@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/errors/errors.custom-message-ref.shared.definitions.js

@@ -63,6 +63,21 @@ export var ErrorCustomMessageReference;
     ErrorCustomMessageReference["AUTHORIZATIONS_VALIDATION_FAILED"] = "authorizations_validation_failed";
     ErrorCustomMessageReference["AUTHORIZATIONS_ACCESS_DENIED"] = "authorizations_access_denied";
     ErrorCustomMessageReference["AUTHORIZATIONS_NO_OPERATION_CONTEXT"] = "authorizations_no_operation_context";
+    /**
+     * The application declares purposes a person must grant before using it
+     * (`compliance.serviceConsentRequirement`), and this person has not granted them (#534). Refused on
+     * every user-initiated operation except the person's own preferences — where consent is recorded.
+     */
+    ErrorCustomMessageReference["AUTHORIZATIONS_SERVICE_CONSENT_REQUIRED"] = "authorizations_service_consent_required";
+    /**
+     * ONE operation declares the purpose its own processing rests on
+     * (`ResourceOperationConsentGateDeclaration`, `refusal: WITHHOLD_CAPABILITY`, #1258 Step 3), and this
+     * person has not granted it. Refuses only THIS operation — distinct from
+     * {@link ErrorCustomMessageReference.AUTHORIZATIONS_SERVICE_CONSENT_REQUIRED}, which withholds the
+     * whole application, so a frontend can branch on the two differently (D2: a declared purpose costs
+     * the capability, not the product, unless the application says otherwise).
+     */
+    ErrorCustomMessageReference["AUTHORIZATIONS_CAPABILITY_CONSENT_REQUIRED"] = "authorizations_capability_consent_required";
     ErrorCustomMessageReference["JWT_SIGNING_FAILED"] = "jwt_signing_failed";
     ErrorCustomMessageReference["JWT_VERIFICATION_FAILED"] = "jwt_verification_failed";
     ErrorCustomMessageReference["JWT_TOKEN_GENERATION_FAILED"] = "jwt_token_generation_failed";
@@ -113,6 +128,20 @@ export var ErrorCustomMessageReference;
     ErrorCustomMessageReference["AUTHENTICATION_NOT_IMPLEMENTED"] = "authentication_not_implemented";
     /** W7.1: Operation requires re-authentication (step-up auth). Frontend should prompt re-auth dialog. */
     ErrorCustomMessageReference["STEP_UP_REQUIRED"] = "step_up_required";
+    /**
+     * #1417: adding a way to sign in needs the account holder to re-prove who they are. Distinct from
+     * `STEP_UP_REQUIRED` because the proof is different (`ReAuthenticationPurpose.BIND_AUTHENTICATOR`:
+     * any held factor, whatever the step-up policy names), and a step-up refusal's context is stripped
+     * at the wire, so the code is the only channel that can tell the client which proof to ask for.
+     */
+    ErrorCustomMessageReference["STEP_UP_REQUIRED_TO_BIND"] = "step_up_required_to_bind";
+    /**
+     * A service firm's expert must prove a second factor for the CLIENT organization they are working in, because the
+     * client organization type's authentication policy asks for one and this session has not satisfied it for that
+     * client (#1633). Distinct from {@link STEP_UP_REQUIRED} so the step-up prompt can say WHOSE policy asks, and offer
+     * only factors that can be a second factor — a password re-proof never satisfies it.
+     */
+    ErrorCustomMessageReference["STEP_UP_REQUIRED_BY_CLIENT_ORGANIZATION"] = "step_up_required_by_client_organization";
     /** W7.2: Cross-organization SSO access is disabled. User already has enterprise SSO link from another org. */
     ErrorCustomMessageReference["CROSS_ORG_SSO_BLOCKED"] = "cross_org_sso_blocked";
     ErrorCustomMessageReference["APP_CONFIGURATION_UNAUTHORIZED"] = "app_configuration_unauthorized";
@@ -128,6 +157,17 @@ export var ErrorCustomMessageReference;
      * `organizationTypes[<org type>].userTypes`, and nothing in a method-shaped error points there.
      */
     ErrorCustomMessageReference["INVITATION_ORGANIZATION_TYPE_UNRESOLVED"] = "invitation_organization_type_unresolved";
+    /**
+     * A member could not sign in (or re-authenticate) because one of their organizations yields no authentication
+     * policy: the organization is gone, carries no type, or carries a type the application no longer declares (#1036).
+     *
+     * Fail-closed on purpose — an organization's type is where its authentication restrictions live, and "could not
+     * tell" must never read as "no restrictions". What changed is that it is NAMED: it used to surface as an
+     * unhandled `500 INTERNAL` at `severity: critical`, which reads as an engine crash for what is an operator
+     * configuration state. The three causes have different remedies, so the log context carries
+     * `OrganizationAuthPolicyUnresolvedReason`; the member sees one message, because none of the remedies is theirs.
+     */
+    ErrorCustomMessageReference["AUTHENTICATION_ORGANIZATION_POLICY_UNRESOLVED"] = "authentication_organization_policy_unresolved";
     // Frontend form errors
     ErrorCustomMessageReference["FRONTEND_FORM_READ_OPERATION_NOT_AVAILABLE"] = "frontend_form_read_operation_not_available";
     // Frontend navigation errors
@@ -242,6 +282,16 @@ export var ErrorCustomMessageReference;
     /** Registration for this user type is admin-provisioned only: accounts are created by an administrator, so there is no self-service sign-up or invitation-accept path. Distinct from REGISTRATION_DISABLED (registration off entirely) and REGISTRATION_INVITATION_ONLY (self-complete via an invitation token). */
     ErrorCustomMessageReference["REGISTRATION_ADMIN_ONLY"] = "registration_admin_only";
     /** A password is required to complete this registration. */
+    /**
+     * Self-service signup is open, but this application admits only certain email domains
+     * (`registration.allowedEmailDomains`) and the registrant's is not among them.
+     *
+     * Told PLAINLY rather than answered with the silent success the SSO-domain block uses, and the two
+     * differ for a reason: an anti-enumeration no-op exists to avoid disclosing whether an ACCOUNT
+     * exists, and this discloses nothing about any account — only the application's own published
+     * admission policy, which it chose to have and which its own signup page should already state.
+     */
+    ErrorCustomMessageReference["REGISTRATION_EMAIL_DOMAIN_NOT_ALLOWED"] = "registration_email_domain_not_allowed";
     ErrorCustomMessageReference["REGISTRATION_PASSWORD_REQUIRED"] = "registration_password_required";
     /** Registration could not be completed due to a transient server error; the user may retry. */
     ErrorCustomMessageReference["REGISTRATION_FAILED"] = "registration_failed";
@@ -276,6 +326,14 @@ export var ErrorCustomMessageReference;
      * than the token authorizes.
      */
     ErrorCustomMessageReference["AUTHORIZATION_MACHINE_SCOPE_MISMATCH"] = "authorization_machine_scope_mismatch";
+    /**
+     * The signed-in account opened a link to an organization it cannot access, so the application sent it
+     * to its home page instead. Raised by the FRONTEND, not by an API response: the server's answer to the
+     * organization READ is a 403 or a deliberate 404, and this reference names the navigation outcome the
+     * person sees. The usual path is a session that expired on another account's organization page and a
+     * different account signing in to the saved redirect.
+     */
+    ErrorCustomMessageReference["AUTHORIZATION_ORGANIZATION_NOT_ACCESSIBLE"] = "authorization_organization_not_accessible";
     // MFA flow errors (user-directed)
     /** The current session state does not allow completing MFA enrollment. */
     ErrorCustomMessageReference["MFA_ENROLLMENT_STATE_INVALID"] = "mfa_enrollment_state_invalid";
@@ -290,31 +348,6 @@ export var ErrorCustomMessageReference;
     // Config / request-contract errors (user-directed)
     /** The organization name is required. */
     ErrorCustomMessageReference["ORG_NAME_REQUIRED"] = "org_name_required";
-    /**
-     * An organization unit cannot be deleted because child units still hang off it.
-     *
-     * Emitted as `ErrorType.CONFLICT` (409). CONFLICT is one of the few error types that expose
-     * `context` to the client, so the blocking dependent is surfaced by name — `blockingChildUnitId`
-     * when a child unit blocks, `blockingUnitMemberId` when a member assignment does. TWO distinct
-     * dependents share this one code; branch on the context key, not on the message.
-     *
-     * Unlike every other `ORGANIZATIONS` child, the unit tree's self-edge
-     * (`ORGANIZATION_UNITS -> ORGANIZATION_UNITS` on `parentUnitId`) declares NO `onParentDelete`
-     * cascade, so deleting an interior node would strand its whole subtree behind a dangling
-     * `parentUnitId` and a stale materialized `path`.
-     *
-     * MOVE is the remedy to point a client at: it re-parents a child onto another node and rewrites
-     * the materialized `path` of its whole subtree in one transaction. (Deleting the subtree
-     * bottom-up also works, leaf by leaf.) Since `parentUnitId` became `.excludeFromUpdate()` in the
-     * same pass that implemented MOVE, MOVE is the ONLY way to re-home a branch — so do not describe
-     * a plain update as an alternative.
-     *
-     * ⚠️ Direct per-unit DELETE only. Deleting the whole ORGANIZATION is a different path: that
-     * cascade IS enabled and removes every unit of the tenant at once (every unit carries the
-     * tenant's `organizationId`), and it runs at the repository level, so this guard is correctly
-     * not consulted there.
-     */
-    ErrorCustomMessageReference["ORGANIZATION_UNIT_HAS_DEPENDENTS"] = "organization_unit_has_dependents";
     /**
      * A MOVE names a destination inside the moved unit's own subtree — one of its descendants, or the
      * unit itself. Either detaches the branch into a cycle: a node below its own descendant has no
@@ -356,6 +389,39 @@ export var ErrorCustomMessageReference;
      * implementation performs against the row it actually loaded.
      */
     ErrorCustomMessageReference["RESOURCE_STATUS_TRANSITION_CONFLICT"] = "resource_status_transition_conflict";
+    /**
+     * A delete was refused because rows on an edge declaring `onParentDelete.strategy:
+     * REFUSE_WHILE_CHILDREN_EXIST` still reference the row being deleted.
+     *
+     * Emitted as `ErrorType.CONFLICT` (409). CONFLICT is one of the few error types that expose
+     * `context` to the client, so `context.blockingDependents` names each blocking edge with its
+     * `childResourceType`, `foreignKeyField` and one `blockingChildId`. Branch on that, not on the
+     * message. When the only blocking children are impersonalized-and-retained (hidden from every ordinary
+     * read), the entry carries `blockingChildRetained: true` and NO `blockingChildId`: the refusal must say
+     * why the delete cannot proceed without revealing a retained row's identity (#1168). Likewise,
+     * when NONE of the blocking children on an edge is readable by the request's own context — for a caller holding
+     * only unit entries in the organization (a unit-scoped service-provider expert), a row outside its units or any row
+     * of an organization resource that neither narrows by unit nor is declared organization-wide for providers; for any
+     * caller, a row of a unit-narrowed resource the request was not authorized for — the entry carries `blockingChildOutsideCallerReach: true` and NO `blockingChildId`: the delete
+     * is still refused, because the row exists, but its id does not leave (#1597). A readable blocker, when one
+     * exists, is always the one named. One code serves every resource because the posture is declared on the edge; what to do
+     * next (MOVE a unit's children onto another node, resolve a billing account's retained financial
+     * records) belongs to that resource's specification.
+     *
+     * Replaced `ORGANIZATION_UNIT_HAS_DEPENDENTS` and `BILLING_ACCOUNT_HAS_DEPENDENTS`, the codes of the
+     * two hand-written DELETE prefix guards this posture now derives (#1123).
+     */
+    ErrorCustomMessageReference["RESOURCE_HAS_DEPENDENTS"] = "resource_has_dependents";
+    /**
+     * A delete addresses a row under an active legal hold (#1634). 409: the caller is authorized, the hold
+     * forbids it until it is released. Carries `code: LegalHoldErrorCode.LEGAL_HOLD_ACTIVE` and the grounds.
+     */
+    ErrorCustomMessageReference["LEGAL_HOLD_ACTIVE"] = "legal_hold_active";
+    /**
+     * The active legal holds could not be read, so whether the addressed rows are held is unknown and the
+     * delete is refused (fail closed, #1634). Retrying later is the remedy.
+     */
+    ErrorCustomMessageReference["LEGAL_HOLD_STATE_UNVERIFIABLE"] = "legal_hold_state_unverifiable";
     /**
      * A unit `code` is already used by a sibling under the same parent.
      *
@@ -369,6 +435,21 @@ export var ErrorCustomMessageReference;
      * differently depending on which write won a race.
      */
     ErrorCustomMessageReference["ORGANIZATION_UNIT_CODE_EXISTS"] = "organization_unit_code_exists";
+    /**
+     * The write would change something an identity directory owns on a unit it provisioned — the
+     * unit's name, or who is in it — while that directory can still push (#1392).
+     *
+     * A unit created by SCIM `/Groups` (`externalSource: SCIM`) is reconciled by the directory: its
+     * name and its member set are re-asserted on every push, so an edit made in the application is
+     * reverted with no error. Refusing tells the administrator where the change belongs instead of
+     * letting it be typed and lost. Emitted as `ErrorType.CONFLICT` (409): the caller is authorized
+     * and the payload is valid; what refuses it is who owns the row.
+     *
+     * The refusal lifts on its own once the organization holds no usable SCIM token — no directory can
+     * push, so an edit made here sticks. Roles on an assignment, the unit's code, type, status and
+     * position are NOT directory-owned and are never refused here.
+     */
+    ErrorCustomMessageReference["ORGANIZATION_UNIT_DIRECTORY_MANAGED"] = "organization_unit_directory_managed";
     /**
      * The requested organization `slug` is already taken.
      *
@@ -412,7 +493,6 @@ export var ErrorCustomMessageReference;
     ErrorCustomMessageReference["BILLING_ACCOUNT_NOT_FOUND"] = "billing_account_not_found";
     ErrorCustomMessageReference["BILLING_NO_PROVIDER_CUSTOMER"] = "billing_no_provider_customer";
     ErrorCustomMessageReference["BILLING_SUBSCRIPTION_NOT_FOUND"] = "billing_subscription_not_found";
-    ErrorCustomMessageReference["BILLING_NO_ACTIVE_SUBSCRIPTION"] = "billing_no_active_subscription";
     ErrorCustomMessageReference["BILLING_NO_PROVIDER_SUBSCRIPTION"] = "billing_no_provider_subscription";
     ErrorCustomMessageReference["BILLING_NO_PROVIDER_PRICE"] = "billing_no_provider_price";
     ErrorCustomMessageReference["BILLING_PRODUCT_NOT_FOUND"] = "billing_product_not_found";
@@ -444,8 +524,8 @@ export var ErrorCustomMessageReference;
     /**
      * A purchase named a product that has been RETIRED from the code catalogue.
      *
-     * `Product.isActive` was the declared off-boarding path — `assertNoBillingAccountDependents`'s own
-     * comment calls the soft retire "the product off-boarding path" — and until 2026-09-09 no purchase
+     * `Product.isActive` was the declared off-boarding path — the billing-account specification's DELETE
+     * entry calls the soft retire "the product off-boarding path" — and until 2026-09-09 no purchase
      * path consulted it. `readProductByKey` returned an inactive product exactly like an active one, so
      * a product could be withdrawn and still be bought, granting entitlements frozen at whatever the
      * last catalogue sync wrote.
@@ -458,27 +538,53 @@ export var ErrorCustomMessageReference;
      * Never raised for a REMOVE_ADDON: a customer holding a retired add-on must be able to drop it.
      */
     ErrorCustomMessageReference["BILLING_PRODUCT_RETIRED"] = "billing_product_retired";
-    ErrorCustomMessageReference["BILLING_SCOPE_NOT_ENABLED"] = "billing_scope_not_enabled";
     /**
-     * Hard removal of a billing account was refused because retained financial children
-     * (subscriptions / invoice refs / usage records / credit pools) still reference it.
-     *
-     * Emitted as `ErrorType.CONFLICT` (409). CONFLICT is one of the few error types that
-     * expose `context` to the client, so the blocking child families are surfaced by name.
-     *
-     * @see the billing-retention rationale at the `Scope -> BillingAccounts` declaration in
-     * `resources-registry.shared.core.definitions.ts` — the children are RETAINED on purpose,
-     * and this account row holds the only local `providerCustomerId` that maps them back to
-     * the provider customer.
+     * The product exists and is announced on pricing surfaces, but its catalogue `availability` is
+     * `UPCOMING`: it cannot be bought, or moved onto, yet. `CONFLICT` for the reason
+     * `BILLING_PRODUCT_RETIRED` gives — the caller and the product are both valid, and what forbids the
+     * purchase is the catalogue's current state. Distinct from retirement because the remedy is the
+     * opposite one: this product will be offered later, a retired one never again.
+     */
+    ErrorCustomMessageReference["BILLING_PRODUCT_NOT_YET_AVAILABLE"] = "billing_product_not_yet_available";
+    /**
+     * A one-time purchase asked for more units than the product's `purchaseConfig.maxQuantityPerPurchase`
+     * allows (#1798). `BUSINESS_RULE`: the request is well-formed and the caller may buy the product, but
+     * not that many at once. Before #1798 nothing read the cap, so a product declaring one sold any
+     * quantity up to the checkout's own bound.
      */
-    ErrorCustomMessageReference["BILLING_ACCOUNT_HAS_DEPENDENTS"] = "billing_account_has_dependents";
+    ErrorCustomMessageReference["BILLING_PURCHASE_QUANTITY_EXCEEDS_LIMIT"] = "billing_purchase_quantity_exceeds_limit";
+    /** Issuing a referral code while the application's `billing.referrals.enabled` is off (#1802). `CONFLICT`: the state of the program forbids it. */
+    ErrorCustomMessageReference["BILLING_REFERRAL_PROGRAM_DISABLED"] = "billing_referral_program_disabled";
+    /**
+     * A referral code that cannot be redeemed: unknown, expired, withdrawn, already redeemed or already
+     * converted (#1802). ONE reference for all five on purpose — telling them apart would let a caller probe
+     * which codes exist. The reason is kept in the error's internal context for the logs.
+     */
+    ErrorCustomMessageReference["BILLING_REFERRAL_CODE_INVALID"] = "billing_referral_code_invalid";
+    /**
+     * The account redeeming a code cannot be referred (#1802): it is the referrer's own account, it has
+     * subscribed or paid before, or it already redeemed another code. A referral rewards bringing a NEW
+     * customer, so each of these would reward nothing.
+     */
+    ErrorCustomMessageReference["BILLING_REFERRAL_ACCOUNT_NOT_ELIGIBLE"] = "billing_referral_account_not_eligible";
+    /** Cancelling a referral that has converted, expired or been cancelled already (#1802). `CONFLICT`. */
+    ErrorCustomMessageReference["BILLING_REFERRAL_NOT_CANCELLABLE"] = "billing_referral_not_cancellable";
+    ErrorCustomMessageReference["BILLING_SCOPE_NOT_ENABLED"] = "billing_scope_not_enabled";
     // SAML Protocol Engine errors (AUTH-2)
     ErrorCustomMessageReference["SAML_ASSERTION_INVALID"] = "saml_assertion_invalid";
     ErrorCustomMessageReference["SAML_SIGNATURE_INVALID"] = "saml_signature_invalid";
     ErrorCustomMessageReference["SAML_AUDIENCE_MISMATCH"] = "saml_audience_mismatch";
     ErrorCustomMessageReference["SAML_REPLAY_DETECTED"] = "saml_replay_detected";
     ErrorCustomMessageReference["SAML_EXPIRED"] = "saml_expired";
-    ErrorCustomMessageReference["SAML_DOMAIN_NOT_VERIFIED"] = "saml_domain_not_verified";
+    /**
+     * An enterprise assertion named an email domain the target organization has not VERIFIED.
+     *
+     * Protocol-neutral, and renamed from `SAML_DOMAIN_NOT_VERIFIED` when the OIDC lane gained the same
+     * check (#1231). It was SAML-named because only SAML asked the question — which was the defect: the
+     * identical assertion over OIDC was admitted. One question asked by two protocols is one refusal,
+     * and a protocol-specific name would have re-created the divergence in the vocabulary.
+     */
+    ErrorCustomMessageReference["SSO_DOMAIN_NOT_VERIFIED"] = "sso_domain_not_verified";
     ErrorCustomMessageReference["SAML_CERT_EXPIRED"] = "saml_cert_expired";
     ErrorCustomMessageReference["SAML_DECRYPTION_FAILED"] = "saml_decryption_failed";
     ErrorCustomMessageReference["SAML_SP_KEY_MISMATCH"] = "saml_sp_key_mismatch";
@@ -489,6 +595,14 @@ export var ErrorCustomMessageReference;
     ErrorCustomMessageReference["SAML_MULTIPLE_ASSERTIONS"] = "saml_multiple_assertions";
     ErrorCustomMessageReference["SAML_BINDING_MISMATCH"] = "saml_binding_mismatch";
     ErrorCustomMessageReference["SAML_METADATA_PARSE_ERROR"] = "saml_metadata_parse_error";
+    /**
+     * An administrator's OIDC endpoint discovery for an issuer failed: the issuer is not HTTPS, the
+     * `/.well-known/openid-configuration` document could not be fetched or parsed, it lacks a required
+     * endpoint, or its `issuer` does not match (#1800). A 400: the issuer the administrator typed is the
+     * problem, and the context carries which of these it was. Sign-in's own discovery failures stay
+     * configuration errors.
+     */
+    ErrorCustomMessageReference["OIDC_DISCOVERY_FAILED"] = "oidc_discovery_failed";
     ErrorCustomMessageReference["SAML_INVALID_IN_RESPONSE_TO"] = "saml_invalid_in_response_to";
     ErrorCustomMessageReference["SAML_ORGANIZATION_REQUIRED"] = "saml_organization_required";
     ErrorCustomMessageReference["SAML_IDP_INITIATED_NOT_ALLOWED"] = "saml_idp_initiated_not_allowed";
@@ -541,6 +655,20 @@ export var ErrorCustomMessageReference;
     ErrorCustomMessageReference["ACTOR_INVALID_KIND"] = "actor_invalid_kind";
     /** The referenced actor is not active. */
     ErrorCustomMessageReference["ACTOR_NOT_ACTIVE"] = "actor_not_active";
+    /** An execution was requested for an actor the named system does not declare. */
+    ErrorCustomMessageReference["ACTOR_NOT_IN_SYSTEM"] = "actor_not_in_system";
+    /**
+     * The actor runtime was asked to run an execution and no persistence is bound for the actor plane.
+     * The plane is REQUIRED (#1358): a run that cannot be recorded refuses before doing work, because a
+     * run nobody can find afterwards is worse than one that did not start.
+     */
+    ErrorCustomMessageReference["ACTOR_EXECUTION_PERSISTENCE_UNBOUND"] = "actor_execution_persistence_unbound";
+    /** A resume was asked of an execution that is not waiting on the question answered — already answered (it may now wait on a later one), never suspended, or settled. */
+    ErrorCustomMessageReference["ACTOR_EXECUTION_NOT_SUSPENDED"] = "actor_execution_not_suspended";
+    /** A start was asked of an execution that is not `PENDING` — already started, waiting, or settled (#1359). */
+    ErrorCustomMessageReference["ACTOR_EXECUTION_NOT_PENDING"] = "actor_execution_not_pending";
+    /** An execution was opened or resumed for an exclusive subject another running execution of the same system already holds (#1361). */
+    ErrorCustomMessageReference["ACTOR_EXECUTION_SUBJECT_BUSY"] = "actor_execution_subject_busy";
     /** Chart parent context resource is not accessible to the caller. */
     ErrorCustomMessageReference["CHART_PARENT_CONTEXT_INACCESSIBLE"] = "chart_parent_context_inaccessible";
     // Auth-methods / SSO errors (user-directed)
@@ -550,6 +678,15 @@ export var ErrorCustomMessageReference;
     ErrorCustomMessageReference["OAUTH_PROVIDER_NOT_FOUND"] = "oauth_provider_not_found";
     /** The requested SSO connection was not found or is disabled. */
     ErrorCustomMessageReference["SSO_CONNECTION_NOT_FOUND"] = "sso_connection_not_found";
+    /**
+     * An enterprise SSO connection in TEMPLATE mode left a provider template placeholder unfilled, so
+     * the endpoint it appears in does not identify one identity provider.
+     *
+     * Refused rather than resolved, because the unresolved case is not a narrower trust boundary — it is
+     * a wider one. Microsoft's contract issuer is `https://login.microsoftonline.com/{tenantid}/v2.0`,
+     * and with no `tenantid` override the tenant was taken from the token being authenticated (#1148).
+     */
+    ErrorCustomMessageReference["SSO_CONNECTION_TEMPLATE_UNRESOLVED"] = "sso_connection_template_unresolved";
     // Config / data-seeding / email errors (user-directed)
     /** The frontendServiceName query parameter is required to fetch application configuration. */
     ErrorCustomMessageReference["APP_CONFIGURATION_FRONTEND_SERVICE_REQUIRED"] = "app_configuration_frontend_service_required";
@@ -645,5 +782,41 @@ export var ErrorCustomMessageReference;
     ErrorCustomMessageReference["FILE_PATH_TRAVERSAL_DETECTED"] = "file_path_traversal_detected";
     /** A bulk relationship operation must provide either _ids or a filter selector. */
     ErrorCustomMessageReference["BULK_RELATIONSHIP_SELECTOR_REQUIRED"] = "bulk_relationship_selector_required";
+    // Bulk selector vocabulary (#1461) — `_ids` (this page) or `_match` (the query that finds the rows)
+    /**
+     * The request named BOTH `_ids` and `_match` (400). Refused rather than resolved by precedence:
+     * honouring one would make the other silently inert, and the caller cannot tell which acted.
+     */
+    ErrorCustomMessageReference["BULK_SELECTOR_AMBIGUOUS"] = "bulk_selector_ambiguous";
+    /**
+     * A `_match` selector resolved to more rows than this operation may change in one synchronous
+     * request (400). A batch enforces its documented maximum; acting on more is the background lane's
+     * job, not a larger synchronous write.
+     */
+    ErrorCustomMessageReference["BULK_SELECTION_TOO_LARGE"] = "bulk_selection_too_large";
+    // Request idempotency (`Idempotency-Key`, #535)
+    /** The operation requires an `Idempotency-Key` header and the request sent none (400). */
+    ErrorCustomMessageReference["IDEMPOTENCY_KEY_REQUIRED"] = "idempotency_key_required";
+    /** The `Idempotency-Key` header is not a String of 1 to 200 printable ASCII characters (400). */
+    ErrorCustomMessageReference["IDEMPOTENCY_KEY_MALFORMED"] = "idempotency_key_malformed";
+    /** An `Idempotency-Key` header was sent to a mutation that does not take one (400). Refused so a retry is never silently undeduplicated; a read ignores it. */
+    ErrorCustomMessageReference["IDEMPOTENCY_KEY_NOT_ACCEPTED"] = "idempotency_key_not_accepted";
+    /**
+     * The `Idempotency-Key` was already used for a DIFFERENT request to this operation (422). A 422 strips error context on
+     * the wire, so this reference is the client-branchable signal: it always reaches the response.
+     */
+    ErrorCustomMessageReference["IDEMPOTENCY_KEY_REUSED"] = "idempotency_key_reused";
+    // Public submission challenge (captcha or proof of work, #1735)
+    /**
+     * A public form the application protects with a captcha was submitted with no challenge answer (400): neither a
+     * consented captcha vendor's token nor a solved proof-of-work challenge.
+     */
+    ErrorCustomMessageReference["SUBMISSION_CHALLENGE_REQUIRED"] = "submission_challenge_required";
+    /**
+     * The submission's challenge answer was refused (400): the vendor rejected its token or scored it too low, the proof of
+     * work was wrong, expired or already used, or the vendor could not be asked. The visitor can answer again — a form
+     * falls back to the proof of work, which needs no third party.
+     */
+    ErrorCustomMessageReference["SUBMISSION_CHALLENGE_REFUSED"] = "submission_challenge_refused";
 })(ErrorCustomMessageReference || (ErrorCustomMessageReference = {}));
 //# sourceMappingURL=errors.custom-message-ref.shared.definitions.js.map