCOPE_MISMATCH = 'billing_product_scope_mismatch',\n  /**\n   * A purchase named a product and a price that do not belong together.\n   *\n   * `Price.productId` is a declared foreign key, so every price already knows its product. The\n   * purchase paths, however, used to resolve the two INDEPENDENTLY — product by key, price by id —\n   * and never consulted that FK. The provider is billed the price while the local subscription item\n   * records the product, and entitlements derive from the product: a caller pairing a premium\n   * product key with a cheap price id therefore received premium entitlements at the cheap price.\n   *\n   * Raised as `ErrorType.VALIDATION` (400) — the payload is internally inconsistent, not unauthorized.\n   */\n  BILLING_PRICE_PRODUCT_MISMATCH = 'billing_price_product_mismatch',\n  BILLING_SCOPE_NOT_ENABLED = 'billing_scope_not_enabled',\n  /**\n   * Hard removal of a billing account was refused because retained financial children\n   * (subscriptions / invoice refs / usage records / credit pools) still reference it.\n   *\n   * Emitted as `ErrorType.CONFLICT` (409). CONFLICT is one of the few error types that\n   * expose `context` to the client, so the blocking child families are surfaced by name.\n   *\n   * @see the billing-retention rationale at the `Scope -> BillingAccounts` declaration in\n   * `resources-registry.shared.core.definitions.ts` — the children are RETAINED on purpose,\n   * and this account row holds the only local `providerCustomerId` that maps them back to\n   * the provider customer.\n   */\n  BILLING_ACCOUNT_HAS_DEPENDENTS = 'billing_account_has_dependents',\n\n  // SAML Protocol Engine errors (AUTH-2)\n  SAML_ASSERTION_INVALID = 'saml_assertion_invalid',\n  SAML_SIGNATURE_INVALID = 'saml_signature_invalid',\n  SAML_AUDIENCE_MISMATCH = 'saml_audience_mismatch',\n  SAML_REPLAY_DETECTED = 'saml_replay_detected',\n  SAML_EXPIRED = 'saml_expired',\n  SAML_DOMAIN_NOT_VERIFIED = 'saml_domain_not_verified',\n  SAML_CERT_EXPIRED = 'saml_cert_expired',\n  SAML_DECRYPTION_FAILED = 'saml_decryption_failed',\n  SAML_SP_KEY_MISMATCH = 'saml_sp_key_mismatch',\n  SAML_UNSUPPORTED_ENCRYPTION = 'saml_unsupported_encryption',\n  SAML_TRANSIENT_NAMEID = 'saml_transient_nameid',\n  SAML_INVALID_NAME_ID = 'saml_invalid_name_id',\n  SAML_MOBILE_NOT_SUPPORTED = 'saml_mobile_not_supported',\n  SAML_MULTIPLE_ASSERTIONS = 'saml_multiple_assertions',\n  SAML_BINDING_MISMATCH = 'saml_binding_mismatch',\n  SAML_METADATA_PARSE_ERROR = 'saml_metadata_parse_error',\n  SAML_INVALID_IN_RESPONSE_TO = 'saml_invalid_in_response_to',\n  SAML_ORGANIZATION_REQUIRED = 'saml_organization_required',\n  SAML_IDP_INITIATED_NOT_ALLOWED = 'saml_idp_initiated_not_allowed',\n  SAML_AMBIGUOUS_IDP = 'saml_ambiguous_idp',\n  SAML_UNKNOWN_IDP = 'saml_unknown_idp',\n  SAML_DESTINATION_MISMATCH = 'saml_destination_mismatch',\n  /** Java runtime required for SAML XSD validation (samlify dependency). Dev: install JRE or use mock parser in tests. */\n  SAML_JAVA_REQUIRED = 'saml_java_required',\n\n  // Aggregation / Chart errors\n  CHART_NOT_FOUND = 'chart_not_found',\n  AGGREGATION_TIMEOUT = 'aggregation_timeout',\n  AGGREGATION_MAX_BUCKETS_EXCEEDED = 'aggregation_max_buckets_exceeded',\n  AGGREGATION_FIELD_ACCESS_DENIED = 'aggregation_field_access_denied',\n  AGGREGATION_COMPUTED_EXPRESSION_ERROR = 'aggregation_computed_expression_error',\n  AGGREGATION_JOIN_ACCESS_DENIED = 'aggregation_join_access_denied',\n  /** User lacks permission to view a chart's aggregated data (missing LIST access, chart role restriction, or insufficient roles). */\n  AGGREGATION_ACCESS_DENIED = 'aggregation_access_denied',\n  /** A required scope/context value (org id, user id, unknown primary scope, or context-filter value) could not be resolved to authorize the aggregation. */\n  AGGREGATION_SCOPE_UNRESOLVED = 'aggregation_scope_unresolved',\n  /** A context filter conflicts with or would override the enforced primary-scope lock on the aggregation. */\n  AGGREGATION_SCOPE_CONFLICT = 'aggregation_scope_conflict',\n  /** Aggregation execution requires an executionContext unless skipAuthorization is explicitly enabled. */\n  AGGREGATION_EXECUTION_CONTEXT_REQUIRED = 'aggregation_execution_context_required',\n\n  // Agent / flows-actors errors (user-directed)\n  /** Selected AI provider/protocol is not enabled in application configuration. */\n  AGENT_PROVIDER_NOT_ENABLED = 'agent_provider_not_enabled',\n  /** Provider not found or its LLM runtime contract is unavailable. */\n  AGENT_PROVIDER_NOT_FOUND = 'agent_provider_not_found',\n  /** Requested agent operation key is not supported by the provider/runtime. */\n  AGENT_OPERATION_NOT_SUPPORTED = 'agent_operation_not_supported',\n  /** Image provider client does not expose image generation. */\n  AGENT_IMAGE_GENERATION_NOT_SUPPORTED = 'agent_image_generation_not_supported',\n  /** Image generation requires a non-empty prompt on the invocation input. */\n  AGENT_IMAGE_PROMPT_REQUIRED = 'agent_image_prompt_required',\n  /** CLI runtime returned output that was missing, malformed, or failed schema validation. */\n  AGENT_CLI_OUTPUT_INVALID = 'agent_cli_output_invalid',\n  /** Structured-generation operation requires a Zod schema on the invocation input. */\n  AGENT_STRUCTURED_SCHEMA_REQUIRED = 'agent_structured_schema_required',\n  /** AI provider client does not support any known model initialization pattern. */\n  AGENT_MODEL_INITIALIZATION_FAILED = 'agent_model_initialization_failed',\n  /** No messages provided for the (multimodal) chat completion. */\n  AGENT_MESSAGES_REQUIRED = 'agent_messages_required',\n  /** The referenced agent is not active. */\n  AGENT_NOT_ACTIVE = 'agent_not_active',\n  /** The referenced system is not a flow. */\n  FLOW_INVALID_KIND = 'flow_invalid_kind',\n  /** The referenced flow is not active. */\n  FLOW_NOT_ACTIVE = 'flow_not_active',\n  /** The referenced system is not an actor. */\n  ACTOR_INVALID_KIND = 'actor_invalid_kind',\n  /** The referenced actor is not active. */\n  ACTOR_NOT_ACTIVE = 'actor_not_active',\n  /** Chart parent context resource is not accessible to the caller. */\n  CHART_PARENT_CONTEXT_INACCESSIBLE = 'chart_parent_context_inaccessible',\n\n  // Auth-methods / SSO errors (user-directed)\n  /** Authentication is disabled for this frontend service + user type (a config gate, NOT session invalidation). */\n  AUTHENTICATION_DISABLED_FOR_SERVICE = 'authentication_disabled_for_service',\n  /** The requested OAuth2/social provider is not registered or available. */\n  OAUTH_PROVIDER_NOT_FOUND = 'oauth_provider_not_found',\n  /** The requested SSO connection was not found or is disabled. */\n  SSO_CONNECTION_NOT_FOUND = 'sso_connection_not_found',\n\n  // Config / data-seeding / email errors (user-directed)\n  /** The frontendServiceName query parameter is required to fetch application configuration. */\n  APP_CONFIGURATION_FRONTEND_SERVICE_REQUIRED = 'app_configuration_frontend_service_required',\n  /** The frontendServiceName does not match any configured frontend service identity. */\n  APP_CONFIGURATION_UNKNOWN_FRONTEND_SERVICE = 'app_configuration_unknown_frontend_service',\n  /** The data-seeding admin endpoint secret header is missing. */\n  SEED_ADMIN_SECRET_REQUIRED = 'seed_admin_secret_required',\n  /** The data-seeding admin endpoint secret header did not match. */\n  SEED_ADMIN_SECRET_INVALID = 'seed_admin_secret_invalid',\n  /** Invalid query parameters for the data-seeding admin list-runs endpoint. */\n  SEED_ADMIN_INVALID_QUERY = 'seed_admin_invalid_query',\n  /** Invalid request body for the data-seeding admin rerun endpoint. */\n  SEED_ADMIN_INVALID_PAYLOAD = 'seed_admin_invalid_payload',\n  /** updateSeedMetadata targeted a row _id that does not exist for the resource. */\n  REPOSITORY_RESOURCE_SEED_METADATA_NOT_FOUND = 'repository_resource_seed_metadata_not_found',\n  /** Email recipient/cc/bcc/replyTo list contains an address that failed format validation. */\n  EMAIL_INVALID_ADDRESS_FORMAT = 'email_invalid_address_format',\n\n  // File operation errors (user-directed)\n  /** The requested file does not exist or is not accessible. */\n  FILE_NOT_FOUND = 'file_not_found',\n  /** File cannot move to the requested status from its current state. */\n  FILE_INVALID_STATUS_TRANSITION = 'file_invalid_status_transition',\n  /** File must be in UPLOADED status before it can be linked to a resource. */\n  FILE_NOT_IN_UPLOADED_STATUS = 'file_not_in_uploaded_status',\n  /** File is already linked to a different resource. */\n  FILE_ALREADY_LINKED = 'file_already_linked',\n  /** File has already been deleted. */\n  FILE_ALREADY_DELETED = 'file_already_deleted',\n  /** Access to the requested file is denied. */\n  FILE_ACCESS_DENIED = 'file_access_denied',\n  /** File cannot be deleted while the AV scan is in progress. */\n  FILE_DELETE_WHILE_PROCESSING = 'file_delete_while_processing',\n  /** A file linked to a resource cannot be deleted; unlink it first. */\n  FILE_DELETE_LINKED_BLOCKED = 'file_delete_linked_blocked',\n  /** Only the original uploader can delete this file. */\n  FILE_DELETE_UPLOADER_ONLY = 'file_delete_uploader_only',\n  /** The file share request body is invalid. */\n  FILE_SHARE_REQUEST_INVALID = 'file_share_request_invalid',\n  /** No file was provided in the upload request. */\n  FILE_UPLOAD_NO_FILE = 'file_upload_no_file',\n  /** Too many files provided for this field (exceeds the configured maximum). */\n  FILE_TOO_MANY_FILES = 'file_too_many_files',\n  /** This file field is system-generated and cannot receive uploads/writes. */\n  FILE_GENERATED_FIELD_NOT_WRITABLE = 'file_generated_field_not_writable',\n  /** This file field is not overridable; existing files cannot be replaced or removed. */\n  FILE_FIELD_NOT_OVERRIDABLE = 'file_field_not_overridable',\n  /** The file field value has an unexpected type (expected string, array, null, or undefined). */\n  FILE_FIELD_VALUE_INVALID = 'file_field_value_invalid',\n  /** A nested file field could not be updated safely because multiple array items changed at once. */\n  FILE_NESTED_UPDATE_AMBIGUOUS = 'file_nested_update_ambiguous',\n  /** uploadedBy and uploadedByEntityType must both be set or both omitted. */\n  FILE_UPLOADER_FIELDS_INCONSISTENT = 'file_uploader_fields_inconsistent',\n  /** Explicit uploader ownership does not match the current execution principal. */\n  FILE_UPLOADER_MISMATCH = 'file_uploader_mismatch',\n  /** A required scope identifier (application/organization/user id) is missing for this file operation. */\n  FILE_SCOPE_IDENTIFIER_MISSING = 'file_scope_identifier_missing',\n  /** The scope identifiers are invalid for the specified primary scope. */\n  FILE_SCOPE_IDENTIFIER_INVALID = 'file_scope_identifier_invalid',\n  /** The file access scope could not be derived from the execution context. */\n  FILE_SCOPE_DERIVATION_FAILED = 'file_scope_derivation_failed',\n  /** Text extraction is not supported for this file's MIME type. */\n  FILE_TEXT_EXTRACTION_UNSUPPORTED_TYPE = 'file_text_extraction_unsupported_type',\n  /**\n   * The file's MIME type IS supported, but its bytes could not be parsed — corrupt, truncated,\n   * or password-protected.\n   *\n   * Deliberately distinct from every storage/wiring failure that can also arise while extracting.\n   * This one is a permanent property of the BYTES, so a batch consumer may skip the file and move\n   * on; an unreachable storage backend is transient and must NOT be treated the same way. The RAG\n   * ingestion sweep branches on exactly this distinction — see `RagIngestionBackendService`.\n   */\n  FILE_TEXT_EXTRACTION_FAILED = 'file_text_extraction_failed',\n  /** The file's blob was not found in the storage backend. */\n  FILE_NOT_FOUND_IN_STORAGE = 'file_not_found_in_storage',\n  /** Access to the file in storage was denied. */\n  FILE_STORAGE_ACCESS_DENIED = 'file_storage_access_denied',\n  /** The storage key/path could not be composed (missing file name/id). */\n  FILE_STORAGE_KEY_COMPOSITION_FAILED = 'file_storage_key_composition_failed',\n  /** The provided storage reference is empty or invalid. */\n  FILE_STORAGE_REF_INVALID = 'file_storage_ref_invalid',\n  /** The storage reference does not belong to the current application namespace. */\n  FILE_STORAGE_REF_FORBIDDEN = 'file_storage_ref_forbidden',\n  /** The requested file path escapes the allowed storage directory. */\n  FILE_PATH_TRAVERSAL_DETECTED = 'file_path_traversal_detected',\n\n  /** A bulk relationship operation must provide either _ids or a filter selector. */\n  BULK_RELATIONSHIP_SELECTOR_REQUIRED = 'bulk_relationship_selector_required',\n}"]}

package/dist/esm/errors/errors.shared.definitions.d.ts

@@ -1,5 +1,5 @@
-import { ErrorType } from "./errors.shared.schemas.js";
-import { WildoError_Definition } from "./errors.shared.schemas.js";
+import { ErrorType } from "./errors.shared.schemas";
+import { WildoError_Definition } from "./errors.shared.schemas";
 /**
  * Fields that can appear in error guidance labels.
  * Each error ref declares which of these fields it needs via ERROR_GUIDANCE_REFS.

package/dist/esm/errors/errors.shared.definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.shared.definitions.d.ts","sourceRoot":"","sources":["../../../src/errors/errors.shared.definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAiH,SAAS,EAA2B,MAAM,yBAAyB,CAAC;AAC5L,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAQhE;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,WAAW,gBAAgB;IAC3B,UAAU,eAAe;IACzB,iBAAiB,oBAAoB;IACrC,eAAe,mBAAmB;CACnC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAiCpE,CAAC;AAGF;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,SAAS,EAAE,qBAAqB,CAkPpE,CAAC"}
+{"version":3,"file":"errors.shared.definitions.d.ts","sourceRoot":"","sources":["../../../../src/errors/errors.shared.definitions.ts"],"names":[],"mappings":"AACA,OAAO,EAAiH,SAAS,EAA2B,MAAM,yBAAyB,CAAC;AAC5L,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAQhE;;;GAGG;AACH,oBAAY,kBAAkB;IAC5B,WAAW,gBAAgB;IAC3B,UAAU,eAAe;IACzB,iBAAiB,oBAAoB;IACrC,eAAe,mBAAmB;CACnC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAiCpE,CAAC;AAGF;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,SAAS,EAAE,qBAAqB,CA8PpE,CAAC"}

package/dist/esm/errors/errors.shared.definitions.js

@@ -96,6 +96,17 @@ export const ERROR_DEFINITIONS = {
         showToUser: true,
         backendActions: [ErrorActionBackend.LOG],
     },
+    [ErrorType.PAYLOAD_TOO_LARGE]: {
+        type: ErrorType.PAYLOAD_TOO_LARGE,
+        description: 'Request body exceeded a size limit',
+        statusCode: HttpStatusCode.PAYLOAD_TOO_LARGE,
+        defaultCustomMessageReference: ErrorCustomMessageReference.CONTENT_LENGTH_VALIDATION_FAILED,
+        severity: ErrorSeverity.LOW,
+        frontendActions: [ErrorActionFrontend.NOTIFY],
+        errorHandlingStrategy: ErrorHandling_Strategy.STOP,
+        showToUser: true,
+        backendActions: [ErrorActionBackend.LOG],
+    },
     [ErrorType.NOT_FOUND]: {
         type: ErrorType.NOT_FOUND,
         description: 'Requested resource not found',
@@ -284,4 +295,4 @@ export const ERROR_DEFINITIONS = {
         backendActions: [ErrorActionBackend.LOG, ErrorActionBackend.RECORD_METRICS],
     },
 };
-//# sourceMappingURL=errors.shared.definitions.js.map
+//# sourceMappingURL=errors.shared.definitions.js.map