@wildo-ai/saas-models 1.1.5 → 1.1.6

package/dist/esm/systems-of-record/system-of-record-declaration.shared.schemas.js

@@ -54,16 +54,59 @@ import { SystemOfRecordCredentialKind } from './system-of-record-credential-kind
 export const SYSTEM_OF_RECORD_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
 /** 32 characters, because the name is a stem of an environment-variable name rather than a label. */
 export const SYSTEM_OF_RECORD_NAME_MAX_LENGTH = 32;
+/**
+ * Whether the personal data held in a system-of-record INSTANCE can have originated from publicly
+ * accessible sources (#1745) — the half of GDPR Art. 14(2)(f) nothing else in an application can
+ * derive.
+ *
+ * A privacy notice owes, for personal data not collected from the person, "from which source the
+ * personal data originate, and if applicable, whether it came from publicly accessible sources".
+ * spec-cite: GDPR Art. 14(2)(f), https://gdpr-info.eu/art-14-gdpr/.
+ * The binding already makes the first half true: the source is this instance, a deployment the
+ * operator runs. The second half is about how records got INTO that deployment — an ERP contact
+ * may have been typed in from a public register, a website or a bought list — and only the
+ * operator knows. So the operator states it here, once per instance, as a typed value a reviewer
+ * can diff, rather than answering a question or leaving it to a drafter's guess.
+ *
+ * Omitting it is legitimate and is NOT read as "no": the notice's source statement then marks the
+ * public-origin half owed for every resource read from the instance.
+ */
+export var SystemOfRecordPersonalDataOrigin;
+(function (SystemOfRecordPersonalDataOrigin) {
+    /** Every person's data in this instance was collected by the operator — from the person, their organisation or the operator's own dealings with them — and none from a publicly accessible source. */
+    SystemOfRecordPersonalDataOrigin["NO_PUBLICLY_ACCESSIBLE_SOURCES"] = "no-publicly-accessible-sources";
+    /** Some of it may come from publicly accessible sources: company registers, websites, social profiles, enrichment services. The notice says so. */
+    SystemOfRecordPersonalDataOrigin["INCLUDES_PUBLICLY_ACCESSIBLE_SOURCES"] = "includes-publicly-accessible-sources";
+})(SystemOfRecordPersonalDataOrigin || (SystemOfRecordPersonalDataOrigin = {}));
 export const SystemOfRecordNameSchema = z
     .string()
     .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')
     .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH);
+/**
+ * The i18n bucket holding every instance's display words — the first segment of
+ * {@link buildSystemOfRecordDisplayNameLabelKey}'s keys.
+ */
+export const SYSTEM_OF_RECORD_LABEL_BUCKET = 'systems_of_record';
+/**
+ * The label key naming ONE declared instance to a person: `systems_of_record.<name>.displayName` (#1997).
+ *
+ * An instance NAME is an environment-variable stem (`odoo`, `sap-fr`), not words: it cannot be translated, and the
+ * words a reader recognises ("Odoo", "SAP France") are not derivable from it. So a surface that names an instance —
+ * the provenance cue on a field a pipeline wrote, "synced from Odoo" — resolves this key, and the labelling pipeline
+ * plans it for every declared instance, total over `systemsOfRecord`. There is deliberately no `displayName` on the
+ * declaration: display text comes from the i18n tree, never from configuration. A key nobody generated renders the
+ * raw name, which is the missing label looking missing.
+ */
+export function buildSystemOfRecordDisplayNameLabelKey(name) {
+    return `${SYSTEM_OF_RECORD_LABEL_BUCKET}.${name}.displayName`;
+}
 /** ONE declared instance. */
 export const SystemOfRecordDeclarationSchema = z.strictObject({
     /**
-     * Which vendor this is an instance of — the `vendor` of a facet the deployment ships (engine-shipped
-     * today, package-shipped once #1057 lands). Refused at boot when no facet answers to it, rather
-     * than here, because the facet map is not in scope in `wildo.saas.config.ts`.
+     * Which vendor this is an instance of — the `vendor` of a facet the deployment ships: the framework's facets
+     * come from the opt-in library `@wildo-ai/systems-of-record`, which `wildo config sync` declares on the backend
+     * as soon as an instance is declared (#2013). Refused at boot when no facet answers to it, rather than here,
+     * because the facet map is not in scope in `wildo.saas.config.ts`.
      */
     vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),
     /**
@@ -71,6 +114,21 @@ export const SystemOfRecordDeclarationSchema = z.strictObject({
      * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST
      * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong
      * to, checked at boot.
+     *
+     * ## One instance per SERVICE ROOT — so a system serving OData v2 and v4 is two instances (#1687)
+     *
+     * An instance has ONE dialect and ONE base URL, and for OData that URL is a service root: an SAP
+     * system's `/sap/opu/odata/sap/API_BUSINESS_PARTNER` (v2) and `/sap/opu/odata4/sap/<service>/…` (v4)
+     * are different roots, as two v4 services of the same system already are. So a system reached over
+     * both versions is declared as two instances, one per root, each with its own dialect, credential
+     * and `maxRequestsPerMinute`.
+     *
+     * Decided rather than asked, because the model already answered it: an instance naming several roots
+     * would need a root per binding, which is what two instances are, and a budget SHARED across
+     * instances would be a new cross-instance ledger for a ceiling the operator can already honour by
+     * splitting it between the instances' `maxRequestsPerMinute`. Both were rejected on that ground.
+     * The cost, stated: two instances against one vendor account are paced separately, so their sum —
+     * not either one — is what must stay under the vendor's allowance.
      */
     dialect: z.enum(HttpApiTransportDialect),
     /**
@@ -82,7 +140,7 @@ export const SystemOfRecordDeclarationSchema = z.strictObject({
      * The framework derives before it asks: a declaration with one legal value is a question whose
      * answer the mechanism already holds.
      *
-     * This stays additive when #1056 widens the catalogue: an instance that omitted the field is
+     * This stays additive when #1056 widens the facet set: an instance that omitted the field is
      * refused on the day its facet gains a second kind, which is exactly the day its author acquires a
      * real decision.
      */
@@ -126,6 +184,27 @@ export const SystemOfRecordDeclarationSchema = z.strictObject({
      * prevent in the first place.
      */
     partition: z.boolean().optional(),
+    /**
+     * The PACKAGES whose facet augmentation applies to this instance (#1675) — npm package names, each of which
+     * must ship an augmentation for this instance's vendor from its `./systems-of-record` export.
+     *
+     * An explicit opt-in per INSTANCE, never implied by installation, because what an augmentation adds can be a
+     * partition declaration, and the facet is the single authority on how a tenant's rows are confined. Two
+     * instances of one vendor may therefore differ: one opts a package's partition in, the other does not.
+     * A package named here that ships no augmentation for the vendor refuses at startup, naming it.
+     *
+     * Naming a package here is also what ADMITS its `./systems-of-record` module to discovery (#2013): apart from the
+     * framework library `@wildo-ai/systems-of-record`, a facet module is recorded only from a package some instance
+     * names. The package must still be walked — named `<scope>/provider-*`, or listed in `providers.packages`.
+     */
+    facetAugmentations: z.array(z.string().min(1).max(214)).min(1).refine((packages) => new Set(packages).size === packages.length, 'A package is named twice in facetAugmentations.').optional(),
+    /**
+     * Whether the personal data in THIS deployment can have come from publicly accessible sources — see
+     * {@link SystemOfRecordPersonalDataOrigin}. A property of the deployment, not the vendor: two Odoo
+     * instances may be fed differently. Optional; omitted, the privacy notice marks that statement owed
+     * for every resource read from this instance, and never states "not from public sources" by default.
+     */
+    personalDataOrigin: z.enum(SystemOfRecordPersonalDataOrigin).optional(),
 });
 /**
  * Every instance this application declares, keyed by name.

package/dist/esm/systems-of-record/system-of-record-declaration.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-declaration.shared.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-declaration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,6GAA6G;AAE7G;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE,qGAAqG;AACrG,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,EAAE;KACR,KAAK,CAAC,6BAA6B,EAAE,sEAAsE,CAAC;KAC5G,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAEzC,6BAA6B;AAC7B,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzF;;;;;OAKG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAExC;;;;;;;;;;;;OAYG;IACH,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErF;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAErE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC,wBAAwB,EAAE,+BAA+B,CAAC;KACjE,WAAW,CAAC,CAAC,eAAe,EAAE,GAAG,EAAE,EAAE;IACpC,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,2GAA2G;kBACzG,iCAAiC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,2DAA2D","sourcesContent":["/**\n * `systemsOfRecord` — the application's declared INSTANCES of the systems it reads its own business\n * rows out of.\n *\n * ```ts\n * systemsOfRecord: {\n *   odoo: { vendor: 'odoo', dialect: HttpApiTransportDialect.ODOO_JSONRPC },\n * }\n * ```\n *\n * ## The name is the whole point\n *\n * Before this, a resource addressed a remote system by `httpApiBinding.providerRef` — a free string\n * naming a PROVIDER whose env-var names were literals inside its module, so one ref was one\n * deployment and a second Odoo could not be expressed at all. A name here is an INSTANCE: two\n * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in their addresses and secrets.\n *\n * The name is also the stem of every environment variable the instance needs —\n * `WILDO_SOR_<NAME>__<SLOT>` — which is why it is capped at 32 characters and admits only\n * lower-kebab-case. Renaming an instance therefore renames its variables, and there is deliberately\n * no rename door for secrets: `wildo config sync` reports every now-missing slot and an operator\n * re-authors them (#1055 E6).\n *\n * ## What is validated HERE, and what is not\n *\n * Here: the SHAPE, and only what a single configuration file can see. That `vendor` names a facet\n * the deployment actually ships, and that `dialect` is one the facet speaks, are checked at BOOT by\n * the systems-of-record registry — the earliest place where the declaration and the facet map are in\n * the same scope. Splitting it that way is the same honest split `httpApiBinding` already makes:\n * the factory checks shape, the registry checks agreement.\n *\n * Also not here: that the environment actually supplies each slot. The saas config and the infra env\n * config parse independently, so cross-file coherence is checked at the seams where both are in\n * scope — `wildo config sync` and the backend startup validator.\n *\n * ## Why declaring one requires an owner organization (#1054)\n *\n * A system of record is read with the APPLICATION's own service identity, and its rows are stamped\n * with the owning organization's id so the per-row tenant gate passes without an exemption. An\n * application that declares no organization type carrying `ownsApplication` has no organization to\n * stamp with, so every read of every bound resource would refuse at request time. That refusal is\n * a statement about two top-level blocks, so it lives in `WildoSaasConfigSchema`'s own refinement,\n * where both are visible.\n */\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\nimport { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';\n\n/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */\n\n/**\n * The charset law for an instance name, exported because the environment-variable derivation and\n * every tool that parses a derived name back into a `(name, slot)` pair depend on it: a name may\n * not contain `_`, so the `__` delimiter is unambiguous (#1055 R4).\n */\nexport const SYSTEM_OF_RECORD_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;\n\n/** 32 characters, because the name is a stem of an environment-variable name rather than a label. */\nexport const SYSTEM_OF_RECORD_NAME_MAX_LENGTH = 32;\n\nexport const SystemOfRecordNameSchema = z\n  .string()\n  .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')\n  .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH);\n\n/** ONE declared instance. */\nexport const SystemOfRecordDeclarationSchema = z.strictObject({\n  /**\n   * Which vendor this is an instance of — the `vendor` of a facet the deployment ships (engine-shipped\n   * today, package-shipped once #1057 lands). Refused at boot when no facet answers to it, rather\n   * than here, because the facet map is not in scope in `wildo.saas.config.ts`.\n   */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n\n  /**\n   * How this instance is READ. Declared per instance rather than taken from the facet because a\n   * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST\n   * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong\n   * to, checked at boot.\n   */\n  dialect: z.enum(HttpApiTransportDialect),\n\n  /**\n   * How the engine proves who it is.\n   *\n   * OPTIONAL, and the absence is DERIVED rather than defaulted: when the instance's facet offers\n   * exactly one credential kind there is nothing for an author to decide, so the registry takes it;\n   * when a facet offers more than one and the instance names none, boot refuses and lists them.\n   * The framework derives before it asks: a declaration with one legal value is a question whose\n   * answer the mechanism already holds.\n   *\n   * This stays additive when #1056 widens the catalogue: an instance that omitted the field is\n   * refused on the day its facet gains a second kind, which is exactly the day its author acquires a\n   * real decision.\n   */\n  credential: z.strictObject({ kind: z.enum(SystemOfRecordCredentialKind) }).optional(),\n\n  /**\n   * The pace this deployment may call the instance at, across EVERY resource bound to it (#1056 §3).\n   *\n   * Per INSTANCE because that is the unit the vendor accounts for: two resources bound to one\n   * Dataverse are one application user to Dataverse, so two independent per-binding budgets would\n   * each believe they were within a limit the pair together exceeds.\n   *\n   * A binding's own `remoteCallSemantics.maxRequestsPerMinute` stays, and becomes a CEILING UNDER\n   * this one: it answers a different question — how much of the shared allowance may ONE resource\n   * take — which matters when a pipeline load and an interactive read share an instance. Both are\n   * consumed for every call, and a call proceeds only if both have room.\n   *\n   * Omitted means unlimited HERE, which is the honest default: the framework does not know the\n   * vendor's contract, and inventing a number would either throttle a deployment that paid for more\n   * or fail to protect one that has less.\n   */\n  maxRequestsPerMinute: z.number().int().min(1).max(600_000).optional(),\n\n  /**\n   * Whether THIS deployment's data is partitioned, and its rows therefore confined to organization\n   * units of the owner organization (#1058).\n   *\n   * ## The reservation this replaces\n   *\n   * #1055 declared this field `z.never()` and refused it by name, because accepting a declaration the\n   * mechanism could not honour would let an author believe their rows were narrowed while every\n   * member still saw every row. That refusal did its job and is now lifted.\n   *\n   * ## Why the VENDOR says how and the INSTANCE says whether\n   *\n   * How a vendor partitions — which field, what shape, what codec — is a property of the vendor and\n   * lives on its facet. Whether a given deployment's data is partitioned is a property of the\n   * deployment: a single-company Odoo has a `company_id` on every row and nothing to confine, and\n   * asking its operator to restate the field name would be asking a question the facet answers.\n   *\n   * Opting in against a facet that declares no partitioning is refused at boot, naming the vendor —\n   * the alternative is a `true` that does nothing, which is the shape the reservation existed to\n   * prevent in the first place.\n   */\n  partition: z.boolean().optional(),\n});\nexport type SystemOfRecordDeclaration = z.infer<typeof SystemOfRecordDeclarationSchema>;\n\n/**\n * Every instance this application declares, keyed by name.\n *\n * Optional as a whole: an application that reads nothing out of another system declares nothing, and\n * declaring this block is what ENABLES the external-data lane (#1055 D3) rather than an engine\n * capability flag — the lane has no meaning without an instance to point at.\n */\nexport const SystemsOfRecordConfigSchema = z\n  .record(SystemOfRecordNameSchema, SystemOfRecordDeclarationSchema)\n  .superRefine((systemsOfRecord, ctx) => {\n    if (Object.keys(systemsOfRecord).length === 0) {\n      ctx.addIssue({\n        code: 'custom',\n        path: [],\n        message:\n          'An empty `systemsOfRecord` declares nothing and enables nothing. Omit the block entirely, or declare the '\n          + 'instance the application reads.',\n      });\n    }\n  });\nexport type SystemsOfRecordConfig = z.infer<typeof SystemsOfRecordConfigSchema>;\n/** @wildo_source:part:end saas.models.systems-of-record */\n"]}
+{"version":3,"file":"system-of-record-declaration.shared.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-declaration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,6GAA6G;AAE7G;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE,qGAAqG;AACrG,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,gCAKX;AALD,WAAY,gCAAgC;IAC1C,sMAAsM;IACtM,qGAAiE,CAAA;IACjE,mJAAmJ;IACnJ,iHAA6E,CAAA;AAC/E,CAAC,EALW,gCAAgC,KAAhC,gCAAgC,QAK3C;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,EAAE;KACR,KAAK,CAAC,6BAA6B,EAAE,sEAAsE,CAAC;KAC5G,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,UAAU,sCAAsC,CAAC,IAAY;IACjE,OAAO,GAAG,6BAA6B,IAAI,IAAI,cAAc,CAAC;AAChE,CAAC;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAExC;;;;;;;;;;;;OAYG;IACH,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErF;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAErE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC;;;;;;;;;;;;OAYG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CACnE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EACxD,iDAAiD,CAClD,CAAC,QAAQ,EAAE;IAEZ;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC,wBAAwB,EAAE,+BAA+B,CAAC;KACjE,WAAW,CAAC,CAAC,eAAe,EAAE,GAAG,EAAE,EAAE;IACpC,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,2GAA2G;kBACzG,iCAAiC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,2DAA2D","sourcesContent":["/**\n * `systemsOfRecord` — the application's declared INSTANCES of the systems it reads its own business\n * rows out of.\n *\n * ```ts\n * systemsOfRecord: {\n *   odoo: { vendor: 'odoo', dialect: HttpApiTransportDialect.ODOO_JSONRPC },\n * }\n * ```\n *\n * ## The name is the whole point\n *\n * Before this, a resource addressed a remote system by `httpApiBinding.providerRef` — a free string\n * naming a PROVIDER whose env-var names were literals inside its module, so one ref was one\n * deployment and a second Odoo could not be expressed at all. A name here is an INSTANCE: two\n * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in their addresses and secrets.\n *\n * The name is also the stem of every environment variable the instance needs —\n * `WILDO_SOR_<NAME>__<SLOT>` — which is why it is capped at 32 characters and admits only\n * lower-kebab-case. Renaming an instance therefore renames its variables, and there is deliberately\n * no rename door for secrets: `wildo config sync` reports every now-missing slot and an operator\n * re-authors them (#1055 E6).\n *\n * ## What is validated HERE, and what is not\n *\n * Here: the SHAPE, and only what a single configuration file can see. That `vendor` names a facet\n * the deployment actually ships, and that `dialect` is one the facet speaks, are checked at BOOT by\n * the systems-of-record registry — the earliest place where the declaration and the facet map are in\n * the same scope. Splitting it that way is the same honest split `httpApiBinding` already makes:\n * the factory checks shape, the registry checks agreement.\n *\n * Also not here: that the environment actually supplies each slot. The saas config and the infra env\n * config parse independently, so cross-file coherence is checked at the seams where both are in\n * scope — `wildo config sync` and the backend startup validator.\n *\n * ## Why declaring one requires an owner organization (#1054)\n *\n * A system of record is read with the APPLICATION's own service identity, and its rows are stamped\n * with the owning organization's id so the per-row tenant gate passes without an exemption. An\n * application that declares no organization type carrying `ownsApplication` has no organization to\n * stamp with, so every read of every bound resource would refuse at request time. That refusal is\n * a statement about two top-level blocks, so it lives in `WildoSaasConfigSchema`'s own refinement,\n * where both are visible.\n */\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\nimport { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';\n\n/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */\n\n/**\n * The charset law for an instance name, exported because the environment-variable derivation and\n * every tool that parses a derived name back into a `(name, slot)` pair depend on it: a name may\n * not contain `_`, so the `__` delimiter is unambiguous (#1055 R4).\n */\nexport const SYSTEM_OF_RECORD_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;\n\n/** 32 characters, because the name is a stem of an environment-variable name rather than a label. */\nexport const SYSTEM_OF_RECORD_NAME_MAX_LENGTH = 32;\n\n/**\n * Whether the personal data held in a system-of-record INSTANCE can have originated from publicly\n * accessible sources (#1745) — the half of GDPR Art. 14(2)(f) nothing else in an application can\n * derive.\n *\n * A privacy notice owes, for personal data not collected from the person, \"from which source the\n * personal data originate, and if applicable, whether it came from publicly accessible sources\".\n * spec-cite: GDPR Art. 14(2)(f), https://gdpr-info.eu/art-14-gdpr/.\n * The binding already makes the first half true: the source is this instance, a deployment the\n * operator runs. The second half is about how records got INTO that deployment — an ERP contact\n * may have been typed in from a public register, a website or a bought list — and only the\n * operator knows. So the operator states it here, once per instance, as a typed value a reviewer\n * can diff, rather than answering a question or leaving it to a drafter's guess.\n *\n * Omitting it is legitimate and is NOT read as \"no\": the notice's source statement then marks the\n * public-origin half owed for every resource read from the instance.\n */\nexport enum SystemOfRecordPersonalDataOrigin {\n  /** Every person's data in this instance was collected by the operator — from the person, their organisation or the operator's own dealings with them — and none from a publicly accessible source. */\n  NO_PUBLICLY_ACCESSIBLE_SOURCES = 'no-publicly-accessible-sources',\n  /** Some of it may come from publicly accessible sources: company registers, websites, social profiles, enrichment services. The notice says so. */\n  INCLUDES_PUBLICLY_ACCESSIBLE_SOURCES = 'includes-publicly-accessible-sources',\n}\n\nexport const SystemOfRecordNameSchema = z\n  .string()\n  .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')\n  .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH);\n\n/**\n * The i18n bucket holding every instance's display words — the first segment of\n * {@link buildSystemOfRecordDisplayNameLabelKey}'s keys.\n */\nexport const SYSTEM_OF_RECORD_LABEL_BUCKET = 'systems_of_record';\n\n/**\n * The label key naming ONE declared instance to a person: `systems_of_record.<name>.displayName` (#1997).\n *\n * An instance NAME is an environment-variable stem (`odoo`, `sap-fr`), not words: it cannot be translated, and the\n * words a reader recognises (\"Odoo\", \"SAP France\") are not derivable from it. So a surface that names an instance —\n * the provenance cue on a field a pipeline wrote, \"synced from Odoo\" — resolves this key, and the labelling pipeline\n * plans it for every declared instance, total over `systemsOfRecord`. There is deliberately no `displayName` on the\n * declaration: display text comes from the i18n tree, never from configuration. A key nobody generated renders the\n * raw name, which is the missing label looking missing.\n */\nexport function buildSystemOfRecordDisplayNameLabelKey(name: string): string {\n  return `${SYSTEM_OF_RECORD_LABEL_BUCKET}.${name}.displayName`;\n}\n\n/** ONE declared instance. */\nexport const SystemOfRecordDeclarationSchema = z.strictObject({\n  /**\n   * Which vendor this is an instance of — the `vendor` of a facet the deployment ships: the framework's facets\n   * come from the opt-in library `@wildo-ai/systems-of-record`, which `wildo config sync` declares on the backend\n   * as soon as an instance is declared (#2013). Refused at boot when no facet answers to it, rather than here,\n   * because the facet map is not in scope in `wildo.saas.config.ts`.\n   */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n\n  /**\n   * How this instance is READ. Declared per instance rather than taken from the facet because a\n   * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST\n   * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong\n   * to, checked at boot.\n   *\n   * ## One instance per SERVICE ROOT — so a system serving OData v2 and v4 is two instances (#1687)\n   *\n   * An instance has ONE dialect and ONE base URL, and for OData that URL is a service root: an SAP\n   * system's `/sap/opu/odata/sap/API_BUSINESS_PARTNER` (v2) and `/sap/opu/odata4/sap/<service>/…` (v4)\n   * are different roots, as two v4 services of the same system already are. So a system reached over\n   * both versions is declared as two instances, one per root, each with its own dialect, credential\n   * and `maxRequestsPerMinute`.\n   *\n   * Decided rather than asked, because the model already answered it: an instance naming several roots\n   * would need a root per binding, which is what two instances are, and a budget SHARED across\n   * instances would be a new cross-instance ledger for a ceiling the operator can already honour by\n   * splitting it between the instances' `maxRequestsPerMinute`. Both were rejected on that ground.\n   * The cost, stated: two instances against one vendor account are paced separately, so their sum —\n   * not either one — is what must stay under the vendor's allowance.\n   */\n  dialect: z.enum(HttpApiTransportDialect),\n\n  /**\n   * How the engine proves who it is.\n   *\n   * OPTIONAL, and the absence is DERIVED rather than defaulted: when the instance's facet offers\n   * exactly one credential kind there is nothing for an author to decide, so the registry takes it;\n   * when a facet offers more than one and the instance names none, boot refuses and lists them.\n   * The framework derives before it asks: a declaration with one legal value is a question whose\n   * answer the mechanism already holds.\n   *\n   * This stays additive when #1056 widens the facet set: an instance that omitted the field is\n   * refused on the day its facet gains a second kind, which is exactly the day its author acquires a\n   * real decision.\n   */\n  credential: z.strictObject({ kind: z.enum(SystemOfRecordCredentialKind) }).optional(),\n\n  /**\n   * The pace this deployment may call the instance at, across EVERY resource bound to it (#1056 §3).\n   *\n   * Per INSTANCE because that is the unit the vendor accounts for: two resources bound to one\n   * Dataverse are one application user to Dataverse, so two independent per-binding budgets would\n   * each believe they were within a limit the pair together exceeds.\n   *\n   * A binding's own `remoteCallSemantics.maxRequestsPerMinute` stays, and becomes a CEILING UNDER\n   * this one: it answers a different question — how much of the shared allowance may ONE resource\n   * take — which matters when a pipeline load and an interactive read share an instance. Both are\n   * consumed for every call, and a call proceeds only if both have room.\n   *\n   * Omitted means unlimited HERE, which is the honest default: the framework does not know the\n   * vendor's contract, and inventing a number would either throttle a deployment that paid for more\n   * or fail to protect one that has less.\n   */\n  maxRequestsPerMinute: z.number().int().min(1).max(600_000).optional(),\n\n  /**\n   * Whether THIS deployment's data is partitioned, and its rows therefore confined to organization\n   * units of the owner organization (#1058).\n   *\n   * ## The reservation this replaces\n   *\n   * #1055 declared this field `z.never()` and refused it by name, because accepting a declaration the\n   * mechanism could not honour would let an author believe their rows were narrowed while every\n   * member still saw every row. That refusal did its job and is now lifted.\n   *\n   * ## Why the VENDOR says how and the INSTANCE says whether\n   *\n   * How a vendor partitions — which field, what shape, what codec — is a property of the vendor and\n   * lives on its facet. Whether a given deployment's data is partitioned is a property of the\n   * deployment: a single-company Odoo has a `company_id` on every row and nothing to confine, and\n   * asking its operator to restate the field name would be asking a question the facet answers.\n   *\n   * Opting in against a facet that declares no partitioning is refused at boot, naming the vendor —\n   * the alternative is a `true` that does nothing, which is the shape the reservation existed to\n   * prevent in the first place.\n   */\n  partition: z.boolean().optional(),\n\n  /**\n   * The PACKAGES whose facet augmentation applies to this instance (#1675) — npm package names, each of which\n   * must ship an augmentation for this instance's vendor from its `./systems-of-record` export.\n   *\n   * An explicit opt-in per INSTANCE, never implied by installation, because what an augmentation adds can be a\n   * partition declaration, and the facet is the single authority on how a tenant's rows are confined. Two\n   * instances of one vendor may therefore differ: one opts a package's partition in, the other does not.\n   * A package named here that ships no augmentation for the vendor refuses at startup, naming it.\n   *\n   * Naming a package here is also what ADMITS its `./systems-of-record` module to discovery (#2013): apart from the\n   * framework library `@wildo-ai/systems-of-record`, a facet module is recorded only from a package some instance\n   * names. The package must still be walked — named `<scope>/provider-*`, or listed in `providers.packages`.\n   */\n  facetAugmentations: z.array(z.string().min(1).max(214)).min(1).refine(\n    (packages) => new Set(packages).size === packages.length,\n    'A package is named twice in facetAugmentations.',\n  ).optional(),\n\n  /**\n   * Whether the personal data in THIS deployment can have come from publicly accessible sources — see\n   * {@link SystemOfRecordPersonalDataOrigin}. A property of the deployment, not the vendor: two Odoo\n   * instances may be fed differently. Optional; omitted, the privacy notice marks that statement owed\n   * for every resource read from this instance, and never states \"not from public sources\" by default.\n   */\n  personalDataOrigin: z.enum(SystemOfRecordPersonalDataOrigin).optional(),\n});\nexport type SystemOfRecordDeclaration = z.infer<typeof SystemOfRecordDeclarationSchema>;\n\n/**\n * Every instance this application declares, keyed by name.\n *\n * Optional as a whole: an application that reads nothing out of another system declares nothing, and\n * declaring this block is what ENABLES the external-data lane (#1055 D3) rather than an engine\n * capability flag — the lane has no meaning without an instance to point at.\n */\nexport const SystemsOfRecordConfigSchema = z\n  .record(SystemOfRecordNameSchema, SystemOfRecordDeclarationSchema)\n  .superRefine((systemsOfRecord, ctx) => {\n    if (Object.keys(systemsOfRecord).length === 0) {\n      ctx.addIssue({\n        code: 'custom',\n        path: [],\n        message:\n          'An empty `systemsOfRecord` declares nothing and enables nothing. Omit the block entirely, or declare the '\n          + 'instance the application reads.',\n      });\n    }\n  });\nexport type SystemsOfRecordConfig = z.infer<typeof SystemsOfRecordConfigSchema>;\n/** @wildo_source:part:end saas.models.systems-of-record */\n"]}

package/dist/esm/systems-of-record/system-of-record-error-codes.shared.d.ts

@@ -8,22 +8,30 @@
  *   and restarting, which needs no running companion, so refusing at boot is legitimate
  *   (`continuity-drift-and-cas-basis.md` Rule 3 — the remedy does not route back through the thing
  *   that just refused).
- * - **Request codes** name a state of the WORLD at the moment of a read: this environment has no
- *   access to the instance, or the owner organization is not seeded yet. Neither is an authoring
- *   mistake, and both must answer with a code rather than a 500 or a silent empty list.
+ * - **Request codes** name a state of the WORLD at the moment of a read or a write: this environment
+ *   has no access to the instance, the owner organization is not seeded yet, a write landed in a
+ *   partition the caller may not touch, or its outcome is unknown. None is an authoring mistake, and
+ *   each must answer with a code rather than a 500 or a silent empty list.
  *
  * Carried in the error's `context.code`, which survives `sanitizeErrorForClient` for `CONFLICT` and
  * `VALIDATION` — the reason those two error types are used here rather than `AUTHORIZATION`, whose
  * context is stripped entirely. A refusal a client cannot branch on is a refusal a client will retry.
  */
-/** Why a system of record could not be prepared, or could not be read. */
+/**
+ * @wildo_source:part:start saas.models.system-of-record-error-codes facet:layer:shared facet:audience:app-developer
+ *
+ * Why a system of record could not be prepared, read, or written — the stable `context.code` a client branches on.
+ * Imported from `@wildo-ai/saas-models`. Request codes ride a `CONFLICT` (409) or `VALIDATION` (400) answer, the two
+ * error types whose context reaches the client.
+ */
 export declare enum SystemOfRecordErrorCode {
     /**
      * BOOT — an instance names a vendor no facet answers to.
      *
-     * The engine ships some facets and a package may ship others (#1057), so this means the vendor is
-     * spelled wrong OR the package that owns it is not installed. The message names both, because from
-     * inside the registry the two are indistinguishable.
+     * The framework's facets ship in the opt-in library `@wildo-ai/systems-of-record` (#2013), and an augmentation
+     * package an instance opts into may add others, so this means the vendor is spelled wrong OR the package that
+     * owns it is not installed. The message names both, because from inside the registry the two are
+     * indistinguishable, and names the library and its remedy.
      */
     VENDOR_HAS_NO_FACET = "SYSTEM_OF_RECORD_VENDOR_HAS_NO_FACET",
     /**
@@ -33,6 +41,35 @@ export declare enum SystemOfRecordErrorCode {
      * install, and reporting it as that one sent a correct configuration looking for a typo (2026-09-24).
      */
     FACET_MODULES_NOT_GENERATED = "SYSTEM_OF_RECORD_FACET_MODULES_NOT_GENERATED",
+    /**
+     * BOOT — an instance opts into a facet AUGMENTATION (#1675) from a package that ships none for its
+     * vendor: `wildo config sync` did not record its `<package>/systems-of-record` module (a package discovery
+     * does not walk by name must be listed in `providers.packages`, #1676), the recorded module fails to load
+     * (the import error is named), or it augments other vendors only. `wildo config sync` refuses the first
+     * case too, before anything starts. Named rather than ignored, because an augmentation the author believes
+     * applies — a partition declaration, say — that silently does not is a confinement they think they have.
+     */
+    FACET_AUGMENTATION_NOT_FOUND = "SYSTEM_OF_RECORD_FACET_AUGMENTATION_NOT_FOUND",
+    /**
+     * BOOT — an opted-in augmentation (#1675) fails the augmentation schema, or the facet it produces once
+     * merged into the base fails the facet schema. The refusal names the package and the instance rather
+     * than surfacing a bare schema error that names neither.
+     */
+    FACET_AUGMENTATION_INVALID = "SYSTEM_OF_RECORD_FACET_AUGMENTATION_INVALID",
+    /**
+     * BOOT — two facet modules each present a BASE facet for one vendor (#1675). Refused naming both,
+     * because the base carries the vendor's partition and "first in module order" would let whichever
+     * package name sorts first decide how a tenant's rows are confined. A package that adds to a vendor it
+     * does not own ships an augmentation an instance opts into.
+     */
+    FACET_BASE_CONFLICT = "SYSTEM_OF_RECORD_FACET_BASE_CONFLICT",
+    /**
+     * BOOT — two sources declare the same thing for one instance's vendor (#1675): a partition declared by
+     * the base facet AND an augmentation, or by two augmentations; one credential kind offered twice. The
+     * facet is the single partition authority, so which declaration confines a tenant's rows must never
+     * depend on order. The refusal names both sources.
+     */
+    FACET_AUGMENTATION_CONFLICT = "SYSTEM_OF_RECORD_FACET_AUGMENTATION_CONFLICT",
     /**
      * BOOT — the instance declares a dialect its vendor's facet does not speak.
      *
@@ -140,6 +177,227 @@ export declare enum SystemOfRecordErrorCode {
      * remedy differs — there the vendor has no partitions at all, here it has partitions this engine
      * does not yet reach, and only the second is a gap on our side.
      */
-    PARTITION_KIND_UNSUPPORTED = "SYSTEM_OF_RECORD_PARTITION_KIND_UNSUPPORTED"
+    PARTITION_KIND_UNSUPPORTED = "SYSTEM_OF_RECORD_PARTITION_KIND_UNSUPPORTED",
+    /**
+     * BOOT — a binding opens a write verb whose DIALECT has no write implementation in this engine yet.
+     *
+     * Refused at boot rather than at the first write, for the reason every declaration refusal here is:
+     * the remedy is editing a file (remove the verb, or wait for the dialect), so nothing needs a
+     * running application to fix it. The message names the dialect, because that is the half an author
+     * cannot see from their own binding.
+     */
+    WRITE_DIALECT_NOT_IMPLEMENTED = "SYSTEM_OF_RECORD_WRITE_DIALECT_NOT_IMPLEMENTED",
+    /**
+     * REQUEST — the write was scoped to an organization that does not own the application.
+     *
+     * A system of record's rows belong to the OWNER organization (#1055 Q2). A read under another
+     * organization answers an empty page, because an empty page is a true statement about what that
+     * tenant may see; a write has no such honest empty answer, so it is refused, before anything is
+     * sent, and the refusal is audited.
+     */
+    WRITE_ORGANIZATION_NOT_OWNER = "SYSTEM_OF_RECORD_WRITE_ORGANIZATION_NOT_OWNER",
+    /**
+     * REQUEST — a CREATE on a partitioned instance could not tell which organization unit the new row
+     * belongs to, and the caller must name one (`organizationUnitId` in the payload).
+     *
+     * Reached by a member confined to SEVERAL units that own a partition of this instance, and by an
+     * organization-wide caller, who is entitled to every assigned partition and so has no single answer.
+     * Distinct from {@link WRITE_PARTITION_REFUSED} because the remedy is to ADD something, not to change it.
+     */
+    WRITE_PARTITION_UNIT_REQUIRED = "SYSTEM_OF_RECORD_WRITE_PARTITION_UNIT_REQUIRED",
+    /**
+     * REQUEST — the partition this write would land in is not one the caller may write. The context
+     * carries a {@link SystemOfRecordWritePartitionRefusal} naming which rule refused.
+     */
+    WRITE_PARTITION_REFUSED = "SYSTEM_OF_RECORD_WRITE_PARTITION_REFUSED",
+    /**
+     * REQUEST — the payload writes a field the engine owns: the partition field (it is DERIVED from the
+     * organization unit on create and never moves afterwards), the owner organization stamp, the unit
+     * stamp on update, or a key component.
+     *
+     * Refused rather than stripped. A caller who sends a partition value believes it decides where the
+     * row lands; silently discarding it would put the row somewhere they did not ask for.
+     */
+    WRITE_FIELD_NOT_WRITABLE = "SYSTEM_OF_RECORD_WRITE_FIELD_NOT_WRITABLE",
+    /**
+     * REQUEST — the write was SENT and nobody knows whether the system of record applied it: the call
+     * timed out, the connection dropped after the request left, or a gateway answered for the vendor.
+     *
+     * The one answer a client must not treat as "not written". A retry with the SAME `Idempotency-Key`
+     * answers this again without sending anything; the way forward is to READ the row (or search for it)
+     * and decide, then send a NEW request under a new key if it is genuinely missing.
+     */
+    WRITE_OUTCOME_UNKNOWN = "SYSTEM_OF_RECORD_WRITE_OUTCOME_UNKNOWN",
+    /**
+     * REQUEST — a request with this `Idempotency-Key` is being sent right now. The client retried before
+     * the first attempt settled; answering it would mean sending the write twice.
+     *
+     * Answered `409` (a CONFLICT carrying this code): wait, then retry the SAME request under the same key.
+     */
+    WRITE_IN_PROGRESS = "SYSTEM_OF_RECORD_WRITE_IN_PROGRESS",
+    /**
+     * REQUEST — this `Idempotency-Key` was already used for a DIFFERENT write (another target, verb or
+     * payload). A key names one request; replaying the first request's outcome for a second one would
+     * tell the caller something false about the second.
+     *
+     * Answered `422` with `customMessageReference: IDEMPOTENCY_KEY_REUSED` (#1941) — the status and the
+     * reference the engine's generic request idempotency answers a reused key with, so a client learns ONE
+     * spelling. A 422's context is stripped on the wire, so THIS code does not reach an HTTP client: it is
+     * what an in-process caller catching the error reads (`context.code`), and what the trail and the
+     * refusal audit row record. Never retry the request as it is; send a new request under a new key.
+     * spec-cite: draft-ietf-httpapi-idempotency-key-header-07 §2.7 (reused key with a different payload → 422;
+     * a request still being processed → 409).
+     */
+    WRITE_IDEMPOTENCY_KEY_REUSED = "SYSTEM_OF_RECORD_WRITE_IDEMPOTENCY_KEY_REUSED",
+    /**
+     * REQUEST — the system of record APPLIED the write, and something the engine did after it failed
+     * (a postfix hook, a local lifecycle step, the response description).
+     *
+     * Never reported as a failure to write: the remote change is durable and nothing here can undo it.
+     * The context names the written row, so the caller can read it; a retry with the same key replays
+     * the applied outcome rather than writing again.
+     */
+    WRITE_APPLIED_FOLLOW_UP_FAILED = "SYSTEM_OF_RECORD_WRITE_APPLIED_FOLLOW_UP_FAILED",
+    /**
+     * BOOT — a binding declares `writeConcurrency: VERSION_CHECKED` and its vendor facet names no row version field
+     * (`rowVersionField`), or the binding's version field does not map onto that remote field. The check would compare a
+     * value the vendor does not maintain, and so would refuse or admit writes for no reason at all.
+     */
+    WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR = "SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR",
+    /**
+     * REQUEST — an UPDATE on a `VERSION_CHECKED` binding carried no row version. The binding declared that every change is
+     * checked against the version its author read; an update without one would silently be last-writer-wins. Send the
+     * version field exactly as the read answered it.
+     */
+    WRITE_VERSION_REQUIRED = "SYSTEM_OF_RECORD_WRITE_VERSION_REQUIRED",
+    /**
+     * REQUEST — the row changed since the caller read it: the version it sent is not the version the system of record
+     * answered just before the write. Nothing was sent. Read the row again and decide.
+     *
+     * BEST-EFFORT on Odoo, and the refusal's message says so: a change landing between that read and the write is not
+     * seen, and a vendor that serves its version coarsely (Odoo serves `write_date` to the SECOND) cannot tell two changes
+     * made in the same second apart. The absence of this code is therefore not proof that nobody else changed the row. On
+     * OData the change landing in that gap is refused by the vendor instead, as `WRITE_PRECONDITION_FAILED`.
+     */
+    WRITE_VERSION_STALE = "SYSTEM_OF_RECORD_WRITE_VERSION_STALE",
+    /**
+     * REQUEST — an UPDATE on a `VERSION_CHECKED` binding, and the row the engine read just before writing carries NO
+     * version at all (#1726). Not "stale": nobody changed anything. The vendor serves no version for this row — an OData
+     * service that returns no `@odata.etag` for this entity set, although OData lets each set decide — so the binding's
+     * stance cannot be honoured for it. Nothing was sent. The remedy is the
+     * binding's, not the caller's: declare `LAST_WRITER_WINS` for this entity set, or have the vendor serve its versions.
+     */
+    WRITE_ROW_VERSION_NOT_SERVED = "SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SERVED",
+    /**
+     * REQUEST — the system of record refused an UPDATE or DELETE because the row's version no longer matched the one the
+     * write was conditioned on: an OData `412 Precondition Failed` answering the `If-Match` the engine sent (#1726).
+     *
+     * Unlike {@link WRITE_VERSION_STALE} this is the VENDOR's decision, taken atomically against the row it was about to
+     * change, and the protocol requires that it change nothing — so it is a definite refusal, never an unknown outcome,
+     * and it is never retried: re-sending the same precondition would only be refused again. Read the row again and
+     * decide.
+     * spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match).
+     */
+    WRITE_PRECONDITION_FAILED = "SYSTEM_OF_RECORD_WRITE_PRECONDITION_FAILED",
+    /**
+     * BOOT — a binding opens writes toward a vendor whose facet lists a step it requires before any modifying request
+     * (`writePrerequisites`, e.g. SAP Gateway's `X-CSRF-Token` handshake) that this engine does not perform (#1726). Every
+     * such write would be refused by the vendor; the binding stays read-only until the engine performs the step.
+     */
+    WRITE_PREREQUISITE_NOT_SUPPORTED = "SYSTEM_OF_RECORD_WRITE_PREREQUISITE_NOT_SUPPORTED",
+    /**
+     * BOOT — a binding declares an action whose call shape the instance's vendor facet does not list
+     * (`actionCallShapes`). The vendor's product does not expose actions that way, so the declaration could never run.
+     */
+    ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR = "SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR",
+    /**
+     * BOOT — a record-free action toward a PARTITIONED instance declares no partition stance. It must say either why it
+     * reaches no partitioned data, or which parameter carries the partition the engine derives from the caller's unit;
+     * otherwise one member's action could land in every company.
+     */
+    ACTION_PARTITION_STANCE_REQUIRED = "SYSTEM_OF_RECORD_ACTION_PARTITION_STANCE_REQUIRED",
+    /** BOOT — two bindings of one instance declare the same action name; callers address an action by `(system, action)`. */
+    ACTION_NAME_DUPLICATED = "SYSTEM_OF_RECORD_ACTION_NAME_DUPLICATED",
+    /** REQUEST — no binding of this instance declares an action of that name. */
+    ACTION_NOT_DECLARED = "SYSTEM_OF_RECORD_ACTION_NOT_DECLARED",
+    /**
+     * REQUEST — this kind of context may not run this action: an anonymous or public execution, an application-scoped
+     * machine with no organization, or a system context (batch, cron, webhook, an autonomous agent with nobody behind it)
+     * on an action that does not declare `admitsSystemInitiation`.
+     */
+    ACTION_INITIATION_NOT_ADMITTED = "SYSTEM_OF_RECORD_ACTION_INITIATION_NOT_ADMITTED",
+    /**
+     * REQUEST — the action was initiated for an organization that does not own the application. A system of record's rows
+     * and actions belong to the owner organization; a tenant that is not the owner never reaches the ERP.
+     */
+    ACTION_ORGANIZATION_NOT_OWNER = "SYSTEM_OF_RECORD_ACTION_ORGANIZATION_NOT_OWNER",
+    /** REQUEST — the caller holds none of the roles the action declares, in the owner organization. */
+    ACTION_ROLE_NOT_HELD = "SYSTEM_OF_RECORD_ACTION_ROLE_NOT_HELD",
+    /** REQUEST — the input does not satisfy the action's declared input schema; the context carries the issues. */
+    ACTION_INPUT_INVALID = "SYSTEM_OF_RECORD_ACTION_INPUT_INVALID",
+    /**
+     * REQUEST — a WRITING action was called without an Idempotency-Key. A remote change cannot be rolled back, so every
+     * caller names its request; a retry under the same key then replays the first outcome instead of acting twice.
+     */
+    ACTION_IDEMPOTENCY_KEY_REQUIRED = "SYSTEM_OF_RECORD_ACTION_IDEMPOTENCY_KEY_REQUIRED",
+    /**
+     * REQUEST — a record-free action that carries the partition must know the caller's unit, and the caller is a member
+     * of several units owning partitions of this instance. Name one in `organizationUnitId`.
+     */
+    ACTION_PARTITION_UNIT_REQUIRED = "SYSTEM_OF_RECORD_ACTION_PARTITION_UNIT_REQUIRED",
+    /**
+     * REQUEST — the partition the action would land in is not one the caller may act in. The context carries a
+     * {@link SystemOfRecordWritePartitionRefusal} naming which rule refused — the same rules a read-through create obeys.
+     */
+    ACTION_PARTITION_REFUSED = "SYSTEM_OF_RECORD_ACTION_PARTITION_REFUSED",
+    /**
+     * REQUEST — the record a record-targeted action names is not one this caller may act on: absent, or outside its
+     * partition, or (for a shared record) not writable by a unit-confined caller. Answered as NOT_FOUND and
+     * indistinguishably, as a read answers, so an action cannot probe for records the caller may not see.
+     */
+    ACTION_TARGET_NOT_REACHABLE = "SYSTEM_OF_RECORD_ACTION_TARGET_NOT_REACHABLE",
+    /** REQUEST — the system of record refused the action with a definite answer; nothing was applied. */
+    ACTION_REMOTE_REFUSED = "SYSTEM_OF_RECORD_ACTION_REMOTE_REFUSED",
+    /**
+     * REQUEST — the action could not be SENT: the instance's access could not be resolved, its handshake failed, the
+     * connection was refused before the request left, the rate budget was spent, or the read-first could not reach the
+     * record. Nothing reached the vendor as an action, so nothing was applied and the Idempotency-Key may be spent again.
+     * The context carries the transport KIND (and status), never the transport's message, which names the URL.
+     */
+    ACTION_NOT_SENT = "SYSTEM_OF_RECORD_ACTION_NOT_SENT"
 }
+/**
+ * Which rule refused a write's PARTITION (#1679), carried as `context.reason` beside
+ * {@link SystemOfRecordErrorCode.WRITE_PARTITION_REFUSED}.
+ *
+ * Distinct members because the remedy differs for each, and every one is somebody else's work: an
+ * operator assigns partitions, an administrator grants units, an author declares the instance.
+ */
+export declare enum SystemOfRecordWritePartitionRefusal {
+    /** The unit named (or derived) is not one the caller's grant covers. */
+    UNIT_OUTSIDE_GRANT = "unit_outside_grant",
+    /** The unit owns no partition of this instance, so a row created "for it" would belong to nobody. */
+    UNIT_HAS_NO_PARTITION = "unit_has_no_partition",
+    /**
+     * The unit owns SEVERAL partitions of this instance, so the unit alone does not say which one the row
+     * belongs to. The operator's assignment map decides this, not the caller: one unit, one partition is
+     * what makes a create's destination derivable.
+     */
+    UNIT_HAS_SEVERAL_PARTITIONS = "unit_has_several_partitions",
+    /** A unit was named for a write to an instance that is not partitioned — a stamp nothing would enforce. */
+    INSTANCE_NOT_PARTITIONED = "instance_not_partitioned",
+    /** The narrowing authority denied the caller every unit (no decision, a registry disagreement, an empty grant). */
+    NARROWING_DENIED = "narrowing_denied",
+    /**
+     * A UNIT-ONLY principal (a unit-scoped service-provider expert, #1597) writing a resource that does not
+     * narrow. The organization-wide admission such a principal may hold covers reads only.
+     */
+    UNIT_ONLY_PRINCIPAL_NOT_ADMITTED = "unit_only_principal_not_admitted"
+}
+/** @wildo_source:part:end saas.models.system-of-record-error-codes */
+/**
+ * Why an opted-in package whose module `wildo config sync` did not record is refused, and what to do (#1675, #1676).
+ * One sentence for the backend's resolver, `wildo secrets` and config sync's own check, so the three agree.
+ */
+export declare const SYSTEM_OF_RECORD_FACET_MODULE_NOT_DISCOVERED: string;
 //# sourceMappingURL=system-of-record-error-codes.shared.d.ts.map

package/dist/esm/systems-of-record/system-of-record-error-codes.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-error-codes.shared.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-error-codes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,0EAA0E;AAC1E,oBAAY,uBAAuB;IACjC;;;;;;OAMG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;OAKG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;;OAMG;IACH,4BAA4B,kDAAkD;IAE9E;;OAEG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;OAKG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;OAOG;IACH,qBAAqB,2CAA2C;IAEhE;;;;;;OAMG;IACH,+BAA+B,qDAAqD;IAEpF;;;;;;OAMG;IACH,qCAAqC,2DAA2D;IAEhG;;;;;;OAMG;IACH,0BAA0B,gDAAgD;IAE1E;;;;;;;;OAQG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,uCAAuC;IAExD;;;;;;;;;OASG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,iCAAiC,uDAAuD;IAExF;;;;;;;;;OASG;IACH,0BAA0B,gDAAgD;CAC3E"}
+{"version":3,"file":"system-of-record-error-codes.shared.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-error-codes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;OAOG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;OAKG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;;;OAOG;IACH,4BAA4B,kDAAkD;IAE9E;;;;OAIG;IACH,0BAA0B,gDAAgD;IAE1E;;;;;OAKG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;OAKG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;;OAMG;IACH,4BAA4B,kDAAkD;IAE9E;;OAEG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;OAKG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;OAOG;IACH,qBAAqB,2CAA2C;IAEhE;;;;;;OAMG;IACH,+BAA+B,qDAAqD;IAEpF;;;;;;OAMG;IACH,qCAAqC,2DAA2D;IAEhG;;;;;;OAMG;IACH,0BAA0B,gDAAgD;IAE1E;;;;;;;;OAQG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,uCAAuC;IAExD;;;;;;;;;OASG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,iCAAiC,uDAAuD;IAExF;;;;;;;;;OASG;IACH,0BAA0B,gDAAgD;IAS1E;;;;;;;OAOG;IACH,6BAA6B,mDAAmD;IAEhF;;;;;;;OAOG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,6BAA6B,mDAAmD;IAEhF;;;OAGG;IACH,uBAAuB,6CAA6C;IAEpE;;;;;;;OAOG;IACH,wBAAwB,8CAA8C;IAEtE;;;;;;;OAOG;IACH,qBAAqB,2CAA2C;IAEhE;;;;;OAKG;IACH,iBAAiB,uCAAuC;IAExD;;;;;;;;;;;;OAYG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,8BAA8B,oDAAoD;IAUlF;;;;OAIG;IACH,yCAAyC,+DAA+D;IAExG;;;;OAIG;IACH,sBAAsB,4CAA4C;IAElE;;;;;;;;OAQG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;;OAMG;IACH,4BAA4B,kDAAkD;IAQ9E;;;;;;;;;OASG;IACH,yBAAyB,+CAA+C;IAExE;;;;OAIG;IACH,gCAAgC,sDAAsD;IAQtF;;;OAGG;IACH,yCAAyC,+DAA+D;IAExG;;;;OAIG;IACH,gCAAgC,sDAAsD;IAEtF,yHAAyH;IACzH,sBAAsB,4CAA4C;IAElE,6EAA6E;IAC7E,mBAAmB,yCAAyC;IAE5D;;;;OAIG;IACH,8BAA8B,oDAAoD;IAElF;;;OAGG;IACH,6BAA6B,mDAAmD;IAEhF,mGAAmG;IACnG,oBAAoB,0CAA0C;IAE9D,+GAA+G;IAC/G,oBAAoB,0CAA0C;IAE9D;;;OAGG;IACH,+BAA+B,qDAAqD;IAEpF;;;OAGG;IACH,8BAA8B,oDAAoD;IAElF;;;OAGG;IACH,wBAAwB,8CAA8C;IAEtE;;;;OAIG;IACH,2BAA2B,iDAAiD;IAE5E,qGAAqG;IACrG,qBAAqB,2CAA2C;IAEhE;;;;;OAKG;IACH,eAAe,qCAAqC;CACrD;AAED;;;;;;GAMG;AACH,oBAAY,mCAAmC;IAC7C,wEAAwE;IACxE,kBAAkB,uBAAuB;IACzC,qGAAqG;IACrG,qBAAqB,0BAA0B;IAC/C;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D,2GAA2G;IAC3G,wBAAwB,6BAA6B;IACrD,mHAAmH;IACnH,gBAAgB,qBAAqB;IACrC;;;OAGG;IACH,gCAAgC,qCAAqC;CACtE;AACD,sEAAsE;AAEtE;;;GAGG;AACH,eAAO,MAAM,4CAA4C,QAEqD,CAAC"}