@wildo-ai/saas-models 1.1.4 → 1.1.5

package/dist/esm/systems-of-record/system-of-record-env.shared.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `WILDO_SOR_<NAME>__<SLOT>` — the ONE derivation of a system-of-record environment-variable name.
+ *
+ * ## Derived, never authored, and why that is the whole design
+ *
+ * The lane this replaces put the variable NAMES in the vendor's module — `ODOO_BASE_URL`,
+ * `ODOO_DB`, `ODOO_LOGIN`, `ODOO_API_KEY` — so a second Odoo was unrepresentable: the name space was
+ * the vendor's, not the instance's. Deriving from the instance NAME instead means two instances of
+ * one vendor cost nothing (`WILDO_SOR_ODOO_FR__BASE_URL` beside `WILDO_SOR_ODOO_DE__BASE_URL`), and
+ * an author never invents a variable name that some other layer then has to guess.
+ *
+ * ## Why the delimiter is a DOUBLE underscore (#1055 R4)
+ *
+ * The pair must be RECOVERABLE — the secrets section is a flat map keyed by variable name (R5), and
+ * per-instance structure is recovered by parsing the key back. With a single underscore,
+ * `odoo-api` + `key` and `odoo` + `apiKey` both derive `WILDO_SOR_ODOO_API_KEY` and nothing could
+ * tell them apart. `__` cannot be produced by either half: an instance name admits only
+ * `[a-z0-9-]` and a slot slug only `[a-zA-Z0-9]`, so neither can emit an underscore at all, and the
+ * only `__` in a derived name is the delimiter. The collision is impossible by construction rather
+ * than checked for.
+ *
+ * That property is load-bearing, so the two charset laws are not cosmetic: widening either one
+ * silently reintroduces the ambiguity. `SYSTEM_OF_RECORD_NAME_PATTERN` and the slot-slug regex are
+ * pinned against this file's round trip for that reason.
+ *
+ * ## Four readers, one authority
+ *
+ * The backend `.env` writer, the k8s secrets generator, the CI secret collector and the backend
+ * registry all need the same name, and three of them live in different packages. Re-deriving it at
+ * each would be the enumeration failure `invariant-call-site-enumeration.md` records — so this module
+ * is the authority and every one of them imports it.
+ */
+/** Every system-of-record variable starts here, which is what makes a prefix scan possible. */
+export declare const SYSTEM_OF_RECORD_ENV_PREFIX = "WILDO_SOR_";
+/** The delimiter between the instance name and the slot. See the module header for why it is two. */
+export declare const SYSTEM_OF_RECORD_ENV_DELIMITER = "__";
+/** The charset law for a slot slug, shared with the facet schema so the two cannot drift apart. */
+export declare const SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN: RegExp;
+/**
+ * The slot slug an instance may never declare, because the environment builder emits it itself.
+ *
+ * `WILDO_SOR_<NAME>__ENABLED=false` is how an environment says it has NO access to this system —
+ * a developer laptop, a staging with no ERP (#1055 E3, R6). A facet declaring a slot named `enabled`
+ * would produce the same variable and make "declared absent" indistinguishable from "an address slot
+ * whose value happens to be false", so the name is reserved and the facet schema refuses it.
+ */
+export declare const SYSTEM_OF_RECORD_ENABLED_SLOT = "enabled";
+/**
+ * The name of the environment variable carrying one slot of one instance.
+ *
+ * Throws on a name or slug outside its charset law rather than emitting a name that cannot be parsed
+ * back: both halves are validated where they are authored, so reaching here with a bad one means a
+ * caller skipped a schema, and a silently unparseable variable is worse than a loud refusal.
+ */
+export declare function deriveSystemOfRecordEnvVarName(instanceName: string, slotSlug: string): string;
+/**
+ * `WILDO_SOR_<NAME>__ENABLED` — present and `false` when an environment declares it has no access to
+ * this instance (E3). Its ABSENCE, with required slots missing, is the different and louder case:
+ * an environment that simply forgot (E4). Silence is never a declaration, which is why the two are
+ * distinguishable at all.
+ */
+export declare function deriveSystemOfRecordEnabledEnvVarName(instanceName: string): string;
+/** What a derived variable name was made of. */
+export interface SystemOfRecordEnvVarParts {
+    readonly instanceName: string;
+    readonly slotSlug: string;
+}
+/**
+ * Recover the `(instance, slot)` pair from a derived variable name, or `null` when the name is not
+ * one of ours.
+ *
+ * `null` rather than a throw because the callers scan a MIXED environment — every variable a
+ * deployment carries goes past this function, and most of them are not system-of-record variables.
+ * A name that starts with the prefix and still does not parse is also `null`: it is not ours either,
+ * and refusing an operator's unrelated `WILDO_SOR_SOMETHING` would be this module deciding what an
+ * environment may contain.
+ */
+export declare function parseSystemOfRecordEnvVarName(envVarName: string): SystemOfRecordEnvVarParts | null;
+//# sourceMappingURL=system-of-record-env.shared.d.ts.map

package/dist/esm/systems-of-record/system-of-record-env.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-env.shared.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,+FAA+F;AAC/F,eAAO,MAAM,2BAA2B,eAAe,CAAC;AAExD,qGAAqG;AACrG,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,mGAAmG;AACnG,eAAO,MAAM,kCAAkC,QAAwB,CAAC;AAExE;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,YAAY,CAAC;AAYvD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ7F;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElF;AAQD,gDAAgD;AAChD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAgBlG"}

package/dist/esm/systems-of-record/system-of-record-env.shared.js

@@ -0,0 +1,116 @@
+/**
+ * `WILDO_SOR_<NAME>__<SLOT>` — the ONE derivation of a system-of-record environment-variable name.
+ *
+ * ## Derived, never authored, and why that is the whole design
+ *
+ * The lane this replaces put the variable NAMES in the vendor's module — `ODOO_BASE_URL`,
+ * `ODOO_DB`, `ODOO_LOGIN`, `ODOO_API_KEY` — so a second Odoo was unrepresentable: the name space was
+ * the vendor's, not the instance's. Deriving from the instance NAME instead means two instances of
+ * one vendor cost nothing (`WILDO_SOR_ODOO_FR__BASE_URL` beside `WILDO_SOR_ODOO_DE__BASE_URL`), and
+ * an author never invents a variable name that some other layer then has to guess.
+ *
+ * ## Why the delimiter is a DOUBLE underscore (#1055 R4)
+ *
+ * The pair must be RECOVERABLE — the secrets section is a flat map keyed by variable name (R5), and
+ * per-instance structure is recovered by parsing the key back. With a single underscore,
+ * `odoo-api` + `key` and `odoo` + `apiKey` both derive `WILDO_SOR_ODOO_API_KEY` and nothing could
+ * tell them apart. `__` cannot be produced by either half: an instance name admits only
+ * `[a-z0-9-]` and a slot slug only `[a-zA-Z0-9]`, so neither can emit an underscore at all, and the
+ * only `__` in a derived name is the delimiter. The collision is impossible by construction rather
+ * than checked for.
+ *
+ * That property is load-bearing, so the two charset laws are not cosmetic: widening either one
+ * silently reintroduces the ambiguity. `SYSTEM_OF_RECORD_NAME_PATTERN` and the slot-slug regex are
+ * pinned against this file's round trip for that reason.
+ *
+ * ## Four readers, one authority
+ *
+ * The backend `.env` writer, the k8s secrets generator, the CI secret collector and the backend
+ * registry all need the same name, and three of them live in different packages. Re-deriving it at
+ * each would be the enumeration failure `invariant-call-site-enumeration.md` records — so this module
+ * is the authority and every one of them imports it.
+ */
+import { SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas.js';
+/** Every system-of-record variable starts here, which is what makes a prefix scan possible. */
+export const SYSTEM_OF_RECORD_ENV_PREFIX = 'WILDO_SOR_';
+/** The delimiter between the instance name and the slot. See the module header for why it is two. */
+export const SYSTEM_OF_RECORD_ENV_DELIMITER = '__';
+/** The charset law for a slot slug, shared with the facet schema so the two cannot drift apart. */
+export const SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
+/**
+ * The slot slug an instance may never declare, because the environment builder emits it itself.
+ *
+ * `WILDO_SOR_<NAME>__ENABLED=false` is how an environment says it has NO access to this system —
+ * a developer laptop, a staging with no ERP (#1055 E3, R6). A facet declaring a slot named `enabled`
+ * would produce the same variable and make "declared absent" indistinguishable from "an address slot
+ * whose value happens to be false", so the name is reserved and the facet schema refuses it.
+ */
+export const SYSTEM_OF_RECORD_ENABLED_SLOT = 'enabled';
+/** `odoo-fr` → `ODOO_FR`. The only transformation a name undergoes. */
+function encodeInstanceName(instanceName) {
+    return instanceName.toUpperCase().replaceAll('-', '_');
+}
+/** `apiKey` → `API_KEY`, `baseUrl` → `BASE_URL`. lowerCamelCase to UPPER_SNAKE, and back below. */
+function encodeSlotSlug(slotSlug) {
+    return slotSlug.replace(/([A-Z])/g, '_$1').toUpperCase();
+}
+/**
+ * The name of the environment variable carrying one slot of one instance.
+ *
+ * Throws on a name or slug outside its charset law rather than emitting a name that cannot be parsed
+ * back: both halves are validated where they are authored, so reaching here with a bad one means a
+ * caller skipped a schema, and a silently unparseable variable is worse than a loud refusal.
+ */
+export function deriveSystemOfRecordEnvVarName(instanceName, slotSlug) {
+    if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName)) {
+        throw new Error(`"${instanceName}" is not a valid system-of-record instance name (lower-kebab-case, starting with a letter).`);
+    }
+    if (!SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) {
+        throw new Error(`"${slotSlug}" is not a valid system-of-record slot slug (lowerCamelCase, no separators).`);
+    }
+    return `${SYSTEM_OF_RECORD_ENV_PREFIX}${encodeInstanceName(instanceName)}${SYSTEM_OF_RECORD_ENV_DELIMITER}${encodeSlotSlug(slotSlug)}`;
+}
+/**
+ * `WILDO_SOR_<NAME>__ENABLED` — present and `false` when an environment declares it has no access to
+ * this instance (E3). Its ABSENCE, with required slots missing, is the different and louder case:
+ * an environment that simply forgot (E4). Silence is never a declaration, which is why the two are
+ * distinguishable at all.
+ */
+export function deriveSystemOfRecordEnabledEnvVarName(instanceName) {
+    return deriveSystemOfRecordEnvVarName(instanceName, SYSTEM_OF_RECORD_ENABLED_SLOT);
+}
+/** `API_KEY` → `apiKey`. The inverse of `encodeSlotSlug`, exact because a slug carries no separator. */
+function decodeSlotSlug(encoded) {
+    const [head, ...rest] = encoded.toLowerCase().split('_');
+    return [head, ...rest.map((part) => (part.length === 0 ? part : part[0].toUpperCase() + part.slice(1)))].join('');
+}
+/**
+ * Recover the `(instance, slot)` pair from a derived variable name, or `null` when the name is not
+ * one of ours.
+ *
+ * `null` rather than a throw because the callers scan a MIXED environment — every variable a
+ * deployment carries goes past this function, and most of them are not system-of-record variables.
+ * A name that starts with the prefix and still does not parse is also `null`: it is not ours either,
+ * and refusing an operator's unrelated `WILDO_SOR_SOMETHING` would be this module deciding what an
+ * environment may contain.
+ */
+export function parseSystemOfRecordEnvVarName(envVarName) {
+    if (!envVarName.startsWith(SYSTEM_OF_RECORD_ENV_PREFIX))
+        return null;
+    const body = envVarName.slice(SYSTEM_OF_RECORD_ENV_PREFIX.length);
+    const delimiterIndex = body.indexOf(SYSTEM_OF_RECORD_ENV_DELIMITER);
+    if (delimiterIndex <= 0)
+        return null;
+    const instanceName = body.slice(0, delimiterIndex).toLowerCase().replaceAll('_', '-');
+    const encodedSlot = body.slice(delimiterIndex + SYSTEM_OF_RECORD_ENV_DELIMITER.length);
+    if (encodedSlot.length === 0)
+        return null;
+    // A second delimiter means the name was not produced here: neither half can emit `__`.
+    if (encodedSlot.includes(SYSTEM_OF_RECORD_ENV_DELIMITER))
+        return null;
+    const slotSlug = decodeSlotSlug(encodedSlot);
+    if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName) || !SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug))
+        return null;
+    return { instanceName, slotSlug };
+}
+//# sourceMappingURL=system-of-record-env.shared.js.map

package/dist/esm/systems-of-record/system-of-record-env.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-env.shared.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAE9F,+FAA+F;AAC/F,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AAExD,qGAAqG;AACrG,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,mGAAmG;AACnG,MAAM,CAAC,MAAM,kCAAkC,GAAG,qBAAqB,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC;AAEvD,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,mGAAmG;AACnG,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,YAAoB,EAAE,QAAgB;IACnF,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,IAAI,YAAY,6FAA6F,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,IAAI,QAAQ,8EAA8E,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,GAAG,2BAA2B,GAAG,kBAAkB,CAAC,YAAY,CAAC,GAAG,8BAA8B,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzI,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB;IACxE,OAAO,8BAA8B,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;AACrF,CAAC;AAED,wGAAwG;AACxG,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrH,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAAkB;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACpE,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,uFAAuF;IACvF,IAAI,WAAW,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC","sourcesContent":["/**\n * `WILDO_SOR_<NAME>__<SLOT>` — the ONE derivation of a system-of-record environment-variable name.\n *\n * ## Derived, never authored, and why that is the whole design\n *\n * The lane this replaces put the variable NAMES in the vendor's module — `ODOO_BASE_URL`,\n * `ODOO_DB`, `ODOO_LOGIN`, `ODOO_API_KEY` — so a second Odoo was unrepresentable: the name space was\n * the vendor's, not the instance's. Deriving from the instance NAME instead means two instances of\n * one vendor cost nothing (`WILDO_SOR_ODOO_FR__BASE_URL` beside `WILDO_SOR_ODOO_DE__BASE_URL`), and\n * an author never invents a variable name that some other layer then has to guess.\n *\n * ## Why the delimiter is a DOUBLE underscore (#1055 R4)\n *\n * The pair must be RECOVERABLE — the secrets section is a flat map keyed by variable name (R5), and\n * per-instance structure is recovered by parsing the key back. With a single underscore,\n * `odoo-api` + `key` and `odoo` + `apiKey` both derive `WILDO_SOR_ODOO_API_KEY` and nothing could\n * tell them apart. `__` cannot be produced by either half: an instance name admits only\n * `[a-z0-9-]` and a slot slug only `[a-zA-Z0-9]`, so neither can emit an underscore at all, and the\n * only `__` in a derived name is the delimiter. The collision is impossible by construction rather\n * than checked for.\n *\n * That property is load-bearing, so the two charset laws are not cosmetic: widening either one\n * silently reintroduces the ambiguity. `SYSTEM_OF_RECORD_NAME_PATTERN` and the slot-slug regex are\n * pinned against this file's round trip for that reason.\n *\n * ## Four readers, one authority\n *\n * The backend `.env` writer, the k8s secrets generator, the CI secret collector and the backend\n * registry all need the same name, and three of them live in different packages. Re-deriving it at\n * each would be the enumeration failure `invariant-call-site-enumeration.md` records — so this module\n * is the authority and every one of them imports it.\n */\n\nimport { SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas';\n\n/** Every system-of-record variable starts here, which is what makes a prefix scan possible. */\nexport const SYSTEM_OF_RECORD_ENV_PREFIX = 'WILDO_SOR_';\n\n/** The delimiter between the instance name and the slot. See the module header for why it is two. */\nexport const SYSTEM_OF_RECORD_ENV_DELIMITER = '__';\n\n/** The charset law for a slot slug, shared with the facet schema so the two cannot drift apart. */\nexport const SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN = /^[a-z][a-zA-Z0-9]*$/;\n\n/**\n * The slot slug an instance may never declare, because the environment builder emits it itself.\n *\n * `WILDO_SOR_<NAME>__ENABLED=false` is how an environment says it has NO access to this system —\n * a developer laptop, a staging with no ERP (#1055 E3, R6). A facet declaring a slot named `enabled`\n * would produce the same variable and make \"declared absent\" indistinguishable from \"an address slot\n * whose value happens to be false\", so the name is reserved and the facet schema refuses it.\n */\nexport const SYSTEM_OF_RECORD_ENABLED_SLOT = 'enabled';\n\n/** `odoo-fr` → `ODOO_FR`. The only transformation a name undergoes. */\nfunction encodeInstanceName(instanceName: string): string {\n  return instanceName.toUpperCase().replaceAll('-', '_');\n}\n\n/** `apiKey` → `API_KEY`, `baseUrl` → `BASE_URL`. lowerCamelCase to UPPER_SNAKE, and back below. */\nfunction encodeSlotSlug(slotSlug: string): string {\n  return slotSlug.replace(/([A-Z])/g, '_$1').toUpperCase();\n}\n\n/**\n * The name of the environment variable carrying one slot of one instance.\n *\n * Throws on a name or slug outside its charset law rather than emitting a name that cannot be parsed\n * back: both halves are validated where they are authored, so reaching here with a bad one means a\n * caller skipped a schema, and a silently unparseable variable is worse than a loud refusal.\n */\nexport function deriveSystemOfRecordEnvVarName(instanceName: string, slotSlug: string): string {\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName)) {\n    throw new Error(`\"${instanceName}\" is not a valid system-of-record instance name (lower-kebab-case, starting with a letter).`);\n  }\n  if (!SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) {\n    throw new Error(`\"${slotSlug}\" is not a valid system-of-record slot slug (lowerCamelCase, no separators).`);\n  }\n  return `${SYSTEM_OF_RECORD_ENV_PREFIX}${encodeInstanceName(instanceName)}${SYSTEM_OF_RECORD_ENV_DELIMITER}${encodeSlotSlug(slotSlug)}`;\n}\n\n/**\n * `WILDO_SOR_<NAME>__ENABLED` — present and `false` when an environment declares it has no access to\n * this instance (E3). Its ABSENCE, with required slots missing, is the different and louder case:\n * an environment that simply forgot (E4). Silence is never a declaration, which is why the two are\n * distinguishable at all.\n */\nexport function deriveSystemOfRecordEnabledEnvVarName(instanceName: string): string {\n  return deriveSystemOfRecordEnvVarName(instanceName, SYSTEM_OF_RECORD_ENABLED_SLOT);\n}\n\n/** `API_KEY` → `apiKey`. The inverse of `encodeSlotSlug`, exact because a slug carries no separator. */\nfunction decodeSlotSlug(encoded: string): string {\n  const [head, ...rest] = encoded.toLowerCase().split('_');\n  return [head, ...rest.map((part) => (part.length === 0 ? part : part[0]!.toUpperCase() + part.slice(1)))].join('');\n}\n\n/** What a derived variable name was made of. */\nexport interface SystemOfRecordEnvVarParts {\n  readonly instanceName: string;\n  readonly slotSlug: string;\n}\n\n/**\n * Recover the `(instance, slot)` pair from a derived variable name, or `null` when the name is not\n * one of ours.\n *\n * `null` rather than a throw because the callers scan a MIXED environment — every variable a\n * deployment carries goes past this function, and most of them are not system-of-record variables.\n * A name that starts with the prefix and still does not parse is also `null`: it is not ours either,\n * and refusing an operator's unrelated `WILDO_SOR_SOMETHING` would be this module deciding what an\n * environment may contain.\n */\nexport function parseSystemOfRecordEnvVarName(envVarName: string): SystemOfRecordEnvVarParts | null {\n  if (!envVarName.startsWith(SYSTEM_OF_RECORD_ENV_PREFIX)) return null;\n  const body = envVarName.slice(SYSTEM_OF_RECORD_ENV_PREFIX.length);\n  const delimiterIndex = body.indexOf(SYSTEM_OF_RECORD_ENV_DELIMITER);\n  if (delimiterIndex <= 0) return null;\n\n  const instanceName = body.slice(0, delimiterIndex).toLowerCase().replaceAll('_', '-');\n  const encodedSlot = body.slice(delimiterIndex + SYSTEM_OF_RECORD_ENV_DELIMITER.length);\n  if (encodedSlot.length === 0) return null;\n  // A second delimiter means the name was not produced here: neither half can emit `__`.\n  if (encodedSlot.includes(SYSTEM_OF_RECORD_ENV_DELIMITER)) return null;\n\n  const slotSlug = decodeSlotSlug(encodedSlot);\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName) || !SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) return null;\n\n  return { instanceName, slotSlug };\n}\n"]}

package/dist/esm/systems-of-record/system-of-record-error-codes.shared.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Stable codes a client can branch on when a system of record refuses (#1055).
+ *
+ * Two audiences, and the split matters because the remedies are different people's work:
+ *
+ * - **Boot codes** name an incoherent DECLARATION — a vendor nothing ships, a dialect the facet does
+ *   not speak, a slot the environment never supplied. Every one of them is fixed by editing a file
+ *   and restarting, which needs no running companion, so refusing at boot is legitimate
+ *   (`continuity-drift-and-cas-basis.md` Rule 3 — the remedy does not route back through the thing
+ *   that just refused).
+ * - **Request codes** name a state of the WORLD at the moment of a read: this environment has no
+ *   access to the instance, or the owner organization is not seeded yet. Neither is an authoring
+ *   mistake, and both must answer with a code rather than a 500 or a silent empty list.
+ *
+ * Carried in the error's `context.code`, which survives `sanitizeErrorForClient` for `CONFLICT` and
+ * `VALIDATION` — the reason those two error types are used here rather than `AUTHORIZATION`, whose
+ * context is stripped entirely. A refusal a client cannot branch on is a refusal a client will retry.
+ */
+/** Why a system of record could not be prepared, or could not be read. */
+export declare enum SystemOfRecordErrorCode {
+    /**
+     * BOOT — an instance names a vendor no facet answers to.
+     *
+     * The engine ships some facets and a package may ship others (#1057), so this means the vendor is
+     * spelled wrong OR the package that owns it is not installed. The message names both, because from
+     * inside the registry the two are indistinguishable.
+     */
+    VENDOR_HAS_NO_FACET = "SYSTEM_OF_RECORD_VENDOR_HAS_NO_FACET",
+    /**
+     * BOOT — the application declares systems of record, but its provider runtime artifact lists no facet
+     * modules at all: it predates the field, or was never generated. Distinct from
+     * {@link VENDOR_HAS_NO_FACET}, because the remedy is a regeneration rather than a spelling or an
+     * install, and reporting it as that one sent a correct configuration looking for a typo (2026-09-24).
+     */
+    FACET_MODULES_NOT_GENERATED = "SYSTEM_OF_RECORD_FACET_MODULES_NOT_GENERATED",
+    /**
+     * BOOT — the instance declares a dialect its vendor's facet does not speak.
+     *
+     * A vendor may legitimately offer several (a service reachable over OData v4 and a bespoke REST
+     * surface is one vendor, two ways in), so this is checked against the facet's list rather than
+     * assumed from the vendor.
+     */
+    DIALECT_NOT_SPOKEN_BY_VENDOR = "SYSTEM_OF_RECORD_DIALECT_NOT_SPOKEN_BY_VENDOR",
+    /**
+     * BOOT — the instance names a credential kind its vendor does not offer.
+     */
+    CREDENTIAL_KIND_NOT_OFFERED = "SYSTEM_OF_RECORD_CREDENTIAL_KIND_NOT_OFFERED",
+    /**
+     * BOOT — the vendor offers several credential kinds and the instance named none.
+     *
+     * Only reachable once a facet offers more than one (#1056). Until then the kind is DERIVED and an
+     * author is never asked for something with a single legal answer.
+     */
+    CREDENTIAL_KIND_AMBIGUOUS = "SYSTEM_OF_RECORD_CREDENTIAL_KIND_AMBIGUOUS",
+    /**
+     * BOOT — a required slot's environment variable is unset while the environment DID author a block
+     * for the instance (#1055 E4).
+     *
+     * Distinct from the instance being declared absent: an environment that has no access says so with
+     * `{ enabled: false }`, and this is what is left — an environment that meant to have access and is
+     * missing a value. Silence is not a declaration, which is why these two are separable at all.
+     */
+    REQUIRED_SLOT_MISSING = "SYSTEM_OF_RECORD_REQUIRED_SLOT_MISSING",
+    /**
+     * BOOT — a resource's `httpApiBinding` names an instance the application does not declare.
+     *
+     * Checked at REGISTRATION rather than in the resource factory, because the factory runs in the
+     * application's `shared-lib` where the saas configuration is not in scope. The factory checks
+     * SHAPE; this checks AGREEMENT, at the first moment both are visible.
+     */
+    BINDING_NAMES_UNDECLARED_SYSTEM = "SYSTEM_OF_RECORD_BINDING_NAMES_UNDECLARED_SYSTEM",
+    /**
+     * BOOT — a binding's dialect and its instance's dialect disagree.
+     *
+     * Both are authored, in different files, and the binding's is the discriminator of its own
+     * per-dialect union — so the binding cannot simply inherit the instance's, and the disagreement has
+     * to be refused where both are known.
+     */
+    BINDING_DIALECT_DISAGREES_WITH_SYSTEM = "SYSTEM_OF_RECORD_BINDING_DIALECT_DISAGREES_WITH_SYSTEM",
+    /**
+     * REQUEST — this environment declared it has no access to the instance (#1055 E3).
+     *
+     * A developer laptop and a staging with no ERP are the ordinary case. The application boots, every
+     * other resource works, and a read on a bound resource answers this rather than a transport error
+     * against an address nobody authored.
+     */
+    UNAVAILABLE_IN_ENVIRONMENT = "SYSTEM_OF_RECORD_UNAVAILABLE_IN_ENVIRONMENT",
+    /**
+     * REQUEST — the application has no owner organization to stamp remote rows with (#1055 E10,
+     * resting on #1054 E1).
+     *
+     * A fresh install before bootstrap runs is the real case. Rows read out of a system of record carry
+     * the owner organization's id so the per-row tenant gate passes without an exemption; with no owner
+     * there is nothing to stamp, and answering an empty list would say "this system holds nothing about
+     * you", which is false.
+     */
+    OWNER_ORGANIZATION_ABSENT = "SYSTEM_OF_RECORD_OWNER_ORGANIZATION_ABSENT",
+    /**
+     * REQUEST — the instance's token endpoint could not be reached, refused to mint, or answered
+     * something that is not a token (#1056 E2, E3; R11).
+     *
+     * ONE code for the whole family rather than one per failure, with a `reason` in the context and an
+     * optional `retryAfterSeconds` taken from the answer's `Retry-After`. The family is deliberately
+     * coarse because every member has the same shape from a caller's side: the remote is not currently
+     * giving us an identity, the request cannot proceed, and retrying later may work. Splitting it
+     * would ask a client to branch on a distinction it cannot act on differently.
+     *
+     * Never carries the token endpoint's own `error_description` verbatim into a client-visible
+     * message: an authorization server is entitled to say things about the credential, and a
+     * credential's failure mode is not an application user's business. The detail is logged.
+     */
+    TOKEN_UNAVAILABLE = "SYSTEM_OF_RECORD_TOKEN_UNAVAILABLE",
+    /**
+     * BOOT — the instance's credential material cannot produce a credential at all: an encrypted
+     * private key (#1056 E6), a certificate whose validity window does not contain now (E7), a BASIC
+     * username carrying the `:` that RFC 7617 makes the delimiter (E11).
+     *
+     * Separate from {@link REQUIRED_SLOT_MISSING} because the remedy is different: a value IS present
+     * and it is the wrong KIND of value, so an operator re-reading their environment for a blank finds
+     * nothing. Refused at boot rather than at the first read — the material is known then, and a
+     * certificate that expired last week should not first be noticed by a user.
+     */
+    CREDENTIAL_MATERIAL_UNUSABLE = "SYSTEM_OF_RECORD_CREDENTIAL_MATERIAL_UNUSABLE",
+    /**
+     * BOOT — the instance opts into partitioning and its vendor declares none (#1058).
+     *
+     * Refused rather than ignored, for the reason the `partition` field was RESERVED for three slices:
+     * an author who writes `partition: true` and sees it accepted believes their rows are confined to
+     * organization units while every member still sees every row. An accepted declaration that does
+     * nothing is worse than a refusal, because only one of the two is visible.
+     */
+    PARTITION_NOT_SUPPORTED_BY_VENDOR = "SYSTEM_OF_RECORD_PARTITION_NOT_SUPPORTED_BY_VENDOR",
+    /**
+     * BOOT — the instance opts into partitioning and its vendor partitions by a PATH SEGMENT, which
+     * this engine cannot confine (#1058 E9).
+     *
+     * A path segment is chosen before the request is built, so it cannot express "these three
+     * companies" in one read: the confinement would have to fan out into one request per unit, which is
+     * a different MECHANISM rather than a different predicate. Distinct from the code above because the
+     * remedy differs — there the vendor has no partitions at all, here it has partitions this engine
+     * does not yet reach, and only the second is a gap on our side.
+     */
+    PARTITION_KIND_UNSUPPORTED = "SYSTEM_OF_RECORD_PARTITION_KIND_UNSUPPORTED"
+}
+//# sourceMappingURL=system-of-record-error-codes.shared.d.ts.map

package/dist/esm/systems-of-record/system-of-record-error-codes.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-error-codes.shared.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-error-codes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,0EAA0E;AAC1E,oBAAY,uBAAuB;IACjC;;;;;;OAMG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;OAKG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;;OAMG;IACH,4BAA4B,kDAAkD;IAE9E;;OAEG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;OAKG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;OAOG;IACH,qBAAqB,2CAA2C;IAEhE;;;;;;OAMG;IACH,+BAA+B,qDAAqD;IAEpF;;;;;;OAMG;IACH,qCAAqC,2DAA2D;IAEhG;;;;;;OAMG;IACH,0BAA0B,gDAAgD;IAE1E;;;;;;;;OAQG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,uCAAuC;IAExD;;;;;;;;;OASG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,iCAAiC,uDAAuD;IAExF;;;;;;;;;OASG;IACH,0BAA0B,gDAAgD;CAC3E"}

package/dist/esm/systems-of-record/system-of-record-error-codes.shared.js

@@ -0,0 +1,146 @@
+/**
+ * Stable codes a client can branch on when a system of record refuses (#1055).
+ *
+ * Two audiences, and the split matters because the remedies are different people's work:
+ *
+ * - **Boot codes** name an incoherent DECLARATION — a vendor nothing ships, a dialect the facet does
+ *   not speak, a slot the environment never supplied. Every one of them is fixed by editing a file
+ *   and restarting, which needs no running companion, so refusing at boot is legitimate
+ *   (`continuity-drift-and-cas-basis.md` Rule 3 — the remedy does not route back through the thing
+ *   that just refused).
+ * - **Request codes** name a state of the WORLD at the moment of a read: this environment has no
+ *   access to the instance, or the owner organization is not seeded yet. Neither is an authoring
+ *   mistake, and both must answer with a code rather than a 500 or a silent empty list.
+ *
+ * Carried in the error's `context.code`, which survives `sanitizeErrorForClient` for `CONFLICT` and
+ * `VALIDATION` — the reason those two error types are used here rather than `AUTHORIZATION`, whose
+ * context is stripped entirely. A refusal a client cannot branch on is a refusal a client will retry.
+ */
+/** Why a system of record could not be prepared, or could not be read. */
+export var SystemOfRecordErrorCode;
+(function (SystemOfRecordErrorCode) {
+    /**
+     * BOOT — an instance names a vendor no facet answers to.
+     *
+     * The engine ships some facets and a package may ship others (#1057), so this means the vendor is
+     * spelled wrong OR the package that owns it is not installed. The message names both, because from
+     * inside the registry the two are indistinguishable.
+     */
+    SystemOfRecordErrorCode["VENDOR_HAS_NO_FACET"] = "SYSTEM_OF_RECORD_VENDOR_HAS_NO_FACET";
+    /**
+     * BOOT — the application declares systems of record, but its provider runtime artifact lists no facet
+     * modules at all: it predates the field, or was never generated. Distinct from
+     * {@link VENDOR_HAS_NO_FACET}, because the remedy is a regeneration rather than a spelling or an
+     * install, and reporting it as that one sent a correct configuration looking for a typo (2026-09-24).
+     */
+    SystemOfRecordErrorCode["FACET_MODULES_NOT_GENERATED"] = "SYSTEM_OF_RECORD_FACET_MODULES_NOT_GENERATED";
+    /**
+     * BOOT — the instance declares a dialect its vendor's facet does not speak.
+     *
+     * A vendor may legitimately offer several (a service reachable over OData v4 and a bespoke REST
+     * surface is one vendor, two ways in), so this is checked against the facet's list rather than
+     * assumed from the vendor.
+     */
+    SystemOfRecordErrorCode["DIALECT_NOT_SPOKEN_BY_VENDOR"] = "SYSTEM_OF_RECORD_DIALECT_NOT_SPOKEN_BY_VENDOR";
+    /**
+     * BOOT — the instance names a credential kind its vendor does not offer.
+     */
+    SystemOfRecordErrorCode["CREDENTIAL_KIND_NOT_OFFERED"] = "SYSTEM_OF_RECORD_CREDENTIAL_KIND_NOT_OFFERED";
+    /**
+     * BOOT — the vendor offers several credential kinds and the instance named none.
+     *
+     * Only reachable once a facet offers more than one (#1056). Until then the kind is DERIVED and an
+     * author is never asked for something with a single legal answer.
+     */
+    SystemOfRecordErrorCode["CREDENTIAL_KIND_AMBIGUOUS"] = "SYSTEM_OF_RECORD_CREDENTIAL_KIND_AMBIGUOUS";
+    /**
+     * BOOT — a required slot's environment variable is unset while the environment DID author a block
+     * for the instance (#1055 E4).
+     *
+     * Distinct from the instance being declared absent: an environment that has no access says so with
+     * `{ enabled: false }`, and this is what is left — an environment that meant to have access and is
+     * missing a value. Silence is not a declaration, which is why these two are separable at all.
+     */
+    SystemOfRecordErrorCode["REQUIRED_SLOT_MISSING"] = "SYSTEM_OF_RECORD_REQUIRED_SLOT_MISSING";
+    /**
+     * BOOT — a resource's `httpApiBinding` names an instance the application does not declare.
+     *
+     * Checked at REGISTRATION rather than in the resource factory, because the factory runs in the
+     * application's `shared-lib` where the saas configuration is not in scope. The factory checks
+     * SHAPE; this checks AGREEMENT, at the first moment both are visible.
+     */
+    SystemOfRecordErrorCode["BINDING_NAMES_UNDECLARED_SYSTEM"] = "SYSTEM_OF_RECORD_BINDING_NAMES_UNDECLARED_SYSTEM";
+    /**
+     * BOOT — a binding's dialect and its instance's dialect disagree.
+     *
+     * Both are authored, in different files, and the binding's is the discriminator of its own
+     * per-dialect union — so the binding cannot simply inherit the instance's, and the disagreement has
+     * to be refused where both are known.
+     */
+    SystemOfRecordErrorCode["BINDING_DIALECT_DISAGREES_WITH_SYSTEM"] = "SYSTEM_OF_RECORD_BINDING_DIALECT_DISAGREES_WITH_SYSTEM";
+    /**
+     * REQUEST — this environment declared it has no access to the instance (#1055 E3).
+     *
+     * A developer laptop and a staging with no ERP are the ordinary case. The application boots, every
+     * other resource works, and a read on a bound resource answers this rather than a transport error
+     * against an address nobody authored.
+     */
+    SystemOfRecordErrorCode["UNAVAILABLE_IN_ENVIRONMENT"] = "SYSTEM_OF_RECORD_UNAVAILABLE_IN_ENVIRONMENT";
+    /**
+     * REQUEST — the application has no owner organization to stamp remote rows with (#1055 E10,
+     * resting on #1054 E1).
+     *
+     * A fresh install before bootstrap runs is the real case. Rows read out of a system of record carry
+     * the owner organization's id so the per-row tenant gate passes without an exemption; with no owner
+     * there is nothing to stamp, and answering an empty list would say "this system holds nothing about
+     * you", which is false.
+     */
+    SystemOfRecordErrorCode["OWNER_ORGANIZATION_ABSENT"] = "SYSTEM_OF_RECORD_OWNER_ORGANIZATION_ABSENT";
+    /**
+     * REQUEST — the instance's token endpoint could not be reached, refused to mint, or answered
+     * something that is not a token (#1056 E2, E3; R11).
+     *
+     * ONE code for the whole family rather than one per failure, with a `reason` in the context and an
+     * optional `retryAfterSeconds` taken from the answer's `Retry-After`. The family is deliberately
+     * coarse because every member has the same shape from a caller's side: the remote is not currently
+     * giving us an identity, the request cannot proceed, and retrying later may work. Splitting it
+     * would ask a client to branch on a distinction it cannot act on differently.
+     *
+     * Never carries the token endpoint's own `error_description` verbatim into a client-visible
+     * message: an authorization server is entitled to say things about the credential, and a
+     * credential's failure mode is not an application user's business. The detail is logged.
+     */
+    SystemOfRecordErrorCode["TOKEN_UNAVAILABLE"] = "SYSTEM_OF_RECORD_TOKEN_UNAVAILABLE";
+    /**
+     * BOOT — the instance's credential material cannot produce a credential at all: an encrypted
+     * private key (#1056 E6), a certificate whose validity window does not contain now (E7), a BASIC
+     * username carrying the `:` that RFC 7617 makes the delimiter (E11).
+     *
+     * Separate from {@link REQUIRED_SLOT_MISSING} because the remedy is different: a value IS present
+     * and it is the wrong KIND of value, so an operator re-reading their environment for a blank finds
+     * nothing. Refused at boot rather than at the first read — the material is known then, and a
+     * certificate that expired last week should not first be noticed by a user.
+     */
+    SystemOfRecordErrorCode["CREDENTIAL_MATERIAL_UNUSABLE"] = "SYSTEM_OF_RECORD_CREDENTIAL_MATERIAL_UNUSABLE";
+    /**
+     * BOOT — the instance opts into partitioning and its vendor declares none (#1058).
+     *
+     * Refused rather than ignored, for the reason the `partition` field was RESERVED for three slices:
+     * an author who writes `partition: true` and sees it accepted believes their rows are confined to
+     * organization units while every member still sees every row. An accepted declaration that does
+     * nothing is worse than a refusal, because only one of the two is visible.
+     */
+    SystemOfRecordErrorCode["PARTITION_NOT_SUPPORTED_BY_VENDOR"] = "SYSTEM_OF_RECORD_PARTITION_NOT_SUPPORTED_BY_VENDOR";
+    /**
+     * BOOT — the instance opts into partitioning and its vendor partitions by a PATH SEGMENT, which
+     * this engine cannot confine (#1058 E9).
+     *
+     * A path segment is chosen before the request is built, so it cannot express "these three
+     * companies" in one read: the confinement would have to fan out into one request per unit, which is
+     * a different MECHANISM rather than a different predicate. Distinct from the code above because the
+     * remedy differs — there the vendor has no partitions at all, here it has partitions this engine
+     * does not yet reach, and only the second is a gap on our side.
+     */
+    SystemOfRecordErrorCode["PARTITION_KIND_UNSUPPORTED"] = "SYSTEM_OF_RECORD_PARTITION_KIND_UNSUPPORTED";
+})(SystemOfRecordErrorCode || (SystemOfRecordErrorCode = {}));
+//# sourceMappingURL=system-of-record-error-codes.shared.js.map

package/dist/esm/systems-of-record/system-of-record-error-codes.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-error-codes.shared.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-error-codes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,0EAA0E;AAC1E,MAAM,CAAN,IAAY,uBAyIX;AAzID,WAAY,uBAAuB;IACjC;;;;;;OAMG;IACH,uFAA4D,CAAA;IAE5D;;;;;OAKG;IACH,uGAA4E,CAAA;IAE5E;;;;;;OAMG;IACH,yGAA8E,CAAA;IAE9E;;OAEG;IACH,uGAA4E,CAAA;IAE5E;;;;;OAKG;IACH,mGAAwE,CAAA;IAExE;;;;;;;OAOG;IACH,2FAAgE,CAAA;IAEhE;;;;;;OAMG;IACH,+GAAoF,CAAA;IAEpF;;;;;;OAMG;IACH,2HAAgG,CAAA;IAEhG;;;;;;OAMG;IACH,qGAA0E,CAAA;IAE1E;;;;;;;;OAQG;IACH,mGAAwE,CAAA;IAExE;;;;;;;;;;;;;OAaG;IACH,mFAAwD,CAAA;IAExD;;;;;;;;;OASG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,mHAAwF,CAAA;IAExF;;;;;;;;;OASG;IACH,qGAA0E,CAAA;AAC5E,CAAC,EAzIW,uBAAuB,KAAvB,uBAAuB,QAyIlC","sourcesContent":["/**\n * Stable codes a client can branch on when a system of record refuses (#1055).\n *\n * Two audiences, and the split matters because the remedies are different people's work:\n *\n * - **Boot codes** name an incoherent DECLARATION — a vendor nothing ships, a dialect the facet does\n *   not speak, a slot the environment never supplied. Every one of them is fixed by editing a file\n *   and restarting, which needs no running companion, so refusing at boot is legitimate\n *   (`continuity-drift-and-cas-basis.md` Rule 3 — the remedy does not route back through the thing\n *   that just refused).\n * - **Request codes** name a state of the WORLD at the moment of a read: this environment has no\n *   access to the instance, or the owner organization is not seeded yet. Neither is an authoring\n *   mistake, and both must answer with a code rather than a 500 or a silent empty list.\n *\n * Carried in the error's `context.code`, which survives `sanitizeErrorForClient` for `CONFLICT` and\n * `VALIDATION` — the reason those two error types are used here rather than `AUTHORIZATION`, whose\n * context is stripped entirely. A refusal a client cannot branch on is a refusal a client will retry.\n */\n\n/** Why a system of record could not be prepared, or could not be read. */\nexport enum SystemOfRecordErrorCode {\n  /**\n   * BOOT — an instance names a vendor no facet answers to.\n   *\n   * The engine ships some facets and a package may ship others (#1057), so this means the vendor is\n   * spelled wrong OR the package that owns it is not installed. The message names both, because from\n   * inside the registry the two are indistinguishable.\n   */\n  VENDOR_HAS_NO_FACET = 'SYSTEM_OF_RECORD_VENDOR_HAS_NO_FACET',\n\n  /**\n   * BOOT — the application declares systems of record, but its provider runtime artifact lists no facet\n   * modules at all: it predates the field, or was never generated. Distinct from\n   * {@link VENDOR_HAS_NO_FACET}, because the remedy is a regeneration rather than a spelling or an\n   * install, and reporting it as that one sent a correct configuration looking for a typo (2026-09-24).\n   */\n  FACET_MODULES_NOT_GENERATED = 'SYSTEM_OF_RECORD_FACET_MODULES_NOT_GENERATED',\n\n  /**\n   * BOOT — the instance declares a dialect its vendor's facet does not speak.\n   *\n   * A vendor may legitimately offer several (a service reachable over OData v4 and a bespoke REST\n   * surface is one vendor, two ways in), so this is checked against the facet's list rather than\n   * assumed from the vendor.\n   */\n  DIALECT_NOT_SPOKEN_BY_VENDOR = 'SYSTEM_OF_RECORD_DIALECT_NOT_SPOKEN_BY_VENDOR',\n\n  /**\n   * BOOT — the instance names a credential kind its vendor does not offer.\n   */\n  CREDENTIAL_KIND_NOT_OFFERED = 'SYSTEM_OF_RECORD_CREDENTIAL_KIND_NOT_OFFERED',\n\n  /**\n   * BOOT — the vendor offers several credential kinds and the instance named none.\n   *\n   * Only reachable once a facet offers more than one (#1056). Until then the kind is DERIVED and an\n   * author is never asked for something with a single legal answer.\n   */\n  CREDENTIAL_KIND_AMBIGUOUS = 'SYSTEM_OF_RECORD_CREDENTIAL_KIND_AMBIGUOUS',\n\n  /**\n   * BOOT — a required slot's environment variable is unset while the environment DID author a block\n   * for the instance (#1055 E4).\n   *\n   * Distinct from the instance being declared absent: an environment that has no access says so with\n   * `{ enabled: false }`, and this is what is left — an environment that meant to have access and is\n   * missing a value. Silence is not a declaration, which is why these two are separable at all.\n   */\n  REQUIRED_SLOT_MISSING = 'SYSTEM_OF_RECORD_REQUIRED_SLOT_MISSING',\n\n  /**\n   * BOOT — a resource's `httpApiBinding` names an instance the application does not declare.\n   *\n   * Checked at REGISTRATION rather than in the resource factory, because the factory runs in the\n   * application's `shared-lib` where the saas configuration is not in scope. The factory checks\n   * SHAPE; this checks AGREEMENT, at the first moment both are visible.\n   */\n  BINDING_NAMES_UNDECLARED_SYSTEM = 'SYSTEM_OF_RECORD_BINDING_NAMES_UNDECLARED_SYSTEM',\n\n  /**\n   * BOOT — a binding's dialect and its instance's dialect disagree.\n   *\n   * Both are authored, in different files, and the binding's is the discriminator of its own\n   * per-dialect union — so the binding cannot simply inherit the instance's, and the disagreement has\n   * to be refused where both are known.\n   */\n  BINDING_DIALECT_DISAGREES_WITH_SYSTEM = 'SYSTEM_OF_RECORD_BINDING_DIALECT_DISAGREES_WITH_SYSTEM',\n\n  /**\n   * REQUEST — this environment declared it has no access to the instance (#1055 E3).\n   *\n   * A developer laptop and a staging with no ERP are the ordinary case. The application boots, every\n   * other resource works, and a read on a bound resource answers this rather than a transport error\n   * against an address nobody authored.\n   */\n  UNAVAILABLE_IN_ENVIRONMENT = 'SYSTEM_OF_RECORD_UNAVAILABLE_IN_ENVIRONMENT',\n\n  /**\n   * REQUEST — the application has no owner organization to stamp remote rows with (#1055 E10,\n   * resting on #1054 E1).\n   *\n   * A fresh install before bootstrap runs is the real case. Rows read out of a system of record carry\n   * the owner organization's id so the per-row tenant gate passes without an exemption; with no owner\n   * there is nothing to stamp, and answering an empty list would say \"this system holds nothing about\n   * you\", which is false.\n   */\n  OWNER_ORGANIZATION_ABSENT = 'SYSTEM_OF_RECORD_OWNER_ORGANIZATION_ABSENT',\n\n  /**\n   * REQUEST — the instance's token endpoint could not be reached, refused to mint, or answered\n   * something that is not a token (#1056 E2, E3; R11).\n   *\n   * ONE code for the whole family rather than one per failure, with a `reason` in the context and an\n   * optional `retryAfterSeconds` taken from the answer's `Retry-After`. The family is deliberately\n   * coarse because every member has the same shape from a caller's side: the remote is not currently\n   * giving us an identity, the request cannot proceed, and retrying later may work. Splitting it\n   * would ask a client to branch on a distinction it cannot act on differently.\n   *\n   * Never carries the token endpoint's own `error_description` verbatim into a client-visible\n   * message: an authorization server is entitled to say things about the credential, and a\n   * credential's failure mode is not an application user's business. The detail is logged.\n   */\n  TOKEN_UNAVAILABLE = 'SYSTEM_OF_RECORD_TOKEN_UNAVAILABLE',\n\n  /**\n   * BOOT — the instance's credential material cannot produce a credential at all: an encrypted\n   * private key (#1056 E6), a certificate whose validity window does not contain now (E7), a BASIC\n   * username carrying the `:` that RFC 7617 makes the delimiter (E11).\n   *\n   * Separate from {@link REQUIRED_SLOT_MISSING} because the remedy is different: a value IS present\n   * and it is the wrong KIND of value, so an operator re-reading their environment for a blank finds\n   * nothing. Refused at boot rather than at the first read — the material is known then, and a\n   * certificate that expired last week should not first be noticed by a user.\n   */\n  CREDENTIAL_MATERIAL_UNUSABLE = 'SYSTEM_OF_RECORD_CREDENTIAL_MATERIAL_UNUSABLE',\n\n  /**\n   * BOOT — the instance opts into partitioning and its vendor declares none (#1058).\n   *\n   * Refused rather than ignored, for the reason the `partition` field was RESERVED for three slices:\n   * an author who writes `partition: true` and sees it accepted believes their rows are confined to\n   * organization units while every member still sees every row. An accepted declaration that does\n   * nothing is worse than a refusal, because only one of the two is visible.\n   */\n  PARTITION_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_PARTITION_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * BOOT — the instance opts into partitioning and its vendor partitions by a PATH SEGMENT, which\n   * this engine cannot confine (#1058 E9).\n   *\n   * A path segment is chosen before the request is built, so it cannot express \"these three\n   * companies\" in one read: the confinement would have to fan out into one request per unit, which is\n   * a different MECHANISM rather than a different predicate. Distinct from the code above because the\n   * remedy differs — there the vendor has no partitions at all, here it has partitions this engine\n   * does not yet reach, and only the second is a gap on our side.\n   */\n  PARTITION_KIND_UNSUPPORTED = 'SYSTEM_OF_RECORD_PARTITION_KIND_UNSUPPORTED',\n}\n"]}