@wildo-ai/saas-models 1.1.6 → 1.1.7

package/dist/esm/systems-of-record/system-of-record-error-codes.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-error-codes.shared.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-error-codes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,uBA8ZX;AA9ZD,WAAY,uBAAuB;IACjC;;;;;;;OAOG;IACH,uFAA4D,CAAA;IAE5D;;;;;OAKG;IACH,uGAA4E,CAAA;IAE5E;;;;;;;OAOG;IACH,yGAA8E,CAAA;IAE9E;;;;OAIG;IACH,qGAA0E,CAAA;IAE1E;;;;;OAKG;IACH,uFAA4D,CAAA;IAE5D;;;;;OAKG;IACH,uGAA4E,CAAA;IAE5E;;;;;;OAMG;IACH,yGAA8E,CAAA;IAE9E;;OAEG;IACH,uGAA4E,CAAA;IAE5E;;;;;OAKG;IACH,mGAAwE,CAAA;IAExE;;;;;;;OAOG;IACH,2FAAgE,CAAA;IAEhE;;;;;;OAMG;IACH,+GAAoF,CAAA;IAEpF;;;;;;OAMG;IACH,2HAAgG,CAAA;IAEhG;;;;;;OAMG;IACH,qGAA0E,CAAA;IAE1E;;;;;;;;OAQG;IACH,mGAAwE,CAAA;IAExE;;;;;;;;;;;;;OAaG;IACH,mFAAwD,CAAA;IAExD;;;;;;;;;OASG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,mHAAwF,CAAA;IAExF;;;;;;;;;OASG;IACH,qGAA0E,CAAA;IAE1E,mGAAmG;IACnG,EAAE;IACF,gGAAgG;IAChG,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IAEnG;;;;;;;OAOG;IACH,2GAAgF,CAAA;IAEhF;;;;;;;OAOG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,2GAAgF,CAAA;IAEhF;;;OAGG;IACH,+FAAoE,CAAA;IAEpE;;;;;;;OAOG;IACH,iGAAsE,CAAA;IAEtE;;;;;;;OAOG;IACH,2FAAgE,CAAA;IAEhE;;;;;OAKG;IACH,mFAAwD,CAAA;IAExD;;;;;;;;;;;;OAYG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,6GAAkF,CAAA;IAElF,mGAAmG;IACnG,EAAE;IACF,sHAAsH;IACtH,uHAAuH;IACvH,oHAAoH;IACpH,kHAAkH;IAClH,2GAA2G;IAE3G;;;;OAIG;IACH,mIAAwG,CAAA;IAExG;;;;OAIG;IACH,6FAAkE,CAAA;IAElE;;;;;;;;OAQG;IACH,uFAA4D,CAAA;IAE5D;;;;;;OAMG;IACH,yGAA8E,CAAA;IAE9E,mGAAmG;IACnG,EAAE;IACF,iHAAiH;IACjH,8GAA8G;IAC9G,uBAAuB;IAEvB;;;;;;;;;OASG;IACH,mGAAwE,CAAA;IAExE;;;;OAIG;IACH,iHAAsF,CAAA;IAEtF,kGAAkG;IAClG,EAAE;IACF,mHAAmH;IACnH,uHAAuH;IACvH,+KAA+K;IAE/K;;;OAGG;IACH,mIAAwG,CAAA;IAExG;;;;OAIG;IACH,iHAAsF,CAAA;IAEtF,yHAAyH;IACzH,6FAAkE,CAAA;IAElE,6EAA6E;IAC7E,uFAA4D,CAAA;IAE5D;;;;OAIG;IACH,6GAAkF,CAAA;IAElF;;;OAGG;IACH,2GAAgF,CAAA;IAEhF,mGAAmG;IACnG,yFAA8D,CAAA;IAE9D,+GAA+G;IAC/G,yFAA8D,CAAA;IAE9D;;;OAGG;IACH,+GAAoF,CAAA;IAEpF;;;OAGG;IACH,6GAAkF,CAAA;IAElF;;;OAGG;IACH,iGAAsE,CAAA;IAEtE;;;;OAIG;IACH,uGAA4E,CAAA;IAE5E,qGAAqG;IACrG,2FAAgE,CAAA;IAEhE;;;;;OAKG;IACH,+EAAoD,CAAA;AACtD,CAAC,EA9ZW,uBAAuB,KAAvB,uBAAuB,QA8ZlC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,mCAoBX;AApBD,WAAY,mCAAmC;IAC7C,wEAAwE;IACxE,gFAAyC,CAAA;IACzC,qGAAqG;IACrG,sFAA+C,CAAA;IAC/C;;;;OAIG;IACH,kGAA2D,CAAA;IAC3D,2GAA2G;IAC3G,4FAAqD,CAAA;IACrD,mHAAmH;IACnH,4EAAqC,CAAA;IACrC;;;OAGG;IACH,4GAAqE,CAAA;AACvE,CAAC,EApBW,mCAAmC,KAAnC,mCAAmC,QAoB9C;AACD,sEAAsE;AAEtE;;;GAGG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,6DAA6D;MACrH,4HAA4H;MAC5H,0GAA0G,CAAC","sourcesContent":["/**\n * Stable codes a client can branch on when a system of record refuses (#1055).\n *\n * Two audiences, and the split matters because the remedies are different people's work:\n *\n * - **Boot codes** name an incoherent DECLARATION — a vendor nothing ships, a dialect the facet does\n *   not speak, a slot the environment never supplied. Every one of them is fixed by editing a file\n *   and restarting, which needs no running companion, so refusing at boot is legitimate\n *   (`continuity-drift-and-cas-basis.md` Rule 3 — the remedy does not route back through the thing\n *   that just refused).\n * - **Request codes** name a state of the WORLD at the moment of a read or a write: this environment\n *   has no access to the instance, the owner organization is not seeded yet, a write landed in a\n *   partition the caller may not touch, or its outcome is unknown. None is an authoring mistake, and\n *   each must answer with a code rather than a 500 or a silent empty list.\n *\n * Carried in the error's `context.code`, which survives `sanitizeErrorForClient` for `CONFLICT` and\n * `VALIDATION` — the reason those two error types are used here rather than `AUTHORIZATION`, whose\n * context is stripped entirely. A refusal a client cannot branch on is a refusal a client will retry.\n */\n\n/**\n * @wildo_source:part:start saas.models.system-of-record-error-codes facet:layer:shared facet:audience:app-developer\n *\n * Why a system of record could not be prepared, read, or written — the stable `context.code` a client branches on.\n * Imported from `@wildo-ai/saas-models`. Request codes ride a `CONFLICT` (409) or `VALIDATION` (400) answer, the two\n * error types whose context reaches the client.\n */\nexport enum SystemOfRecordErrorCode {\n  /**\n   * BOOT — an instance names a vendor no facet answers to.\n   *\n   * The framework's facets ship in the opt-in library `@wildo-ai/systems-of-record` (#2013), and an augmentation\n   * package an instance opts into may add others, so this means the vendor is spelled wrong OR the package that\n   * owns it is not installed. The message names both, because from inside the registry the two are\n   * indistinguishable, and names the library and its remedy.\n   */\n  VENDOR_HAS_NO_FACET = 'SYSTEM_OF_RECORD_VENDOR_HAS_NO_FACET',\n\n  /**\n   * BOOT — the application declares systems of record, but its provider runtime artifact lists no facet\n   * modules at all: it predates the field, or was never generated. Distinct from\n   * {@link VENDOR_HAS_NO_FACET}, because the remedy is a regeneration rather than a spelling or an\n   * install, and reporting it as that one sent a correct configuration looking for a typo (2026-09-24).\n   */\n  FACET_MODULES_NOT_GENERATED = 'SYSTEM_OF_RECORD_FACET_MODULES_NOT_GENERATED',\n\n  /**\n   * BOOT — an instance opts into a facet AUGMENTATION (#1675) from a package that ships none for its\n   * vendor: `wildo config sync` did not record its `<package>/systems-of-record` module (a package discovery\n   * does not walk by name must be listed in `providers.packages`, #1676), the recorded module fails to load\n   * (the import error is named), or it augments other vendors only. `wildo config sync` refuses the first\n   * case too, before anything starts. Named rather than ignored, because an augmentation the author believes\n   * applies — a partition declaration, say — that silently does not is a confinement they think they have.\n   */\n  FACET_AUGMENTATION_NOT_FOUND = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_NOT_FOUND',\n\n  /**\n   * BOOT — an opted-in augmentation (#1675) fails the augmentation schema, or the facet it produces once\n   * merged into the base fails the facet schema. The refusal names the package and the instance rather\n   * than surfacing a bare schema error that names neither.\n   */\n  FACET_AUGMENTATION_INVALID = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_INVALID',\n\n  /**\n   * BOOT — two facet modules each present a BASE facet for one vendor (#1675). Refused naming both,\n   * because the base carries the vendor's partition and \"first in module order\" would let whichever\n   * package name sorts first decide how a tenant's rows are confined. A package that adds to a vendor it\n   * does not own ships an augmentation an instance opts into.\n   */\n  FACET_BASE_CONFLICT = 'SYSTEM_OF_RECORD_FACET_BASE_CONFLICT',\n\n  /**\n   * BOOT — two sources declare the same thing for one instance's vendor (#1675): a partition declared by\n   * the base facet AND an augmentation, or by two augmentations; one credential kind offered twice. The\n   * facet is the single partition authority, so which declaration confines a tenant's rows must never\n   * depend on order. The refusal names both sources.\n   */\n  FACET_AUGMENTATION_CONFLICT = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_CONFLICT',\n\n  /**\n   * BOOT — the instance declares a dialect its vendor's facet does not speak.\n   *\n   * A vendor may legitimately offer several (a service reachable over OData v4 and a bespoke REST\n   * surface is one vendor, two ways in), so this is checked against the facet's list rather than\n   * assumed from the vendor.\n   */\n  DIALECT_NOT_SPOKEN_BY_VENDOR = 'SYSTEM_OF_RECORD_DIALECT_NOT_SPOKEN_BY_VENDOR',\n\n  /**\n   * BOOT — the instance names a credential kind its vendor does not offer.\n   */\n  CREDENTIAL_KIND_NOT_OFFERED = 'SYSTEM_OF_RECORD_CREDENTIAL_KIND_NOT_OFFERED',\n\n  /**\n   * BOOT — the vendor offers several credential kinds and the instance named none.\n   *\n   * Only reachable once a facet offers more than one (#1056). Until then the kind is DERIVED and an\n   * author is never asked for something with a single legal answer.\n   */\n  CREDENTIAL_KIND_AMBIGUOUS = 'SYSTEM_OF_RECORD_CREDENTIAL_KIND_AMBIGUOUS',\n\n  /**\n   * BOOT — a required slot's environment variable is unset while the environment DID author a block\n   * for the instance (#1055 E4).\n   *\n   * Distinct from the instance being declared absent: an environment that has no access says so with\n   * `{ enabled: false }`, and this is what is left — an environment that meant to have access and is\n   * missing a value. Silence is not a declaration, which is why these two are separable at all.\n   */\n  REQUIRED_SLOT_MISSING = 'SYSTEM_OF_RECORD_REQUIRED_SLOT_MISSING',\n\n  /**\n   * BOOT — a resource's `httpApiBinding` names an instance the application does not declare.\n   *\n   * Checked at REGISTRATION rather than in the resource factory, because the factory runs in the\n   * application's `shared-lib` where the saas configuration is not in scope. The factory checks\n   * SHAPE; this checks AGREEMENT, at the first moment both are visible.\n   */\n  BINDING_NAMES_UNDECLARED_SYSTEM = 'SYSTEM_OF_RECORD_BINDING_NAMES_UNDECLARED_SYSTEM',\n\n  /**\n   * BOOT — a binding's dialect and its instance's dialect disagree.\n   *\n   * Both are authored, in different files, and the binding's is the discriminator of its own\n   * per-dialect union — so the binding cannot simply inherit the instance's, and the disagreement has\n   * to be refused where both are known.\n   */\n  BINDING_DIALECT_DISAGREES_WITH_SYSTEM = 'SYSTEM_OF_RECORD_BINDING_DIALECT_DISAGREES_WITH_SYSTEM',\n\n  /**\n   * REQUEST — this environment declared it has no access to the instance (#1055 E3).\n   *\n   * A developer laptop and a staging with no ERP are the ordinary case. The application boots, every\n   * other resource works, and a read on a bound resource answers this rather than a transport error\n   * against an address nobody authored.\n   */\n  UNAVAILABLE_IN_ENVIRONMENT = 'SYSTEM_OF_RECORD_UNAVAILABLE_IN_ENVIRONMENT',\n\n  /**\n   * REQUEST — the application has no owner organization to stamp remote rows with (#1055 E10,\n   * resting on #1054 E1).\n   *\n   * A fresh install before bootstrap runs is the real case. Rows read out of a system of record carry\n   * the owner organization's id so the per-row tenant gate passes without an exemption; with no owner\n   * there is nothing to stamp, and answering an empty list would say \"this system holds nothing about\n   * you\", which is false.\n   */\n  OWNER_ORGANIZATION_ABSENT = 'SYSTEM_OF_RECORD_OWNER_ORGANIZATION_ABSENT',\n\n  /**\n   * REQUEST — the instance's token endpoint could not be reached, refused to mint, or answered\n   * something that is not a token (#1056 E2, E3; R11).\n   *\n   * ONE code for the whole family rather than one per failure, with a `reason` in the context and an\n   * optional `retryAfterSeconds` taken from the answer's `Retry-After`. The family is deliberately\n   * coarse because every member has the same shape from a caller's side: the remote is not currently\n   * giving us an identity, the request cannot proceed, and retrying later may work. Splitting it\n   * would ask a client to branch on a distinction it cannot act on differently.\n   *\n   * Never carries the token endpoint's own `error_description` verbatim into a client-visible\n   * message: an authorization server is entitled to say things about the credential, and a\n   * credential's failure mode is not an application user's business. The detail is logged.\n   */\n  TOKEN_UNAVAILABLE = 'SYSTEM_OF_RECORD_TOKEN_UNAVAILABLE',\n\n  /**\n   * BOOT — the instance's credential material cannot produce a credential at all: an encrypted\n   * private key (#1056 E6), a certificate whose validity window does not contain now (E7), a BASIC\n   * username carrying the `:` that RFC 7617 makes the delimiter (E11).\n   *\n   * Separate from {@link REQUIRED_SLOT_MISSING} because the remedy is different: a value IS present\n   * and it is the wrong KIND of value, so an operator re-reading their environment for a blank finds\n   * nothing. Refused at boot rather than at the first read — the material is known then, and a\n   * certificate that expired last week should not first be noticed by a user.\n   */\n  CREDENTIAL_MATERIAL_UNUSABLE = 'SYSTEM_OF_RECORD_CREDENTIAL_MATERIAL_UNUSABLE',\n\n  /**\n   * BOOT — the instance opts into partitioning and its vendor declares none (#1058).\n   *\n   * Refused rather than ignored, for the reason the `partition` field was RESERVED for three slices:\n   * an author who writes `partition: true` and sees it accepted believes their rows are confined to\n   * organization units while every member still sees every row. An accepted declaration that does\n   * nothing is worse than a refusal, because only one of the two is visible.\n   */\n  PARTITION_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_PARTITION_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * BOOT — the instance opts into partitioning and its vendor partitions by a PATH SEGMENT, which\n   * this engine cannot confine (#1058 E9).\n   *\n   * A path segment is chosen before the request is built, so it cannot express \"these three\n   * companies\" in one read: the confinement would have to fan out into one request per unit, which is\n   * a different MECHANISM rather than a different predicate. Distinct from the code above because the\n   * remedy differs — there the vendor has no partitions at all, here it has partitions this engine\n   * does not yet reach, and only the second is a gap on our side.\n   */\n  PARTITION_KIND_UNSUPPORTED = 'SYSTEM_OF_RECORD_PARTITION_KIND_UNSUPPORTED',\n\n  // ─── Writes (#1679) ─────────────────────────────────────────────────────────────────────────────\n  //\n  // Every REQUEST code below is raised BEFORE anything is sent, except the two that name what the\n  // remote did (OUTCOME_UNKNOWN, APPLIED_FOLLOW_UP_FAILED) and the admission codes, which name what a\n  // retried request would do. A refusal before the send is safe to retry once the cause is fixed;\n  // the other two are the cases a client must NOT blindly retry, which is why they are codes at all.\n\n  /**\n   * BOOT — a binding opens a write verb whose DIALECT has no write implementation in this engine yet.\n   *\n   * Refused at boot rather than at the first write, for the reason every declaration refusal here is:\n   * the remedy is editing a file (remove the verb, or wait for the dialect), so nothing needs a\n   * running application to fix it. The message names the dialect, because that is the half an author\n   * cannot see from their own binding.\n   */\n  WRITE_DIALECT_NOT_IMPLEMENTED = 'SYSTEM_OF_RECORD_WRITE_DIALECT_NOT_IMPLEMENTED',\n\n  /**\n   * REQUEST — the write was scoped to an organization that does not own the application.\n   *\n   * A system of record's rows belong to the OWNER organization (#1055 Q2). A read under another\n   * organization answers an empty page, because an empty page is a true statement about what that\n   * tenant may see; a write has no such honest empty answer, so it is refused, before anything is\n   * sent, and the refusal is audited.\n   */\n  WRITE_ORGANIZATION_NOT_OWNER = 'SYSTEM_OF_RECORD_WRITE_ORGANIZATION_NOT_OWNER',\n\n  /**\n   * REQUEST — a CREATE on a partitioned instance could not tell which organization unit the new row\n   * belongs to, and the caller must name one (`organizationUnitId` in the payload).\n   *\n   * Reached by a member confined to SEVERAL units that own a partition of this instance, and by an\n   * organization-wide caller, who is entitled to every assigned partition and so has no single answer.\n   * Distinct from {@link WRITE_PARTITION_REFUSED} because the remedy is to ADD something, not to change it.\n   */\n  WRITE_PARTITION_UNIT_REQUIRED = 'SYSTEM_OF_RECORD_WRITE_PARTITION_UNIT_REQUIRED',\n\n  /**\n   * REQUEST — the partition this write would land in is not one the caller may write. The context\n   * carries a {@link SystemOfRecordWritePartitionRefusal} naming which rule refused.\n   */\n  WRITE_PARTITION_REFUSED = 'SYSTEM_OF_RECORD_WRITE_PARTITION_REFUSED',\n\n  /**\n   * REQUEST — the payload writes a field the engine owns: the partition field (it is DERIVED from the\n   * organization unit on create and never moves afterwards), the owner organization stamp, the unit\n   * stamp on update, or a key component.\n   *\n   * Refused rather than stripped. A caller who sends a partition value believes it decides where the\n   * row lands; silently discarding it would put the row somewhere they did not ask for.\n   */\n  WRITE_FIELD_NOT_WRITABLE = 'SYSTEM_OF_RECORD_WRITE_FIELD_NOT_WRITABLE',\n\n  /**\n   * REQUEST — the write was SENT and nobody knows whether the system of record applied it: the call\n   * timed out, the connection dropped after the request left, or a gateway answered for the vendor.\n   *\n   * The one answer a client must not treat as \"not written\". A retry with the SAME `Idempotency-Key`\n   * answers this again without sending anything; the way forward is to READ the row (or search for it)\n   * and decide, then send a NEW request under a new key if it is genuinely missing.\n   */\n  WRITE_OUTCOME_UNKNOWN = 'SYSTEM_OF_RECORD_WRITE_OUTCOME_UNKNOWN',\n\n  /**\n   * REQUEST — a request with this `Idempotency-Key` is being sent right now. The client retried before\n   * the first attempt settled; answering it would mean sending the write twice.\n   *\n   * Answered `409` (a CONFLICT carrying this code): wait, then retry the SAME request under the same key.\n   */\n  WRITE_IN_PROGRESS = 'SYSTEM_OF_RECORD_WRITE_IN_PROGRESS',\n\n  /**\n   * REQUEST — this `Idempotency-Key` was already used for a DIFFERENT write (another target, verb or\n   * payload). A key names one request; replaying the first request's outcome for a second one would\n   * tell the caller something false about the second.\n   *\n   * Answered `422` with `customMessageReference: IDEMPOTENCY_KEY_REUSED` (#1941) — the status and the\n   * reference the engine's generic request idempotency answers a reused key with, so a client learns ONE\n   * spelling. A 422's context is stripped on the wire, so THIS code does not reach an HTTP client: it is\n   * what an in-process caller catching the error reads (`context.code`), and what the trail and the\n   * refusal audit row record. Never retry the request as it is; send a new request under a new key.\n   * spec-cite: draft-ietf-httpapi-idempotency-key-header-07 §2.7 (reused key with a different payload → 422;\n   * a request still being processed → 409).\n   */\n  WRITE_IDEMPOTENCY_KEY_REUSED = 'SYSTEM_OF_RECORD_WRITE_IDEMPOTENCY_KEY_REUSED',\n\n  /**\n   * REQUEST — the system of record APPLIED the write, and something the engine did after it failed\n   * (a postfix hook, a local lifecycle step, the response description).\n   *\n   * Never reported as a failure to write: the remote change is durable and nothing here can undo it.\n   * The context names the written row, so the caller can read it; a retry with the same key replays\n   * the applied outcome rather than writing again.\n   */\n  WRITE_APPLIED_FOLLOW_UP_FAILED = 'SYSTEM_OF_RECORD_WRITE_APPLIED_FOLLOW_UP_FAILED',\n\n  // ─── Version-checked updates (#1724, #1726) ─────────────────────────────────────────────────────\n  //\n  // A binding may declare `writeConcurrency: VERSION_CHECKED`: the caller sends the row version it read, and the engine\n  // compares it with the row it reads just before sending. On a system with no CONDITIONAL write (Odoo) that NARROWS the\n  // lost-update race and does not close it — the comparison and the write are two calls, and a change landing between\n  // them is overwritten. On OData the same version then travels as `If-Match`, and the vendor closes the gap itself\n  // (`WRITE_PRECONDITION_FAILED` below). The request codes in this block are raised BEFORE anything is sent.\n\n  /**\n   * BOOT — a binding declares `writeConcurrency: VERSION_CHECKED` and its vendor facet names no row version field\n   * (`rowVersionField`), or the binding's version field does not map onto that remote field. The check would compare a\n   * value the vendor does not maintain, and so would refuse or admit writes for no reason at all.\n   */\n  WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * REQUEST — an UPDATE on a `VERSION_CHECKED` binding carried no row version. The binding declared that every change is\n   * checked against the version its author read; an update without one would silently be last-writer-wins. Send the\n   * version field exactly as the read answered it.\n   */\n  WRITE_VERSION_REQUIRED = 'SYSTEM_OF_RECORD_WRITE_VERSION_REQUIRED',\n\n  /**\n   * REQUEST — the row changed since the caller read it: the version it sent is not the version the system of record\n   * answered just before the write. Nothing was sent. Read the row again and decide.\n   *\n   * BEST-EFFORT on Odoo, and the refusal's message says so: a change landing between that read and the write is not\n   * seen, and a vendor that serves its version coarsely (Odoo serves `write_date` to the SECOND) cannot tell two changes\n   * made in the same second apart. The absence of this code is therefore not proof that nobody else changed the row. On\n   * OData the change landing in that gap is refused by the vendor instead, as `WRITE_PRECONDITION_FAILED`.\n   */\n  WRITE_VERSION_STALE = 'SYSTEM_OF_RECORD_WRITE_VERSION_STALE',\n\n  /**\n   * REQUEST — an UPDATE on a `VERSION_CHECKED` binding, and the row the engine read just before writing carries NO\n   * version at all (#1726). Not \"stale\": nobody changed anything. The vendor serves no version for this row — an OData\n   * service that returns no `@odata.etag` for this entity set, although OData lets each set decide — so the binding's\n   * stance cannot be honoured for it. Nothing was sent. The remedy is the\n   * binding's, not the caller's: declare `LAST_WRITER_WINS` for this entity set, or have the vendor serve its versions.\n   */\n  WRITE_ROW_VERSION_NOT_SERVED = 'SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SERVED',\n\n  // ─── Conditional writes (#1726) ─────────────────────────────────────────────────────────────────\n  //\n  // A vendor that offers a real precondition (OData `If-Match` against the row's entity tag) refuses a stale write\n  // ITSELF, atomically — so the refusal arrives from the remote, after the write was sent, and still means that\n  // nothing was applied.\n\n  /**\n   * REQUEST — the system of record refused an UPDATE or DELETE because the row's version no longer matched the one the\n   * write was conditioned on: an OData `412 Precondition Failed` answering the `If-Match` the engine sent (#1726).\n   *\n   * Unlike {@link WRITE_VERSION_STALE} this is the VENDOR's decision, taken atomically against the row it was about to\n   * change, and the protocol requires that it change nothing — so it is a definite refusal, never an unknown outcome,\n   * and it is never retried: re-sending the same precondition would only be refused again. Read the row again and\n   * decide.\n   * spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match).\n   */\n  WRITE_PRECONDITION_FAILED = 'SYSTEM_OF_RECORD_WRITE_PRECONDITION_FAILED',\n\n  /**\n   * BOOT — a binding opens writes toward a vendor whose facet lists a step it requires before any modifying request\n   * (`writePrerequisites`, e.g. SAP Gateway's `X-CSRF-Token` handshake) that this engine does not perform (#1726). Every\n   * such write would be refused by the vendor; the binding stays read-only until the engine performs the step.\n   */\n  WRITE_PREREQUISITE_NOT_SUPPORTED = 'SYSTEM_OF_RECORD_WRITE_PREREQUISITE_NOT_SUPPORTED',\n\n  // ── Declared ACTIONS (#1678) ───────────────────────────────────────────────────────────────────\n  //\n  // An action re-uses the write path's key-ledger answers as they are — WRITE_OUTCOME_UNKNOWN, WRITE_IN_PROGRESS and\n  // WRITE_IDEMPOTENCY_KEY_REUSED mean exactly the same thing for an action as for a row write, and a client that already\n  // branches on them must not learn a second spelling. Both doors answer them from one table, statuses included (#1941). What follows is what only an action can be refused for.\n\n  /**\n   * BOOT — a binding declares an action whose call shape the instance's vendor facet does not list\n   * (`actionCallShapes`). The vendor's product does not expose actions that way, so the declaration could never run.\n   */\n  ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * BOOT — a record-free action toward a PARTITIONED instance declares no partition stance. It must say either why it\n   * reaches no partitioned data, or which parameter carries the partition the engine derives from the caller's unit;\n   * otherwise one member's action could land in every company.\n   */\n  ACTION_PARTITION_STANCE_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_STANCE_REQUIRED',\n\n  /** BOOT — two bindings of one instance declare the same action name; callers address an action by `(system, action)`. */\n  ACTION_NAME_DUPLICATED = 'SYSTEM_OF_RECORD_ACTION_NAME_DUPLICATED',\n\n  /** REQUEST — no binding of this instance declares an action of that name. */\n  ACTION_NOT_DECLARED = 'SYSTEM_OF_RECORD_ACTION_NOT_DECLARED',\n\n  /**\n   * REQUEST — this kind of context may not run this action: an anonymous or public execution, an application-scoped\n   * machine with no organization, or a system context (batch, cron, webhook, an autonomous agent with nobody behind it)\n   * on an action that does not declare `admitsSystemInitiation`.\n   */\n  ACTION_INITIATION_NOT_ADMITTED = 'SYSTEM_OF_RECORD_ACTION_INITIATION_NOT_ADMITTED',\n\n  /**\n   * REQUEST — the action was initiated for an organization that does not own the application. A system of record's rows\n   * and actions belong to the owner organization; a tenant that is not the owner never reaches the ERP.\n   */\n  ACTION_ORGANIZATION_NOT_OWNER = 'SYSTEM_OF_RECORD_ACTION_ORGANIZATION_NOT_OWNER',\n\n  /** REQUEST — the caller holds none of the roles the action declares, in the owner organization. */\n  ACTION_ROLE_NOT_HELD = 'SYSTEM_OF_RECORD_ACTION_ROLE_NOT_HELD',\n\n  /** REQUEST — the input does not satisfy the action's declared input schema; the context carries the issues. */\n  ACTION_INPUT_INVALID = 'SYSTEM_OF_RECORD_ACTION_INPUT_INVALID',\n\n  /**\n   * REQUEST — a WRITING action was called without an Idempotency-Key. A remote change cannot be rolled back, so every\n   * caller names its request; a retry under the same key then replays the first outcome instead of acting twice.\n   */\n  ACTION_IDEMPOTENCY_KEY_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_IDEMPOTENCY_KEY_REQUIRED',\n\n  /**\n   * REQUEST — a record-free action that carries the partition must know the caller's unit, and the caller is a member\n   * of several units owning partitions of this instance. Name one in `organizationUnitId`.\n   */\n  ACTION_PARTITION_UNIT_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_UNIT_REQUIRED',\n\n  /**\n   * REQUEST — the partition the action would land in is not one the caller may act in. The context carries a\n   * {@link SystemOfRecordWritePartitionRefusal} naming which rule refused — the same rules a read-through create obeys.\n   */\n  ACTION_PARTITION_REFUSED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_REFUSED',\n\n  /**\n   * REQUEST — the record a record-targeted action names is not one this caller may act on: absent, or outside its\n   * partition, or (for a shared record) not writable by a unit-confined caller. Answered as NOT_FOUND and\n   * indistinguishably, as a read answers, so an action cannot probe for records the caller may not see.\n   */\n  ACTION_TARGET_NOT_REACHABLE = 'SYSTEM_OF_RECORD_ACTION_TARGET_NOT_REACHABLE',\n\n  /** REQUEST — the system of record refused the action with a definite answer; nothing was applied. */\n  ACTION_REMOTE_REFUSED = 'SYSTEM_OF_RECORD_ACTION_REMOTE_REFUSED',\n\n  /**\n   * REQUEST — the action could not be SENT: the instance's access could not be resolved, its handshake failed, the\n   * connection was refused before the request left, the rate budget was spent, or the read-first could not reach the\n   * record. Nothing reached the vendor as an action, so nothing was applied and the Idempotency-Key may be spent again.\n   * The context carries the transport KIND (and status), never the transport's message, which names the URL.\n   */\n  ACTION_NOT_SENT = 'SYSTEM_OF_RECORD_ACTION_NOT_SENT',\n}\n\n/**\n * Which rule refused a write's PARTITION (#1679), carried as `context.reason` beside\n * {@link SystemOfRecordErrorCode.WRITE_PARTITION_REFUSED}.\n *\n * Distinct members because the remedy differs for each, and every one is somebody else's work: an\n * operator assigns partitions, an administrator grants units, an author declares the instance.\n */\nexport enum SystemOfRecordWritePartitionRefusal {\n  /** The unit named (or derived) is not one the caller's grant covers. */\n  UNIT_OUTSIDE_GRANT = 'unit_outside_grant',\n  /** The unit owns no partition of this instance, so a row created \"for it\" would belong to nobody. */\n  UNIT_HAS_NO_PARTITION = 'unit_has_no_partition',\n  /**\n   * The unit owns SEVERAL partitions of this instance, so the unit alone does not say which one the row\n   * belongs to. The operator's assignment map decides this, not the caller: one unit, one partition is\n   * what makes a create's destination derivable.\n   */\n  UNIT_HAS_SEVERAL_PARTITIONS = 'unit_has_several_partitions',\n  /** A unit was named for a write to an instance that is not partitioned — a stamp nothing would enforce. */\n  INSTANCE_NOT_PARTITIONED = 'instance_not_partitioned',\n  /** The narrowing authority denied the caller every unit (no decision, a registry disagreement, an empty grant). */\n  NARROWING_DENIED = 'narrowing_denied',\n  /**\n   * A UNIT-ONLY principal (a unit-scoped service-provider expert, #1597) writing a resource that does not\n   * narrow. The organization-wide admission such a principal may hold covers reads only.\n   */\n  UNIT_ONLY_PRINCIPAL_NOT_ADMITTED = 'unit_only_principal_not_admitted',\n}\n/** @wildo_source:part:end saas.models.system-of-record-error-codes */\n\n/**\n * Why an opted-in package whose module `wildo config sync` did not record is refused, and what to do (#1675, #1676).\n * One sentence for the backend's resolver, `wildo secrets` and config sync's own check, so the three agree.\n */\nexport const SYSTEM_OF_RECORD_FACET_MODULE_NOT_DISCOVERED = '`wildo config sync` did not discover it. A package outside '\n  + 'the framework\\'s own names and the application\\'s `<scope>/provider-*` is walked only when `providers.packages` lists it, '\n  + 'and the backend must depend on it and it must export `./systems-of-record`; then run `wildo config sync`';\n"]}
+{"version":3,"file":"system-of-record-error-codes.shared.js","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-error-codes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,uBA8ZX;AA9ZD,WAAY,uBAAuB;IACjC;;;;;;;OAOG;IACH,uFAA4D,CAAA;IAE5D;;;;;OAKG;IACH,uGAA4E,CAAA;IAE5E;;;;;;;OAOG;IACH,yGAA8E,CAAA;IAE9E;;;;OAIG;IACH,qGAA0E,CAAA;IAE1E;;;;;OAKG;IACH,uFAA4D,CAAA;IAE5D;;;;;OAKG;IACH,uGAA4E,CAAA;IAE5E;;;;;;OAMG;IACH,yGAA8E,CAAA;IAE9E;;OAEG;IACH,uGAA4E,CAAA;IAE5E;;;;;OAKG;IACH,mGAAwE,CAAA;IAExE;;;;;;;OAOG;IACH,2FAAgE,CAAA;IAEhE;;;;;;OAMG;IACH,+GAAoF,CAAA;IAEpF;;;;;;OAMG;IACH,2HAAgG,CAAA;IAEhG;;;;;;OAMG;IACH,qGAA0E,CAAA;IAE1E;;;;;;;;OAQG;IACH,mGAAwE,CAAA;IAExE;;;;;;;;;;;;;OAaG;IACH,mFAAwD,CAAA;IAExD;;;;;;;;;OASG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,mHAAwF,CAAA;IAExF;;;;;;;;;OASG;IACH,qGAA0E,CAAA;IAE1E,mGAAmG;IACnG,EAAE;IACF,gGAAgG;IAChG,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IAEnG;;;;;;;OAOG;IACH,2GAAgF,CAAA;IAEhF;;;;;;;OAOG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,2GAAgF,CAAA;IAEhF;;;OAGG;IACH,+FAAoE,CAAA;IAEpE;;;;;;;OAOG;IACH,iGAAsE,CAAA;IAEtE;;;;;;;OAOG;IACH,2FAAgE,CAAA;IAEhE;;;;;OAKG;IACH,mFAAwD,CAAA;IAExD;;;;;;;;;;;;OAYG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,6GAAkF,CAAA;IAElF,mGAAmG;IACnG,EAAE;IACF,sHAAsH;IACtH,uHAAuH;IACvH,oHAAoH;IACpH,kHAAkH;IAClH,2GAA2G;IAE3G;;;;OAIG;IACH,mIAAwG,CAAA;IAExG;;;;OAIG;IACH,6FAAkE,CAAA;IAElE;;;;;;;;OAQG;IACH,uFAA4D,CAAA;IAE5D;;;;;;OAMG;IACH,yGAA8E,CAAA;IAE9E,mGAAmG;IACnG,EAAE;IACF,iHAAiH;IACjH,8GAA8G;IAC9G,uBAAuB;IAEvB;;;;;;;;;OASG;IACH,mGAAwE,CAAA;IAExE;;;;OAIG;IACH,iHAAsF,CAAA;IAEtF,kGAAkG;IAClG,EAAE;IACF,mHAAmH;IACnH,uHAAuH;IACvH,+KAA+K;IAE/K;;;OAGG;IACH,mIAAwG,CAAA;IAExG;;;;OAIG;IACH,iHAAsF,CAAA;IAEtF,yHAAyH;IACzH,6FAAkE,CAAA;IAElE,6EAA6E;IAC7E,uFAA4D,CAAA;IAE5D;;;;OAIG;IACH,6GAAkF,CAAA;IAElF;;;OAGG;IACH,2GAAgF,CAAA;IAEhF,mGAAmG;IACnG,yFAA8D,CAAA;IAE9D,+GAA+G;IAC/G,yFAA8D,CAAA;IAE9D;;;OAGG;IACH,+GAAoF,CAAA;IAEpF;;;OAGG;IACH,6GAAkF,CAAA;IAElF;;;OAGG;IACH,iGAAsE,CAAA;IAEtE;;;;OAIG;IACH,uGAA4E,CAAA;IAE5E,qGAAqG;IACrG,2FAAgE,CAAA;IAEhE;;;;;OAKG;IACH,+EAAoD,CAAA;AACtD,CAAC,EA9ZW,uBAAuB,KAAvB,uBAAuB,QA8ZlC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,mCAoBX;AApBD,WAAY,mCAAmC;IAC7C,wEAAwE;IACxE,gFAAyC,CAAA;IACzC,qGAAqG;IACrG,sFAA+C,CAAA;IAC/C;;;;OAIG;IACH,kGAA2D,CAAA;IAC3D,2GAA2G;IAC3G,4FAAqD,CAAA;IACrD,mHAAmH;IACnH,4EAAqC,CAAA;IACrC;;;OAGG;IACH,4GAAqE,CAAA;AACvE,CAAC,EApBW,mCAAmC,KAAnC,mCAAmC,QAoB9C;AACD,sEAAsE;AAEtE;;;GAGG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,6DAA6D;MACrH,4HAA4H;MAC5H,0GAA0G,CAAC","sourcesContent":["/**\n * Stable codes a client can branch on when a system of record refuses (#1055).\n *\n * Two audiences, and the split matters because the remedies are different people's work:\n *\n * - **Boot codes** name an incoherent DECLARATION — a vendor nothing ships, a dialect the facet does\n *   not speak, a slot the environment never supplied. Every one of them is fixed by editing a file\n *   and restarting, which needs no running companion, so refusing at boot is legitimate\n *   (`continuity-drift-and-cas-basis.md` Rule 3 — the remedy does not route back through the thing\n *   that just refused).\n * - **Request codes** name a state of the WORLD at the moment of a read or a write: this environment\n *   has no access to the instance, the owner organization is not seeded yet, a write landed in a\n *   partition the caller may not touch, or its outcome is unknown. None is an authoring mistake, and\n *   each must answer with a code rather than a 500 or a silent empty list.\n *\n * Carried in the error's `context.code`, which survives `sanitizeErrorForClient` for `CONFLICT` and\n * `VALIDATION` — the reason those two error types are used here rather than `AUTHORIZATION`, whose\n * context is stripped entirely. A refusal a client cannot branch on is a refusal a client will retry.\n */\n\n/**\n * @wildo_source:part:start saas.models.system-of-record-error-codes facet:layer:shared facet:audience:app-developer\n *\n * Why a system of record could not be prepared, read, or written — the stable `context.code` a client branches on.\n * Imported from `@wildo-ai/saas-models`. Request codes ride a `CONFLICT` (409) or `VALIDATION` (400) answer, the two\n * error types whose context reaches the client.\n */\nexport enum SystemOfRecordErrorCode {\n  /**\n   * BOOT — an instance names a vendor no facet answers to.\n   *\n   * The framework's facets ship in the opt-in library `@wildo-ai/systems-of-record` (#2013), and an augmentation\n   * package an instance opts into may add others, so this means the vendor is spelled wrong OR the package that\n   * owns it is not installed. The message names both, because from inside the registry the two are\n   * indistinguishable, and names the library and its remedy.\n   */\n  VENDOR_HAS_NO_FACET = 'SYSTEM_OF_RECORD_VENDOR_HAS_NO_FACET',\n\n  /**\n   * BOOT — the application declares systems of record, but its provider runtime artifact lists no facet\n   * modules at all: it predates the field, or was never generated. Distinct from\n   * {@link VENDOR_HAS_NO_FACET}, because the remedy is a regeneration rather than a spelling or an\n   * install, and reporting it as that one sent a correct configuration looking for a typo (2026-09-24).\n   */\n  FACET_MODULES_NOT_GENERATED = 'SYSTEM_OF_RECORD_FACET_MODULES_NOT_GENERATED',\n\n  /**\n   * BOOT — an instance opts into a facet AUGMENTATION (#1675) from a package that ships none for its\n   * vendor: `wildo config sync` did not record its `<package>/systems-of-record` module (a package discovery\n   * does not walk by name must be listed in `providers.packages`, #1676), the recorded module fails to load\n   * (the import error is named), or it augments other vendors only. `wildo config sync` refuses the first\n   * case too, before anything starts. Named rather than ignored, because an augmentation the author believes\n   * applies — a partition declaration, say — that silently does not is a confinement they think they have.\n   */\n  FACET_AUGMENTATION_NOT_FOUND = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_NOT_FOUND',\n\n  /**\n   * BOOT — an opted-in augmentation (#1675) fails the augmentation schema, or the facet it produces once\n   * merged into the base fails the facet schema. The refusal names the package and the instance rather\n   * than surfacing a bare schema error that names neither.\n   */\n  FACET_AUGMENTATION_INVALID = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_INVALID',\n\n  /**\n   * BOOT — two facet modules each present a BASE facet for one vendor (#1675). Refused naming both,\n   * because the base carries the vendor's partition and \"first in module order\" would let whichever\n   * package name sorts first decide how a tenant's rows are confined. A package that adds to a vendor it\n   * does not own ships an augmentation an instance opts into.\n   */\n  FACET_BASE_CONFLICT = 'SYSTEM_OF_RECORD_FACET_BASE_CONFLICT',\n\n  /**\n   * BOOT — two sources declare the same thing for one instance's vendor (#1675): a partition declared by\n   * the base facet AND an augmentation, or by two augmentations; one credential kind offered twice. The\n   * facet is the single partition authority, so which declaration confines a tenant's rows must never\n   * depend on order. The refusal names both sources.\n   */\n  FACET_AUGMENTATION_CONFLICT = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_CONFLICT',\n\n  /**\n   * BOOT — the instance declares a dialect its vendor's facet does not speak.\n   *\n   * A vendor may legitimately offer several (a service reachable over OData v4 and a bespoke REST\n   * surface is one vendor, two ways in), so this is checked against the facet's list rather than\n   * assumed from the vendor.\n   */\n  DIALECT_NOT_SPOKEN_BY_VENDOR = 'SYSTEM_OF_RECORD_DIALECT_NOT_SPOKEN_BY_VENDOR',\n\n  /**\n   * BOOT — the instance names a credential kind its vendor does not offer.\n   */\n  CREDENTIAL_KIND_NOT_OFFERED = 'SYSTEM_OF_RECORD_CREDENTIAL_KIND_NOT_OFFERED',\n\n  /**\n   * BOOT — the vendor offers several credential kinds and the instance named none.\n   *\n   * Only reachable once a facet offers more than one (#1056). Until then the kind is DERIVED and an\n   * author is never asked for something with a single legal answer.\n   */\n  CREDENTIAL_KIND_AMBIGUOUS = 'SYSTEM_OF_RECORD_CREDENTIAL_KIND_AMBIGUOUS',\n\n  /**\n   * BOOT — a required slot's environment variable is unset while the environment DID author a block\n   * for the instance (#1055 E4).\n   *\n   * Distinct from the instance being declared absent: an environment that has no access says so with\n   * `{ enabled: false }`, and this is what is left — an environment that meant to have access and is\n   * missing a value. Silence is not a declaration, which is why these two are separable at all.\n   */\n  REQUIRED_SLOT_MISSING = 'SYSTEM_OF_RECORD_REQUIRED_SLOT_MISSING',\n\n  /**\n   * BOOT — a resource's `httpApiBinding` names an instance the application does not declare.\n   *\n   * Checked at REGISTRATION rather than in the resource factory, because the factory runs in the\n   * application's `shared-lib` where the saas configuration is not in scope. The factory checks\n   * SHAPE; this checks AGREEMENT, at the first moment both are visible.\n   */\n  BINDING_NAMES_UNDECLARED_SYSTEM = 'SYSTEM_OF_RECORD_BINDING_NAMES_UNDECLARED_SYSTEM',\n\n  /**\n   * BOOT — a binding's dialect and its instance's dialect disagree.\n   *\n   * Both are authored, in different files, and the binding's is the discriminator of its own\n   * per-dialect union — so the binding cannot simply inherit the instance's, and the disagreement has\n   * to be refused where both are known.\n   */\n  BINDING_DIALECT_DISAGREES_WITH_SYSTEM = 'SYSTEM_OF_RECORD_BINDING_DIALECT_DISAGREES_WITH_SYSTEM',\n\n  /**\n   * REQUEST — this environment declared it has no access to the instance (#1055 E3).\n   *\n   * A developer laptop and a staging with no ERP are the ordinary case. The application boots, every\n   * other resource works, and a read on a bound resource answers this rather than a transport error\n   * against an address nobody authored.\n   */\n  UNAVAILABLE_IN_ENVIRONMENT = 'SYSTEM_OF_RECORD_UNAVAILABLE_IN_ENVIRONMENT',\n\n  /**\n   * REQUEST — the application has no owner organization to stamp remote rows with (#1055 E10,\n   * resting on #1054 E1).\n   *\n   * A fresh install before bootstrap runs is the real case. Rows read out of a system of record carry\n   * the owner organization's id so the per-row tenant gate passes without an exemption; with no owner\n   * there is nothing to stamp, and answering an empty list would say \"this system holds nothing about\n   * you\", which is false.\n   */\n  OWNER_ORGANIZATION_ABSENT = 'SYSTEM_OF_RECORD_OWNER_ORGANIZATION_ABSENT',\n\n  /**\n   * REQUEST — the instance's token endpoint could not be reached, refused to mint, or answered\n   * something that is not a token (#1056 E2, E3; R11).\n   *\n   * ONE code for the whole family rather than one per failure, with a `reason` in the context and an\n   * optional `retryAfterSeconds` taken from the answer's `Retry-After`. The family is deliberately\n   * coarse because every member has the same shape from a caller's side: the remote is not currently\n   * giving us an identity, the request cannot proceed, and retrying later may work. Splitting it\n   * would ask a client to branch on a distinction it cannot act on differently.\n   *\n   * Never carries the token endpoint's own `error_description` verbatim into a client-visible\n   * message: an authorization server is entitled to say things about the credential, and a\n   * credential's failure mode is not an application user's business. The detail is logged.\n   */\n  TOKEN_UNAVAILABLE = 'SYSTEM_OF_RECORD_TOKEN_UNAVAILABLE',\n\n  /**\n   * BOOT — the instance's credential material cannot produce a credential at all: an encrypted\n   * private key (#1056 E6), a certificate whose validity window does not contain now (E7), a BASIC\n   * username carrying the `:` that RFC 7617 makes the delimiter (E11).\n   *\n   * Separate from {@link REQUIRED_SLOT_MISSING} because the remedy is different: a value IS present\n   * and it is the wrong KIND of value, so an operator re-reading their environment for a blank finds\n   * nothing. Refused at boot rather than at the first read — the material is known then, and a\n   * certificate that expired last week should not first be noticed by a user.\n   */\n  CREDENTIAL_MATERIAL_UNUSABLE = 'SYSTEM_OF_RECORD_CREDENTIAL_MATERIAL_UNUSABLE',\n\n  /**\n   * BOOT — the instance opts into partitioning and its vendor declares none (#1058).\n   *\n   * Refused rather than ignored, for the reason the `partition` field was RESERVED for three slices:\n   * an author who writes `partition: true` and sees it accepted believes their rows are confined to\n   * organization units while every member still sees every row. An accepted declaration that does\n   * nothing is worse than a refusal, because only one of the two is visible.\n   */\n  PARTITION_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_PARTITION_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * BOOT — the instance opts into partitioning and its vendor partitions by a PATH SEGMENT, which\n   * this engine cannot confine (#1058 E9).\n   *\n   * A path segment is chosen before the request is built, so it cannot express \"these three\n   * companies\" in one read: the confinement would have to fan out into one request per unit, which is\n   * a different MECHANISM rather than a different predicate. Distinct from the code above because the\n   * remedy differs — there the vendor has no partitions at all, here it has partitions this engine\n   * does not yet reach, and only the second is a gap on our side.\n   */\n  PARTITION_KIND_UNSUPPORTED = 'SYSTEM_OF_RECORD_PARTITION_KIND_UNSUPPORTED',\n\n  // ─── Writes (#1679) ─────────────────────────────────────────────────────────────────────────────\n  //\n  // Every REQUEST code below is raised BEFORE anything is sent, except the two that name what the\n  // remote did (OUTCOME_UNKNOWN, APPLIED_FOLLOW_UP_FAILED) and the admission codes, which name what a\n  // retried request would do. A refusal before the send is safe to retry once the cause is fixed;\n  // the other two are the cases a client must NOT blindly retry, which is why they are codes at all.\n\n  /**\n   * BOOT — a binding opens a write verb whose DIALECT has no write implementation in this engine yet.\n   *\n   * Refused at boot rather than at the first write, for the reason every declaration refusal here is:\n   * the remedy is editing a file (remove the verb, or wait for the dialect), so nothing needs a\n   * running application to fix it. The message names the dialect, because that is the half an author\n   * cannot see from their own binding.\n   */\n  WRITE_DIALECT_NOT_IMPLEMENTED = 'SYSTEM_OF_RECORD_WRITE_DIALECT_NOT_IMPLEMENTED',\n\n  /**\n   * REQUEST — the write was scoped to an organization that does not own the application.\n   *\n   * A system of record's rows belong to the OWNER organization (#1055 Q2). A read under another\n   * organization answers an empty page, because an empty page is a true statement about what that\n   * tenant may see; a write has no such honest empty answer, so it is refused, before anything is\n   * sent, and the refusal is audited.\n   */\n  WRITE_ORGANIZATION_NOT_OWNER = 'SYSTEM_OF_RECORD_WRITE_ORGANIZATION_NOT_OWNER',\n\n  /**\n   * REQUEST — a CREATE on a partitioned instance could not tell which organization unit the new row\n   * belongs to, and the caller must name one (`organizationUnitId` in the payload).\n   *\n   * Reached by a member confined to SEVERAL units that own a partition of this instance, and by an\n   * organization-wide caller, who is entitled to every assigned partition and so has no single answer.\n   * Distinct from {@link WRITE_PARTITION_REFUSED} because the remedy is to ADD something, not to change it.\n   */\n  WRITE_PARTITION_UNIT_REQUIRED = 'SYSTEM_OF_RECORD_WRITE_PARTITION_UNIT_REQUIRED',\n\n  /**\n   * REQUEST — the partition this write would land in is not one the caller may write. The context\n   * carries a {@link SystemOfRecordWritePartitionRefusal} naming which rule refused.\n   */\n  WRITE_PARTITION_REFUSED = 'SYSTEM_OF_RECORD_WRITE_PARTITION_REFUSED',\n\n  /**\n   * REQUEST — the payload writes a field the engine owns: the partition field (it is DERIVED from the\n   * organization unit on create and never moves afterwards), the owner organization stamp, the unit\n   * stamp on update, or a key component.\n   *\n   * Refused rather than stripped. A caller who sends a partition value believes it decides where the\n   * row lands; silently discarding it would put the row somewhere they did not ask for.\n   */\n  WRITE_FIELD_NOT_WRITABLE = 'SYSTEM_OF_RECORD_WRITE_FIELD_NOT_WRITABLE',\n\n  /**\n   * REQUEST — the write was SENT and nobody knows whether the system of record applied it: the call\n   * timed out, the connection dropped after the request left, or a gateway answered for the vendor.\n   *\n   * The one answer a client must not treat as \"not written\". A retry with the SAME `Idempotency-Key`\n   * answers this again without sending anything; the way forward is to READ the row (or search for it)\n   * and decide, then send a NEW request under a new key if it is genuinely missing.\n   */\n  WRITE_OUTCOME_UNKNOWN = 'SYSTEM_OF_RECORD_WRITE_OUTCOME_UNKNOWN',\n\n  /**\n   * REQUEST — a request with this `Idempotency-Key` is being sent right now. The client retried before\n   * the first attempt settled; answering it would mean sending the write twice.\n   *\n   * Answered `409` (a CONFLICT carrying this code): wait, then retry the SAME request under the same key.\n   */\n  WRITE_IN_PROGRESS = 'SYSTEM_OF_RECORD_WRITE_IN_PROGRESS',\n\n  /**\n   * REQUEST — this `Idempotency-Key` was already used for a DIFFERENT write (another target, verb or\n   * payload). A key names one request; replaying the first request's outcome for a second one would\n   * tell the caller something false about the second.\n   *\n   * Answered `422` with `customMessageReference: IDEMPOTENCY_KEY_REUSED` (#1941) — the status and the\n   * reference the engine's generic request idempotency answers a reused key with, so a client learns ONE\n   * spelling. A 422's context is stripped on the wire, so THIS code does not reach an HTTP client: it is\n   * what an in-process caller catching the error reads (`context.code`), and what the trail and the\n   * refusal audit row record. Never retry the request as it is; send a new request under a new key.\n   * spec-cite: draft-ietf-httpapi-idempotency-key-header-07 §2.7 (reused key with a different payload → 422;\n   * a request still being processed → 409).\n   */\n  WRITE_IDEMPOTENCY_KEY_REUSED = 'SYSTEM_OF_RECORD_WRITE_IDEMPOTENCY_KEY_REUSED',\n\n  /**\n   * REQUEST — the system of record APPLIED the write, and something the engine did after it failed\n   * (a postfix hook, a local lifecycle step, the response description).\n   *\n   * Never reported as a failure to write: the remote change is durable and nothing here can undo it.\n   * The context names the written row, so the caller can read it; a retry with the same key replays\n   * the applied outcome rather than writing again.\n   */\n  WRITE_APPLIED_FOLLOW_UP_FAILED = 'SYSTEM_OF_RECORD_WRITE_APPLIED_FOLLOW_UP_FAILED',\n\n  // ─── Version-checked updates (#1724, #1726) ─────────────────────────────────────────────────────\n  //\n  // A binding may declare `writeConcurrency: VERSION_CHECKED`: the caller sends the row version it read, and the engine\n  // compares it with the row it reads just before sending. On a system with no CONDITIONAL write (Odoo) that NARROWS the\n  // lost-update race and does not close it — the comparison and the write are two calls, and a change landing between\n  // them is overwritten. On OData the same version then travels as `If-Match`, and the vendor closes the gap itself\n  // (`WRITE_PRECONDITION_FAILED` below). The request codes in this block are raised BEFORE anything is sent.\n\n  /**\n   * BOOT — a binding declares `writeConcurrency: VERSION_CHECKED` and its vendor facet names no row version field\n   * (`rowVersionField`), or the binding's version field does not map onto that remote field. The check would compare a\n   * value the vendor does not maintain, and so would refuse or admit writes for no reason at all.\n   */\n  WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * REQUEST — an UPDATE on a `VERSION_CHECKED` binding carried no row version. The binding declared that every change is\n   * checked against the version its author read; an update without one would silently be last-writer-wins. Send the\n   * version field exactly as the read answered it.\n   */\n  WRITE_VERSION_REQUIRED = 'SYSTEM_OF_RECORD_WRITE_VERSION_REQUIRED',\n\n  /**\n   * REQUEST — the row changed since the caller read it: the version it sent is not the version the system of record\n   * answered just before the write. Nothing was sent. Read the row again and decide.\n   *\n   * BEST-EFFORT on Odoo, and the refusal's message says so: a change landing between that read and the write is not\n   * seen, and a vendor that serves its version coarsely (Odoo serves `write_date` to the SECOND) cannot tell two changes\n   * made in the same second apart. The absence of this code is therefore not proof that nobody else changed the row. On\n   * OData the change landing in that gap is refused by the vendor instead, as `WRITE_PRECONDITION_FAILED`.\n   */\n  WRITE_VERSION_STALE = 'SYSTEM_OF_RECORD_WRITE_VERSION_STALE',\n\n  /**\n   * REQUEST — an UPDATE on a `VERSION_CHECKED` binding, and the row the engine read just before writing carries NO\n   * version at all (#1726). Not \"stale\": nobody changed anything. The vendor serves no version for this row — an OData\n   * service that returns no `@odata.etag` for this entity set, although OData lets each set decide — so the binding's\n   * stance cannot be honoured for it. Nothing was sent. The remedy is the\n   * binding's, not the caller's: declare `LAST_WRITER_WINS` for this entity set, or have the vendor serve its versions.\n   */\n  WRITE_ROW_VERSION_NOT_SERVED = 'SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SERVED',\n\n  // ─── Conditional writes (#1726) ─────────────────────────────────────────────────────────────────\n  //\n  // A vendor that offers a real precondition (OData `If-Match` against the row's entity tag) refuses a stale write\n  // ITSELF, atomically — so the refusal arrives from the remote, after the write was sent, and still means that\n  // nothing was applied.\n\n  /**\n   * REQUEST — the system of record refused an UPDATE or DELETE because the row's version no longer matched the one the\n   * write was conditioned on: an OData `412 Precondition Failed` answering the `If-Match` the engine sent (#1726).\n   *\n   * Unlike {@link WRITE_VERSION_STALE} this is the VENDOR's decision, taken atomically against the row it was about to\n   * change, and the protocol requires that it change nothing — so it is a definite refusal, never an unknown outcome,\n   * and it is never retried: re-sending the same precondition would only be refused again. Read the row again and\n   * decide.\n   * spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match).\n   */\n  WRITE_PRECONDITION_FAILED = 'SYSTEM_OF_RECORD_WRITE_PRECONDITION_FAILED',\n\n  /**\n   * BOOT — a binding opens writes toward a vendor whose facet lists a step it requires before any modifying request\n   * (`writePrerequisites`, e.g. SAP Gateway's `X-CSRF-Token` handshake) that this engine does not perform (#1726). Every\n   * such write would be refused by the vendor; the binding stays read-only until the engine performs the step.\n   */\n  WRITE_PREREQUISITE_NOT_SUPPORTED = 'SYSTEM_OF_RECORD_WRITE_PREREQUISITE_NOT_SUPPORTED',\n\n  // ── Declared ACTIONS (#1678) ───────────────────────────────────────────────────────────────────\n  //\n  // An action re-uses the write path's key-ledger answers as they are — WRITE_OUTCOME_UNKNOWN, WRITE_IN_PROGRESS and\n  // WRITE_IDEMPOTENCY_KEY_REUSED mean exactly the same thing for an action as for a row write, and a client that already\n  // branches on them must not learn a second spelling. Both doors answer them from one table, statuses included (#1941). What follows is what only an action can be refused for.\n\n  /**\n   * BOOT — a binding declares an action whose call shape the instance's vendor facet does not list\n   * (`actionCallShapes`). The vendor's product does not expose actions that way, so the declaration could never run.\n   */\n  ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * BOOT — a record-free action toward a PARTITIONED instance declares no partition stance. It must say either why it\n   * reaches no partitioned data, or which parameter carries the partition the engine derives from the caller's unit;\n   * otherwise one member's action could land in every company.\n   */\n  ACTION_PARTITION_STANCE_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_STANCE_REQUIRED',\n\n  /** BOOT — two bindings of one instance declare the same action name; callers address an action by `(system, action)`. */\n  ACTION_NAME_DUPLICATED = 'SYSTEM_OF_RECORD_ACTION_NAME_DUPLICATED',\n\n  /** REQUEST — no binding of this instance declares an action of that name. */\n  ACTION_NOT_DECLARED = 'SYSTEM_OF_RECORD_ACTION_NOT_DECLARED',\n\n  /**\n   * REQUEST — this kind of context may not run this action: an anonymous or public execution, an application-scoped\n   * machine with no organization, or a system context (batch, cron, webhook, an autonomous agent with nobody behind it)\n   * on an action that does not declare `admitsSystemInitiation`.\n   */\n  ACTION_INITIATION_NOT_ADMITTED = 'SYSTEM_OF_RECORD_ACTION_INITIATION_NOT_ADMITTED',\n\n  /**\n   * REQUEST — the action was initiated for an organization that does not own the application. A system of record's rows\n   * and actions belong to the owner organization; a tenant that is not the owner never reaches the ERP.\n   */\n  ACTION_ORGANIZATION_NOT_OWNER = 'SYSTEM_OF_RECORD_ACTION_ORGANIZATION_NOT_OWNER',\n\n  /** REQUEST — the caller holds none of the roles the action declares, in the owner organization. */\n  ACTION_ROLE_NOT_HELD = 'SYSTEM_OF_RECORD_ACTION_ROLE_NOT_HELD',\n\n  /** REQUEST — the input does not satisfy the action's declared input schema; the context carries the issues. */\n  ACTION_INPUT_INVALID = 'SYSTEM_OF_RECORD_ACTION_INPUT_INVALID',\n\n  /**\n   * REQUEST — a WRITING action was called without an Idempotency-Key. A remote change cannot be rolled back, so every\n   * caller names its request; a retry under the same key then replays the first outcome instead of acting twice.\n   */\n  ACTION_IDEMPOTENCY_KEY_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_IDEMPOTENCY_KEY_REQUIRED',\n\n  /**\n   * REQUEST — a record-free action that carries the partition must know the caller's unit, and the caller is a member\n   * of several units owning partitions of this instance. Name one in `organizationUnitId`.\n   */\n  ACTION_PARTITION_UNIT_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_UNIT_REQUIRED',\n\n  /**\n   * REQUEST — the partition the action would land in is not one the caller may act in. The context carries a\n   * {@link SystemOfRecordWritePartitionRefusal} naming which rule refused — the same rules a read-through create obeys.\n   */\n  ACTION_PARTITION_REFUSED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_REFUSED',\n\n  /**\n   * REQUEST — the record a record-targeted action names is not one this caller may act on: absent, or outside its\n   * partition, or (for a shared record) not writable by a unit-confined caller. Answered as NOT_FOUND and\n   * indistinguishably, as a read answers, so an action cannot probe for records the caller may not see.\n   */\n  ACTION_TARGET_NOT_REACHABLE = 'SYSTEM_OF_RECORD_ACTION_TARGET_NOT_REACHABLE',\n\n  /** REQUEST — the system of record refused the action with a definite answer; nothing was applied. */\n  ACTION_REMOTE_REFUSED = 'SYSTEM_OF_RECORD_ACTION_REMOTE_REFUSED',\n\n  /**\n   * REQUEST — the action could not be SENT: the instance's access could not be resolved, its handshake failed, the\n   * connection was refused before the request left, the rate budget was spent, or the read-first could not reach the\n   * record. Nothing reached the vendor as an action, so nothing was applied and the Idempotency-Key may be spent again.\n   * The context carries the transport KIND (and status), never the transport's message, which names the URL.\n   */\n  ACTION_NOT_SENT = 'SYSTEM_OF_RECORD_ACTION_NOT_SENT',\n}\n\n/**\n * Which rule refused a write's PARTITION (#1679), carried as `context.reason` beside\n * {@link SystemOfRecordErrorCode.WRITE_PARTITION_REFUSED}.\n *\n * Distinct members because the remedy differs for each, and every one is somebody else's work: an\n * operator assigns partitions, an administrator grants units, an author declares the instance.\n */\nexport enum SystemOfRecordWritePartitionRefusal {\n  /** The unit named (or derived) is not one the caller's grant covers. */\n  UNIT_OUTSIDE_GRANT = 'unit_outside_grant',\n  /** The unit owns no partition of this instance, so a row created \"for it\" would belong to nobody. */\n  UNIT_HAS_NO_PARTITION = 'unit_has_no_partition',\n  /**\n   * The unit owns SEVERAL partitions of this instance, so the unit alone does not say which one the row\n   * belongs to. The operator's assignment map decides this, not the caller: one unit, one partition is\n   * what makes a create's destination derivable.\n   */\n  UNIT_HAS_SEVERAL_PARTITIONS = 'unit_has_several_partitions',\n  /** A unit was named for a write to an instance that is not partitioned — a stamp nothing would enforce. */\n  INSTANCE_NOT_PARTITIONED = 'instance_not_partitioned',\n  /** The narrowing authority denied the caller every unit (no decision, a registry disagreement, an empty grant). */\n  NARROWING_DENIED = 'narrowing_denied',\n  /**\n   * A UNIT-ONLY principal (a unit-scoped service-provider expert, #1597) writing a resource that does not\n   * narrow. The organization-wide admission such a principal may hold covers reads only.\n   */\n  UNIT_ONLY_PRINCIPAL_NOT_ADMITTED = 'unit_only_principal_not_admitted',\n}\n/** @wildo_source:part:end saas.models.system-of-record-error-codes */\n\n/**\n * Why an opted-in package whose module `wildo config sync` did not record is refused, and what to do (#1675, #1676).\n * One sentence for the backend's resolver, `wildo secrets` and config sync's own check, so the three agree.\n */\nexport const SYSTEM_OF_RECORD_FACET_MODULE_NOT_DISCOVERED = '`wildo config sync` did not discover it. A package outside '\n  + 'the framework\\'s own names and the application\\'s `<scope>/provider-*` is walked only when `providers.packages` lists it, '\n  + 'and the backend must depend on it and it must export `./systems-of-record`; then run `wildo config sync`';\n"]}

package/dist/esm/systems-of-record/system-of-record-facet.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-facet.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-facet.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAGH,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,qCAAqC,EAAE,MAAM,wDAAwD,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAA8C,MAAM,2CAA2C,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,6GAA6G;AAE7G;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;IACnC;;;OAGG;;IAWH;;;;OAIG;;IAEH,kFAAkF;;kBAElF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAuB1E;;;;;;;;GAQG;AACH,eAAO,MAAM,0CAA0C;;QAvDrD;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;;QApBlF;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;kBAsClF,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,0CAA0C,EAAE,QAAQ,CAAC,MAAM,CAAC,4BAA4B,EAAE,oCAAoC,CAAC,CA2H3I,CAAC;AAEF;;;;;GAKG;AACH,oBAAY,mCAAmC;IAC7C,+FAA+F;IAC/F,eAAe,oBAAoB;IACnC;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,2CAA2C;IACrD,0EAA0E;IAC1E,YAAY,iBAAiB;IAC7B,kEAAkE;IAClE,YAAY,iBAAiB;CAC9B;AAED;;;;GAIG;AACH,oBAAY,uCAAuC;IACjD,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;CAChB;AAYD;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC;;;;IAK5C,yGAAyG;;IAEzG,gIAAgI;;;;IAMhI,kDAAkD;;;;;;;;;;;;IAgBlD,uGAAuG;;;;;;;;4BAWzG,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;GAYG;AACH,oBAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;;;;;;OAUG;IACH,cAAc,mBAAmB;CAClC;AAED;;;;;;;GAOG;AACH,oBAAY,2BAA2B;IACrC;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;GAUG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,MAAM,WAAW;IACjB,iFAAiF;IACjF,aAAa,kBAAkB;CAChC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC;;IAE/C,+FAA+F;;IAE/F;;;;OAIG;;;kBAGH,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,gBAAgB,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,+BAA+B;IAC1C,6GAA6G;;IAE7G;;;;OAIG;;IAEH;;;OAGG;;QAvdH;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;IAqclF;;;;;;;;OAQG;;;;;QApMD,yGAAyG;;QAEzG,gIAAgI;;;;QAMhI,kDAAkD;;;;;;;;;;;;QAgBlD,uGAAuG;;;;;;;;;IA8KzG;;;;;;;;OAQG;;IAEH;;;;;;OAMG;;;QAvFH,+FAA+F;;QAE/F;;;;WAIG;;;;IAmFH;;;;;;;;;;OAUG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;;IAEH;;;;OAIG;;kBAsEH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,+CAA+C,CAAC;AAEjG,2FAA2F;AAC3F,eAAO,MAAM,qCAAqC,uBAAuB,CAAC;AAC1E,2DAA2D;AAE3D;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,oGAAoG;AACpG,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iHAAiH;IACjH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,gCAAgC,GACxC;IAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC;AAEtF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,SAAS,gCAAgC,EAAE,CAAC;CAClE,GAAG,gCAAgC,GAAG,SAAS,CAY/C;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2CAA2C;IACtD,0EAA0E;;IAE1E,2EAA2E;;;QAvU3E,+FAA+F;;QAE/F;;;;WAIG;;;;IAmUH,6FAA6F;;;;;QAxc3F,yGAAyG;;QAEzG,gIAAgI;;;;QAMhI,kDAAkD;;;;;;;;;;;;QAgBlD,uGAAuG;;;;;;;;;kBA6bzG,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,+HAA+H;AAC/H,eAAO,MAAM,iDAAiD,4DAA4D,CAAC;AAC3H,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,WAAW,yCAAyC;IACxD,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,kEAAkE;AAClE,oBAAY,0CAA0C;IACpD,4EAA4E;IAC5E,SAAS,cAAc;IACvB,iEAAiE;IACjE,QAAQ,aAAa;IACrB,qFAAqF;IACrF,OAAO,YAAY;CACpB;AAED,MAAM,MAAM,qCAAqC,GAC7C;IAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,yCAAyC,CAAA;CAAE,GAC9G;IAAE,QAAQ,CAAC,OAAO,EAAE,0CAA0C,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC;AAEnJ;;;;;;;;;;;;GAYG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QACtB;;;WAGG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;CACJ,GAAG,qCAAqC,CAwFxC;AAED;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,yBAAyB,GAAG,6BAA6B,CAEpH;AAED,kGAAkG;AAClG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,4BAA4B,GAC3C,6BAA6B,GAAG,SAAS,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kCAAkC,CAChD,YAAY,EAAE,4BAA4B,GAAG,SAAS,EACtD,KAAK,EAAE,yBAAyB,GAE9B;IAAE,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC,2BAA2B,GAAG,uBAAuB,CAAC,yBAAyB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAA;CAAE,CAM3L;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,4BAA4B,GAC3C,2BAA2B,CAmB7B"}
+{"version":3,"file":"system-of-record-facet.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-facet.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAGH,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,qCAAqC,EAAE,MAAM,wDAAwD,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAA8C,MAAM,2CAA2C,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,6GAA6G;AAE7G;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;IACnC;;;OAGG;;IAWH;;;;OAIG;;IAEH,kFAAkF;;kBAElF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAuB1E;;;;;;;;GAQG;AACH,eAAO,MAAM,0CAA0C;;QAvDrD;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;;QApBlF;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;kBAsClF,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,0CAA0C,EAAE,QAAQ,CAAC,MAAM,CAAC,4BAA4B,EAAE,oCAAoC,CAAC,CA2H3I,CAAC;AAEF;;;;;GAKG;AACH,oBAAY,mCAAmC;IAC7C,+FAA+F;IAC/F,eAAe,oBAAoB;IACnC;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,2CAA2C;IACrD,0EAA0E;IAC1E,YAAY,iBAAiB;IAC7B,kEAAkE;IAClE,YAAY,iBAAiB;CAC9B;AAED;;;;GAIG;AACH,oBAAY,uCAAuC;IACjD,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;CAChB;AAYD;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC;;;;IAK5C,yGAAyG;;IAEzG,gIAAgI;;;;IAMhI,kDAAkD;;;;;;;;;;;;IAgBlD,uGAAuG;;;;;;;;4BAWzG,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;GAYG;AACH,oBAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;;;;;;OAUG;IACH,cAAc,mBAAmB;CAClC;AAED;;;;;;;GAOG;AACH,oBAAY,2BAA2B;IACrC;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;GAUG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,MAAM,WAAW;IACjB,iFAAiF;IACjF,aAAa,kBAAkB;CAChC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC;;IAE/C,+FAA+F;;IAE/F;;;;OAIG;;;kBAGH,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,gBAAgB,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,+BAA+B;IAC1C,6GAA6G;;IAE7G;;;;OAIG;;IAEH;;;OAGG;;QAvdH;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;IAqclF;;;;;;;;OAQG;;;;;QApMD,yGAAyG;;QAEzG,gIAAgI;;;;QAMhI,kDAAkD;;;;;;;;;;;;QAgBlD,uGAAuG;;;;;;;;;IA8KzG;;;;;;;;OAQG;;IAEH;;;;;;OAMG;;;QAvFH,+FAA+F;;QAE/F;;;;WAIG;;;;IAmFH;;;;;;;;;;OAUG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;;IAEH;;;;OAIG;;kBAsEH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,+CAA+C,CAAC;AAEjG,2FAA2F;AAC3F,eAAO,MAAM,qCAAqC,uBAAuB,CAAC;AAC1E,2DAA2D;AAE3D;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,oGAAoG;AACpG,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iHAAiH;IACjH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,gCAAgC,GACxC;IAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC;AAEtF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,SAAS,gCAAgC,EAAE,CAAC;CAClE,GAAG,gCAAgC,GAAG,SAAS,CAY/C;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2CAA2C;IACtD,0EAA0E;;IAE1E,2EAA2E;;;QAvU3E,+FAA+F;;QAE/F;;;;WAIG;;;;IAmUH,6FAA6F;;;;;QAxc3F,yGAAyG;;QAEzG,gIAAgI;;;;QAMhI,kDAAkD;;;;;;;;;;;;QAgBlD,uGAAuG;;;;;;;;;kBA6bzG,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,+HAA+H;AAC/H,eAAO,MAAM,iDAAiD,4DAA4D,CAAC;AAC3H,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,WAAW,yCAAyC;IACxD,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,kEAAkE;AAClE,oBAAY,0CAA0C;IACpD,4EAA4E;IAC5E,SAAS,cAAc;IACvB,iEAAiE;IACjE,QAAQ,aAAa;IACrB,qFAAqF;IACrF,OAAO,YAAY;CACpB;AAED,MAAM,MAAM,qCAAqC,GAC7C;IAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,yCAAyC,CAAA;CAAE,GAC9G;IAAE,QAAQ,CAAC,OAAO,EAAE,0CAA0C,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC;AAEnJ;;;;;;;;;;;;GAYG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QACtB;;;WAGG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;CACJ,GAAG,qCAAqC,CAwFxC;AAED;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,yBAAyB,GAAG,6BAA6B,CAEpH;AAED,kGAAkG;AAClG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,4BAA4B,GAC3C,6BAA6B,GAAG,SAAS,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kCAAkC,CAChD,YAAY,EAAE,4BAA4B,GAAG,SAAS,EACtD,KAAK,EAAE,yBAAyB,GAE9B;IAAE,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC,2BAA2B,GAAG,uBAAuB,CAAC,yBAAyB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAA;CAAE,CAM3L;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,4BAA4B,GAC3C,2BAA2B,CAmB7B"}

package/dist/esm/systems-of-record/system-of-record-facet.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-facet.shared.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-facet.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,qCAAqC,EAAE,MAAM,wDAAwD,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AAEzJ,6GAA6G;AAE7G;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD;;;OAGG;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,KAAK,CAAC,kCAAkC,EAAE,mDAAmD,CAAC;SAC9F,GAAG,CAAC,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,6BAA6B,EAAE;QACxD,KAAK,EACH,IAAI,6BAA6B,+CAA+C;cAC9E,GAAG,qCAAqC,CAAC,SAAS,CAAC,8DAA8D;cACjH,qHAAqH;KAC1H,CAAC;IACJ;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,4BAA4B,GAAG,CAAC,KAAa,EAAE,EAAE,CACrD,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,aAAa,KAAK,UAAU,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,gCAAgC,EAAE,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,YAAY,CAAC;IACvE,YAAY,EAAE,4BAA4B,CAAC,oBAAoB,CAAC;IAChE,WAAW,EAAE,4BAA4B,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAyF;IAC9I,CAAC,4BAA4B,CAAC,oBAAoB,CAAC,EAAE;QACnD,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,mFAAmF;sBACjF,sFAAsF;aAC3F;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,cAAc,CAAC,EAAE;QAC7C,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,6FAA6F;sBAC3F,+DAA+D;aACpE;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,aAAa,CAAC,EAAE;QAC5C,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,4FAA4F;sBAC1F,uFAAuF;sBACvF,yCAAyC;aAC9C;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE;QACpC,YAAY,EAAE;YACZ;gBACE,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,6FAA6F;sBAC3F,2FAA2F;sBAC3F,4EAA4E;aACjF;SACF;QACD,WAAW,EAAE;YACX,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wGAAwG,EAAE;SAC5J;KACF;IAED,CAAC,4BAA4B,CAAC,gCAAgC,CAAC,EAAE;QAC/D,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,yIAAyI,EAAE;YAC7L,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oGAAoG,EAAE;YACvJ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,uGAAuG,EAAE;YACxJ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2HAA2H,EAAE;SAC/K;QACD,WAAW,EAAE;YACX,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kIAAkI,EAAE;SAC1L;KACF;IAED,CAAC,4BAA4B,CAAC,qCAAqC,CAAC,EAAE;QACpE,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,qEAAqE,EAAE;YACzH;gBACE,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,2FAA2F;sBACzF,2FAA2F;sBAC3F,6CAA6C;aAClD;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,0FAA0F;sBACxF,wFAAwF;sBACxF,4EAA4E;aACjF;YACD,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4EAA4E,EAAE;YAC/H,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,oCAAoC,EAAE;YACrF,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+DAA+D,EAAE;SACnH;QACD,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,kFAAkF;sBAChF,2FAA2F;sBAC3F,qDAAqD;aAC1D;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,EAAE;QAChD,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,oGAAoG,EAAE;YACxJ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6DAA6D,EAAE;YAChH,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,oCAAoC,EAAE;YACrF;gBACE,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,uFAAuF;sBACrF,yFAAyF;sBACzF,8BAA8B;aACnC;YACD,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oCAAoC,EAAE;SACxF;QACD,WAAW,EAAE;YACX,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4GAA4G,EAAE;SACrK;KACF;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,mCAYX;AAZD,WAAY,mCAAmC;IAC7C,+FAA+F;IAC/F,0EAAmC,CAAA;IACnC;;;;;;;OAOG;IACH,0FAAmD,CAAA;AACrD,CAAC,EAZW,mCAAmC,KAAnC,mCAAmC,QAY9C;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,2CAKX;AALD,WAAY,2CAA2C;IACrD,0EAA0E;IAC1E,4EAA6B,CAAA;IAC7B,kEAAkE;IAClE,4EAA6B,CAAA;AAC/B,CAAC,EALW,2CAA2C,KAA3C,2CAA2C,QAKtD;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,uCAQX;AARD,WAAY,uCAAuC;IACjD,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;AACjB,CAAC,EARW,uCAAuC,KAAvC,uCAAuC,QAQlD;AAED;;;;;;;GAOG;AACH,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;IAEjI,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QACvG,yGAAyG;QACzG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE,qCAAqC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5G,gIAAgI;QAChI,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QACtG,kDAAkD;QAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;KAChH,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;IAElH,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,gCAAgC,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QACzH,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC;QACzE,4BAA4B,EAAE,kCAAkC;KACjE,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,qCAAqC,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QAC9H,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC;QAClE,yBAAyB,EAAE,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;QAC1E,uGAAuG;QACvG,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC3D,4BAA4B,EAAE,kCAAkC;KACjE,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QAC1G,yBAAyB,EAAE,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;QAC1E,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC3D,4BAA4B,EAAE,kCAAkC;KACjE,CAAC;CACH,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,6BAqBX;AArBD,WAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,8CAAa,CAAA;IACb;;;;;;;;;;OAUG;IACH,kEAAiC,CAAA;AACnC,CAAC,EArBW,6BAA6B,KAA7B,6BAA6B,QAqBxC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,2BAgBX;AAhBD,WAAY,2BAA2B;IACrC;;;;OAIG;IACH,8CAAe,CAAA;IACf;;;;;;;OAOG;IACH,4DAA6B,CAAA;AAC/B,CAAC,EAhBW,2BAA2B,KAA3B,2BAA2B,QAgBtC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,sDAAiB,CAAA;IACjB,iFAAiF;IACjF,oEAA+B,CAAA;AACjC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IACzC,+FAA+F;IAC/F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CACtD,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAQX;AARD,WAAY,+BAA+B;IACzC;;;;;OAKG;IACH,gFAA6C,CAAA;AAC/C,CAAC,EARW,+BAA+B,KAA/B,+BAA+B,QAQ1C;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,aAAa,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,6GAA6G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD;;;OAGG;IACH,YAAY,EAAE,4BAA4B,CAAC,gBAAgB,CAAC;IAC5D;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE;IACjE;;;;;;OAMG;IACH,SAAS,EAAE,oCAAoC,CAAC,QAAQ,EAAE;IAC1D;;;;;;;;;;OAUG;IACH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7F;;;;;;;;;;OAUG;IACH,oCAAoC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChF,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;OAIG;IACH,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC;WAC5F,KAAK,CAAC,eAAe,KAAK,oCAAoC,EAAE,CAAC;QACpE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,qDAAqD,oCAAoC,YAAY,KAAK,CAAC,eAAe,IAAI;SACxI,CAAC,CAAC;IACL,CAAC;IACD,uHAAuH;IACvH,0DAA0D;IAC1D,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,0CAA0C,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC;gBACjC,OAAO,EAAE,sBAAsB,KAAK,oBAAoB,0CAA0C,CAAC,KAAK,CAAC,6CAA6C;aACvJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,yHAAyH;IACzH,mCAAmC;IACnC,IAAI,KAAK,CAAC,oCAAoC,KAAK,SAAS;WACvD,CAAC,CAAC,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAChH,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,sCAAsC,CAAC;YAC9C,OAAO,EAAE,wDAAwD,qCAAqC,CAAC,gBAAgB,qEAAqE;SAC7L,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,8BAA8B,OAAO,IAAI,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,gGAAgG;IAChG,qEAAqE;IACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9D,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,sCAAsC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,8FAA8F;IAC9F,gGAAgG;IAChG,qFAAqF;IACrF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YACvF,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,cAAc,CAAC;oBACtB,OAAO,EAAE,iBAAiB,IAAI,CAAC,IAAI,wDAAwD,KAAK,CAAC,IAAI,6BAA6B;iBACnI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,4CAA4C,CAAC;AAEjG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,qCAAqC,GAAG,oBAAoB,CAAC;AAC1E,2DAA2D;AAE3D;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,WAAmB;IACpE,OAAO,GAAG,WAAW,GAAG,qCAAqC,EAAE,CAAC;AAClE,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,kCAAkC,CAAC,SAAiB;IAClE,OAAO,SAAS,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,qCAAqC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnJ,CAAC;AAcD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAG7C;IACC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,WAAW,KAAK,CAAC,MAAM,+BAA+B,KAAK,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,sBAAsB;kBACxH,+HAA+H;kBAC/H,2FAA2F;YAC/F,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;SACjG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC3F,CAAC;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,0EAA0E;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF,2EAA2E;IAC3E,SAAS,EAAE,oCAAoC,CAAC,QAAQ,EAAE;IAC1D,6FAA6F;IAC7F,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjF,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE;IACvC,IAAI,YAAY,CAAC,SAAS,KAAK,SAAS,IAAI,YAAY,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,qGAAqG,EAAE,CAAC,CAAC;IACjK,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7E,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,sCAAsC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,+HAA+H;AAC/H,MAAM,CAAC,MAAM,iDAAiD,GAAG,yDAAyD,CAAC;AAgB3H,kEAAkE;AAClE,MAAM,CAAN,IAAY,0CAOX;AAPD,WAAY,0CAA0C;IACpD,4EAA4E;IAC5E,qEAAuB,CAAA;IACvB,iEAAiE;IACjE,mEAAqB,CAAA;IACrB,qFAAqF;IACrF,iEAAmB,CAAA;AACrB,CAAC,EAPW,0CAA0C,KAA1C,0CAA0C,QAOrD;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qCAAqC,CAAC,KAYrD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;IACrC,IAAI,eAAe,GAAuB,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC5F,IAAI,yBAA6C,CAAC;IAClD,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAiB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,cAAc,GAA2B,EAAE,CAAC;IAElD,KAAK,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACnE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,0CAA0C,CAAC,SAAS;gBAC7D,OAAO,EAAE,UAAU,KAAK,SAAS;oBAC/B,CAAC,CAAC,WAAW,WAAW,mCAAmC,MAAM,2CAA2C;0BACxG,2DAA2D;oBAC/D,CAAC,CAAC,WAAW,WAAW,mCAAmC,MAAM,0BAA0B;0BACvF,GAAG,kCAAkC,CAAC,WAAW,CAAC,uBAAuB,UAAU,GAAG;gBAC5F,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;aACrF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,2CAA2C,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,0CAA0C,CAAC,OAAO;gBAC3D,OAAO,EAAE,WAAW,WAAW,8BAA8B,MAAM,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACrH,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;aAChC,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;QACjC,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,0CAA0C,CAAC,SAAS;gBAC7D,OAAO,EAAE,WAAW,WAAW,0CAA0C,MAAM,2BAA2B,YAAY,CAAC,MAAM,IAAI;gBACjI,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,MAAM,EAAE;aACrE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,WAAW,EAAE,CAAC;QACxC,IAAI,YAAY,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,0CAA0C,CAAC,QAAQ;oBAC5D,OAAO,EAAE,WAAW,MAAM,oCAAoC,eAAe,WAAW,MAAM,yBAAyB;0BACnH,6DAA6D;oBACjE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE;iBACvD,CAAC;YACJ,CAAC;YACD,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC;YACnC,eAAe,GAAG,MAAM,CAAC;YACzB,yBAAyB,GAAG,WAAW,CAAC;QAC1C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,0CAA0C,CAAC,QAAQ;oBAC5D,OAAO,EAAE,WAAW,MAAM,kCAAkC,KAAK,CAAC,IAAI,iBAAiB,QAAQ,aAAa,MAAM,GAAG;oBACrH,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;iBAC5E,CAAC;YACJ,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,gHAAgH;IAChH,oBAAoB;IACpB,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC;QACvD,GAAG,IAAI,CAAC,KAAK;QACb,gBAAgB;QAChB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACrF,OAAO;YACL,OAAO,EAAE,0CAA0C,CAAC,OAAO;YAC3D,OAAO,EAAE,WAAW,MAAM,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxI,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,IAAI;QAClB,WAAW,EAAE;YACX,GAAG,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;YAC5F,eAAe,EAAE,cAAc;SAChC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAAgC;IACnF,OAAO,KAAK,CAAC,eAAe,IAAI,6BAA6B,CAAC,IAAI,CAAC;AACrE,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,KAAgC,EAChC,cAA4C;IAE5C,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kCAAkC,CAChD,YAAsD,EACtD,KAAgC;IAIhC,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,uBAAuB,CAAC,2BAA2B,EAAE,OAAO,EAAE,CAAC;IAC7I,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,uBAAuB,CAAC,yBAAyB,EAAE,OAAO,EAAE,CAAC;AAChI,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAAgC,EAChC,cAA4C;IAE5C,MAAM,KAAK,GAAG,iCAAiC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,CAAC,MAAM,qCAAqC,cAAc,IAAI;cAC5E,YAAY,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,0CAA0C,CAAC,cAAc,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,CAAC,IAAwB,EAAsB,EAAE,CAClE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1F,MAAM,MAAM,GAAG,CAAC,IAAwB,EAAE,KAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5G,OAAO;QACL,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5F,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,8BAA8B,CAAC,KAAoC;IAC1E,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,4BAA4B,CAAC,oBAAoB,CAAC;QACvD,KAAK,4BAA4B,CAAC,cAAc,CAAC;QACjD,KAAK,4BAA4B,CAAC,aAAa,CAAC;QAChD,KAAK,4BAA4B,CAAC,KAAK,CAAC;QACxC,KAAK,4BAA4B,CAAC,gCAAgC;YAChE,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,KAAK,4BAA4B,CAAC,qCAAqC;YACrE,OAAO,IAAI,GAAG,CAAC;gBACb,KAAK,CAAC,qBAAqB,KAAK,mCAAmC,CAAC,eAAe;oBACjF,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,gBAAgB;aACrB,CAAC,CAAC;QACL,KAAK,4BAA4B,CAAC,iBAAiB;YACjD,8FAA8F;YAC9F,wDAAwD;YACxD,OAAO,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAChC,CAAC;AACH,CAAC","sourcesContent":["/**\n * `SystemOfRecordVendorFacet` — what a VENDOR is, as a system of record.\n *\n * Four concepts carry one job each in this lane (#1049 §4.1, #1055): the **external-data lane** (the\n * engine runtime), a **dialect adapter** (how to speak — `HttpApiTransportDialect`), a **vendor\n * facet** (this module: what the vendor needs to be addressed and believed), and a **system of\n * record** — a named, declared INSTANCE that resources bind by name.\n *\n * ## What a facet is NOT\n *\n * It is not a provider. A provider is selected through a capability plane, may carry a person's\n * lent credential, and has an operation catalogue; a system of record is a named deployment the\n * application reads its own business rows out of, spending its own service identity (D10, D12).\n * Nothing in this module may reach the provider registry, and the reverse import is what\n * `pnpm check:systems-of-record-separation` refuses.\n *\n * It is also not an INSTANCE. The facet says \"an Odoo needs a base URL, a database and a login, and\n * offers the in-args API-key credential\"; it never says WHICH Odoo. Two instances of one vendor\n * (`odoo-fr`, `odoo-de`) share this facet and differ only in their addresses and secrets — which is\n * the whole reason the instance is a separate concept from the vendor.\n *\n * ## Why this lives in `@wildo-ai/saas-models/external-data` (#1055 R2)\n *\n * The obvious home looks like `external-connectors-models`, beside the provider contracts. It\n * cannot be: that package depends only on `zod-decorators` and its own header forbids reaching\n * saas-models, while a facet is typed against `HttpApiTransportDialect`, which lives here. It is\n * also not `ProviderMetadata`-shaped, which is bundle-fenced. So the facet sits beside the binding\n * schema it serves, on the subpath whose two audiences — the app author and the backend — are\n * exactly the audiences a facet has.\n *\n * Note the split with the two VOCABULARIES it names: `HttpApiTransportDialect` and\n * `SystemOfRecordCredentialKind` are root-exported boundary modules, because the root-exported\n * `systemsOfRecord` declaration names them. The SHAPES here are subpath-only, because nothing\n * root-exported names a slot.\n *\n * ## Slots, and why their slugs are lowerCamelCase with nothing else in them\n *\n * A slot's slug becomes half of a derived environment-variable name, `WILDO_SOR_<NAME>__<SLOT>`\n * (#1055 R4). The instance name admits `-` and the slug admits neither `-` nor `_`, so the DOUBLE\n * underscore between them is a delimiter neither half can produce: the pair is recoverable from\n * the variable name, and `odoo-api` + `key` can never collide with `odoo` + `apiKey`. That property\n * is the reason for the regex, so widening it would silently reintroduce the collision.\n *\n * ## Partitioning LANDED in #1058, and was held back until it had a reader\n *\n * The facet is the single partition authority — which remote field carries the tenant, how it is\n * encoded — and that vocabulary arrived with the slice that first READS it. It is `partition`\n * below, and the INSTANCE-side opt-in is now honoured rather than refused at declaration.\n *\n * It was withheld until then on purpose, and the reasoning is kept because it is the general rule:\n * shipping a four-member vocabulary with no reader is the \"declared surface with nothing behind\n * it\" shape this repository keeps paying for. It landed additively, as an OPTIONAL field, so every\n * facet written against the earlier shape still parses.\n */\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\nimport { HttpApiKeyComponentCodec } from '../http-api-binding/http-api-binding.shared.schemas';\nimport { ExternalDataIncrementalExtractionMode } from '../external-data/external-data-pipeline.shared.schemas';\nimport { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';\nimport { SystemOfRecordActionCallShape, SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT } from './system-of-record-actions.shared.schemas';\nimport { SystemOfRecordErrorCode } from './system-of-record-error-codes.shared';\nimport { SYSTEM_OF_RECORD_ENABLED_SLOT, SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN, deriveSystemOfRecordEnabledEnvVarName } from './system-of-record-env.shared';\n\n/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */\n\n/**\n * One input an instance must supply — an address slot (non-secret, authored in the infra env\n * config) or a secret slot (authored in `secrets.json`). Both halves share this shape because both\n * derive an environment-variable name the same way; what differs is WHERE the value is authored and\n * whether it is ever printed.\n */\nexport const SystemOfRecordSlotSchema = z.strictObject({\n  /**\n   * lowerCamelCase, and nothing else — see the module header. Becomes the `<SLOT>` half of\n   * `WILDO_SOR_<NAME>__<SLOT>` by upper-snake-casing.\n   */\n  slug: z\n    .string()\n    .regex(SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN, 'A slot slug is lowerCamelCase with no separators.')\n    .max(40)\n    .refine((slug) => slug !== SYSTEM_OF_RECORD_ENABLED_SLOT, {\n      error:\n        `\"${SYSTEM_OF_RECORD_ENABLED_SLOT}\" is reserved: the environment builder emits `\n        + `${deriveSystemOfRecordEnabledEnvVarName('example')} itself to say an environment has no access to an instance. `\n        + 'A slot of that name would make \"declared absent\" indistinguishable from an address whose value happens to be false.',\n    }),\n  /**\n   * Whether an instance MUST supply it. A missing required slot refuses at `wildo config sync` and\n   * again at boot (#1055 E4) — the remedy is authoring a value, which needs no running companion,\n   * so refusing is legitimate there.\n   */\n  required: z.boolean(),\n  /** What an operator must put in it. Printed by sync and by the secrets report. */\n  description: z.string().min(1),\n});\nexport type SystemOfRecordSlot = z.infer<typeof SystemOfRecordSlotSchema>;\n\n/**\n * A slot list that cannot be order-dependent or ambiguous: sorted by slug, slugs unique.\n *\n * Mirrors `ProviderSecretContractShapeSchema`, and for the same reason — these lists are compared,\n * reported and (once #1057 lands) contributed by independently-versioned packages, so two facets\n * declaring the same slots in different orders must not be two different things.\n */\nconst systemOfRecordSlotListSchema = (label: string) =>\n  z.array(SystemOfRecordSlotSchema).superRefine((slots, context) => {\n    const seen = new Set<string>();\n    for (const [index, slot] of slots.entries()) {\n      if (seen.has(slot.slug)) {\n        context.addIssue({ code: 'custom', path: [index, 'slug'], message: `Duplicate ${label} slot \"${slot.slug}\".` });\n      }\n      seen.add(slot.slug);\n      if (index > 0 && slots[index - 1]!.slug.localeCompare(slot.slug) >= 0) {\n        context.addIssue({ code: 'custom', path: [index, 'slug'], message: `${label} slots must be sorted by slug.` });\n      }\n    }\n  });\n\n/**\n * What ONE credential kind needs, independent of vendor (#1055 R15).\n *\n * The kind owns its secrets and any address slot that exists only because the kind was chosen — a\n * future `OAUTH2_CLIENT_CREDENTIALS` owns `tokenUrl`, which no vendor would declare if it were\n * reached with a static key. `ODOO_API_KEY_IN_ARGS` needs no address slot of its own, and that is\n * the seam rather than an omission: its `database` and `login` inputs identify WHICH Odoo and WHICH\n * user, so they belong to the vendor and would survive a second Odoo credential kind.\n */\nexport const SystemOfRecordCredentialKindContractSchema = z.strictObject({\n  addressSlots: systemOfRecordSlotListSchema('credential address'),\n  secretSlots: systemOfRecordSlotListSchema('credential secret'),\n});\nexport type SystemOfRecordCredentialKindContract = z.infer<typeof SystemOfRecordCredentialKindContractSchema>;\n\n/**\n * Every credential kind's inputs. Engine-owned and CLOSED, keyed by the enum so a member added\n * without a contract is a compile error rather than a boot surprise.\n *\n * ## Which half a slot lands in, since the answer is not \"is it secret\"\n *\n * The split follows the precedent #1055 set with Odoo's `login`: **an identity slot is an ADDRESS\n * slot and a proof slot is a SECRET slot.** A `clientId` and a BASIC `username` are not\n * confidential — they name WHICH client and WHICH user — and putting them in `secrets.json` would\n * hide, from every diff and every environment review, the one thing an operator most often needs to\n * check. What must never be printed is the half that PROVES the identity.\n *\n * The consequence is that a credential's two halves are authored in two files. That is deliberate\n * and it is the same shape Odoo already has (`login` in the infra config, `apiKey` in the secrets),\n * so an operator meets one convention rather than two.\n *\n * ## Required-ness that a static list cannot express\n *\n * Three slots are declared `required: false` here and are made required by the FACET's offer, which\n * is the only place that knows: `certificateKeyId` when the vendor's assertion header policy is\n * {@link SystemOfRecordAssertionHeaderPolicy.KEY_ID_SUPPLIED}, `certificatePem` when it is\n * `X509_THUMBPRINT_DERIVED`, and `subject` for the JWT-bearer grant's `sub`. The join is performed\n * ONCE, in {@link resolveSystemOfRecordInstanceSlots}, rather than by each of the five readers of\n * \"what does this instance need\" — which is the enumeration failure\n * `invariant-call-site-enumeration.md` exists to stop.\n */\nexport const SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS: Readonly<Record<SystemOfRecordCredentialKind, SystemOfRecordCredentialKindContract>> = {\n  [SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS]: {\n    addressSlots: [],\n    secretSlots: [\n      {\n        slug: 'apiKey',\n        required: true,\n        description:\n          'Odoo external-API key (Settings → Users → API Keys). It replaces the password in '\n          + '`common.authenticate` and rides as a positional argument of every `execute_kw` call.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.API_KEY_HEADER]: {\n    addressSlots: [],\n    secretSlots: [\n      {\n        slug: 'apiKey',\n        required: true,\n        description:\n          'The static key this deployment presents. It travels in the header the vendor facet names — '\n          + 'the operator never chooses the header, only supplies the key.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.API_KEY_QUERY]: {\n    addressSlots: [],\n    secretSlots: [\n      {\n        slug: 'apiKey',\n        required: true,\n        description:\n          'The static key this deployment presents, appended as the query parameter the vendor facet '\n          + 'names. Weaker than a header — a URL reaches access logs and proxy logs — so prefer a '\n          + 'header kind when the vendor offers one.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.BASIC]: {\n    addressSlots: [\n      {\n        slug: 'username',\n        required: true,\n        description:\n          'The user this deployment authenticates as (SAP calls it a communication user). It names an '\n          + 'identity rather than proving one, so it is authored in the environment config beside the '\n          + 'base URL. It may not contain \":\" — RFC 7617 makes the colon the delimiter.',\n      },\n    ],\n    secretSlots: [\n      { slug: 'password', required: true, description: \"That user's password. Half of one credential; rotate it with the username only if the vendor requires.\" },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET]: {\n    addressSlots: [\n      { slug: 'audience', required: false, description: 'The `audience` / `resource` parameter, when the vendor requires one to scope the token (Entra names the resource; Salesforce does not).' },\n      { slug: 'clientId', required: true, description: 'The registered application (client) id. Names WHICH client, so it is addressing rather than proof.' },\n      { slug: 'scope', required: false, description: 'Space-delimited scopes to request. Omitted when the vendor derives them from the client registration.' },\n      { slug: 'tokenUrl', required: true, description: \"The token endpoint's absolute URL. Kind-owned: no vendor would declare it if the instance were reached with a static key.\" },\n    ],\n    secretSlots: [\n      { slug: 'clientSecret', required: true, description: 'The client secret issued with the client id. This is the half that proves the identity, and the only half that is never printed.' },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE]: {\n    addressSlots: [\n      { slug: 'audience', required: false, description: 'The `audience` / `resource` parameter when the vendor requires one.' },\n      {\n        slug: 'certificateKeyId',\n        required: false,\n        description:\n          'The key id the vendor assigned to this certificate, placed in the assertion\\'s protected '\n          + 'header as `kid` (NetSuite issues one at upload). REQUIRED when the vendor facet declares '\n          + 'the key-id header policy; unused otherwise.',\n      },\n      {\n        slug: 'certificatePem',\n        required: false,\n        description:\n          'The PUBLIC certificate in PEM, used to derive the `x5t` thumbprint the assertion header '\n          + 'carries. REQUIRED when the vendor facet declares the thumbprint header policy; unused '\n          + 'otherwise. Public material, so it is an address slot rather than a secret.',\n      },\n      { slug: 'clientId', required: true, description: 'The registered application (client) id — the assertion\\'s `iss` and `sub`.' },\n      { slug: 'scope', required: false, description: 'Space-delimited scopes to request.' },\n      { slug: 'tokenUrl', required: true, description: \"The token endpoint's absolute URL, and the assertion's `aud`.\" },\n    ],\n    secretSlots: [\n      {\n        slug: 'privateKeyPem',\n        required: true,\n        description:\n          'The UNENCRYPTED PKCS#8 private key, in PEM, that signs the client assertion. An '\n          + 'encrypted key is refused by name: the secret channel is the protection, and a passphrase '\n          + 'stored beside the key it protects protects nothing.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER]: {\n    addressSlots: [\n      { slug: 'audience', required: false, description: 'The assertion\\'s `aud`, when it differs from the token endpoint (Salesforce wants the login host).' },\n      { slug: 'clientId', required: true, description: 'The connected app\\'s consumer key — the assertion\\'s `iss`.' },\n      { slug: 'scope', required: false, description: 'Space-delimited scopes to request.' },\n      {\n        slug: 'subject',\n        required: false,\n        description:\n          'The user the assertion is made FOR — its `sub`. REQUIRED for this grant and declared '\n          + 'optional here only because the facet\\'s offer is what asserts it; a service account\\'s '\n          + 'username on the vendor side.',\n      },\n      { slug: 'tokenUrl', required: true, description: \"The token endpoint's absolute URL.\" },\n    ],\n    secretSlots: [\n      { slug: 'privateKeyPem', required: true, description: 'The UNENCRYPTED PKCS#8 private key, in PEM, that signs the assertion. An encrypted key is refused by name.' },\n    ],\n  },\n};\n\n/**\n * How a vendor wants a client assertion's PROTECTED HEADER built (#1056 R2).\n *\n * A generic \"sign it with the private key\" is rejected by both vendors that want an assertion, and\n * they want DIFFERENT things — which is why this is a facet policy rather than an engine constant.\n */\nexport enum SystemOfRecordAssertionHeaderPolicy {\n  /** `kid` carries a key id the VENDOR assigned when the certificate was uploaded (NetSuite). */\n  KEY_ID_SUPPLIED = 'key-id-supplied',\n  /**\n   * `x5t` carries the base64url SHA-1 thumbprint of the certificate, DERIVED by the engine from the\n   * supplied `certificatePem` (Microsoft Entra's certificate credential).\n   *\n   * SHA-1 is not a security choice here: `x5t` is defined as a SHA-1 thumbprint (RFC 7515 §4.1.7)\n   * and is an identifier for locating a key, never an integrity proof.\n   * spec-cite: RFC 7515 §4.1.7 (\"x5t\" (X.509 Certificate SHA-1 Thumbprint) Header Parameter).\n   */\n  X509_THUMBPRINT_DERIVED = 'x509-thumbprint-derived',\n}\n\n/**\n * Where a client's id and secret travel on a client-credentials token request.\n *\n * RFC 6749 §2.3.1 permits BOTH and says a server MUST support the Basic header while it MAY support\n * the body form — and real vendors differ, so the choice cannot be an engine default.\n * spec-cite: RFC 6749 §2.3.1 (Client Password).\n */\nexport enum SystemOfRecordClientAuthenticationPlacement {\n  /** `client_id` and `client_secret` as form fields in the request body. */\n  REQUEST_BODY = 'request-body',\n  /** `Authorization: Basic base64(client_id \":\" client_secret)`. */\n  BASIC_HEADER = 'basic-header',\n}\n\n/**\n * The algorithms an assertion may be signed with. Asymmetric ONLY, and that is the point: a\n * symmetric `HS*` assertion is signed with a shared secret, which makes the assertion no stronger\n * than the secret it was supposed to replace, and `none` is not an algorithm.\n */\nexport enum SystemOfRecordAssertionSigningAlgorithm {\n  RS256 = 'RS256',\n  RS384 = 'RS384',\n  RS512 = 'RS512',\n  PS256 = 'PS256',\n  ES256 = 'ES256',\n  ES384 = 'ES384',\n  ES512 = 'ES512',\n}\n\n/**\n * How long to treat a token as valid when the answer carries no `expires_in` (#1056 R3).\n *\n * A FACET property rather than a per-kind engine constant, because two vendors of the SAME kind\n * disagree: NetSuite's answer states `expires_in` is always 3600, while Salesforce's\n * client-credentials answer is reported to omit it. A per-kind constant would have to be wrong for\n * one of them.\n */\nconst tokenLifetimeFallbackSecondsSchema = z.number().int().min(30).max(86_400);\n\n/**\n * ONE credential kind as ONE vendor offers it — the kind, plus everything about it that varies by\n * VENDOR and not by deployment.\n *\n * A discriminated union rather than a kind list beside a policy map, so a policy cannot exist\n * without its kind and a kind cannot be offered without the policy it needs. `API_KEY_HEADER` with\n * no header name is unrepresentable here; under a parallel map it would parse and fail at the first\n * read.\n */\nexport const SystemOfRecordCredentialOfferSchema = z.discriminatedUnion('kind', [\n  z.strictObject({ kind: z.literal(SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS).systemEnum('SystemOfRecordCredentialKind') }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.API_KEY_HEADER).systemEnum('SystemOfRecordCredentialKind'),\n    /** The header the key travels in — `Authorization`, `X-API-Key`, `apikey`, whatever the vendor reads. */\n    headerName: z.string().regex(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/, 'A header name is an RFC 9110 token.').max(64),\n    /** What precedes the key in the header value, INCLUDING its trailing space (`\"Bearer \"`). Omitted when the key stands alone. */\n    valuePrefix: z.string().max(32).optional(),\n  }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.API_KEY_QUERY).systemEnum('SystemOfRecordCredentialKind'),\n    /** The query parameter the key is appended as. */\n    parameterName: z.string().regex(/^[A-Za-z0-9_.-]+$/, 'A query parameter name is alphanumeric with -._').max(64),\n  }),\n\n  z.strictObject({ kind: z.literal(SystemOfRecordCredentialKind.BASIC).systemEnum('SystemOfRecordCredentialKind') }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET).systemEnum('SystemOfRecordCredentialKind'),\n    clientAuthentication: z.enum(SystemOfRecordClientAuthenticationPlacement),\n    tokenLifetimeFallbackSeconds: tokenLifetimeFallbackSecondsSchema,\n  }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE).systemEnum('SystemOfRecordCredentialKind'),\n    assertionHeaderPolicy: z.enum(SystemOfRecordAssertionHeaderPolicy),\n    assertionSigningAlgorithm: z.enum(SystemOfRecordAssertionSigningAlgorithm),\n    /** How long the ASSERTION is valid — minutes, not hours; it is consumed once at the token endpoint. */\n    assertionLifetimeSeconds: z.number().int().min(30).max(600),\n    tokenLifetimeFallbackSeconds: tokenLifetimeFallbackSecondsSchema,\n  }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER).systemEnum('SystemOfRecordCredentialKind'),\n    assertionSigningAlgorithm: z.enum(SystemOfRecordAssertionSigningAlgorithm),\n    assertionLifetimeSeconds: z.number().int().min(30).max(600),\n    tokenLifetimeFallbackSeconds: tokenLifetimeFallbackSecondsSchema,\n  }),\n]);\nexport type SystemOfRecordCredentialOffer = z.infer<typeof SystemOfRecordCredentialOfferSchema>;\n\n/**\n * How a vendor's OData service pages a COLLECTION READ (#1292).\n *\n * A vendor property rather than a dialect constant, and the reason is one large implementation: the\n * Microsoft Dataverse Web API refuses `$skip` outright, while OData v4 defines it and a conformant\n * service serves it. A per-dialect default would have to be wrong for one of them — the same\n * argument #1056 R3 settled for the token-lifetime fallback.\n *\n * spec-cite: OData Version 4.01 Part 1: Protocol §11.2.6 (\"$top and $skip\") for the default; Microsoft\n * Learn, \"Query data using the Web API\"\n * (https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/query-data-web-api) for\n * the refusal — that page enumerates the query options the Web API does not support.\n */\nexport enum SystemOfRecordODataListPaging {\n  /**\n   * `$top` + `$skip` — one request for any page, which is what a page-numbered contract wants, unless the\n   * service serves fewer rows than `$top` and hands back a continuation: the page is then read to its end\n   * along the continuation (#1998), so the next page's `$skip` does not jump the rows the service held back.\n   *\n   * The default, because it is what OData v4 defines and what an uncatalogued service serves.\n   */\n  SKIP = 'skip',\n  /**\n   * `@odata.nextLink` only: the service hands back a continuation URL and refuses to be addressed by\n   * offset.\n   *\n   * The consequence is structural rather than a detail — a cursor has no page NUMBER, so reaching a page\n   * costs one request per page before it. The engine asks for the page size with `Prefer:\n   * odata.maxpagesize` on v4 (v2 has no such preference, so the service's own size decides) — never with\n   * `$top`, which would cap the whole collection (#1991) — walks forward\n   * counting ROWS rather than links (the service may serve a page size of its own, #1998), and refuses\n   * past a bound rather than pretending otherwise.\n   */\n  NEXT_LINK_ONLY = 'next-link-only',\n}\n\n/**\n * HOW a vendor partitions the data one deployment holds (#1058).\n *\n * Inside ONE corporate, a system of record usually holds several partitions — Odoo companies, SAP\n * company codes, Dynamics business units, NetSuite subsidiaries. They are not tenants: they all\n * belong to the operator, which is why they map onto ORGANIZATION UNITS of the owner organization\n * rather than onto organizations (#1049 Q3).\n */\nexport enum SystemOfRecordPartitionKind {\n  /**\n   * A FIELD on every row carries the partition (Odoo `company_id`, NetSuite `subsidiary`). The only\n   * kind supported today: it is filterable, so the confinement can be PUSHED DOWN and a caller never\n   * receives rows of a partition they may not see.\n   */\n  FIELD = 'field',\n  /**\n   * The partition is a PATH SEGMENT of the request (Business Central's `/companies({id})/customers`).\n   *\n   * Declared so a facet can be HONEST about a vendor this engine cannot confine yet, and refused by\n   * name where a partition is opted into. A path segment is chosen before the request is built, so it\n   * cannot express \"these three companies\" in one read — the confinement would have to fan out into\n   * one request per unit, which is a different mechanism rather than a different predicate.\n   */\n  PATH_SEGMENT = 'path-segment',\n}\n\n/**\n * The SHAPE a partition value arrives in — the difference between a number and a pair.\n *\n * Odoo answers a many2one as `[id, display_name]`: `company_id: [10, \"Acme\"]` on a read, and `false`\n * when unset. A reader that took the whole array as the key would match nothing, and one that took\n * `row.company_id` as a scalar would stamp `\"10,Acme\"`. The shape is declared because the engine\n * cannot tell a pair from a two-element list by looking.\n *\n * spec-cite: Odoo 18.0 developer documentation, \"External API\" — a many2one is returned as an\n * `[id, display_name]` pair under both *Read records* and *Search and read*.\n */\nexport enum SystemOfRecordPartitionValueShape {\n  /** The field holds the key directly (an integer, a GUID, a string). */\n  SCALAR = 'scalar',\n  /** Odoo's many2one: `[id, label]`, and `false` when unset. The id is the key. */\n  MANY2ONE_PAIR = 'many2one-pair',\n}\n\n/**\n * What a vendor's partitioning IS — declared by the FACET, opted into by the INSTANCE.\n *\n * The split is the same one every other vendor fact takes: how a vendor partitions is a property of\n * the vendor, and WHETHER this deployment's data is partitioned is a property of the deployment. A\n * single-company Odoo has a `company_id` on every row and nothing to confine.\n */\nexport const SystemOfRecordPartitionSupportSchema = z.strictObject({\n  kind: z.enum(SystemOfRecordPartitionKind),\n  /** The remote field carrying the partition key (`company_id`, `subsidiary`, `CompanyCode`). */\n  remoteField: z.string().min(1).max(120),\n  /**\n   * How a key is spelled on the wire. Reused from the KEY component vocabulary rather than given its\n   * own: a partition key is addressed exactly as a key component is — decoded from an operator's\n   * authored string, compiled into a remote predicate — and two vocabularies for one job would drift.\n   */\n  codec: z.enum(HttpApiKeyComponentCodec),\n  valueShape: z.enum(SystemOfRecordPartitionValueShape),\n});\nexport type SystemOfRecordPartitionSupport = z.infer<typeof SystemOfRecordPartitionSupportSchema>;\n\n/**\n * A step a vendor requires before it accepts ANY modifying request — a row write or a writing action — beyond the\n * credential every request carries (#1726).\n *\n * Declared by the FACET because it is a fact about the product, and refused at startup by the engine for every step it\n * does not perform (`WRITE_PREREQUISITE_NOT_SUPPORTED`): a write the vendor is known to refuse must not be opened, since\n * it would only surface as a remote `403` at the first request, under a code that names nothing.\n */\nexport enum SystemOfRecordWritePrerequisite {\n  /**\n   * SAP Gateway's cross-site-request-forgery protection: a modifying request must carry an `X-CSRF-Token` obtained by a\n   * prior NON-modifying request sent with `X-CSRF-Token: Fetch`, together with the session cookie that request set.\n   * spec-cite: SAP Help Portal, SAP Gateway Foundation — \"Cross-Site Request Forgery Protection\"\n   * (https://help.sap.com/saphelp_gateway20sp12/helpdata/en/e6/cae27d5e8d4996add4067280c8714e/frameset.htm).\n   */\n  CSRF_TOKEN_HANDSHAKE = 'csrf-token-handshake',\n}\n\n/**\n * The OData v4 control information that carries an entity's ETag in a JSON row (#1726) — the only row version an OData\n * vendor can declare in `rowVersionField`, and the value the OData write dialect sends as `If-Match`.\n *\n * The OData 4.0 spelling. A payload that is not OData-Version 4.0 omits the `odata.` infix (`@etag`); the engine asks\n * for 4.0 on its OData requests (`OData-MaxVersion: 4.0`), so a conformant service answers this spelling. A field MAPPED\n * onto the tag, and a `VERSION_CHECKED` comparison, read this spelling only; the write dialect alone also reads the\n * short form when it derives `If-Match`, which only widens what it can condition on.\n * spec-cite: OData JSON Format Version 4.01 §4.5.10 (Control Information: etag (odata.etag)) and §4.5 (\"In requests and\n * responses with an OData-Version header with a value of 4.0 control information names are prefixed with @odata.\").\n */\nexport const ODATA_ENTITY_TAG_CONTROL_INFORMATION = '@odata.etag';\n\n/**\n * What a vendor is, as a system of record. Parsed rather than trusted because #1057 lets a PACKAGE\n * ship one — a record produced by one package version and read by another.\n */\nexport const SystemOfRecordVendorFacetSchema = z.strictObject({\n  /** The vendor's stable identifier, named by an instance's `vendor`. Same charset law as an instance name. */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n  /**\n   * The dialects this vendor can be READ through. An instance's `dialect` must be one of them, and\n   * a binding's `dialect` must equal its instance's — both refused at boot registration, where the\n   * declaration and the facet are finally in the same scope.\n   */\n  dialects: z.array(z.enum(HttpApiTransportDialect)).min(1),\n  /**\n   * The vendor's own address slots — non-secret, authored per instance in the infra env config. The\n   * base URL is registration-scoped and is never credential material.\n   */\n  addressSlots: systemOfRecordSlotListSchema('vendor address'),\n  /**\n   * The credential kinds this vendor offers, each carrying THIS vendor's policy for it. The instance\n   * chooses one kind; a kind no offer names is refused.\n   *\n   * Reshaped from a bare `credentialKinds: Kind[]` in #1056. A list of kinds could say that a vendor\n   * accepts a header-borne API key and could not say WHICH header — so either the operator was asked\n   * (a question the vendor already answers, `derive-before-you-ask.md`) or the engine guessed. An\n   * offer is the kind and its vendor policy as one indivisible thing.\n   */\n  credentialOffers: z.array(SystemOfRecordCredentialOfferSchema).min(1),\n  /**\n   * How a COLLECTION READ pages against this vendor (#1292). Meaningful only for the OData dialects.\n   *\n   * OPTIONAL rather than defaulted, and the difference is not cosmetic: `.default()` would make the\n   * field REQUIRED on the parsed type, so every facet — Odoo's JSON-RPC included — would have to\n   * state an answer to a question about a dialect it does not speak. Absent means \"not an OData\n   * concern, or the conformant default\", and {@link resolveSystemOfRecordODataListPaging} is the one\n   * place that turns absence into `SKIP`.\n   */\n  odataListPaging: z.enum(SystemOfRecordODataListPaging).optional(),\n  /**\n   * How this vendor partitions one deployment's data (#1058), when it does.\n   *\n   * ABSENT means the vendor has no partition concept the engine can confine on — which is a real\n   * answer rather than an unfinished one, and the reason an instance opting into `partition` against\n   * such a facet is refused by name rather than silently doing nothing.\n   */\n  partition: SystemOfRecordPartitionSupportSchema.optional(),\n  /**\n   * The change-tracking mechanisms this vendor's deployments support, which a pipeline may read\n   * incrementally through (#1682). A pipeline declaring `incremental.mode` outside this list is refused\n   * at startup, naming the vendor.\n   *\n   * A VENDOR property rather than a dialect constant: whether a deployment can say what changed is a\n   * fact about the product (Odoo's ORM stamps `write_date` on every model that logs access; an OData\n   * service may or may not enable change tracking, #1722), not about the wire language.\n   *\n   * ABSENT means none — a real answer: that vendor's pipelines run full passes only.\n   */\n  incrementalExtractionModes: z.array(z.enum(ExternalDataIncrementalExtractionMode)).optional(),\n  /**\n   * The service-defined OData error codes with which this vendor says a tracked change position has EXPIRED (#1722), for a\n   * vendor that answers it with its own code rather than the protocol's `410 Gone` / `404 Not Found`.\n   *\n   * A delta-link pass whose link the vendor no longer honours starts over with a full pass. The protocol names the status\n   * for an expired URL, and the engine recognises it for every vendor; a vendor that answers something else instead\n   * states its code here, so the fallback does not depend on guessing which `400` means \"too old\". Dataverse documents\n   * `0x80044352` (`ExpiredVersionStamp`, \"Please perform a full sync\").\n   *\n   * ABSENT means the vendor answers the protocol's status, or has no change tracking.\n   */\n  odataExpiredChangePositionErrorCodes: z.array(z.string().min(1)).optional(),\n  /**\n   * The ACTION call shapes this vendor's product supports (#1678) — how a declared action is called on it: Odoo's\n   * `execute_kw` on a model method, an OData bound action, an OData unbound action import.\n   *\n   * A VENDOR property, like `partition`: whether a product exposes callable operations beyond row reads is a fact about\n   * the product, and a generic OData service may expose none. A binding declaring an action whose shape its vendor does\n   * not list is refused at boot, naming the vendor. ABSENT means none — the vendor is read (and perhaps written) only.\n   * Each listed shape must be spoken over one of the facet's own `dialects`.\n   */\n  actionCallShapes: z.array(z.enum(SystemOfRecordActionCallShape)).optional(),\n  /**\n   * The remote field this vendor's product maintains on EVERY row as its version — changed by the product itself on every\n   * write, never by a caller (#1724, #1726). Odoo: `write_date`, the ORM's \"Last Updated on\". An OData v4 vendor that\n   * serves entity tags: {@link ODATA_ENTITY_TAG_CONTROL_INFORMATION} (`@odata.etag`), and nothing else.\n   *\n   * A binding may declare `writeConcurrency: VERSION_CHECKED` only against a vendor that names one, and only with a\n   * version field that maps onto it (refused at boot, `WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR`). The engine then\n   * compares the version a caller read with the one it reads just before the write.\n   *\n   * ## What that comparison is worth depends on the DIALECT, not on this field\n   *\n   * - **Odoo (best-effort).** Its external API has no conditional write — `write(ids, vals)` applies the values, with no\n   *   precondition — so the comparison and the write are two separate calls, and a change landing between them is\n   *   overwritten. The check NARROWS the lost-update window to the gap between two calls; it does not close it.\n   * - **OData v4 (atomic).** The OData write dialect sends the version as `If-Match` on the `PATCH` or `DELETE`, and the\n   *   service itself refuses a mismatch with `412 Precondition Failed` and applies nothing. The engine's comparison\n   *   before sending is then only a fast refusal; the guarantee is the vendor's.\n   *   spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match) — \"the service MUST respond with 412\n   *   Precondition Failed and MUST ensure that no observable change occurs as a result of the request\".\n   *\n   * Declaring it for an OData vendor is also what lets its writes send the row's own entity tag rather than `*`: the\n   * write dialect reads `@odata.etag` from the row it reads first, so a row moved (into another partition, say) between\n   * that read and the write is refused by the vendor instead of written.\n   *\n   * A VENDOR property, like `incrementalExtractionModes`: whether a product maintains a per-row version is a fact about the\n   * product. ABSENT means none, and a binding against such a vendor states `LAST_WRITER_WINS` instead.\n   */\n  rowVersionField: z.string().min(1).max(120).optional(),\n  /**\n   * What this vendor requires before any modifying request (#1726) — see {@link SystemOfRecordWritePrerequisite}. ABSENT\n   * means nothing beyond the credential. A binding opening writes against a vendor listing a step the engine does not\n   * perform is refused at startup.\n   */\n  writePrerequisites: z.array(z.enum(SystemOfRecordWritePrerequisite)).optional(),\n}).superRefine((facet, context) => {\n  /*\n   * #1726 — over OData the row version IS the entity tag: it is what `If-Match` carries and what the service compares.\n   * A property value (a `modifiedon` column, a `RowVersion` field) is not an ETag, and sending one as `If-Match` would\n   * be refused as a mismatch on every write — so an OData vendor names the entity tag or nothing.\n   */\n  if (facet.rowVersionField !== undefined && facet.dialects.includes(HttpApiTransportDialect.ODATA)\n    && facet.rowVersionField !== ODATA_ENTITY_TAG_CONTROL_INFORMATION) {\n    context.addIssue({\n      code: 'custom',\n      path: ['rowVersionField'],\n      message: `An OData vendor's row version is its entity tag, \"${ODATA_ENTITY_TAG_CONTROL_INFORMATION}\" — got \"${facet.rowVersionField}\".`,\n    });\n  }\n  // #1678 — a call shape is spoken over one dialect; listing a shape over a dialect the vendor is not read through would\n  // advertise an action no instance of it could ever reach.\n  for (const [index, shape] of (facet.actionCallShapes ?? []).entries()) {\n    if (!facet.dialects.includes(SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT[shape])) {\n      context.addIssue({\n        code: 'custom',\n        path: ['actionCallShapes', index],\n        message: `Action call shape \"${shape}\" is spoken over ${SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT[shape]}, which this vendor's dialects do not list.`,\n      });\n    }\n  }\n  // #1722 — an expired-position code is read only by a delta-link pass, so a vendor listing one without that mode states a\n  // fact nothing could ever consult.\n  if (facet.odataExpiredChangePositionErrorCodes !== undefined\n    && !(facet.incrementalExtractionModes ?? []).includes(ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK)) {\n    context.addIssue({\n      code: 'custom',\n      path: ['odataExpiredChangePositionErrorCodes'],\n      message: `An expired change-position code is read only by the \"${ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK}\" mode, which this vendor's incrementalExtractionModes do not list.`,\n    });\n  }\n  const seenDialects = new Set<string>();\n  for (const [index, dialect] of facet.dialects.entries()) {\n    if (seenDialects.has(dialect)) {\n      context.addIssue({ code: 'custom', path: ['dialects', index], message: `Duplicate dialects member \"${dialect}\".` });\n    }\n    seenDialects.add(dialect);\n  }\n\n  // One vendor may not offer the same kind twice: the instance names a KIND, so two offers of one\n  // kind would make the policy the engine reads depend on array order.\n  const seenKinds = new Set<string>();\n  for (const [index, offer] of facet.credentialOffers.entries()) {\n    if (seenKinds.has(offer.kind)) {\n      context.addIssue({ code: 'custom', path: ['credentialOffers', index], message: `Duplicate credentialOffers member \"${offer.kind}\".` });\n    }\n    seenKinds.add(offer.kind);\n  }\n\n  // A vendor address slug that a kind also declares would make the derived environment variable\n  // ambiguous about who owns the value, so the two namespaces are checked against each other here\n  // rather than at the instance, where the failure would read as an authoring mistake.\n  const vendorSlugs = new Set(facet.addressSlots.map((slot) => slot.slug));\n  for (const offer of facet.credentialOffers) {\n    for (const slot of SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS[offer.kind].addressSlots) {\n      if (vendorSlugs.has(slot.slug)) {\n        context.addIssue({\n          code: 'custom',\n          path: ['addressSlots'],\n          message: `Address slot \"${slot.slug}\" is declared by this vendor AND by credential kind \"${offer.kind}\" — one slot has one owner.`,\n        });\n      }\n    }\n  }\n});\nexport type SystemOfRecordVendorFacet = z.infer<typeof SystemOfRecordVendorFacetSchema>;\n\n/**\n * The export a package's `./systems-of-record` module presents: a record of facets keyed by vendor id. The\n * backend's facet resolver and `wildo secrets` (which lists the credential slots an instance needs) both read\n * a facet module through this name, so it is declared once, beside the shape it carries.\n */\nexport const SYSTEM_OF_RECORD_FACET_RECORD_EXPORT = 'PROVIDER_CATALOGUE_SYSTEM_OF_RECORD_FACETS';\n\n/** The subpath a package exports its facet module under: `<package>/systems-of-record`. */\nexport const SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH = '/systems-of-record';\n/** @wildo_source:part:end saas.models.systems-of-record */\n\n/**\n * The specifier of `packageName`'s facet module. ONE spelling for the backend's resolver, `wildo secrets` and the\n * discovery that records the modules, so the three cannot disagree about where a package's facets live (#1675).\n */\nexport function systemOfRecordFacetModuleSpecifier(packageName: string): string {\n  return `${packageName}${SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH}`;\n}\n\n/** The package a facet module specifier belongs to: `@acme/erp/systems-of-record` → `@acme/erp`. */\nexport function packageOfSystemOfRecordFacetModule(specifier: string): string {\n  return specifier.endsWith(SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH) ? specifier.slice(0, -SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH.length) : specifier;\n}\n\n/** A vendor's BASE facet as one source presents it, before it is chosen. */\nexport interface SystemOfRecordBaseFacetCandidate {\n  /** Who presents it: `the engine`, `package @wildo-ai/systems-of-record`. */\n  readonly source: string;\n  /** The facet as presented — parsed here, since it was produced by one package version and is read by another. */\n  readonly raw: unknown;\n}\n\nexport type SystemOfRecordBaseFacetSelection =\n  | { readonly facet: SystemOfRecordVendorFacet; readonly source: string }\n  | { readonly conflict: string; readonly detail: Readonly<Record<string, unknown>> };\n\n/**\n * The ONE base facet for a vendor, or a refusal naming both sources when two present one (#1675).\n *\n * Refused rather than \"the first in authority order wins\": a base facet carries the vendor's partition, and module\n * order is the sorted order of discovered package names, so which package's partition confined a tenant's rows would\n * otherwise depend on how two names sort — and a newly installed package could replace the library's facet with\n * no opt-in at all. A package that knows more about a vendor it does not own ADDS to the base through an augmentation\n * an instance opts into; it never presents a second base.\n *\n * `undefined` when no source presents the vendor — the caller's own refusal names the vendor.\n *\n * assurance-control: WILDO.DATA.TENANT_ISOLATION WILDO.SECURITY.FAIL_CLOSED — two base facets for one vendor refuse,\n * so a tenant-confinement declaration never comes from whichever of two packages sorts first.\n */\nexport function selectSystemOfRecordBaseFacet(input: {\n  readonly vendor: string;\n  readonly candidates: readonly SystemOfRecordBaseFacetCandidate[];\n}): SystemOfRecordBaseFacetSelection | undefined {\n  const [first, second] = input.candidates;\n  if (first === undefined) return undefined;\n  if (second !== undefined) {\n    return {\n      conflict: `Vendor '${input.vendor}' has two base facets: from ${first.source} and from ${second.source}. One source owns a `\n        + 'vendor\\'s facet; a package that adds to it ships an augmentation (`PROVIDER_CATALOGUE_SYSTEM_OF_RECORD_FACET_AUGMENTATIONS`) '\n        + 'an instance opts into. Uninstall one of the two, or have it ship an augmentation instead.',\n      detail: { vendor: input.vendor, sources: input.candidates.map((candidate) => candidate.source) },\n    };\n  }\n  return { facet: SystemOfRecordVendorFacetSchema.parse(first.raw), source: first.source };\n}\n\n/** @wildo_source:part:start saas.models.systems-of-record.facet-augmentation facet:kind:api facet:audience:app-developer */\n/**\n * What a package ADDS to a vendor facet it does not own (#1675) — the facet counterpart of a provider\n * augmentation (#1672), with its own code path.\n *\n * One base facet per vendor answers — the one package module that presents it; two refuse, naming both. An\n * augmentation adds to it: a PARTITION declaration for a vendor whose base declares none (say a `company_id`\n * FIELD every row of an ERP carries, shipped by a package that knows the vendor better), or further\n * CREDENTIAL OFFERS. It never replaces or removes anything the base declares — two declarations of one\n * partition, or one credential kind offered twice, refuse at startup naming both sources.\n *\n * Only a FIELD partition can be confined. A PATH-SEGMENT partition (a company chosen in the request path) is\n * refused when an instance sets `partition: true`, augmented or not, because nothing narrows a read the path\n * already scoped — so augmenting one declares something no instance can use.\n *\n * INERT until an instance opts in: `systemsOfRecord.<name>.facetAugmentations` names the PACKAGES whose\n * augmentation applies to that instance. The facet is the single partition authority, so a partition\n * arriving from a package is a tenant-confinement change and is never applied because a package happens\n * to be installed.\n *\n * A package presents its augmentations beside its facets, from its `./systems-of-record` export, as a\n * record keyed by vendor id under {@link SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT}. A package\n * may ship augmentations and no facet at all. Its module is found the way every facet module is: by the\n * provider discovery walk `wildo config sync` runs, which reads the framework's names, the application's own\n * scope, and any package the application lists in `providers.packages` (#1676). Listing ADMITS the package;\n * an instance's opt-in ACTIVATES its augmentation. A package the walk did not record is refused by name.\n *\n * Entity descriptions are not augmentable: the facet declares none today, so there is nothing to add to.\n */\nexport const SystemOfRecordVendorFacetAugmentationSchema = z.strictObject({\n  /** The vendor this augments — must equal the key it is recorded under. */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n  /** A partition declaration for a vendor whose base facet declares none. */\n  partition: SystemOfRecordPartitionSupportSchema.optional(),\n  /** Credential kinds the base facet does not offer, each with this vendor's policy for it. */\n  credentialOffers: z.array(SystemOfRecordCredentialOfferSchema).min(1).optional(),\n}).superRefine((augmentation, context) => {\n  if (augmentation.partition === undefined && augmentation.credentialOffers === undefined) {\n    context.addIssue({ code: 'custom', path: [], message: 'A facet augmentation that adds nothing is refused: declare a partition, credential offers, or both.' });\n  }\n  const seenKinds = new Set<string>();\n  for (const [index, offer] of (augmentation.credentialOffers ?? []).entries()) {\n    if (seenKinds.has(offer.kind)) {\n      context.addIssue({ code: 'custom', path: ['credentialOffers', index], message: `Duplicate credentialOffers member \"${offer.kind}\".` });\n    }\n    seenKinds.add(offer.kind);\n  }\n});\nexport type SystemOfRecordVendorFacetAugmentation = z.infer<typeof SystemOfRecordVendorFacetAugmentationSchema>;\n\n/** The export a package's `./systems-of-record` module presents its facet augmentations under: a record keyed by vendor id. */\nexport const SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT = 'PROVIDER_CATALOGUE_SYSTEM_OF_RECORD_FACET_AUGMENTATIONS';\n/** @wildo_source:part:end saas.models.systems-of-record.facet-augmentation */\n\n/**\n * Where each thing a RESOLVED facet declares came from, once an instance's opted-in augmentations were applied\n * (#1675). Written only by {@link applySystemOfRecordFacetAugmentations}: a facet a package ships is parsed through\n * a strict schema with no such field, so a package cannot claim to have been augmented, nor attribute a partition\n * to someone else.\n */\nexport interface SystemOfRecordFacetAugmentationProvenance {\n  /** The package whose augmentation declared the instance's partition. */\n  readonly partition?: string;\n  /** Credential kind → the package whose augmentation offered it. */\n  readonly credentialKinds: Readonly<Record<string, string>>;\n}\n\n/** Why an instance's opted-in augmentations cannot be applied. */\nexport enum SystemOfRecordFacetAugmentationRefusalKind {\n  /** A package the instance opted in ships no augmentation for its vendor. */\n  NOT_FOUND = 'not-found',\n  /** Two sources declare the same partition or credential kind. */\n  CONFLICT = 'conflict',\n  /** An augmentation, or the facet it produces once merged, fails the facet schema. */\n  INVALID = 'invalid',\n}\n\nexport type SystemOfRecordFacetAugmentationResult =\n  | { readonly facet: SystemOfRecordVendorFacet; readonly augmentedBy: SystemOfRecordFacetAugmentationProvenance }\n  | { readonly refusal: SystemOfRecordFacetAugmentationRefusalKind; readonly message: string; readonly detail: Readonly<Record<string, unknown>> };\n\n/**\n * Folds an instance's opted-in augmentations into its base facet — and refuses, naming both sources, the moment two\n * of them declare the same thing. ONE implementation for the backend's facet resolver and `wildo secrets`, so a\n * listing cannot ask for a credential the backend would refuse, or miss one an augmentation offers.\n *\n * `augmentations` is in the instance's declared opt-in order; each `raw` is what the package's module presents under\n * {@link SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT} for this vendor (`undefined` when it presents none),\n * parsed here like a facet because it was produced by one package version and is read by another.\n *\n * assurance-control: WILDO.DATA.TENANT_ISOLATION WILDO.SECURITY.FAIL_CLOSED — a partition declaration (how a tenant's\n * rows are confined) is admitted from a package only when the instance opted that package in, only for a vendor whose\n * base facet declares none, never twice, and every admitted one is recorded with the package that contributed it.\n */\nexport function applySystemOfRecordFacetAugmentations(input: {\n  readonly vendor: string;\n  readonly base: { readonly facet: SystemOfRecordVendorFacet; readonly source: string };\n  readonly augmentations: ReadonlyArray<{\n    readonly packageName: string;\n    readonly raw: unknown;\n    /**\n     * Why the package's facet module could not be read at all — it was not discovered, or its import failed — named in\n     * the NOT_FOUND refusal, never swallowed. A full clause, since the reader supplies the remedy it knows.\n     */\n    readonly unreadable?: string;\n  }>;\n}): SystemOfRecordFacetAugmentationResult {\n  const { vendor, base } = input;\n  let partition = base.facet.partition;\n  let partitionSource: string | undefined = partition === undefined ? undefined : base.source;\n  let augmentedPartitionPackage: string | undefined;\n  const credentialOffers = [...base.facet.credentialOffers];\n  const offerSources = new Map<string, string>(base.facet.credentialOffers.map((offer) => [offer.kind, base.source]));\n  const augmentedKinds: Record<string, string> = {};\n\n  for (const { packageName, raw, unreadable } of input.augmentations) {\n    if (raw === undefined) {\n      return {\n        refusal: SystemOfRecordFacetAugmentationRefusalKind.NOT_FOUND,\n        message: unreadable === undefined\n          ? `Package ${packageName} is opted in to augment vendor '${vendor}' and ships no augmentation for it — its `\n            + '`./systems-of-record` module augments other vendors only.'\n          : `Package ${packageName} is opted in to augment vendor '${vendor}', and its facet module `\n            + `${systemOfRecordFacetModuleSpecifier(packageName)} could not be read: ${unreadable}.`,\n        detail: { vendor, packageName, ...(unreadable === undefined ? {} : { unreadable }) },\n      };\n    }\n    const parsed = SystemOfRecordVendorFacetAugmentationSchema.safeParse(raw);\n    if (!parsed.success) {\n      return {\n        refusal: SystemOfRecordFacetAugmentationRefusalKind.INVALID,\n        message: `Package ${packageName}'s augmentation of vendor '${vendor}' is malformed: ${z.prettifyError(parsed.error)}`,\n        detail: { vendor, packageName },\n      };\n    }\n    const augmentation = parsed.data;\n    if (augmentation.vendor !== vendor) {\n      return {\n        refusal: SystemOfRecordFacetAugmentationRefusalKind.NOT_FOUND,\n        message: `Package ${packageName} records an augmentation under vendor '${vendor}' that declares vendor '${augmentation.vendor}'.`,\n        detail: { vendor, packageName, declaredVendor: augmentation.vendor },\n      };\n    }\n    const source = `package ${packageName}`;\n    if (augmentation.partition !== undefined) {\n      if (partitionSource !== undefined) {\n        return {\n          refusal: SystemOfRecordFacetAugmentationRefusalKind.CONFLICT,\n          message: `Vendor '${vendor}' would be partitioned twice: by ${partitionSource} and by ${source}. The facet is the one `\n            + 'authority on how rows are confined — remove one of the two.',\n          detail: { vendor, sources: [partitionSource, source] },\n        };\n      }\n      partition = augmentation.partition;\n      partitionSource = source;\n      augmentedPartitionPackage = packageName;\n    }\n    for (const offer of augmentation.credentialOffers ?? []) {\n      const existing = offerSources.get(offer.kind);\n      if (existing !== undefined) {\n        return {\n          refusal: SystemOfRecordFacetAugmentationRefusalKind.CONFLICT,\n          message: `Vendor '${vendor}' would offer credential kind '${offer.kind}' twice: from ${existing} and from ${source}.`,\n          detail: { vendor, credentialKind: offer.kind, sources: [existing, source] },\n        };\n      }\n      offerSources.set(offer.kind, source);\n      credentialOffers.push(offer);\n      augmentedKinds[offer.kind] = packageName;\n    }\n  }\n\n  // Re-parsed as a whole, so every rule the base schema holds (a kind's slots against the vendor's) holds for the\n  // merged facet too.\n  const merged = SystemOfRecordVendorFacetSchema.safeParse({\n    ...base.facet,\n    credentialOffers,\n    ...(partition === undefined ? {} : { partition }),\n  });\n  if (!merged.success) {\n    const packages = input.augmentations.map((augmentation) => augmentation.packageName);\n    return {\n      refusal: SystemOfRecordFacetAugmentationRefusalKind.INVALID,\n      message: `Vendor '${vendor}''s facet, augmented by ${packages.join(', ')}, is no longer a valid facet: ${z.prettifyError(merged.error)}`,\n      detail: { vendor, packages },\n    };\n  }\n  return {\n    facet: merged.data,\n    augmentedBy: {\n      ...(augmentedPartitionPackage === undefined ? {} : { partition: augmentedPartitionPackage }),\n      credentialKinds: augmentedKinds,\n    },\n  };\n}\n\n/**\n * How this vendor pages an OData collection read — the ONE place an absent declaration becomes an\n * answer (#1292).\n *\n * `$skip` is what OData v4 defines and what a conformant service serves, so silence means the\n * conformant behaviour rather than an unknown. A second `?? SKIP` written at a consumer is how two\n * readers come to disagree about what silence meant.\n */\nexport function resolveSystemOfRecordODataListPaging(facet: SystemOfRecordVendorFacet): SystemOfRecordODataListPaging {\n  return facet.odataListPaging ?? SystemOfRecordODataListPaging.SKIP;\n}\n\n/** Every slot ONE instance must supply, once its facet and its credential kind are both known. */\nexport interface SystemOfRecordInstanceSlots {\n  readonly addressSlots: readonly SystemOfRecordSlot[];\n  readonly secretSlots: readonly SystemOfRecordSlot[];\n}\n\n/**\n * Find the offer a vendor makes for one kind, or `undefined`.\n *\n * Separate from {@link resolveSystemOfRecordInstanceSlots} because the two answer different\n * questions: this one is \"what is this vendor's POLICY for the kind I chose\", which the minter needs\n * at every call, while the slot union is a boot-time question asked once.\n */\nexport function findSystemOfRecordCredentialOffer(\n  facet: SystemOfRecordVendorFacet,\n  credentialKind: SystemOfRecordCredentialKind,\n): SystemOfRecordCredentialOffer | undefined {\n  return facet.credentialOffers.find((offer) => offer.kind === credentialKind);\n}\n\n/**\n * Which credential kind an instance uses — decided ONCE, for the backend registry that enforces it at boot\n * and for `wildo secrets`, which lists the secret slots that kind needs (#1637). Two readers deriving it\n * separately is how a listing comes to ask for a secret the backend will not read.\n *\n * DECLARED when the instance names one the facet offers; DERIVED when the instance names none and the\n * facet offers exactly one, because an author asked to choose between one option is being asked a question\n * the mechanism already holds the answer to (`derive-before-you-ask.md`). Otherwise a refusal, carrying\n * what the facet does offer so the reader can name it: a kind the vendor does not offer, or several on\n * offer and none chosen — the day the author acquires a real decision.\n */\nexport function chooseSystemOfRecordCredentialKind(\n  declaredKind: SystemOfRecordCredentialKind | undefined,\n  facet: SystemOfRecordVendorFacet,\n):\n  | { readonly kind: SystemOfRecordCredentialKind }\n  | { readonly refusal: SystemOfRecordErrorCode.CREDENTIAL_KIND_NOT_OFFERED | SystemOfRecordErrorCode.CREDENTIAL_KIND_AMBIGUOUS; readonly offered: readonly SystemOfRecordCredentialKind[] } {\n  const offered = facet.credentialOffers.map((offer) => offer.kind);\n  if (declaredKind !== undefined) {\n    return offered.includes(declaredKind) ? { kind: declaredKind } : { refusal: SystemOfRecordErrorCode.CREDENTIAL_KIND_NOT_OFFERED, offered };\n  }\n  return offered.length === 1 ? { kind: offered[0]! } : { refusal: SystemOfRecordErrorCode.CREDENTIAL_KIND_AMBIGUOUS, offered };\n}\n\n/**\n * The ONE place the vendor's slots and the credential kind's slots are joined.\n *\n * Every reader of \"what does this instance need\" goes through here — the environment-variable\n * derivation, `wildo config sync`'s coherence check, the k8s secrets generator, the CI collector\n * and the backend registry. Four of those five live in different packages, which is precisely why\n * re-deriving the union at each of them would drift (`invariant-call-site-enumeration.md`).\n *\n * ## It also applies the offer's REQUIRED-NESS, which is why it takes a facet and not a contract\n *\n * Three slots are declared optional in the contract map and become required here, because only the\n * vendor's offer knows: `certificateKeyId` under the key-id assertion header policy, `certificatePem`\n * under the thumbprint policy, and `subject` for the JWT-bearer grant. Declaring them required in the\n * contract would make every certificate vendor supply both halves of a choice only one of them makes;\n * leaving them optional everywhere would let an instance boot with an assertion it cannot build, and\n * fail at the first read instead of at configuration.\n *\n * Throws when the kind is not one the facet offers: that pairing is chosen by an instance and\n * refused where the instance is validated, so reaching here with it means a caller skipped the\n * check rather than an operator wrote something wrong.\n */\nexport function resolveSystemOfRecordInstanceSlots(\n  facet: SystemOfRecordVendorFacet,\n  credentialKind: SystemOfRecordCredentialKind,\n): SystemOfRecordInstanceSlots {\n  const offer = findSystemOfRecordCredentialOffer(facet, credentialKind);\n  if (offer === undefined) {\n    throw new Error(\n      `Vendor \"${facet.vendor}\" does not offer credential kind \"${credentialKind}\" `\n      + `(offers: ${facet.credentialOffers.map((candidate) => candidate.kind).join(', ')}).`,\n    );\n  }\n\n  const contract = SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS[credentialKind];\n  const requiredByOffer = slotSlugsTheOfferMakesRequired(offer);\n  const applyOffer = (slot: SystemOfRecordSlot): SystemOfRecordSlot =>\n    (slot.required || !requiredByOffer.has(slot.slug) ? slot : { ...slot, required: true });\n\n  const bySlug = (left: SystemOfRecordSlot, right: SystemOfRecordSlot) => left.slug.localeCompare(right.slug);\n  return {\n    addressSlots: [...facet.addressSlots, ...contract.addressSlots.map(applyOffer)].sort(bySlug),\n    secretSlots: [...contract.secretSlots.map(applyOffer)].sort(bySlug),\n  };\n}\n\n/**\n * Which otherwise-optional slugs THIS offer turns into obligations.\n *\n * A `switch` over the discriminated union rather than a lookup, so a member added to the union\n * without a decision here is a compile error rather than a slot that silently stays optional.\n */\nfunction slotSlugsTheOfferMakesRequired(offer: SystemOfRecordCredentialOffer): ReadonlySet<string> {\n  switch (offer.kind) {\n    case SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS:\n    case SystemOfRecordCredentialKind.API_KEY_HEADER:\n    case SystemOfRecordCredentialKind.API_KEY_QUERY:\n    case SystemOfRecordCredentialKind.BASIC:\n    case SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET:\n      return new Set();\n    case SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE:\n      return new Set([\n        offer.assertionHeaderPolicy === SystemOfRecordAssertionHeaderPolicy.KEY_ID_SUPPLIED\n          ? 'certificateKeyId'\n          : 'certificatePem',\n      ]);\n    case SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER:\n      // The `sub` of an RFC 7523 §2.1 assertion. Optional in the contract only because the GRANT is\n      // what asserts it — no other kind has a subject at all.\n      return new Set(['subject']);\n  }\n}\n"]}
+{"version":3,"file":"system-of-record-facet.shared.schemas.js","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-facet.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,6GAA6G;AAC7G,+GAA+G;AAC/G,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,qCAAqC,EAAE,MAAM,wDAAwD,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,kCAAkC,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AAEzJ,6GAA6G;AAE7G;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD;;;OAGG;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,KAAK,CAAC,kCAAkC,EAAE,mDAAmD,CAAC;SAC9F,GAAG,CAAC,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,6BAA6B,EAAE;QACxD,KAAK,EACH,IAAI,6BAA6B,+CAA+C;cAC9E,GAAG,qCAAqC,CAAC,SAAS,CAAC,8DAA8D;cACjH,qHAAqH;KAC1H,CAAC;IACJ;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,kFAAkF;IAClF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,4BAA4B,GAAG,CAAC,KAAa,EAAE,EAAE,CACrD,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,aAAa,KAAK,UAAU,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,gCAAgC,EAAE,CAAC,CAAC;QACjH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,YAAY,CAAC;IACvE,YAAY,EAAE,4BAA4B,CAAC,oBAAoB,CAAC;IAChE,WAAW,EAAE,4BAA4B,CAAC,mBAAmB,CAAC;CAC/D,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAyF;IAC9I,CAAC,4BAA4B,CAAC,oBAAoB,CAAC,EAAE;QACnD,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,mFAAmF;sBACjF,sFAAsF;aAC3F;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,cAAc,CAAC,EAAE;QAC7C,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,6FAA6F;sBAC3F,+DAA+D;aACpE;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,aAAa,CAAC,EAAE;QAC5C,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,4FAA4F;sBAC1F,uFAAuF;sBACvF,yCAAyC;aAC9C;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE;QACpC,YAAY,EAAE;YACZ;gBACE,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,6FAA6F;sBAC3F,2FAA2F;sBAC3F,4EAA4E;aACjF;SACF;QACD,WAAW,EAAE;YACX,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wGAAwG,EAAE;SAC5J;KACF;IAED,CAAC,4BAA4B,CAAC,gCAAgC,CAAC,EAAE;QAC/D,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,yIAAyI,EAAE;YAC7L,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oGAAoG,EAAE;YACvJ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,uGAAuG,EAAE;YACxJ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2HAA2H,EAAE;SAC/K;QACD,WAAW,EAAE;YACX,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kIAAkI,EAAE;SAC1L;KACF;IAED,CAAC,4BAA4B,CAAC,qCAAqC,CAAC,EAAE;QACpE,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,qEAAqE,EAAE;YACzH;gBACE,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,2FAA2F;sBACzF,2FAA2F;sBAC3F,6CAA6C;aAClD;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,0FAA0F;sBACxF,wFAAwF;sBACxF,4EAA4E;aACjF;YACD,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4EAA4E,EAAE;YAC/H,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,oCAAoC,EAAE;YACrF,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+DAA+D,EAAE;SACnH;QACD,WAAW,EAAE;YACX;gBACE,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,IAAI;gBACd,WAAW,EACT,kFAAkF;sBAChF,2FAA2F;sBAC3F,qDAAqD;aAC1D;SACF;KACF;IAED,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,EAAE;QAChD,YAAY,EAAE;YACZ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,oGAAoG,EAAE;YACxJ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6DAA6D,EAAE;YAChH,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,oCAAoC,EAAE;YACrF;gBACE,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,KAAK;gBACf,WAAW,EACT,uFAAuF;sBACrF,yFAAyF;sBACzF,8BAA8B;aACnC;YACD,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oCAAoC,EAAE;SACxF;QACD,WAAW,EAAE;YACX,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4GAA4G,EAAE;SACrK;KACF;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAN,IAAY,mCAYX;AAZD,WAAY,mCAAmC;IAC7C,+FAA+F;IAC/F,0EAAmC,CAAA;IACnC;;;;;;;OAOG;IACH,0FAAmD,CAAA;AACrD,CAAC,EAZW,mCAAmC,KAAnC,mCAAmC,QAY9C;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,2CAKX;AALD,WAAY,2CAA2C;IACrD,0EAA0E;IAC1E,4EAA6B,CAAA;IAC7B,kEAAkE;IAClE,4EAA6B,CAAA;AAC/B,CAAC,EALW,2CAA2C,KAA3C,2CAA2C,QAKtD;AAED;;;;GAIG;AACH,MAAM,CAAN,IAAY,uCAQX;AARD,WAAY,uCAAuC;IACjD,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;IACf,0DAAe,CAAA;AACjB,CAAC,EARW,uCAAuC,KAAvC,uCAAuC,QAQlD;AAED;;;;;;;GAOG;AACH,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9E,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;IAEjI,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QACvG,yGAAyG;QACzG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,EAAE,qCAAqC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5G,gIAAgI;QAChI,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3C,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QACtG,kDAAkD;QAClD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;KAChH,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;IAElH,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,gCAAgC,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QACzH,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC;QACzE,4BAA4B,EAAE,kCAAkC;KACjE,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,qCAAqC,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QAC9H,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC;QAClE,yBAAyB,EAAE,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;QAC1E,uGAAuG;QACvG,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC3D,4BAA4B,EAAE,kCAAkC;KACjE,CAAC;IAEF,CAAC,CAAC,YAAY,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,8BAA8B,CAAC;QAC1G,yBAAyB,EAAE,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;QAC1E,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC3D,4BAA4B,EAAE,kCAAkC;KACjE,CAAC;CACH,CAAC,CAAC;AAGH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAN,IAAY,6BAqBX;AArBD,WAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,8CAAa,CAAA;IACb;;;;;;;;;;OAUG;IACH,kEAAiC,CAAA;AACnC,CAAC,EArBW,6BAA6B,KAA7B,6BAA6B,QAqBxC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,2BAgBX;AAhBD,WAAY,2BAA2B;IACrC;;;;OAIG;IACH,8CAAe,CAAA;IACf;;;;;;;OAOG;IACH,4DAA6B,CAAA;AAC/B,CAAC,EAhBW,2BAA2B,KAA3B,2BAA2B,QAgBtC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,iCAKX;AALD,WAAY,iCAAiC;IAC3C,uEAAuE;IACvE,sDAAiB,CAAA;IACjB,iFAAiF;IACjF,oEAA+B,CAAA;AACjC,CAAC,EALW,iCAAiC,KAAjC,iCAAiC,QAK5C;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,YAAY,CAAC;IACjE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC;IACzC,+FAA+F;IAC/F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CACtD,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAQX;AARD,WAAY,+BAA+B;IACzC;;;;;OAKG;IACH,gFAA6C,CAAA;AAC/C,CAAC,EARW,+BAA+B,KAA/B,+BAA+B,QAQ1C;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,aAAa,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,6GAA6G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF;;;;OAIG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD;;;OAGG;IACH,YAAY,EAAE,4BAA4B,CAAC,gBAAgB,CAAC;IAC5D;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE;;;;;;;;OAQG;IACH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE;IACjE;;;;;;OAMG;IACH,SAAS,EAAE,oCAAoC,CAAC,QAAQ,EAAE;IAC1D;;;;;;;;;;OAUG;IACH,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7F;;;;;;;;;;OAUG;IACH,oCAAoC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3E;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChF,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAChC;;;;OAIG;IACH,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC;WAC5F,KAAK,CAAC,eAAe,KAAK,oCAAoC,EAAE,CAAC;QACpE,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,qDAAqD,oCAAoC,YAAY,KAAK,CAAC,eAAe,IAAI;SACxI,CAAC,CAAC;IACL,CAAC;IACD,uHAAuH;IACvH,0DAA0D;IAC1D,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,0CAA0C,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC;gBACjC,OAAO,EAAE,sBAAsB,KAAK,oBAAoB,0CAA0C,CAAC,KAAK,CAAC,6CAA6C;aACvJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,yHAAyH;IACzH,mCAAmC;IACnC,IAAI,KAAK,CAAC,oCAAoC,KAAK,SAAS;WACvD,CAAC,CAAC,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAChH,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,sCAAsC,CAAC;YAC9C,OAAO,EAAE,wDAAwD,qCAAqC,CAAC,gBAAgB,qEAAqE;SAC7L,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACxD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,8BAA8B,OAAO,IAAI,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,gGAAgG;IAChG,qEAAqE;IACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9D,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,sCAAsC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,8FAA8F;IAC9F,gGAAgG;IAChG,qFAAqF;IACrF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,0CAA0C,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YACvF,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,QAAQ,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,cAAc,CAAC;oBACtB,OAAO,EAAE,iBAAiB,IAAI,CAAC,IAAI,wDAAwD,KAAK,CAAC,IAAI,6BAA6B;iBACnI,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,4CAA4C,CAAC;AAEjG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,qCAAqC,GAAG,oBAAoB,CAAC;AAC1E,2DAA2D;AAE3D;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,WAAmB;IACpE,OAAO,GAAG,WAAW,GAAG,qCAAqC,EAAE,CAAC;AAClE,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,kCAAkC,CAAC,SAAiB;IAClE,OAAO,SAAS,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,qCAAqC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnJ,CAAC;AAcD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAG7C;IACC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ,EAAE,WAAW,KAAK,CAAC,MAAM,+BAA+B,KAAK,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,sBAAsB;kBACxH,+HAA+H;kBAC/H,2FAA2F;YAC/F,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;SACjG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,+BAA+B,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC3F,CAAC;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,0EAA0E;IAC1E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF,2EAA2E;IAC3E,SAAS,EAAE,oCAAoC,CAAC,QAAQ,EAAE;IAC1D,6FAA6F;IAC7F,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACjF,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE;IACvC,IAAI,YAAY,CAAC,SAAS,KAAK,SAAS,IAAI,YAAY,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACxF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,qGAAqG,EAAE,CAAC,CAAC;IACjK,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7E,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,sCAAsC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzI,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,+HAA+H;AAC/H,MAAM,CAAC,MAAM,iDAAiD,GAAG,yDAAyD,CAAC;AAgB3H,kEAAkE;AAClE,MAAM,CAAN,IAAY,0CAOX;AAPD,WAAY,0CAA0C;IACpD,4EAA4E;IAC5E,qEAAuB,CAAA;IACvB,iEAAiE;IACjE,mEAAqB,CAAA;IACrB,qFAAqF;IACrF,iEAAmB,CAAA;AACrB,CAAC,EAPW,0CAA0C,KAA1C,0CAA0C,QAOrD;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qCAAqC,CAAC,KAYrD;IACC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC/B,IAAI,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;IACrC,IAAI,eAAe,GAAuB,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAC5F,IAAI,yBAA6C,CAAC;IAClD,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAiB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpH,MAAM,cAAc,GAA2B,EAAE,CAAC;IAElD,KAAK,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACnE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO;gBACL,OAAO,EAAE,0CAA0C,CAAC,SAAS;gBAC7D,OAAO,EAAE,UAAU,KAAK,SAAS;oBAC/B,CAAC,CAAC,WAAW,WAAW,mCAAmC,MAAM,2CAA2C;0BACxG,2DAA2D;oBAC/D,CAAC,CAAC,WAAW,WAAW,mCAAmC,MAAM,0BAA0B;0BACvF,GAAG,kCAAkC,CAAC,WAAW,CAAC,uBAAuB,UAAU,GAAG;gBAC5F,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;aACrF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,2CAA2C,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,0CAA0C,CAAC,OAAO;gBAC3D,OAAO,EAAE,WAAW,WAAW,8BAA8B,MAAM,mBAAmB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACrH,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;aAChC,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;QACjC,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,0CAA0C,CAAC,SAAS;gBAC7D,OAAO,EAAE,WAAW,WAAW,0CAA0C,MAAM,2BAA2B,YAAY,CAAC,MAAM,IAAI;gBACjI,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,MAAM,EAAE;aACrE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,WAAW,EAAE,CAAC;QACxC,IAAI,YAAY,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,0CAA0C,CAAC,QAAQ;oBAC5D,OAAO,EAAE,WAAW,MAAM,oCAAoC,eAAe,WAAW,MAAM,yBAAyB;0BACnH,6DAA6D;oBACjE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE;iBACvD,CAAC;YACJ,CAAC;YACD,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC;YACnC,eAAe,GAAG,MAAM,CAAC;YACzB,yBAAyB,GAAG,WAAW,CAAC;QAC1C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,0CAA0C,CAAC,QAAQ;oBAC5D,OAAO,EAAE,WAAW,MAAM,kCAAkC,KAAK,CAAC,IAAI,iBAAiB,QAAQ,aAAa,MAAM,GAAG;oBACrH,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;iBAC5E,CAAC;YACJ,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,gHAAgH;IAChH,oBAAoB;IACpB,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC;QACvD,GAAG,IAAI,CAAC,KAAK;QACb,gBAAgB;QAChB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACrF,OAAO;YACL,OAAO,EAAE,0CAA0C,CAAC,OAAO;YAC3D,OAAO,EAAE,WAAW,MAAM,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACxI,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,IAAI;QAClB,WAAW,EAAE;YACX,GAAG,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,yBAAyB,EAAE,CAAC;YAC5F,eAAe,EAAE,cAAc;SAChC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oCAAoC,CAAC,KAAgC;IACnF,OAAO,KAAK,CAAC,eAAe,IAAI,6BAA6B,CAAC,IAAI,CAAC;AACrE,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,KAAgC,EAChC,cAA4C;IAE5C,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kCAAkC,CAChD,YAAsD,EACtD,KAAgC;IAIhC,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,uBAAuB,CAAC,2BAA2B,EAAE,OAAO,EAAE,CAAC;IAC7I,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,uBAAuB,CAAC,yBAAyB,EAAE,OAAO,EAAE,CAAC;AAChI,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAAgC,EAChC,cAA4C;IAE5C,MAAM,KAAK,GAAG,iCAAiC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,CAAC,MAAM,qCAAqC,cAAc,IAAI;cAC5E,YAAY,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,0CAA0C,CAAC,cAAc,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,CAAC,IAAwB,EAAsB,EAAE,CAClE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1F,MAAM,MAAM,GAAG,CAAC,IAAwB,EAAE,KAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5G,OAAO;QACL,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5F,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,8BAA8B,CAAC,KAAoC;IAC1E,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,4BAA4B,CAAC,oBAAoB,CAAC;QACvD,KAAK,4BAA4B,CAAC,cAAc,CAAC;QACjD,KAAK,4BAA4B,CAAC,aAAa,CAAC;QAChD,KAAK,4BAA4B,CAAC,KAAK,CAAC;QACxC,KAAK,4BAA4B,CAAC,gCAAgC;YAChE,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,KAAK,4BAA4B,CAAC,qCAAqC;YACrE,OAAO,IAAI,GAAG,CAAC;gBACb,KAAK,CAAC,qBAAqB,KAAK,mCAAmC,CAAC,eAAe;oBACjF,CAAC,CAAC,kBAAkB;oBACpB,CAAC,CAAC,gBAAgB;aACrB,CAAC,CAAC;QACL,KAAK,4BAA4B,CAAC,iBAAiB;YACjD,8FAA8F;YAC9F,wDAAwD;YACxD,OAAO,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAChC,CAAC;AACH,CAAC","sourcesContent":["/**\n * `SystemOfRecordVendorFacet` — what a VENDOR is, as a system of record.\n *\n * Four concepts carry one job each in this lane (#1049 §4.1, #1055): the **external-data lane** (the\n * engine runtime), a **dialect adapter** (how to speak — `HttpApiTransportDialect`), a **vendor\n * facet** (this module: what the vendor needs to be addressed and believed), and a **system of\n * record** — a named, declared INSTANCE that resources bind by name.\n *\n * ## What a facet is NOT\n *\n * It is not a provider. A provider is selected through a capability plane, may carry a person's\n * lent credential, and has an operation catalogue; a system of record is a named deployment the\n * application reads its own business rows out of, spending its own service identity (D10, D12).\n * Nothing in this module may reach the provider registry, and the reverse import is what\n * `pnpm check:systems-of-record-separation` refuses.\n *\n * It is also not an INSTANCE. The facet says \"an Odoo needs a base URL, a database and a login, and\n * offers the in-args API-key credential\"; it never says WHICH Odoo. Two instances of one vendor\n * (`odoo-fr`, `odoo-de`) share this facet and differ only in their addresses and secrets — which is\n * the whole reason the instance is a separate concept from the vendor.\n *\n * ## Why this lives in `@wildo-ai/saas-models/external-data` (#1055 R2)\n *\n * The obvious home looks like `external-connectors-models`, beside the provider contracts. It\n * cannot be: that package depends only on `zod-decorators` and its own header forbids reaching\n * saas-models, while a facet is typed against `HttpApiTransportDialect`, which lives here. It is\n * also not `ProviderMetadata`-shaped, which is bundle-fenced. So the facet sits beside the binding\n * schema it serves, on the subpath whose two audiences — the app author and the backend — are\n * exactly the audiences a facet has.\n *\n * Note the split with the two VOCABULARIES it names: `HttpApiTransportDialect` and\n * `SystemOfRecordCredentialKind` are root-exported boundary modules, because the root-exported\n * `systemsOfRecord` declaration names them. The SHAPES here are subpath-only, because nothing\n * root-exported names a slot.\n *\n * ## Slots, and why their slugs are lowerCamelCase with nothing else in them\n *\n * A slot's slug becomes half of a derived environment-variable name, `WILDO_SOR_<NAME>__<SLOT>`\n * (#1055 R4). The instance name admits `-` and the slug admits neither `-` nor `_`, so the DOUBLE\n * underscore between them is a delimiter neither half can produce: the pair is recoverable from\n * the variable name, and `odoo-api` + `key` can never collide with `odoo` + `apiKey`. That property\n * is the reason for the regex, so widening it would silently reintroduce the collision.\n *\n * ## Partitioning LANDED in #1058, and was held back until it had a reader\n *\n * The facet is the single partition authority — which remote field carries the tenant, how it is\n * encoded — and that vocabulary arrived with the slice that first READS it. It is `partition`\n * below, and the INSTANCE-side opt-in is now honoured rather than refused at declaration.\n *\n * It was withheld until then on purpose, and the reasoning is kept because it is the general rule:\n * shipping a four-member vocabulary with no reader is the \"declared surface with nothing behind\n * it\" shape this repository keeps paying for. It landed additively, as an OPTIONAL field, so every\n * facet written against the earlier shape still parses.\n */\n// Side-effect import: this module calls `.systemEnum()` at load, so the decorators must be installed first —\n// never by the importer's luck (#966). A named import used only as a type would be elided and install nothing.\nimport '@wildo-ai/zod-decorators';\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\nimport { HttpApiKeyComponentCodec } from '../http-api-binding/http-api-binding.shared.schemas';\nimport { ExternalDataIncrementalExtractionMode } from '../external-data/external-data-pipeline.shared.schemas';\nimport { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';\nimport { SystemOfRecordActionCallShape, SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT } from './system-of-record-actions.shared.schemas';\nimport { SystemOfRecordErrorCode } from './system-of-record-error-codes.shared';\nimport { SYSTEM_OF_RECORD_ENABLED_SLOT, SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN, deriveSystemOfRecordEnabledEnvVarName } from './system-of-record-env.shared';\n\n/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */\n\n/**\n * One input an instance must supply — an address slot (non-secret, authored in the infra env\n * config) or a secret slot (authored in `secrets.json`). Both halves share this shape because both\n * derive an environment-variable name the same way; what differs is WHERE the value is authored and\n * whether it is ever printed.\n */\nexport const SystemOfRecordSlotSchema = z.strictObject({\n  /**\n   * lowerCamelCase, and nothing else — see the module header. Becomes the `<SLOT>` half of\n   * `WILDO_SOR_<NAME>__<SLOT>` by upper-snake-casing.\n   */\n  slug: z\n    .string()\n    .regex(SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN, 'A slot slug is lowerCamelCase with no separators.')\n    .max(40)\n    .refine((slug) => slug !== SYSTEM_OF_RECORD_ENABLED_SLOT, {\n      error:\n        `\"${SYSTEM_OF_RECORD_ENABLED_SLOT}\" is reserved: the environment builder emits `\n        + `${deriveSystemOfRecordEnabledEnvVarName('example')} itself to say an environment has no access to an instance. `\n        + 'A slot of that name would make \"declared absent\" indistinguishable from an address whose value happens to be false.',\n    }),\n  /**\n   * Whether an instance MUST supply it. A missing required slot refuses at `wildo config sync` and\n   * again at boot (#1055 E4) — the remedy is authoring a value, which needs no running companion,\n   * so refusing is legitimate there.\n   */\n  required: z.boolean(),\n  /** What an operator must put in it. Printed by sync and by the secrets report. */\n  description: z.string().min(1),\n});\nexport type SystemOfRecordSlot = z.infer<typeof SystemOfRecordSlotSchema>;\n\n/**\n * A slot list that cannot be order-dependent or ambiguous: sorted by slug, slugs unique.\n *\n * Mirrors `ProviderSecretContractShapeSchema`, and for the same reason — these lists are compared,\n * reported and (once #1057 lands) contributed by independently-versioned packages, so two facets\n * declaring the same slots in different orders must not be two different things.\n */\nconst systemOfRecordSlotListSchema = (label: string) =>\n  z.array(SystemOfRecordSlotSchema).superRefine((slots, context) => {\n    const seen = new Set<string>();\n    for (const [index, slot] of slots.entries()) {\n      if (seen.has(slot.slug)) {\n        context.addIssue({ code: 'custom', path: [index, 'slug'], message: `Duplicate ${label} slot \"${slot.slug}\".` });\n      }\n      seen.add(slot.slug);\n      if (index > 0 && slots[index - 1]!.slug.localeCompare(slot.slug) >= 0) {\n        context.addIssue({ code: 'custom', path: [index, 'slug'], message: `${label} slots must be sorted by slug.` });\n      }\n    }\n  });\n\n/**\n * What ONE credential kind needs, independent of vendor (#1055 R15).\n *\n * The kind owns its secrets and any address slot that exists only because the kind was chosen — a\n * future `OAUTH2_CLIENT_CREDENTIALS` owns `tokenUrl`, which no vendor would declare if it were\n * reached with a static key. `ODOO_API_KEY_IN_ARGS` needs no address slot of its own, and that is\n * the seam rather than an omission: its `database` and `login` inputs identify WHICH Odoo and WHICH\n * user, so they belong to the vendor and would survive a second Odoo credential kind.\n */\nexport const SystemOfRecordCredentialKindContractSchema = z.strictObject({\n  addressSlots: systemOfRecordSlotListSchema('credential address'),\n  secretSlots: systemOfRecordSlotListSchema('credential secret'),\n});\nexport type SystemOfRecordCredentialKindContract = z.infer<typeof SystemOfRecordCredentialKindContractSchema>;\n\n/**\n * Every credential kind's inputs. Engine-owned and CLOSED, keyed by the enum so a member added\n * without a contract is a compile error rather than a boot surprise.\n *\n * ## Which half a slot lands in, since the answer is not \"is it secret\"\n *\n * The split follows the precedent #1055 set with Odoo's `login`: **an identity slot is an ADDRESS\n * slot and a proof slot is a SECRET slot.** A `clientId` and a BASIC `username` are not\n * confidential — they name WHICH client and WHICH user — and putting them in `secrets.json` would\n * hide, from every diff and every environment review, the one thing an operator most often needs to\n * check. What must never be printed is the half that PROVES the identity.\n *\n * The consequence is that a credential's two halves are authored in two files. That is deliberate\n * and it is the same shape Odoo already has (`login` in the infra config, `apiKey` in the secrets),\n * so an operator meets one convention rather than two.\n *\n * ## Required-ness that a static list cannot express\n *\n * Three slots are declared `required: false` here and are made required by the FACET's offer, which\n * is the only place that knows: `certificateKeyId` when the vendor's assertion header policy is\n * {@link SystemOfRecordAssertionHeaderPolicy.KEY_ID_SUPPLIED}, `certificatePem` when it is\n * `X509_THUMBPRINT_DERIVED`, and `subject` for the JWT-bearer grant's `sub`. The join is performed\n * ONCE, in {@link resolveSystemOfRecordInstanceSlots}, rather than by each of the five readers of\n * \"what does this instance need\" — which is the enumeration failure\n * `invariant-call-site-enumeration.md` exists to stop.\n */\nexport const SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS: Readonly<Record<SystemOfRecordCredentialKind, SystemOfRecordCredentialKindContract>> = {\n  [SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS]: {\n    addressSlots: [],\n    secretSlots: [\n      {\n        slug: 'apiKey',\n        required: true,\n        description:\n          'Odoo external-API key (Settings → Users → API Keys). It replaces the password in '\n          + '`common.authenticate` and rides as a positional argument of every `execute_kw` call.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.API_KEY_HEADER]: {\n    addressSlots: [],\n    secretSlots: [\n      {\n        slug: 'apiKey',\n        required: true,\n        description:\n          'The static key this deployment presents. It travels in the header the vendor facet names — '\n          + 'the operator never chooses the header, only supplies the key.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.API_KEY_QUERY]: {\n    addressSlots: [],\n    secretSlots: [\n      {\n        slug: 'apiKey',\n        required: true,\n        description:\n          'The static key this deployment presents, appended as the query parameter the vendor facet '\n          + 'names. Weaker than a header — a URL reaches access logs and proxy logs — so prefer a '\n          + 'header kind when the vendor offers one.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.BASIC]: {\n    addressSlots: [\n      {\n        slug: 'username',\n        required: true,\n        description:\n          'The user this deployment authenticates as (SAP calls it a communication user). It names an '\n          + 'identity rather than proving one, so it is authored in the environment config beside the '\n          + 'base URL. It may not contain \":\" — RFC 7617 makes the colon the delimiter.',\n      },\n    ],\n    secretSlots: [\n      { slug: 'password', required: true, description: \"That user's password. Half of one credential; rotate it with the username only if the vendor requires.\" },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET]: {\n    addressSlots: [\n      { slug: 'audience', required: false, description: 'The `audience` / `resource` parameter, when the vendor requires one to scope the token (Entra names the resource; Salesforce does not).' },\n      { slug: 'clientId', required: true, description: 'The registered application (client) id. Names WHICH client, so it is addressing rather than proof.' },\n      { slug: 'scope', required: false, description: 'Space-delimited scopes to request. Omitted when the vendor derives them from the client registration.' },\n      { slug: 'tokenUrl', required: true, description: \"The token endpoint's absolute URL. Kind-owned: no vendor would declare it if the instance were reached with a static key.\" },\n    ],\n    secretSlots: [\n      { slug: 'clientSecret', required: true, description: 'The client secret issued with the client id. This is the half that proves the identity, and the only half that is never printed.' },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE]: {\n    addressSlots: [\n      { slug: 'audience', required: false, description: 'The `audience` / `resource` parameter when the vendor requires one.' },\n      {\n        slug: 'certificateKeyId',\n        required: false,\n        description:\n          'The key id the vendor assigned to this certificate, placed in the assertion\\'s protected '\n          + 'header as `kid` (NetSuite issues one at upload). REQUIRED when the vendor facet declares '\n          + 'the key-id header policy; unused otherwise.',\n      },\n      {\n        slug: 'certificatePem',\n        required: false,\n        description:\n          'The PUBLIC certificate in PEM, used to derive the `x5t` thumbprint the assertion header '\n          + 'carries. REQUIRED when the vendor facet declares the thumbprint header policy; unused '\n          + 'otherwise. Public material, so it is an address slot rather than a secret.',\n      },\n      { slug: 'clientId', required: true, description: 'The registered application (client) id — the assertion\\'s `iss` and `sub`.' },\n      { slug: 'scope', required: false, description: 'Space-delimited scopes to request.' },\n      { slug: 'tokenUrl', required: true, description: \"The token endpoint's absolute URL, and the assertion's `aud`.\" },\n    ],\n    secretSlots: [\n      {\n        slug: 'privateKeyPem',\n        required: true,\n        description:\n          'The UNENCRYPTED PKCS#8 private key, in PEM, that signs the client assertion. An '\n          + 'encrypted key is refused by name: the secret channel is the protection, and a passphrase '\n          + 'stored beside the key it protects protects nothing.',\n      },\n    ],\n  },\n\n  [SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER]: {\n    addressSlots: [\n      { slug: 'audience', required: false, description: 'The assertion\\'s `aud`, when it differs from the token endpoint (Salesforce wants the login host).' },\n      { slug: 'clientId', required: true, description: 'The connected app\\'s consumer key — the assertion\\'s `iss`.' },\n      { slug: 'scope', required: false, description: 'Space-delimited scopes to request.' },\n      {\n        slug: 'subject',\n        required: false,\n        description:\n          'The user the assertion is made FOR — its `sub`. REQUIRED for this grant and declared '\n          + 'optional here only because the facet\\'s offer is what asserts it; a service account\\'s '\n          + 'username on the vendor side.',\n      },\n      { slug: 'tokenUrl', required: true, description: \"The token endpoint's absolute URL.\" },\n    ],\n    secretSlots: [\n      { slug: 'privateKeyPem', required: true, description: 'The UNENCRYPTED PKCS#8 private key, in PEM, that signs the assertion. An encrypted key is refused by name.' },\n    ],\n  },\n};\n\n/**\n * How a vendor wants a client assertion's PROTECTED HEADER built (#1056 R2).\n *\n * A generic \"sign it with the private key\" is rejected by both vendors that want an assertion, and\n * they want DIFFERENT things — which is why this is a facet policy rather than an engine constant.\n */\nexport enum SystemOfRecordAssertionHeaderPolicy {\n  /** `kid` carries a key id the VENDOR assigned when the certificate was uploaded (NetSuite). */\n  KEY_ID_SUPPLIED = 'key-id-supplied',\n  /**\n   * `x5t` carries the base64url SHA-1 thumbprint of the certificate, DERIVED by the engine from the\n   * supplied `certificatePem` (Microsoft Entra's certificate credential).\n   *\n   * SHA-1 is not a security choice here: `x5t` is defined as a SHA-1 thumbprint (RFC 7515 §4.1.7)\n   * and is an identifier for locating a key, never an integrity proof.\n   * spec-cite: RFC 7515 §4.1.7 (\"x5t\" (X.509 Certificate SHA-1 Thumbprint) Header Parameter).\n   */\n  X509_THUMBPRINT_DERIVED = 'x509-thumbprint-derived',\n}\n\n/**\n * Where a client's id and secret travel on a client-credentials token request.\n *\n * RFC 6749 §2.3.1 permits BOTH and says a server MUST support the Basic header while it MAY support\n * the body form — and real vendors differ, so the choice cannot be an engine default.\n * spec-cite: RFC 6749 §2.3.1 (Client Password).\n */\nexport enum SystemOfRecordClientAuthenticationPlacement {\n  /** `client_id` and `client_secret` as form fields in the request body. */\n  REQUEST_BODY = 'request-body',\n  /** `Authorization: Basic base64(client_id \":\" client_secret)`. */\n  BASIC_HEADER = 'basic-header',\n}\n\n/**\n * The algorithms an assertion may be signed with. Asymmetric ONLY, and that is the point: a\n * symmetric `HS*` assertion is signed with a shared secret, which makes the assertion no stronger\n * than the secret it was supposed to replace, and `none` is not an algorithm.\n */\nexport enum SystemOfRecordAssertionSigningAlgorithm {\n  RS256 = 'RS256',\n  RS384 = 'RS384',\n  RS512 = 'RS512',\n  PS256 = 'PS256',\n  ES256 = 'ES256',\n  ES384 = 'ES384',\n  ES512 = 'ES512',\n}\n\n/**\n * How long to treat a token as valid when the answer carries no `expires_in` (#1056 R3).\n *\n * A FACET property rather than a per-kind engine constant, because two vendors of the SAME kind\n * disagree: NetSuite's answer states `expires_in` is always 3600, while Salesforce's\n * client-credentials answer is reported to omit it. A per-kind constant would have to be wrong for\n * one of them.\n */\nconst tokenLifetimeFallbackSecondsSchema = z.number().int().min(30).max(86_400);\n\n/**\n * ONE credential kind as ONE vendor offers it — the kind, plus everything about it that varies by\n * VENDOR and not by deployment.\n *\n * A discriminated union rather than a kind list beside a policy map, so a policy cannot exist\n * without its kind and a kind cannot be offered without the policy it needs. `API_KEY_HEADER` with\n * no header name is unrepresentable here; under a parallel map it would parse and fail at the first\n * read.\n */\nexport const SystemOfRecordCredentialOfferSchema = z.discriminatedUnion('kind', [\n  z.strictObject({ kind: z.literal(SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS).systemEnum('SystemOfRecordCredentialKind') }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.API_KEY_HEADER).systemEnum('SystemOfRecordCredentialKind'),\n    /** The header the key travels in — `Authorization`, `X-API-Key`, `apikey`, whatever the vendor reads. */\n    headerName: z.string().regex(/^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/, 'A header name is an RFC 9110 token.').max(64),\n    /** What precedes the key in the header value, INCLUDING its trailing space (`\"Bearer \"`). Omitted when the key stands alone. */\n    valuePrefix: z.string().max(32).optional(),\n  }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.API_KEY_QUERY).systemEnum('SystemOfRecordCredentialKind'),\n    /** The query parameter the key is appended as. */\n    parameterName: z.string().regex(/^[A-Za-z0-9_.-]+$/, 'A query parameter name is alphanumeric with -._').max(64),\n  }),\n\n  z.strictObject({ kind: z.literal(SystemOfRecordCredentialKind.BASIC).systemEnum('SystemOfRecordCredentialKind') }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET).systemEnum('SystemOfRecordCredentialKind'),\n    clientAuthentication: z.enum(SystemOfRecordClientAuthenticationPlacement),\n    tokenLifetimeFallbackSeconds: tokenLifetimeFallbackSecondsSchema,\n  }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE).systemEnum('SystemOfRecordCredentialKind'),\n    assertionHeaderPolicy: z.enum(SystemOfRecordAssertionHeaderPolicy),\n    assertionSigningAlgorithm: z.enum(SystemOfRecordAssertionSigningAlgorithm),\n    /** How long the ASSERTION is valid — minutes, not hours; it is consumed once at the token endpoint. */\n    assertionLifetimeSeconds: z.number().int().min(30).max(600),\n    tokenLifetimeFallbackSeconds: tokenLifetimeFallbackSecondsSchema,\n  }),\n\n  z.strictObject({\n    kind: z.literal(SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER).systemEnum('SystemOfRecordCredentialKind'),\n    assertionSigningAlgorithm: z.enum(SystemOfRecordAssertionSigningAlgorithm),\n    assertionLifetimeSeconds: z.number().int().min(30).max(600),\n    tokenLifetimeFallbackSeconds: tokenLifetimeFallbackSecondsSchema,\n  }),\n]);\nexport type SystemOfRecordCredentialOffer = z.infer<typeof SystemOfRecordCredentialOfferSchema>;\n\n/**\n * How a vendor's OData service pages a COLLECTION READ (#1292).\n *\n * A vendor property rather than a dialect constant, and the reason is one large implementation: the\n * Microsoft Dataverse Web API refuses `$skip` outright, while OData v4 defines it and a conformant\n * service serves it. A per-dialect default would have to be wrong for one of them — the same\n * argument #1056 R3 settled for the token-lifetime fallback.\n *\n * spec-cite: OData Version 4.01 Part 1: Protocol §11.2.6 (\"$top and $skip\") for the default; Microsoft\n * Learn, \"Query data using the Web API\"\n * (https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/query-data-web-api) for\n * the refusal — that page enumerates the query options the Web API does not support.\n */\nexport enum SystemOfRecordODataListPaging {\n  /**\n   * `$top` + `$skip` — one request for any page, which is what a page-numbered contract wants, unless the\n   * service serves fewer rows than `$top` and hands back a continuation: the page is then read to its end\n   * along the continuation (#1998), so the next page's `$skip` does not jump the rows the service held back.\n   *\n   * The default, because it is what OData v4 defines and what an uncatalogued service serves.\n   */\n  SKIP = 'skip',\n  /**\n   * `@odata.nextLink` only: the service hands back a continuation URL and refuses to be addressed by\n   * offset.\n   *\n   * The consequence is structural rather than a detail — a cursor has no page NUMBER, so reaching a page\n   * costs one request per page before it. The engine asks for the page size with `Prefer:\n   * odata.maxpagesize` on v4 (v2 has no such preference, so the service's own size decides) — never with\n   * `$top`, which would cap the whole collection (#1991) — walks forward\n   * counting ROWS rather than links (the service may serve a page size of its own, #1998), and refuses\n   * past a bound rather than pretending otherwise.\n   */\n  NEXT_LINK_ONLY = 'next-link-only',\n}\n\n/**\n * HOW a vendor partitions the data one deployment holds (#1058).\n *\n * Inside ONE corporate, a system of record usually holds several partitions — Odoo companies, SAP\n * company codes, Dynamics business units, NetSuite subsidiaries. They are not tenants: they all\n * belong to the operator, which is why they map onto ORGANIZATION UNITS of the owner organization\n * rather than onto organizations (#1049 Q3).\n */\nexport enum SystemOfRecordPartitionKind {\n  /**\n   * A FIELD on every row carries the partition (Odoo `company_id`, NetSuite `subsidiary`). The only\n   * kind supported today: it is filterable, so the confinement can be PUSHED DOWN and a caller never\n   * receives rows of a partition they may not see.\n   */\n  FIELD = 'field',\n  /**\n   * The partition is a PATH SEGMENT of the request (Business Central's `/companies({id})/customers`).\n   *\n   * Declared so a facet can be HONEST about a vendor this engine cannot confine yet, and refused by\n   * name where a partition is opted into. A path segment is chosen before the request is built, so it\n   * cannot express \"these three companies\" in one read — the confinement would have to fan out into\n   * one request per unit, which is a different mechanism rather than a different predicate.\n   */\n  PATH_SEGMENT = 'path-segment',\n}\n\n/**\n * The SHAPE a partition value arrives in — the difference between a number and a pair.\n *\n * Odoo answers a many2one as `[id, display_name]`: `company_id: [10, \"Acme\"]` on a read, and `false`\n * when unset. A reader that took the whole array as the key would match nothing, and one that took\n * `row.company_id` as a scalar would stamp `\"10,Acme\"`. The shape is declared because the engine\n * cannot tell a pair from a two-element list by looking.\n *\n * spec-cite: Odoo 18.0 developer documentation, \"External API\" — a many2one is returned as an\n * `[id, display_name]` pair under both *Read records* and *Search and read*.\n */\nexport enum SystemOfRecordPartitionValueShape {\n  /** The field holds the key directly (an integer, a GUID, a string). */\n  SCALAR = 'scalar',\n  /** Odoo's many2one: `[id, label]`, and `false` when unset. The id is the key. */\n  MANY2ONE_PAIR = 'many2one-pair',\n}\n\n/**\n * What a vendor's partitioning IS — declared by the FACET, opted into by the INSTANCE.\n *\n * The split is the same one every other vendor fact takes: how a vendor partitions is a property of\n * the vendor, and WHETHER this deployment's data is partitioned is a property of the deployment. A\n * single-company Odoo has a `company_id` on every row and nothing to confine.\n */\nexport const SystemOfRecordPartitionSupportSchema = z.strictObject({\n  kind: z.enum(SystemOfRecordPartitionKind),\n  /** The remote field carrying the partition key (`company_id`, `subsidiary`, `CompanyCode`). */\n  remoteField: z.string().min(1).max(120),\n  /**\n   * How a key is spelled on the wire. Reused from the KEY component vocabulary rather than given its\n   * own: a partition key is addressed exactly as a key component is — decoded from an operator's\n   * authored string, compiled into a remote predicate — and two vocabularies for one job would drift.\n   */\n  codec: z.enum(HttpApiKeyComponentCodec),\n  valueShape: z.enum(SystemOfRecordPartitionValueShape),\n});\nexport type SystemOfRecordPartitionSupport = z.infer<typeof SystemOfRecordPartitionSupportSchema>;\n\n/**\n * A step a vendor requires before it accepts ANY modifying request — a row write or a writing action — beyond the\n * credential every request carries (#1726).\n *\n * Declared by the FACET because it is a fact about the product, and refused at startup by the engine for every step it\n * does not perform (`WRITE_PREREQUISITE_NOT_SUPPORTED`): a write the vendor is known to refuse must not be opened, since\n * it would only surface as a remote `403` at the first request, under a code that names nothing.\n */\nexport enum SystemOfRecordWritePrerequisite {\n  /**\n   * SAP Gateway's cross-site-request-forgery protection: a modifying request must carry an `X-CSRF-Token` obtained by a\n   * prior NON-modifying request sent with `X-CSRF-Token: Fetch`, together with the session cookie that request set.\n   * spec-cite: SAP Help Portal, SAP Gateway Foundation — \"Cross-Site Request Forgery Protection\"\n   * (https://help.sap.com/saphelp_gateway20sp12/helpdata/en/e6/cae27d5e8d4996add4067280c8714e/frameset.htm).\n   */\n  CSRF_TOKEN_HANDSHAKE = 'csrf-token-handshake',\n}\n\n/**\n * The OData v4 control information that carries an entity's ETag in a JSON row (#1726) — the only row version an OData\n * vendor can declare in `rowVersionField`, and the value the OData write dialect sends as `If-Match`.\n *\n * The OData 4.0 spelling. A payload that is not OData-Version 4.0 omits the `odata.` infix (`@etag`); the engine asks\n * for 4.0 on its OData requests (`OData-MaxVersion: 4.0`), so a conformant service answers this spelling. A field MAPPED\n * onto the tag, and a `VERSION_CHECKED` comparison, read this spelling only; the write dialect alone also reads the\n * short form when it derives `If-Match`, which only widens what it can condition on.\n * spec-cite: OData JSON Format Version 4.01 §4.5.10 (Control Information: etag (odata.etag)) and §4.5 (\"In requests and\n * responses with an OData-Version header with a value of 4.0 control information names are prefixed with @odata.\").\n */\nexport const ODATA_ENTITY_TAG_CONTROL_INFORMATION = '@odata.etag';\n\n/**\n * What a vendor is, as a system of record. Parsed rather than trusted because #1057 lets a PACKAGE\n * ship one — a record produced by one package version and read by another.\n */\nexport const SystemOfRecordVendorFacetSchema = z.strictObject({\n  /** The vendor's stable identifier, named by an instance's `vendor`. Same charset law as an instance name. */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n  /**\n   * The dialects this vendor can be READ through. An instance's `dialect` must be one of them, and\n   * a binding's `dialect` must equal its instance's — both refused at boot registration, where the\n   * declaration and the facet are finally in the same scope.\n   */\n  dialects: z.array(z.enum(HttpApiTransportDialect)).min(1),\n  /**\n   * The vendor's own address slots — non-secret, authored per instance in the infra env config. The\n   * base URL is registration-scoped and is never credential material.\n   */\n  addressSlots: systemOfRecordSlotListSchema('vendor address'),\n  /**\n   * The credential kinds this vendor offers, each carrying THIS vendor's policy for it. The instance\n   * chooses one kind; a kind no offer names is refused.\n   *\n   * Reshaped from a bare `credentialKinds: Kind[]` in #1056. A list of kinds could say that a vendor\n   * accepts a header-borne API key and could not say WHICH header — so either the operator was asked\n   * (a question the vendor already answers, `derive-before-you-ask.md`) or the engine guessed. An\n   * offer is the kind and its vendor policy as one indivisible thing.\n   */\n  credentialOffers: z.array(SystemOfRecordCredentialOfferSchema).min(1),\n  /**\n   * How a COLLECTION READ pages against this vendor (#1292). Meaningful only for the OData dialects.\n   *\n   * OPTIONAL rather than defaulted, and the difference is not cosmetic: `.default()` would make the\n   * field REQUIRED on the parsed type, so every facet — Odoo's JSON-RPC included — would have to\n   * state an answer to a question about a dialect it does not speak. Absent means \"not an OData\n   * concern, or the conformant default\", and {@link resolveSystemOfRecordODataListPaging} is the one\n   * place that turns absence into `SKIP`.\n   */\n  odataListPaging: z.enum(SystemOfRecordODataListPaging).optional(),\n  /**\n   * How this vendor partitions one deployment's data (#1058), when it does.\n   *\n   * ABSENT means the vendor has no partition concept the engine can confine on — which is a real\n   * answer rather than an unfinished one, and the reason an instance opting into `partition` against\n   * such a facet is refused by name rather than silently doing nothing.\n   */\n  partition: SystemOfRecordPartitionSupportSchema.optional(),\n  /**\n   * The change-tracking mechanisms this vendor's deployments support, which a pipeline may read\n   * incrementally through (#1682). A pipeline declaring `incremental.mode` outside this list is refused\n   * at startup, naming the vendor.\n   *\n   * A VENDOR property rather than a dialect constant: whether a deployment can say what changed is a\n   * fact about the product (Odoo's ORM stamps `write_date` on every model that logs access; an OData\n   * service may or may not enable change tracking, #1722), not about the wire language.\n   *\n   * ABSENT means none — a real answer: that vendor's pipelines run full passes only.\n   */\n  incrementalExtractionModes: z.array(z.enum(ExternalDataIncrementalExtractionMode)).optional(),\n  /**\n   * The service-defined OData error codes with which this vendor says a tracked change position has EXPIRED (#1722), for a\n   * vendor that answers it with its own code rather than the protocol's `410 Gone` / `404 Not Found`.\n   *\n   * A delta-link pass whose link the vendor no longer honours starts over with a full pass. The protocol names the status\n   * for an expired URL, and the engine recognises it for every vendor; a vendor that answers something else instead\n   * states its code here, so the fallback does not depend on guessing which `400` means \"too old\". Dataverse documents\n   * `0x80044352` (`ExpiredVersionStamp`, \"Please perform a full sync\").\n   *\n   * ABSENT means the vendor answers the protocol's status, or has no change tracking.\n   */\n  odataExpiredChangePositionErrorCodes: z.array(z.string().min(1)).optional(),\n  /**\n   * The ACTION call shapes this vendor's product supports (#1678) — how a declared action is called on it: Odoo's\n   * `execute_kw` on a model method, an OData bound action, an OData unbound action import.\n   *\n   * A VENDOR property, like `partition`: whether a product exposes callable operations beyond row reads is a fact about\n   * the product, and a generic OData service may expose none. A binding declaring an action whose shape its vendor does\n   * not list is refused at boot, naming the vendor. ABSENT means none — the vendor is read (and perhaps written) only.\n   * Each listed shape must be spoken over one of the facet's own `dialects`.\n   */\n  actionCallShapes: z.array(z.enum(SystemOfRecordActionCallShape)).optional(),\n  /**\n   * The remote field this vendor's product maintains on EVERY row as its version — changed by the product itself on every\n   * write, never by a caller (#1724, #1726). Odoo: `write_date`, the ORM's \"Last Updated on\". An OData v4 vendor that\n   * serves entity tags: {@link ODATA_ENTITY_TAG_CONTROL_INFORMATION} (`@odata.etag`), and nothing else.\n   *\n   * A binding may declare `writeConcurrency: VERSION_CHECKED` only against a vendor that names one, and only with a\n   * version field that maps onto it (refused at boot, `WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR`). The engine then\n   * compares the version a caller read with the one it reads just before the write.\n   *\n   * ## What that comparison is worth depends on the DIALECT, not on this field\n   *\n   * - **Odoo (best-effort).** Its external API has no conditional write — `write(ids, vals)` applies the values, with no\n   *   precondition — so the comparison and the write are two separate calls, and a change landing between them is\n   *   overwritten. The check NARROWS the lost-update window to the gap between two calls; it does not close it.\n   * - **OData v4 (atomic).** The OData write dialect sends the version as `If-Match` on the `PATCH` or `DELETE`, and the\n   *   service itself refuses a mismatch with `412 Precondition Failed` and applies nothing. The engine's comparison\n   *   before sending is then only a fast refusal; the guarantee is the vendor's.\n   *   spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match) — \"the service MUST respond with 412\n   *   Precondition Failed and MUST ensure that no observable change occurs as a result of the request\".\n   *\n   * Declaring it for an OData vendor is also what lets its writes send the row's own entity tag rather than `*`: the\n   * write dialect reads `@odata.etag` from the row it reads first, so a row moved (into another partition, say) between\n   * that read and the write is refused by the vendor instead of written.\n   *\n   * A VENDOR property, like `incrementalExtractionModes`: whether a product maintains a per-row version is a fact about the\n   * product. ABSENT means none, and a binding against such a vendor states `LAST_WRITER_WINS` instead.\n   */\n  rowVersionField: z.string().min(1).max(120).optional(),\n  /**\n   * What this vendor requires before any modifying request (#1726) — see {@link SystemOfRecordWritePrerequisite}. ABSENT\n   * means nothing beyond the credential. A binding opening writes against a vendor listing a step the engine does not\n   * perform is refused at startup.\n   */\n  writePrerequisites: z.array(z.enum(SystemOfRecordWritePrerequisite)).optional(),\n}).superRefine((facet, context) => {\n  /*\n   * #1726 — over OData the row version IS the entity tag: it is what `If-Match` carries and what the service compares.\n   * A property value (a `modifiedon` column, a `RowVersion` field) is not an ETag, and sending one as `If-Match` would\n   * be refused as a mismatch on every write — so an OData vendor names the entity tag or nothing.\n   */\n  if (facet.rowVersionField !== undefined && facet.dialects.includes(HttpApiTransportDialect.ODATA)\n    && facet.rowVersionField !== ODATA_ENTITY_TAG_CONTROL_INFORMATION) {\n    context.addIssue({\n      code: 'custom',\n      path: ['rowVersionField'],\n      message: `An OData vendor's row version is its entity tag, \"${ODATA_ENTITY_TAG_CONTROL_INFORMATION}\" — got \"${facet.rowVersionField}\".`,\n    });\n  }\n  // #1678 — a call shape is spoken over one dialect; listing a shape over a dialect the vendor is not read through would\n  // advertise an action no instance of it could ever reach.\n  for (const [index, shape] of (facet.actionCallShapes ?? []).entries()) {\n    if (!facet.dialects.includes(SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT[shape])) {\n      context.addIssue({\n        code: 'custom',\n        path: ['actionCallShapes', index],\n        message: `Action call shape \"${shape}\" is spoken over ${SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_DIALECT[shape]}, which this vendor's dialects do not list.`,\n      });\n    }\n  }\n  // #1722 — an expired-position code is read only by a delta-link pass, so a vendor listing one without that mode states a\n  // fact nothing could ever consult.\n  if (facet.odataExpiredChangePositionErrorCodes !== undefined\n    && !(facet.incrementalExtractionModes ?? []).includes(ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK)) {\n    context.addIssue({\n      code: 'custom',\n      path: ['odataExpiredChangePositionErrorCodes'],\n      message: `An expired change-position code is read only by the \"${ExternalDataIncrementalExtractionMode.ODATA_DELTA_LINK}\" mode, which this vendor's incrementalExtractionModes do not list.`,\n    });\n  }\n  const seenDialects = new Set<string>();\n  for (const [index, dialect] of facet.dialects.entries()) {\n    if (seenDialects.has(dialect)) {\n      context.addIssue({ code: 'custom', path: ['dialects', index], message: `Duplicate dialects member \"${dialect}\".` });\n    }\n    seenDialects.add(dialect);\n  }\n\n  // One vendor may not offer the same kind twice: the instance names a KIND, so two offers of one\n  // kind would make the policy the engine reads depend on array order.\n  const seenKinds = new Set<string>();\n  for (const [index, offer] of facet.credentialOffers.entries()) {\n    if (seenKinds.has(offer.kind)) {\n      context.addIssue({ code: 'custom', path: ['credentialOffers', index], message: `Duplicate credentialOffers member \"${offer.kind}\".` });\n    }\n    seenKinds.add(offer.kind);\n  }\n\n  // A vendor address slug that a kind also declares would make the derived environment variable\n  // ambiguous about who owns the value, so the two namespaces are checked against each other here\n  // rather than at the instance, where the failure would read as an authoring mistake.\n  const vendorSlugs = new Set(facet.addressSlots.map((slot) => slot.slug));\n  for (const offer of facet.credentialOffers) {\n    for (const slot of SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS[offer.kind].addressSlots) {\n      if (vendorSlugs.has(slot.slug)) {\n        context.addIssue({\n          code: 'custom',\n          path: ['addressSlots'],\n          message: `Address slot \"${slot.slug}\" is declared by this vendor AND by credential kind \"${offer.kind}\" — one slot has one owner.`,\n        });\n      }\n    }\n  }\n});\nexport type SystemOfRecordVendorFacet = z.infer<typeof SystemOfRecordVendorFacetSchema>;\n\n/**\n * The export a package's `./systems-of-record` module presents: a record of facets keyed by vendor id. The\n * backend's facet resolver and `wildo secrets` (which lists the credential slots an instance needs) both read\n * a facet module through this name, so it is declared once, beside the shape it carries.\n */\nexport const SYSTEM_OF_RECORD_FACET_RECORD_EXPORT = 'PROVIDER_CATALOGUE_SYSTEM_OF_RECORD_FACETS';\n\n/** The subpath a package exports its facet module under: `<package>/systems-of-record`. */\nexport const SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH = '/systems-of-record';\n/** @wildo_source:part:end saas.models.systems-of-record */\n\n/**\n * The specifier of `packageName`'s facet module. ONE spelling for the backend's resolver, `wildo secrets` and the\n * discovery that records the modules, so the three cannot disagree about where a package's facets live (#1675).\n */\nexport function systemOfRecordFacetModuleSpecifier(packageName: string): string {\n  return `${packageName}${SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH}`;\n}\n\n/** The package a facet module specifier belongs to: `@acme/erp/systems-of-record` → `@acme/erp`. */\nexport function packageOfSystemOfRecordFacetModule(specifier: string): string {\n  return specifier.endsWith(SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH) ? specifier.slice(0, -SYSTEM_OF_RECORD_FACET_MODULE_SUBPATH.length) : specifier;\n}\n\n/** A vendor's BASE facet as one source presents it, before it is chosen. */\nexport interface SystemOfRecordBaseFacetCandidate {\n  /** Who presents it: `the engine`, `package @wildo-ai/systems-of-record`. */\n  readonly source: string;\n  /** The facet as presented — parsed here, since it was produced by one package version and is read by another. */\n  readonly raw: unknown;\n}\n\nexport type SystemOfRecordBaseFacetSelection =\n  | { readonly facet: SystemOfRecordVendorFacet; readonly source: string }\n  | { readonly conflict: string; readonly detail: Readonly<Record<string, unknown>> };\n\n/**\n * The ONE base facet for a vendor, or a refusal naming both sources when two present one (#1675).\n *\n * Refused rather than \"the first in authority order wins\": a base facet carries the vendor's partition, and module\n * order is the sorted order of discovered package names, so which package's partition confined a tenant's rows would\n * otherwise depend on how two names sort — and a newly installed package could replace the library's facet with\n * no opt-in at all. A package that knows more about a vendor it does not own ADDS to the base through an augmentation\n * an instance opts into; it never presents a second base.\n *\n * `undefined` when no source presents the vendor — the caller's own refusal names the vendor.\n *\n * assurance-control: WILDO.DATA.TENANT_ISOLATION WILDO.SECURITY.FAIL_CLOSED — two base facets for one vendor refuse,\n * so a tenant-confinement declaration never comes from whichever of two packages sorts first.\n */\nexport function selectSystemOfRecordBaseFacet(input: {\n  readonly vendor: string;\n  readonly candidates: readonly SystemOfRecordBaseFacetCandidate[];\n}): SystemOfRecordBaseFacetSelection | undefined {\n  const [first, second] = input.candidates;\n  if (first === undefined) return undefined;\n  if (second !== undefined) {\n    return {\n      conflict: `Vendor '${input.vendor}' has two base facets: from ${first.source} and from ${second.source}. One source owns a `\n        + 'vendor\\'s facet; a package that adds to it ships an augmentation (`PROVIDER_CATALOGUE_SYSTEM_OF_RECORD_FACET_AUGMENTATIONS`) '\n        + 'an instance opts into. Uninstall one of the two, or have it ship an augmentation instead.',\n      detail: { vendor: input.vendor, sources: input.candidates.map((candidate) => candidate.source) },\n    };\n  }\n  return { facet: SystemOfRecordVendorFacetSchema.parse(first.raw), source: first.source };\n}\n\n/** @wildo_source:part:start saas.models.systems-of-record.facet-augmentation facet:kind:api facet:audience:app-developer */\n/**\n * What a package ADDS to a vendor facet it does not own (#1675) — the facet counterpart of a provider\n * augmentation (#1672), with its own code path.\n *\n * One base facet per vendor answers — the one package module that presents it; two refuse, naming both. An\n * augmentation adds to it: a PARTITION declaration for a vendor whose base declares none (say a `company_id`\n * FIELD every row of an ERP carries, shipped by a package that knows the vendor better), or further\n * CREDENTIAL OFFERS. It never replaces or removes anything the base declares — two declarations of one\n * partition, or one credential kind offered twice, refuse at startup naming both sources.\n *\n * Only a FIELD partition can be confined. A PATH-SEGMENT partition (a company chosen in the request path) is\n * refused when an instance sets `partition: true`, augmented or not, because nothing narrows a read the path\n * already scoped — so augmenting one declares something no instance can use.\n *\n * INERT until an instance opts in: `systemsOfRecord.<name>.facetAugmentations` names the PACKAGES whose\n * augmentation applies to that instance. The facet is the single partition authority, so a partition\n * arriving from a package is a tenant-confinement change and is never applied because a package happens\n * to be installed.\n *\n * A package presents its augmentations beside its facets, from its `./systems-of-record` export, as a\n * record keyed by vendor id under {@link SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT}. A package\n * may ship augmentations and no facet at all. Its module is found the way every facet module is: by the\n * provider discovery walk `wildo config sync` runs, which reads the framework's names, the application's own\n * scope, and any package the application lists in `providers.packages` (#1676). Listing ADMITS the package;\n * an instance's opt-in ACTIVATES its augmentation. A package the walk did not record is refused by name.\n *\n * Entity descriptions are not augmentable: the facet declares none today, so there is nothing to add to.\n */\nexport const SystemOfRecordVendorFacetAugmentationSchema = z.strictObject({\n  /** The vendor this augments — must equal the key it is recorded under. */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n  /** A partition declaration for a vendor whose base facet declares none. */\n  partition: SystemOfRecordPartitionSupportSchema.optional(),\n  /** Credential kinds the base facet does not offer, each with this vendor's policy for it. */\n  credentialOffers: z.array(SystemOfRecordCredentialOfferSchema).min(1).optional(),\n}).superRefine((augmentation, context) => {\n  if (augmentation.partition === undefined && augmentation.credentialOffers === undefined) {\n    context.addIssue({ code: 'custom', path: [], message: 'A facet augmentation that adds nothing is refused: declare a partition, credential offers, or both.' });\n  }\n  const seenKinds = new Set<string>();\n  for (const [index, offer] of (augmentation.credentialOffers ?? []).entries()) {\n    if (seenKinds.has(offer.kind)) {\n      context.addIssue({ code: 'custom', path: ['credentialOffers', index], message: `Duplicate credentialOffers member \"${offer.kind}\".` });\n    }\n    seenKinds.add(offer.kind);\n  }\n});\nexport type SystemOfRecordVendorFacetAugmentation = z.infer<typeof SystemOfRecordVendorFacetAugmentationSchema>;\n\n/** The export a package's `./systems-of-record` module presents its facet augmentations under: a record keyed by vendor id. */\nexport const SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT = 'PROVIDER_CATALOGUE_SYSTEM_OF_RECORD_FACET_AUGMENTATIONS';\n/** @wildo_source:part:end saas.models.systems-of-record.facet-augmentation */\n\n/**\n * Where each thing a RESOLVED facet declares came from, once an instance's opted-in augmentations were applied\n * (#1675). Written only by {@link applySystemOfRecordFacetAugmentations}: a facet a package ships is parsed through\n * a strict schema with no such field, so a package cannot claim to have been augmented, nor attribute a partition\n * to someone else.\n */\nexport interface SystemOfRecordFacetAugmentationProvenance {\n  /** The package whose augmentation declared the instance's partition. */\n  readonly partition?: string;\n  /** Credential kind → the package whose augmentation offered it. */\n  readonly credentialKinds: Readonly<Record<string, string>>;\n}\n\n/** Why an instance's opted-in augmentations cannot be applied. */\nexport enum SystemOfRecordFacetAugmentationRefusalKind {\n  /** A package the instance opted in ships no augmentation for its vendor. */\n  NOT_FOUND = 'not-found',\n  /** Two sources declare the same partition or credential kind. */\n  CONFLICT = 'conflict',\n  /** An augmentation, or the facet it produces once merged, fails the facet schema. */\n  INVALID = 'invalid',\n}\n\nexport type SystemOfRecordFacetAugmentationResult =\n  | { readonly facet: SystemOfRecordVendorFacet; readonly augmentedBy: SystemOfRecordFacetAugmentationProvenance }\n  | { readonly refusal: SystemOfRecordFacetAugmentationRefusalKind; readonly message: string; readonly detail: Readonly<Record<string, unknown>> };\n\n/**\n * Folds an instance's opted-in augmentations into its base facet — and refuses, naming both sources, the moment two\n * of them declare the same thing. ONE implementation for the backend's facet resolver and `wildo secrets`, so a\n * listing cannot ask for a credential the backend would refuse, or miss one an augmentation offers.\n *\n * `augmentations` is in the instance's declared opt-in order; each `raw` is what the package's module presents under\n * {@link SYSTEM_OF_RECORD_FACET_AUGMENTATION_RECORD_EXPORT} for this vendor (`undefined` when it presents none),\n * parsed here like a facet because it was produced by one package version and is read by another.\n *\n * assurance-control: WILDO.DATA.TENANT_ISOLATION WILDO.SECURITY.FAIL_CLOSED — a partition declaration (how a tenant's\n * rows are confined) is admitted from a package only when the instance opted that package in, only for a vendor whose\n * base facet declares none, never twice, and every admitted one is recorded with the package that contributed it.\n */\nexport function applySystemOfRecordFacetAugmentations(input: {\n  readonly vendor: string;\n  readonly base: { readonly facet: SystemOfRecordVendorFacet; readonly source: string };\n  readonly augmentations: ReadonlyArray<{\n    readonly packageName: string;\n    readonly raw: unknown;\n    /**\n     * Why the package's facet module could not be read at all — it was not discovered, or its import failed — named in\n     * the NOT_FOUND refusal, never swallowed. A full clause, since the reader supplies the remedy it knows.\n     */\n    readonly unreadable?: string;\n  }>;\n}): SystemOfRecordFacetAugmentationResult {\n  const { vendor, base } = input;\n  let partition = base.facet.partition;\n  let partitionSource: string | undefined = partition === undefined ? undefined : base.source;\n  let augmentedPartitionPackage: string | undefined;\n  const credentialOffers = [...base.facet.credentialOffers];\n  const offerSources = new Map<string, string>(base.facet.credentialOffers.map((offer) => [offer.kind, base.source]));\n  const augmentedKinds: Record<string, string> = {};\n\n  for (const { packageName, raw, unreadable } of input.augmentations) {\n    if (raw === undefined) {\n      return {\n        refusal: SystemOfRecordFacetAugmentationRefusalKind.NOT_FOUND,\n        message: unreadable === undefined\n          ? `Package ${packageName} is opted in to augment vendor '${vendor}' and ships no augmentation for it — its `\n            + '`./systems-of-record` module augments other vendors only.'\n          : `Package ${packageName} is opted in to augment vendor '${vendor}', and its facet module `\n            + `${systemOfRecordFacetModuleSpecifier(packageName)} could not be read: ${unreadable}.`,\n        detail: { vendor, packageName, ...(unreadable === undefined ? {} : { unreadable }) },\n      };\n    }\n    const parsed = SystemOfRecordVendorFacetAugmentationSchema.safeParse(raw);\n    if (!parsed.success) {\n      return {\n        refusal: SystemOfRecordFacetAugmentationRefusalKind.INVALID,\n        message: `Package ${packageName}'s augmentation of vendor '${vendor}' is malformed: ${z.prettifyError(parsed.error)}`,\n        detail: { vendor, packageName },\n      };\n    }\n    const augmentation = parsed.data;\n    if (augmentation.vendor !== vendor) {\n      return {\n        refusal: SystemOfRecordFacetAugmentationRefusalKind.NOT_FOUND,\n        message: `Package ${packageName} records an augmentation under vendor '${vendor}' that declares vendor '${augmentation.vendor}'.`,\n        detail: { vendor, packageName, declaredVendor: augmentation.vendor },\n      };\n    }\n    const source = `package ${packageName}`;\n    if (augmentation.partition !== undefined) {\n      if (partitionSource !== undefined) {\n        return {\n          refusal: SystemOfRecordFacetAugmentationRefusalKind.CONFLICT,\n          message: `Vendor '${vendor}' would be partitioned twice: by ${partitionSource} and by ${source}. The facet is the one `\n            + 'authority on how rows are confined — remove one of the two.',\n          detail: { vendor, sources: [partitionSource, source] },\n        };\n      }\n      partition = augmentation.partition;\n      partitionSource = source;\n      augmentedPartitionPackage = packageName;\n    }\n    for (const offer of augmentation.credentialOffers ?? []) {\n      const existing = offerSources.get(offer.kind);\n      if (existing !== undefined) {\n        return {\n          refusal: SystemOfRecordFacetAugmentationRefusalKind.CONFLICT,\n          message: `Vendor '${vendor}' would offer credential kind '${offer.kind}' twice: from ${existing} and from ${source}.`,\n          detail: { vendor, credentialKind: offer.kind, sources: [existing, source] },\n        };\n      }\n      offerSources.set(offer.kind, source);\n      credentialOffers.push(offer);\n      augmentedKinds[offer.kind] = packageName;\n    }\n  }\n\n  // Re-parsed as a whole, so every rule the base schema holds (a kind's slots against the vendor's) holds for the\n  // merged facet too.\n  const merged = SystemOfRecordVendorFacetSchema.safeParse({\n    ...base.facet,\n    credentialOffers,\n    ...(partition === undefined ? {} : { partition }),\n  });\n  if (!merged.success) {\n    const packages = input.augmentations.map((augmentation) => augmentation.packageName);\n    return {\n      refusal: SystemOfRecordFacetAugmentationRefusalKind.INVALID,\n      message: `Vendor '${vendor}''s facet, augmented by ${packages.join(', ')}, is no longer a valid facet: ${z.prettifyError(merged.error)}`,\n      detail: { vendor, packages },\n    };\n  }\n  return {\n    facet: merged.data,\n    augmentedBy: {\n      ...(augmentedPartitionPackage === undefined ? {} : { partition: augmentedPartitionPackage }),\n      credentialKinds: augmentedKinds,\n    },\n  };\n}\n\n/**\n * How this vendor pages an OData collection read — the ONE place an absent declaration becomes an\n * answer (#1292).\n *\n * `$skip` is what OData v4 defines and what a conformant service serves, so silence means the\n * conformant behaviour rather than an unknown. A second `?? SKIP` written at a consumer is how two\n * readers come to disagree about what silence meant.\n */\nexport function resolveSystemOfRecordODataListPaging(facet: SystemOfRecordVendorFacet): SystemOfRecordODataListPaging {\n  return facet.odataListPaging ?? SystemOfRecordODataListPaging.SKIP;\n}\n\n/** Every slot ONE instance must supply, once its facet and its credential kind are both known. */\nexport interface SystemOfRecordInstanceSlots {\n  readonly addressSlots: readonly SystemOfRecordSlot[];\n  readonly secretSlots: readonly SystemOfRecordSlot[];\n}\n\n/**\n * Find the offer a vendor makes for one kind, or `undefined`.\n *\n * Separate from {@link resolveSystemOfRecordInstanceSlots} because the two answer different\n * questions: this one is \"what is this vendor's POLICY for the kind I chose\", which the minter needs\n * at every call, while the slot union is a boot-time question asked once.\n */\nexport function findSystemOfRecordCredentialOffer(\n  facet: SystemOfRecordVendorFacet,\n  credentialKind: SystemOfRecordCredentialKind,\n): SystemOfRecordCredentialOffer | undefined {\n  return facet.credentialOffers.find((offer) => offer.kind === credentialKind);\n}\n\n/**\n * Which credential kind an instance uses — decided ONCE, for the backend registry that enforces it at boot\n * and for `wildo secrets`, which lists the secret slots that kind needs (#1637). Two readers deriving it\n * separately is how a listing comes to ask for a secret the backend will not read.\n *\n * DECLARED when the instance names one the facet offers; DERIVED when the instance names none and the\n * facet offers exactly one, because an author asked to choose between one option is being asked a question\n * the mechanism already holds the answer to (`derive-before-you-ask.md`). Otherwise a refusal, carrying\n * what the facet does offer so the reader can name it: a kind the vendor does not offer, or several on\n * offer and none chosen — the day the author acquires a real decision.\n */\nexport function chooseSystemOfRecordCredentialKind(\n  declaredKind: SystemOfRecordCredentialKind | undefined,\n  facet: SystemOfRecordVendorFacet,\n):\n  | { readonly kind: SystemOfRecordCredentialKind }\n  | { readonly refusal: SystemOfRecordErrorCode.CREDENTIAL_KIND_NOT_OFFERED | SystemOfRecordErrorCode.CREDENTIAL_KIND_AMBIGUOUS; readonly offered: readonly SystemOfRecordCredentialKind[] } {\n  const offered = facet.credentialOffers.map((offer) => offer.kind);\n  if (declaredKind !== undefined) {\n    return offered.includes(declaredKind) ? { kind: declaredKind } : { refusal: SystemOfRecordErrorCode.CREDENTIAL_KIND_NOT_OFFERED, offered };\n  }\n  return offered.length === 1 ? { kind: offered[0]! } : { refusal: SystemOfRecordErrorCode.CREDENTIAL_KIND_AMBIGUOUS, offered };\n}\n\n/**\n * The ONE place the vendor's slots and the credential kind's slots are joined.\n *\n * Every reader of \"what does this instance need\" goes through here — the environment-variable\n * derivation, `wildo config sync`'s coherence check, the k8s secrets generator, the CI collector\n * and the backend registry. Four of those five live in different packages, which is precisely why\n * re-deriving the union at each of them would drift (`invariant-call-site-enumeration.md`).\n *\n * ## It also applies the offer's REQUIRED-NESS, which is why it takes a facet and not a contract\n *\n * Three slots are declared optional in the contract map and become required here, because only the\n * vendor's offer knows: `certificateKeyId` under the key-id assertion header policy, `certificatePem`\n * under the thumbprint policy, and `subject` for the JWT-bearer grant. Declaring them required in the\n * contract would make every certificate vendor supply both halves of a choice only one of them makes;\n * leaving them optional everywhere would let an instance boot with an assertion it cannot build, and\n * fail at the first read instead of at configuration.\n *\n * Throws when the kind is not one the facet offers: that pairing is chosen by an instance and\n * refused where the instance is validated, so reaching here with it means a caller skipped the\n * check rather than an operator wrote something wrong.\n */\nexport function resolveSystemOfRecordInstanceSlots(\n  facet: SystemOfRecordVendorFacet,\n  credentialKind: SystemOfRecordCredentialKind,\n): SystemOfRecordInstanceSlots {\n  const offer = findSystemOfRecordCredentialOffer(facet, credentialKind);\n  if (offer === undefined) {\n    throw new Error(\n      `Vendor \"${facet.vendor}\" does not offer credential kind \"${credentialKind}\" `\n      + `(offers: ${facet.credentialOffers.map((candidate) => candidate.kind).join(', ')}).`,\n    );\n  }\n\n  const contract = SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS[credentialKind];\n  const requiredByOffer = slotSlugsTheOfferMakesRequired(offer);\n  const applyOffer = (slot: SystemOfRecordSlot): SystemOfRecordSlot =>\n    (slot.required || !requiredByOffer.has(slot.slug) ? slot : { ...slot, required: true });\n\n  const bySlug = (left: SystemOfRecordSlot, right: SystemOfRecordSlot) => left.slug.localeCompare(right.slug);\n  return {\n    addressSlots: [...facet.addressSlots, ...contract.addressSlots.map(applyOffer)].sort(bySlug),\n    secretSlots: [...contract.secretSlots.map(applyOffer)].sort(bySlug),\n  };\n}\n\n/**\n * Which otherwise-optional slugs THIS offer turns into obligations.\n *\n * A `switch` over the discriminated union rather than a lookup, so a member added to the union\n * without a decision here is a compile error rather than a slot that silently stays optional.\n */\nfunction slotSlugsTheOfferMakesRequired(offer: SystemOfRecordCredentialOffer): ReadonlySet<string> {\n  switch (offer.kind) {\n    case SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS:\n    case SystemOfRecordCredentialKind.API_KEY_HEADER:\n    case SystemOfRecordCredentialKind.API_KEY_QUERY:\n    case SystemOfRecordCredentialKind.BASIC:\n    case SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET:\n      return new Set();\n    case SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE:\n      return new Set([\n        offer.assertionHeaderPolicy === SystemOfRecordAssertionHeaderPolicy.KEY_ID_SUPPLIED\n          ? 'certificateKeyId'\n          : 'certificatePem',\n      ]);\n    case SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER:\n      // The `sub` of an RFC 7523 §2.1 assertion. Optional in the contract only because the GRANT is\n      // what asserts it — no other kind has a subject at all.\n      return new Set(['subject']);\n  }\n}\n"]}