@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/systems-of-record/system-of-record-error-codes.shared.d.ts

@@ -0,0 +1,403 @@
+/**
+ * Stable codes a client can branch on when a system of record refuses (#1055).
+ *
+ * Two audiences, and the split matters because the remedies are different people's work:
+ *
+ * - **Boot codes** name an incoherent DECLARATION — a vendor nothing ships, a dialect the facet does
+ *   not speak, a slot the environment never supplied. Every one of them is fixed by editing a file
+ *   and restarting, which needs no running companion, so refusing at boot is legitimate
+ *   (`continuity-drift-and-cas-basis.md` Rule 3 — the remedy does not route back through the thing
+ *   that just refused).
+ * - **Request codes** name a state of the WORLD at the moment of a read or a write: this environment
+ *   has no access to the instance, the owner organization is not seeded yet, a write landed in a
+ *   partition the caller may not touch, or its outcome is unknown. None is an authoring mistake, and
+ *   each must answer with a code rather than a 500 or a silent empty list.
+ *
+ * Carried in the error's `context.code`, which survives `sanitizeErrorForClient` for `CONFLICT` and
+ * `VALIDATION` — the reason those two error types are used here rather than `AUTHORIZATION`, whose
+ * context is stripped entirely. A refusal a client cannot branch on is a refusal a client will retry.
+ */
+/**
+ * @wildo_source:part:start saas.models.system-of-record-error-codes facet:layer:shared facet:audience:app-developer
+ *
+ * Why a system of record could not be prepared, read, or written — the stable `context.code` a client branches on.
+ * Imported from `@wildo-ai/saas-models`. Request codes ride a `CONFLICT` (409) or `VALIDATION` (400) answer, the two
+ * error types whose context reaches the client.
+ */
+export declare enum SystemOfRecordErrorCode {
+    /**
+     * BOOT — an instance names a vendor no facet answers to.
+     *
+     * The framework's facets ship in the opt-in library `@wildo-ai/systems-of-record` (#2013), and an augmentation
+     * package an instance opts into may add others, so this means the vendor is spelled wrong OR the package that
+     * owns it is not installed. The message names both, because from inside the registry the two are
+     * indistinguishable, and names the library and its remedy.
+     */
+    VENDOR_HAS_NO_FACET = "SYSTEM_OF_RECORD_VENDOR_HAS_NO_FACET",
+    /**
+     * BOOT — the application declares systems of record, but its provider runtime artifact lists no facet
+     * modules at all: it predates the field, or was never generated. Distinct from
+     * {@link VENDOR_HAS_NO_FACET}, because the remedy is a regeneration rather than a spelling or an
+     * install, and reporting it as that one sent a correct configuration looking for a typo (2026-09-24).
+     */
+    FACET_MODULES_NOT_GENERATED = "SYSTEM_OF_RECORD_FACET_MODULES_NOT_GENERATED",
+    /**
+     * BOOT — an instance opts into a facet AUGMENTATION (#1675) from a package that ships none for its
+     * vendor: `wildo config sync` did not record its `<package>/systems-of-record` module (a package discovery
+     * does not walk by name must be listed in `providers.packages`, #1676), the recorded module fails to load
+     * (the import error is named), or it augments other vendors only. `wildo config sync` refuses the first
+     * case too, before anything starts. Named rather than ignored, because an augmentation the author believes
+     * applies — a partition declaration, say — that silently does not is a confinement they think they have.
+     */
+    FACET_AUGMENTATION_NOT_FOUND = "SYSTEM_OF_RECORD_FACET_AUGMENTATION_NOT_FOUND",
+    /**
+     * BOOT — an opted-in augmentation (#1675) fails the augmentation schema, or the facet it produces once
+     * merged into the base fails the facet schema. The refusal names the package and the instance rather
+     * than surfacing a bare schema error that names neither.
+     */
+    FACET_AUGMENTATION_INVALID = "SYSTEM_OF_RECORD_FACET_AUGMENTATION_INVALID",
+    /**
+     * BOOT — two facet modules each present a BASE facet for one vendor (#1675). Refused naming both,
+     * because the base carries the vendor's partition and "first in module order" would let whichever
+     * package name sorts first decide how a tenant's rows are confined. A package that adds to a vendor it
+     * does not own ships an augmentation an instance opts into.
+     */
+    FACET_BASE_CONFLICT = "SYSTEM_OF_RECORD_FACET_BASE_CONFLICT",
+    /**
+     * BOOT — two sources declare the same thing for one instance's vendor (#1675): a partition declared by
+     * the base facet AND an augmentation, or by two augmentations; one credential kind offered twice. The
+     * facet is the single partition authority, so which declaration confines a tenant's rows must never
+     * depend on order. The refusal names both sources.
+     */
+    FACET_AUGMENTATION_CONFLICT = "SYSTEM_OF_RECORD_FACET_AUGMENTATION_CONFLICT",
+    /**
+     * BOOT — the instance declares a dialect its vendor's facet does not speak.
+     *
+     * A vendor may legitimately offer several (a service reachable over OData v4 and a bespoke REST
+     * surface is one vendor, two ways in), so this is checked against the facet's list rather than
+     * assumed from the vendor.
+     */
+    DIALECT_NOT_SPOKEN_BY_VENDOR = "SYSTEM_OF_RECORD_DIALECT_NOT_SPOKEN_BY_VENDOR",
+    /**
+     * BOOT — the instance names a credential kind its vendor does not offer.
+     */
+    CREDENTIAL_KIND_NOT_OFFERED = "SYSTEM_OF_RECORD_CREDENTIAL_KIND_NOT_OFFERED",
+    /**
+     * BOOT — the vendor offers several credential kinds and the instance named none.
+     *
+     * Only reachable once a facet offers more than one (#1056). Until then the kind is DERIVED and an
+     * author is never asked for something with a single legal answer.
+     */
+    CREDENTIAL_KIND_AMBIGUOUS = "SYSTEM_OF_RECORD_CREDENTIAL_KIND_AMBIGUOUS",
+    /**
+     * BOOT — a required slot's environment variable is unset while the environment DID author a block
+     * for the instance (#1055 E4).
+     *
+     * Distinct from the instance being declared absent: an environment that has no access says so with
+     * `{ enabled: false }`, and this is what is left — an environment that meant to have access and is
+     * missing a value. Silence is not a declaration, which is why these two are separable at all.
+     */
+    REQUIRED_SLOT_MISSING = "SYSTEM_OF_RECORD_REQUIRED_SLOT_MISSING",
+    /**
+     * BOOT — a resource's `httpApiBinding` names an instance the application does not declare.
+     *
+     * Checked at REGISTRATION rather than in the resource factory, because the factory runs in the
+     * application's `shared-lib` where the saas configuration is not in scope. The factory checks
+     * SHAPE; this checks AGREEMENT, at the first moment both are visible.
+     */
+    BINDING_NAMES_UNDECLARED_SYSTEM = "SYSTEM_OF_RECORD_BINDING_NAMES_UNDECLARED_SYSTEM",
+    /**
+     * BOOT — a binding's dialect and its instance's dialect disagree.
+     *
+     * Both are authored, in different files, and the binding's is the discriminator of its own
+     * per-dialect union — so the binding cannot simply inherit the instance's, and the disagreement has
+     * to be refused where both are known.
+     */
+    BINDING_DIALECT_DISAGREES_WITH_SYSTEM = "SYSTEM_OF_RECORD_BINDING_DIALECT_DISAGREES_WITH_SYSTEM",
+    /**
+     * REQUEST — this environment declared it has no access to the instance (#1055 E3).
+     *
+     * A developer laptop and a staging with no ERP are the ordinary case. The application boots, every
+     * other resource works, and a read on a bound resource answers this rather than a transport error
+     * against an address nobody authored.
+     */
+    UNAVAILABLE_IN_ENVIRONMENT = "SYSTEM_OF_RECORD_UNAVAILABLE_IN_ENVIRONMENT",
+    /**
+     * REQUEST — the application has no owner organization to stamp remote rows with (#1055 E10,
+     * resting on #1054 E1).
+     *
+     * A fresh install before bootstrap runs is the real case. Rows read out of a system of record carry
+     * the owner organization's id so the per-row tenant gate passes without an exemption; with no owner
+     * there is nothing to stamp, and answering an empty list would say "this system holds nothing about
+     * you", which is false.
+     */
+    OWNER_ORGANIZATION_ABSENT = "SYSTEM_OF_RECORD_OWNER_ORGANIZATION_ABSENT",
+    /**
+     * REQUEST — the instance's token endpoint could not be reached, refused to mint, or answered
+     * something that is not a token (#1056 E2, E3; R11).
+     *
+     * ONE code for the whole family rather than one per failure, with a `reason` in the context and an
+     * optional `retryAfterSeconds` taken from the answer's `Retry-After`. The family is deliberately
+     * coarse because every member has the same shape from a caller's side: the remote is not currently
+     * giving us an identity, the request cannot proceed, and retrying later may work. Splitting it
+     * would ask a client to branch on a distinction it cannot act on differently.
+     *
+     * Never carries the token endpoint's own `error_description` verbatim into a client-visible
+     * message: an authorization server is entitled to say things about the credential, and a
+     * credential's failure mode is not an application user's business. The detail is logged.
+     */
+    TOKEN_UNAVAILABLE = "SYSTEM_OF_RECORD_TOKEN_UNAVAILABLE",
+    /**
+     * BOOT — the instance's credential material cannot produce a credential at all: an encrypted
+     * private key (#1056 E6), a certificate whose validity window does not contain now (E7), a BASIC
+     * username carrying the `:` that RFC 7617 makes the delimiter (E11).
+     *
+     * Separate from {@link REQUIRED_SLOT_MISSING} because the remedy is different: a value IS present
+     * and it is the wrong KIND of value, so an operator re-reading their environment for a blank finds
+     * nothing. Refused at boot rather than at the first read — the material is known then, and a
+     * certificate that expired last week should not first be noticed by a user.
+     */
+    CREDENTIAL_MATERIAL_UNUSABLE = "SYSTEM_OF_RECORD_CREDENTIAL_MATERIAL_UNUSABLE",
+    /**
+     * BOOT — the instance opts into partitioning and its vendor declares none (#1058).
+     *
+     * Refused rather than ignored, for the reason the `partition` field was RESERVED for three slices:
+     * an author who writes `partition: true` and sees it accepted believes their rows are confined to
+     * organization units while every member still sees every row. An accepted declaration that does
+     * nothing is worse than a refusal, because only one of the two is visible.
+     */
+    PARTITION_NOT_SUPPORTED_BY_VENDOR = "SYSTEM_OF_RECORD_PARTITION_NOT_SUPPORTED_BY_VENDOR",
+    /**
+     * BOOT — the instance opts into partitioning and its vendor partitions by a PATH SEGMENT, which
+     * this engine cannot confine (#1058 E9).
+     *
+     * A path segment is chosen before the request is built, so it cannot express "these three
+     * companies" in one read: the confinement would have to fan out into one request per unit, which is
+     * a different MECHANISM rather than a different predicate. Distinct from the code above because the
+     * remedy differs — there the vendor has no partitions at all, here it has partitions this engine
+     * does not yet reach, and only the second is a gap on our side.
+     */
+    PARTITION_KIND_UNSUPPORTED = "SYSTEM_OF_RECORD_PARTITION_KIND_UNSUPPORTED",
+    /**
+     * BOOT — a binding opens a write verb whose DIALECT has no write implementation in this engine yet.
+     *
+     * Refused at boot rather than at the first write, for the reason every declaration refusal here is:
+     * the remedy is editing a file (remove the verb, or wait for the dialect), so nothing needs a
+     * running application to fix it. The message names the dialect, because that is the half an author
+     * cannot see from their own binding.
+     */
+    WRITE_DIALECT_NOT_IMPLEMENTED = "SYSTEM_OF_RECORD_WRITE_DIALECT_NOT_IMPLEMENTED",
+    /**
+     * REQUEST — the write was scoped to an organization that does not own the application.
+     *
+     * A system of record's rows belong to the OWNER organization (#1055 Q2). A read under another
+     * organization answers an empty page, because an empty page is a true statement about what that
+     * tenant may see; a write has no such honest empty answer, so it is refused, before anything is
+     * sent, and the refusal is audited.
+     */
+    WRITE_ORGANIZATION_NOT_OWNER = "SYSTEM_OF_RECORD_WRITE_ORGANIZATION_NOT_OWNER",
+    /**
+     * REQUEST — a CREATE on a partitioned instance could not tell which organization unit the new row
+     * belongs to, and the caller must name one (`organizationUnitId` in the payload).
+     *
+     * Reached by a member confined to SEVERAL units that own a partition of this instance, and by an
+     * organization-wide caller, who is entitled to every assigned partition and so has no single answer.
+     * Distinct from {@link WRITE_PARTITION_REFUSED} because the remedy is to ADD something, not to change it.
+     */
+    WRITE_PARTITION_UNIT_REQUIRED = "SYSTEM_OF_RECORD_WRITE_PARTITION_UNIT_REQUIRED",
+    /**
+     * REQUEST — the partition this write would land in is not one the caller may write. The context
+     * carries a {@link SystemOfRecordWritePartitionRefusal} naming which rule refused.
+     */
+    WRITE_PARTITION_REFUSED = "SYSTEM_OF_RECORD_WRITE_PARTITION_REFUSED",
+    /**
+     * REQUEST — the payload writes a field the engine owns: the partition field (it is DERIVED from the
+     * organization unit on create and never moves afterwards), the owner organization stamp, the unit
+     * stamp on update, or a key component.
+     *
+     * Refused rather than stripped. A caller who sends a partition value believes it decides where the
+     * row lands; silently discarding it would put the row somewhere they did not ask for.
+     */
+    WRITE_FIELD_NOT_WRITABLE = "SYSTEM_OF_RECORD_WRITE_FIELD_NOT_WRITABLE",
+    /**
+     * REQUEST — the write was SENT and nobody knows whether the system of record applied it: the call
+     * timed out, the connection dropped after the request left, or a gateway answered for the vendor.
+     *
+     * The one answer a client must not treat as "not written". A retry with the SAME `Idempotency-Key`
+     * answers this again without sending anything; the way forward is to READ the row (or search for it)
+     * and decide, then send a NEW request under a new key if it is genuinely missing.
+     */
+    WRITE_OUTCOME_UNKNOWN = "SYSTEM_OF_RECORD_WRITE_OUTCOME_UNKNOWN",
+    /**
+     * REQUEST — a request with this `Idempotency-Key` is being sent right now. The client retried before
+     * the first attempt settled; answering it would mean sending the write twice.
+     *
+     * Answered `409` (a CONFLICT carrying this code): wait, then retry the SAME request under the same key.
+     */
+    WRITE_IN_PROGRESS = "SYSTEM_OF_RECORD_WRITE_IN_PROGRESS",
+    /**
+     * REQUEST — this `Idempotency-Key` was already used for a DIFFERENT write (another target, verb or
+     * payload). A key names one request; replaying the first request's outcome for a second one would
+     * tell the caller something false about the second.
+     *
+     * Answered `422` with `customMessageReference: IDEMPOTENCY_KEY_REUSED` (#1941) — the status and the
+     * reference the engine's generic request idempotency answers a reused key with, so a client learns ONE
+     * spelling. A 422's context is stripped on the wire, so THIS code does not reach an HTTP client: it is
+     * what an in-process caller catching the error reads (`context.code`), and what the trail and the
+     * refusal audit row record. Never retry the request as it is; send a new request under a new key.
+     * spec-cite: draft-ietf-httpapi-idempotency-key-header-07 §2.7 (reused key with a different payload → 422;
+     * a request still being processed → 409).
+     */
+    WRITE_IDEMPOTENCY_KEY_REUSED = "SYSTEM_OF_RECORD_WRITE_IDEMPOTENCY_KEY_REUSED",
+    /**
+     * REQUEST — the system of record APPLIED the write, and something the engine did after it failed
+     * (a postfix hook, a local lifecycle step, the response description).
+     *
+     * Never reported as a failure to write: the remote change is durable and nothing here can undo it.
+     * The context names the written row, so the caller can read it; a retry with the same key replays
+     * the applied outcome rather than writing again.
+     */
+    WRITE_APPLIED_FOLLOW_UP_FAILED = "SYSTEM_OF_RECORD_WRITE_APPLIED_FOLLOW_UP_FAILED",
+    /**
+     * BOOT — a binding declares `writeConcurrency: VERSION_CHECKED` and its vendor facet names no row version field
+     * (`rowVersionField`), or the binding's version field does not map onto that remote field. The check would compare a
+     * value the vendor does not maintain, and so would refuse or admit writes for no reason at all.
+     */
+    WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR = "SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR",
+    /**
+     * REQUEST — an UPDATE on a `VERSION_CHECKED` binding carried no row version. The binding declared that every change is
+     * checked against the version its author read; an update without one would silently be last-writer-wins. Send the
+     * version field exactly as the read answered it.
+     */
+    WRITE_VERSION_REQUIRED = "SYSTEM_OF_RECORD_WRITE_VERSION_REQUIRED",
+    /**
+     * REQUEST — the row changed since the caller read it: the version it sent is not the version the system of record
+     * answered just before the write. Nothing was sent. Read the row again and decide.
+     *
+     * BEST-EFFORT on Odoo, and the refusal's message says so: a change landing between that read and the write is not
+     * seen, and a vendor that serves its version coarsely (Odoo serves `write_date` to the SECOND) cannot tell two changes
+     * made in the same second apart. The absence of this code is therefore not proof that nobody else changed the row. On
+     * OData the change landing in that gap is refused by the vendor instead, as `WRITE_PRECONDITION_FAILED`.
+     */
+    WRITE_VERSION_STALE = "SYSTEM_OF_RECORD_WRITE_VERSION_STALE",
+    /**
+     * REQUEST — an UPDATE on a `VERSION_CHECKED` binding, and the row the engine read just before writing carries NO
+     * version at all (#1726). Not "stale": nobody changed anything. The vendor serves no version for this row — an OData
+     * service that returns no `@odata.etag` for this entity set, although OData lets each set decide — so the binding's
+     * stance cannot be honoured for it. Nothing was sent. The remedy is the
+     * binding's, not the caller's: declare `LAST_WRITER_WINS` for this entity set, or have the vendor serve its versions.
+     */
+    WRITE_ROW_VERSION_NOT_SERVED = "SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SERVED",
+    /**
+     * REQUEST — the system of record refused an UPDATE or DELETE because the row's version no longer matched the one the
+     * write was conditioned on: an OData `412 Precondition Failed` answering the `If-Match` the engine sent (#1726).
+     *
+     * Unlike {@link WRITE_VERSION_STALE} this is the VENDOR's decision, taken atomically against the row it was about to
+     * change, and the protocol requires that it change nothing — so it is a definite refusal, never an unknown outcome,
+     * and it is never retried: re-sending the same precondition would only be refused again. Read the row again and
+     * decide.
+     * spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match).
+     */
+    WRITE_PRECONDITION_FAILED = "SYSTEM_OF_RECORD_WRITE_PRECONDITION_FAILED",
+    /**
+     * BOOT — a binding opens writes toward a vendor whose facet lists a step it requires before any modifying request
+     * (`writePrerequisites`, e.g. SAP Gateway's `X-CSRF-Token` handshake) that this engine does not perform (#1726). Every
+     * such write would be refused by the vendor; the binding stays read-only until the engine performs the step.
+     */
+    WRITE_PREREQUISITE_NOT_SUPPORTED = "SYSTEM_OF_RECORD_WRITE_PREREQUISITE_NOT_SUPPORTED",
+    /**
+     * BOOT — a binding declares an action whose call shape the instance's vendor facet does not list
+     * (`actionCallShapes`). The vendor's product does not expose actions that way, so the declaration could never run.
+     */
+    ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR = "SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR",
+    /**
+     * BOOT — a record-free action toward a PARTITIONED instance declares no partition stance. It must say either why it
+     * reaches no partitioned data, or which parameter carries the partition the engine derives from the caller's unit;
+     * otherwise one member's action could land in every company.
+     */
+    ACTION_PARTITION_STANCE_REQUIRED = "SYSTEM_OF_RECORD_ACTION_PARTITION_STANCE_REQUIRED",
+    /** BOOT — two bindings of one instance declare the same action name; callers address an action by `(system, action)`. */
+    ACTION_NAME_DUPLICATED = "SYSTEM_OF_RECORD_ACTION_NAME_DUPLICATED",
+    /** REQUEST — no binding of this instance declares an action of that name. */
+    ACTION_NOT_DECLARED = "SYSTEM_OF_RECORD_ACTION_NOT_DECLARED",
+    /**
+     * REQUEST — this kind of context may not run this action: an anonymous or public execution, an application-scoped
+     * machine with no organization, or a system context (batch, cron, webhook, an autonomous agent with nobody behind it)
+     * on an action that does not declare `admitsSystemInitiation`.
+     */
+    ACTION_INITIATION_NOT_ADMITTED = "SYSTEM_OF_RECORD_ACTION_INITIATION_NOT_ADMITTED",
+    /**
+     * REQUEST — the action was initiated for an organization that does not own the application. A system of record's rows
+     * and actions belong to the owner organization; a tenant that is not the owner never reaches the ERP.
+     */
+    ACTION_ORGANIZATION_NOT_OWNER = "SYSTEM_OF_RECORD_ACTION_ORGANIZATION_NOT_OWNER",
+    /** REQUEST — the caller holds none of the roles the action declares, in the owner organization. */
+    ACTION_ROLE_NOT_HELD = "SYSTEM_OF_RECORD_ACTION_ROLE_NOT_HELD",
+    /** REQUEST — the input does not satisfy the action's declared input schema; the context carries the issues. */
+    ACTION_INPUT_INVALID = "SYSTEM_OF_RECORD_ACTION_INPUT_INVALID",
+    /**
+     * REQUEST — a WRITING action was called without an Idempotency-Key. A remote change cannot be rolled back, so every
+     * caller names its request; a retry under the same key then replays the first outcome instead of acting twice.
+     */
+    ACTION_IDEMPOTENCY_KEY_REQUIRED = "SYSTEM_OF_RECORD_ACTION_IDEMPOTENCY_KEY_REQUIRED",
+    /**
+     * REQUEST — a record-free action that carries the partition must know the caller's unit, and the caller is a member
+     * of several units owning partitions of this instance. Name one in `organizationUnitId`.
+     */
+    ACTION_PARTITION_UNIT_REQUIRED = "SYSTEM_OF_RECORD_ACTION_PARTITION_UNIT_REQUIRED",
+    /**
+     * REQUEST — the partition the action would land in is not one the caller may act in. The context carries a
+     * {@link SystemOfRecordWritePartitionRefusal} naming which rule refused — the same rules a read-through create obeys.
+     */
+    ACTION_PARTITION_REFUSED = "SYSTEM_OF_RECORD_ACTION_PARTITION_REFUSED",
+    /**
+     * REQUEST — the record a record-targeted action names is not one this caller may act on: absent, or outside its
+     * partition, or (for a shared record) not writable by a unit-confined caller. Answered as NOT_FOUND and
+     * indistinguishably, as a read answers, so an action cannot probe for records the caller may not see.
+     */
+    ACTION_TARGET_NOT_REACHABLE = "SYSTEM_OF_RECORD_ACTION_TARGET_NOT_REACHABLE",
+    /** REQUEST — the system of record refused the action with a definite answer; nothing was applied. */
+    ACTION_REMOTE_REFUSED = "SYSTEM_OF_RECORD_ACTION_REMOTE_REFUSED",
+    /**
+     * REQUEST — the action could not be SENT: the instance's access could not be resolved, its handshake failed, the
+     * connection was refused before the request left, the rate budget was spent, or the read-first could not reach the
+     * record. Nothing reached the vendor as an action, so nothing was applied and the Idempotency-Key may be spent again.
+     * The context carries the transport KIND (and status), never the transport's message, which names the URL.
+     */
+    ACTION_NOT_SENT = "SYSTEM_OF_RECORD_ACTION_NOT_SENT"
+}
+/**
+ * Which rule refused a write's PARTITION (#1679), carried as `context.reason` beside
+ * {@link SystemOfRecordErrorCode.WRITE_PARTITION_REFUSED}.
+ *
+ * Distinct members because the remedy differs for each, and every one is somebody else's work: an
+ * operator assigns partitions, an administrator grants units, an author declares the instance.
+ */
+export declare enum SystemOfRecordWritePartitionRefusal {
+    /** The unit named (or derived) is not one the caller's grant covers. */
+    UNIT_OUTSIDE_GRANT = "unit_outside_grant",
+    /** The unit owns no partition of this instance, so a row created "for it" would belong to nobody. */
+    UNIT_HAS_NO_PARTITION = "unit_has_no_partition",
+    /**
+     * The unit owns SEVERAL partitions of this instance, so the unit alone does not say which one the row
+     * belongs to. The operator's assignment map decides this, not the caller: one unit, one partition is
+     * what makes a create's destination derivable.
+     */
+    UNIT_HAS_SEVERAL_PARTITIONS = "unit_has_several_partitions",
+    /** A unit was named for a write to an instance that is not partitioned — a stamp nothing would enforce. */
+    INSTANCE_NOT_PARTITIONED = "instance_not_partitioned",
+    /** The narrowing authority denied the caller every unit (no decision, a registry disagreement, an empty grant). */
+    NARROWING_DENIED = "narrowing_denied",
+    /**
+     * A UNIT-ONLY principal (a unit-scoped service-provider expert, #1597) writing a resource that does not
+     * narrow. The organization-wide admission such a principal may hold covers reads only.
+     */
+    UNIT_ONLY_PRINCIPAL_NOT_ADMITTED = "unit_only_principal_not_admitted"
+}
+/** @wildo_source:part:end saas.models.system-of-record-error-codes */
+/**
+ * Why an opted-in package whose module `wildo config sync` did not record is refused, and what to do (#1675, #1676).
+ * One sentence for the backend's resolver, `wildo secrets` and config sync's own check, so the three agree.
+ */
+export declare const SYSTEM_OF_RECORD_FACET_MODULE_NOT_DISCOVERED: string;
+//# sourceMappingURL=system-of-record-error-codes.shared.d.ts.map

package/dist/esm/systems-of-record/system-of-record-error-codes.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-error-codes.shared.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-error-codes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;OAOG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;OAKG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;;;OAOG;IACH,4BAA4B,kDAAkD;IAE9E;;;;OAIG;IACH,0BAA0B,gDAAgD;IAE1E;;;;;OAKG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;OAKG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;;OAMG;IACH,4BAA4B,kDAAkD;IAE9E;;OAEG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;OAKG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;OAOG;IACH,qBAAqB,2CAA2C;IAEhE;;;;;;OAMG;IACH,+BAA+B,qDAAqD;IAEpF;;;;;;OAMG;IACH,qCAAqC,2DAA2D;IAEhG;;;;;;OAMG;IACH,0BAA0B,gDAAgD;IAE1E;;;;;;;;OAQG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,uCAAuC;IAExD;;;;;;;;;OASG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,iCAAiC,uDAAuD;IAExF;;;;;;;;;OASG;IACH,0BAA0B,gDAAgD;IAS1E;;;;;;;OAOG;IACH,6BAA6B,mDAAmD;IAEhF;;;;;;;OAOG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,6BAA6B,mDAAmD;IAEhF;;;OAGG;IACH,uBAAuB,6CAA6C;IAEpE;;;;;;;OAOG;IACH,wBAAwB,8CAA8C;IAEtE;;;;;;;OAOG;IACH,qBAAqB,2CAA2C;IAEhE;;;;;OAKG;IACH,iBAAiB,uCAAuC;IAExD;;;;;;;;;;;;OAYG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,8BAA8B,oDAAoD;IAUlF;;;;OAIG;IACH,yCAAyC,+DAA+D;IAExG;;;;OAIG;IACH,sBAAsB,4CAA4C;IAElE;;;;;;;;OAQG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;;OAMG;IACH,4BAA4B,kDAAkD;IAQ9E;;;;;;;;;OASG;IACH,yBAAyB,+CAA+C;IAExE;;;;OAIG;IACH,gCAAgC,sDAAsD;IAQtF;;;OAGG;IACH,yCAAyC,+DAA+D;IAExG;;;;OAIG;IACH,gCAAgC,sDAAsD;IAEtF,yHAAyH;IACzH,sBAAsB,4CAA4C;IAElE,6EAA6E;IAC7E,mBAAmB,yCAAyC;IAE5D;;;;OAIG;IACH,8BAA8B,oDAAoD;IAElF;;;OAGG;IACH,6BAA6B,mDAAmD;IAEhF,mGAAmG;IACnG,oBAAoB,0CAA0C;IAE9D,+GAA+G;IAC/G,oBAAoB,0CAA0C;IAE9D;;;OAGG;IACH,+BAA+B,qDAAqD;IAEpF;;;OAGG;IACH,8BAA8B,oDAAoD;IAElF;;;OAGG;IACH,wBAAwB,8CAA8C;IAEtE;;;;OAIG;IACH,2BAA2B,iDAAiD;IAE5E,qGAAqG;IACrG,qBAAqB,2CAA2C;IAEhE;;;;;OAKG;IACH,eAAe,qCAAqC;CACrD;AAED;;;;;;GAMG;AACH,oBAAY,mCAAmC;IAC7C,wEAAwE;IACxE,kBAAkB,uBAAuB;IACzC,qGAAqG;IACrG,qBAAqB,0BAA0B;IAC/C;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D,2GAA2G;IAC3G,wBAAwB,6BAA6B;IACrD,mHAAmH;IACnH,gBAAgB,qBAAqB;IACrC;;;OAGG;IACH,gCAAgC,qCAAqC;CACtE;AACD,sEAAsE;AAEtE;;;GAGG;AACH,eAAO,MAAM,4CAA4C,QAEqD,CAAC"}