@wildo-ai/saas-models 1.1.8 → 1.1.10

package/dist/esm/systems-of-record/system-of-record-declaration.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-declaration.shared.schemas.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-declaration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,6GAA6G;AAE7G;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE,qGAAqG;AACrG,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,gCAKX;AALD,WAAY,gCAAgC;IAC1C,sMAAsM;IACtM,qGAAiE,CAAA;IACjE,mJAAmJ;IACnJ,iHAA6E,CAAA;AAC/E,CAAC,EALW,gCAAgC,KAAhC,gCAAgC,QAK3C;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,EAAE;KACR,KAAK,CAAC,6BAA6B,EAAE,sEAAsE,CAAC;KAC5G,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,UAAU,sCAAsC,CAAC,IAAY;IACjE,OAAO,GAAG,6BAA6B,IAAI,IAAI,cAAc,CAAC;AAChE,CAAC;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAExC;;;;;;;;;;;;OAYG;IACH,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErF;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAErE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC;;;;;;;;;;;;OAYG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CACnE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EACxD,iDAAiD,CAClD,CAAC,QAAQ,EAAE;IAEZ;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC,wBAAwB,EAAE,+BAA+B,CAAC;KACjE,WAAW,CAAC,CAAC,eAAe,EAAE,GAAG,EAAE,EAAE;IACpC,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,2GAA2G;kBACzG,iCAAiC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,2DAA2D","sourcesContent":["/**\n * `systemsOfRecord` — the application's declared INSTANCES of the systems it reads its own business\n * rows out of.\n *\n * ```ts\n * systemsOfRecord: {\n *   odoo: { vendor: 'odoo', dialect: HttpApiTransportDialect.ODOO_JSONRPC },\n * }\n * ```\n *\n * ## The name is the whole point\n *\n * Before this, a resource addressed a remote system by `httpApiBinding.providerRef` — a free string\n * naming a PROVIDER whose env-var names were literals inside its module, so one ref was one\n * deployment and a second Odoo could not be expressed at all. A name here is an INSTANCE: two\n * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in their addresses and secrets.\n *\n * The name is also the stem of every environment variable the instance needs —\n * `WILDO_SOR_<NAME>__<SLOT>` — which is why it is capped at 32 characters and admits only\n * lower-kebab-case. Renaming an instance therefore renames its variables, and there is deliberately\n * no rename door for secrets: `wildo config sync` reports every now-missing slot and an operator\n * re-authors them (#1055 E6).\n *\n * ## What is validated HERE, and what is not\n *\n * Here: the SHAPE, and only what a single configuration file can see. That `vendor` names a facet\n * the deployment actually ships, and that `dialect` is one the facet speaks, are checked at BOOT by\n * the systems-of-record registry — the earliest place where the declaration and the facet map are in\n * the same scope. Splitting it that way is the same honest split `httpApiBinding` already makes:\n * the factory checks shape, the registry checks agreement.\n *\n * Also not here: that the environment actually supplies each slot. The saas config and the infra env\n * config parse independently, so cross-file coherence is checked at the seams where both are in\n * scope — `wildo config sync` and the backend startup validator.\n *\n * ## Why declaring one requires an owner organization (#1054)\n *\n * A system of record is read with the APPLICATION's own service identity, and its rows are stamped\n * with the owning organization's id so the per-row tenant gate passes without an exemption. An\n * application that declares no organization type carrying `ownsApplication` has no organization to\n * stamp with, so every read of every bound resource would refuse at request time. That refusal is\n * a statement about two top-level blocks, so it lives in `WildoSaasConfigSchema`'s own refinement,\n * where both are visible.\n */\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\nimport { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';\n\n/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */\n\n/**\n * The charset law for an instance name, exported because the environment-variable derivation and\n * every tool that parses a derived name back into a `(name, slot)` pair depend on it: a name may\n * not contain `_`, so the `__` delimiter is unambiguous (#1055 R4).\n */\nexport const SYSTEM_OF_RECORD_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;\n\n/** 32 characters, because the name is a stem of an environment-variable name rather than a label. */\nexport const SYSTEM_OF_RECORD_NAME_MAX_LENGTH = 32;\n\n/**\n * Whether the personal data held in a system-of-record INSTANCE can have originated from publicly\n * accessible sources (#1745) — the half of GDPR Art. 14(2)(f) nothing else in an application can\n * derive.\n *\n * A privacy notice owes, for personal data not collected from the person, \"from which source the\n * personal data originate, and if applicable, whether it came from publicly accessible sources\".\n * spec-cite: GDPR Art. 14(2)(f), https://gdpr-info.eu/art-14-gdpr/.\n * The binding already makes the first half true: the source is this instance, a deployment the\n * operator runs. The second half is about how records got INTO that deployment — an ERP contact\n * may have been typed in from a public register, a website or a bought list — and only the\n * operator knows. So the operator states it here, once per instance, as a typed value a reviewer\n * can diff, rather than answering a question or leaving it to a drafter's guess.\n *\n * Omitting it is legitimate and is NOT read as \"no\": the notice's source statement then marks the\n * public-origin half owed for every resource read from the instance.\n */\nexport enum SystemOfRecordPersonalDataOrigin {\n  /** Every person's data in this instance was collected by the operator — from the person, their organisation or the operator's own dealings with them — and none from a publicly accessible source. */\n  NO_PUBLICLY_ACCESSIBLE_SOURCES = 'no-publicly-accessible-sources',\n  /** Some of it may come from publicly accessible sources: company registers, websites, social profiles, enrichment services. The notice says so. */\n  INCLUDES_PUBLICLY_ACCESSIBLE_SOURCES = 'includes-publicly-accessible-sources',\n}\n\nexport const SystemOfRecordNameSchema = z\n  .string()\n  .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')\n  .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH);\n\n/**\n * The i18n bucket holding every instance's display words — the first segment of\n * {@link buildSystemOfRecordDisplayNameLabelKey}'s keys.\n */\nexport const SYSTEM_OF_RECORD_LABEL_BUCKET = 'systems_of_record';\n\n/**\n * The label key naming ONE declared instance to a person: `systems_of_record.<name>.displayName` (#1997).\n *\n * An instance NAME is an environment-variable stem (`odoo`, `sap-fr`), not words: it cannot be translated, and the\n * words a reader recognises (\"Odoo\", \"SAP France\") are not derivable from it. So a surface that names an instance —\n * the provenance cue on a field a pipeline wrote, \"synced from Odoo\" — resolves this key, and the labelling pipeline\n * plans it for every declared instance, total over `systemsOfRecord`. There is deliberately no `displayName` on the\n * declaration: display text comes from the i18n tree, never from configuration. A key nobody generated renders the\n * raw name, which is the missing label looking missing.\n */\nexport function buildSystemOfRecordDisplayNameLabelKey(name: string): string {\n  return `${SYSTEM_OF_RECORD_LABEL_BUCKET}.${name}.displayName`;\n}\n\n/** ONE declared instance. */\nexport const SystemOfRecordDeclarationSchema = z.strictObject({\n  /**\n   * Which vendor this is an instance of — the `vendor` of a facet the deployment ships: the framework's facets\n   * come from the opt-in library `@wildo-ai/systems-of-record`, which `wildo config sync` declares on the backend\n   * as soon as an instance is declared (#2013). Refused at boot when no facet answers to it, rather than here,\n   * because the facet map is not in scope in `wildo.saas.config.ts`.\n   */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n\n  /**\n   * How this instance is READ. Declared per instance rather than taken from the facet because a\n   * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST\n   * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong\n   * to, checked at boot.\n   *\n   * ## One instance per SERVICE ROOT — so a system serving OData v2 and v4 is two instances (#1687)\n   *\n   * An instance has ONE dialect and ONE base URL, and for OData that URL is a service root: an SAP\n   * system's `/sap/opu/odata/sap/API_BUSINESS_PARTNER` (v2) and `/sap/opu/odata4/sap/<service>/…` (v4)\n   * are different roots, as two v4 services of the same system already are. So a system reached over\n   * both versions is declared as two instances, one per root, each with its own dialect, credential\n   * and `maxRequestsPerMinute`.\n   *\n   * Decided rather than asked, because the model already answered it: an instance naming several roots\n   * would need a root per binding, which is what two instances are, and a budget SHARED across\n   * instances would be a new cross-instance ledger for a ceiling the operator can already honour by\n   * splitting it between the instances' `maxRequestsPerMinute`. Both were rejected on that ground.\n   * The cost, stated: two instances against one vendor account are paced separately, so their sum —\n   * not either one — is what must stay under the vendor's allowance.\n   */\n  dialect: z.enum(HttpApiTransportDialect),\n\n  /**\n   * How the engine proves who it is.\n   *\n   * OPTIONAL, and the absence is DERIVED rather than defaulted: when the instance's facet offers\n   * exactly one credential kind there is nothing for an author to decide, so the registry takes it;\n   * when a facet offers more than one and the instance names none, boot refuses and lists them.\n   * The framework derives before it asks: a declaration with one legal value is a question whose\n   * answer the mechanism already holds.\n   *\n   * This stays additive when #1056 widens the facet set: an instance that omitted the field is\n   * refused on the day its facet gains a second kind, which is exactly the day its author acquires a\n   * real decision.\n   */\n  credential: z.strictObject({ kind: z.enum(SystemOfRecordCredentialKind) }).optional(),\n\n  /**\n   * The pace this deployment may call the instance at, across EVERY resource bound to it (#1056 §3).\n   *\n   * Per INSTANCE because that is the unit the vendor accounts for: two resources bound to one\n   * Dataverse are one application user to Dataverse, so two independent per-binding budgets would\n   * each believe they were within a limit the pair together exceeds.\n   *\n   * A binding's own `remoteCallSemantics.maxRequestsPerMinute` stays, and becomes a CEILING UNDER\n   * this one: it answers a different question — how much of the shared allowance may ONE resource\n   * take — which matters when a pipeline load and an interactive read share an instance. Both are\n   * consumed for every call, and a call proceeds only if both have room.\n   *\n   * Omitted means unlimited HERE, which is the honest default: the framework does not know the\n   * vendor's contract, and inventing a number would either throttle a deployment that paid for more\n   * or fail to protect one that has less.\n   */\n  maxRequestsPerMinute: z.number().int().min(1).max(600_000).optional(),\n\n  /**\n   * Whether THIS deployment's data is partitioned, and its rows therefore confined to organization\n   * units of the owner organization (#1058).\n   *\n   * ## The reservation this replaces\n   *\n   * #1055 declared this field `z.never()` and refused it by name, because accepting a declaration the\n   * mechanism could not honour would let an author believe their rows were narrowed while every\n   * member still saw every row. That refusal did its job and is now lifted.\n   *\n   * ## Why the VENDOR says how and the INSTANCE says whether\n   *\n   * How a vendor partitions — which field, what shape, what codec — is a property of the vendor and\n   * lives on its facet. Whether a given deployment's data is partitioned is a property of the\n   * deployment: a single-company Odoo has a `company_id` on every row and nothing to confine, and\n   * asking its operator to restate the field name would be asking a question the facet answers.\n   *\n   * Opting in against a facet that declares no partitioning is refused at boot, naming the vendor —\n   * the alternative is a `true` that does nothing, which is the shape the reservation existed to\n   * prevent in the first place.\n   */\n  partition: z.boolean().optional(),\n\n  /**\n   * The PACKAGES whose facet augmentation applies to this instance (#1675) — npm package names, each of which\n   * must ship an augmentation for this instance's vendor from its `./systems-of-record` export.\n   *\n   * An explicit opt-in per INSTANCE, never implied by installation, because what an augmentation adds can be a\n   * partition declaration, and the facet is the single authority on how a tenant's rows are confined. Two\n   * instances of one vendor may therefore differ: one opts a package's partition in, the other does not.\n   * A package named here that ships no augmentation for the vendor refuses at startup, naming it.\n   *\n   * Naming a package here is also what ADMITS its `./systems-of-record` module to discovery (#2013): apart from the\n   * framework library `@wildo-ai/systems-of-record`, a facet module is recorded only from a package some instance\n   * names. The package must still be walked — named `<scope>/provider-*`, or listed in `providers.packages`.\n   */\n  facetAugmentations: z.array(z.string().min(1).max(214)).min(1).refine(\n    (packages) => new Set(packages).size === packages.length,\n    'A package is named twice in facetAugmentations.',\n  ).optional(),\n\n  /**\n   * Whether the personal data in THIS deployment can have come from publicly accessible sources — see\n   * {@link SystemOfRecordPersonalDataOrigin}. A property of the deployment, not the vendor: two Odoo\n   * instances may be fed differently. Optional; omitted, the privacy notice marks that statement owed\n   * for every resource read from this instance, and never states \"not from public sources\" by default.\n   */\n  personalDataOrigin: z.enum(SystemOfRecordPersonalDataOrigin).optional(),\n});\nexport type SystemOfRecordDeclaration = z.infer<typeof SystemOfRecordDeclarationSchema>;\n\n/**\n * Every instance this application declares, keyed by name.\n *\n * Optional as a whole: an application that reads nothing out of another system declares nothing, and\n * declaring this block is what ENABLES the external-data lane (#1055 D3) rather than an engine\n * capability flag — the lane has no meaning without an instance to point at.\n */\nexport const SystemsOfRecordConfigSchema = z\n  .record(SystemOfRecordNameSchema, SystemOfRecordDeclarationSchema)\n  .superRefine((systemsOfRecord, ctx) => {\n    if (Object.keys(systemsOfRecord).length === 0) {\n      ctx.addIssue({\n        code: 'custom',\n        path: [],\n        message:\n          'An empty `systemsOfRecord` declares nothing and enables nothing. Omit the block entirely, or declare the '\n          + 'instance the application reads.',\n      });\n    }\n  });\nexport type SystemsOfRecordConfig = z.infer<typeof SystemsOfRecordConfigSchema>;\n/** @wildo_source:part:end saas.models.systems-of-record */\n"]}
+{"version":3,"file":"system-of-record-declaration.shared.schemas.js","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-declaration.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAEzF,6GAA6G;AAE7G;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE,qGAAqG;AACrG,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAN,IAAY,gCAKX;AALD,WAAY,gCAAgC;IAC1C,sMAAsM;IACtM,qGAAiE,CAAA;IACjE,mJAAmJ;IACnJ,iHAA6E,CAAA;AAC/E,CAAC,EALW,gCAAgC,KAAhC,gCAAgC,QAK3C;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,EAAE;KACR,KAAK,CAAC,6BAA6B,EAAE,sEAAsE,CAAC;KAC5G,GAAG,CAAC,gCAAgC,CAAC,CAAC;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,UAAU,sCAAsC,CAAC,IAAY;IACjE,OAAO,GAAG,6BAA6B,IAAI,IAAI,cAAc,CAAC;AAChE,CAAC;AAED,6BAA6B;AAC7B,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D;;;;;OAKG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAEzF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC;IAExC;;;;;;;;;;;;OAYG;IACH,UAAU,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAErF;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAErE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEjC;;;;;;;;;;;;OAYG;IACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CACnE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EACxD,iDAAiD,CAClD,CAAC,QAAQ,EAAE;IAEZ;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE;CACxE,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC,wBAAwB,EAAE,+BAA+B,CAAC;KACjE,WAAW,CAAC,CAAC,eAAe,EAAE,GAAG,EAAE,EAAE;IACpC,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE;YACR,OAAO,EACL,2GAA2G;kBACzG,iCAAiC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,2DAA2D","sourcesContent":["/**\n * `systemsOfRecord` — the application's declared INSTANCES of the systems it reads its own business\n * rows out of.\n *\n * ```ts\n * systemsOfRecord: {\n *   odoo: { vendor: 'odoo', dialect: HttpApiTransportDialect.ODOO_JSONRPC },\n * }\n * ```\n *\n * ## The name is the whole point\n *\n * Before this, a resource addressed a remote system by `httpApiBinding.providerRef` — a free string\n * naming a PROVIDER whose env-var names were literals inside its module, so one ref was one\n * deployment and a second Odoo could not be expressed at all. A name here is an INSTANCE: two\n * (`odoo-fr`, `odoo-de`) share one vendor facet and differ only in their addresses and secrets.\n *\n * The name is also the stem of every environment variable the instance needs —\n * `WILDO_SOR_<NAME>__<SLOT>` — which is why it is capped at 32 characters and admits only\n * lower-kebab-case. Renaming an instance therefore renames its variables, and there is deliberately\n * no rename door for secrets: `wildo config sync` reports every now-missing slot and an operator\n * re-authors them (#1055 E6).\n *\n * ## What is validated HERE, and what is not\n *\n * Here: the SHAPE, and only what a single configuration file can see. That `vendor` names a facet\n * the deployment actually ships, and that `dialect` is one the facet speaks, are checked at BOOT by\n * the systems-of-record registry — the earliest place where the declaration and the facet map are in\n * the same scope. Splitting it that way is the same honest split `httpApiBinding` already makes:\n * the factory checks shape, the registry checks agreement.\n *\n * Also not here: that the environment actually supplies each slot. The saas config and the infra env\n * config parse independently, so cross-file coherence is checked at the seams where both are in\n * scope — `wildo config sync` and the backend startup validator.\n *\n * ## Why declaring one requires an owner organization (#1054)\n *\n * A system of record is read with the APPLICATION's own service identity, and its rows are stamped\n * with the owning organization's id so the per-row tenant gate passes without an exemption. An\n * application that declares no organization type carrying `ownsApplication` has no organization to\n * stamp with, so every read of every bound resource would refuse at request time. That refusal is\n * a statement about two top-level blocks, so it lives in `WildoSaasConfigSchema`'s own refinement,\n * where both are visible.\n */\nimport { z } from 'zod';\nimport { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';\nimport { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';\n\n/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */\n\n/**\n * The charset law for an instance name, exported because the environment-variable derivation and\n * every tool that parses a derived name back into a `(name, slot)` pair depend on it: a name may\n * not contain `_`, so the `__` delimiter is unambiguous (#1055 R4).\n */\nexport const SYSTEM_OF_RECORD_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;\n\n/** 32 characters, because the name is a stem of an environment-variable name rather than a label. */\nexport const SYSTEM_OF_RECORD_NAME_MAX_LENGTH = 32;\n\n/**\n * Whether the personal data held in a system-of-record INSTANCE can have originated from publicly\n * accessible sources (#1745) — the half of GDPR Art. 14(2)(f) nothing else in an application can\n * derive.\n *\n * A privacy notice owes, for personal data not collected from the person, \"from which source the\n * personal data originate, and if applicable, whether it came from publicly accessible sources\".\n * spec-cite: GDPR Art. 14(2)(f), https://gdpr-info.eu/art-14-gdpr/.\n * The binding already makes the first half true: the source is this instance, a deployment the\n * operator runs. The second half is about how records got INTO that deployment — an ERP contact\n * may have been typed in from a public register, a website or a bought list — and only the\n * operator knows. So the operator states it here, once per instance, as a typed value a reviewer\n * can diff, rather than answering a question or leaving it to a drafter's guess.\n *\n * Omitting it is legitimate and is NOT read as \"no\": the notice's source statement then marks the\n * public-origin half owed for every resource read from the instance.\n */\nexport enum SystemOfRecordPersonalDataOrigin {\n  /** Every person's data in this instance was collected by the operator — from the person, their organisation or the operator's own dealings with them — and none from a publicly accessible source. */\n  NO_PUBLICLY_ACCESSIBLE_SOURCES = 'no-publicly-accessible-sources',\n  /** Some of it may come from publicly accessible sources: company registers, websites, social profiles, enrichment services. The notice says so. */\n  INCLUDES_PUBLICLY_ACCESSIBLE_SOURCES = 'includes-publicly-accessible-sources',\n}\n\nexport const SystemOfRecordNameSchema = z\n  .string()\n  .regex(SYSTEM_OF_RECORD_NAME_PATTERN, 'A system-of-record name is lower-kebab-case, starting with a letter.')\n  .max(SYSTEM_OF_RECORD_NAME_MAX_LENGTH);\n\n/**\n * The i18n bucket holding every instance's display words — the first segment of\n * {@link buildSystemOfRecordDisplayNameLabelKey}'s keys.\n */\nexport const SYSTEM_OF_RECORD_LABEL_BUCKET = 'systems_of_record';\n\n/**\n * The label key naming ONE declared instance to a person: `systems_of_record.<name>.displayName` (#1997).\n *\n * An instance NAME is an environment-variable stem (`odoo`, `sap-fr`), not words: it cannot be translated, and the\n * words a reader recognises (\"Odoo\", \"SAP France\") are not derivable from it. So a surface that names an instance —\n * the provenance cue on a field a pipeline wrote, \"synced from Odoo\" — resolves this key, and the labelling pipeline\n * plans it for every declared instance, total over `systemsOfRecord`. There is deliberately no `displayName` on the\n * declaration: display text comes from the i18n tree, never from configuration. A key nobody generated renders the\n * raw name, which is the missing label looking missing.\n */\nexport function buildSystemOfRecordDisplayNameLabelKey(name: string): string {\n  return `${SYSTEM_OF_RECORD_LABEL_BUCKET}.${name}.displayName`;\n}\n\n/** ONE declared instance. */\nexport const SystemOfRecordDeclarationSchema = z.strictObject({\n  /**\n   * Which vendor this is an instance of — the `vendor` of a facet the deployment ships: the framework's facets\n   * come from the opt-in library `@wildo-ai/systems-of-record`, which `wildo config sync` declares on the backend\n   * as soon as an instance is declared (#2013). Refused at boot when no facet answers to it, rather than here,\n   * because the facet map is not in scope in `wildo.saas.config.ts`.\n   */\n  vendor: z.string().regex(/^[a-z][a-z0-9-]*$/, 'A vendor id is lower-kebab-case.').max(40),\n\n  /**\n   * How this instance is READ. Declared per instance rather than taken from the facet because a\n   * vendor may speak several dialects — a service reachable over both OData v4 and a bespoke REST\n   * surface is one vendor and two ways in. The facet's `dialects` is the closed set this must belong\n   * to, checked at boot.\n   *\n   * ## One instance per SERVICE ROOT — so a system serving OData v2 and v4 is two instances (#1687)\n   *\n   * An instance has ONE dialect and ONE base URL, and for OData that URL is a service root: an SAP\n   * system's `/sap/opu/odata/sap/API_BUSINESS_PARTNER` (v2) and `/sap/opu/odata4/sap/<service>/…` (v4)\n   * are different roots, as two v4 services of the same system already are. So a system reached over\n   * both versions is declared as two instances, one per root, each with its own dialect, credential\n   * and `maxRequestsPerMinute`.\n   *\n   * Decided rather than asked, because the model already answered it: an instance naming several roots\n   * would need a root per binding, which is what two instances are, and a budget SHARED across\n   * instances would be a new cross-instance ledger for a ceiling the operator can already honour by\n   * splitting it between the instances' `maxRequestsPerMinute`. Both were rejected on that ground.\n   * The cost, stated: two instances against one vendor account are paced separately, so their sum —\n   * not either one — is what must stay under the vendor's allowance.\n   */\n  dialect: z.enum(HttpApiTransportDialect),\n\n  /**\n   * How the engine proves who it is.\n   *\n   * OPTIONAL, and the absence is DERIVED rather than defaulted: when the instance's facet offers\n   * exactly one credential kind there is nothing for an author to decide, so the registry takes it;\n   * when a facet offers more than one and the instance names none, boot refuses and lists them.\n   * The framework derives before it asks: a declaration with one legal value is a question whose\n   * answer the mechanism already holds.\n   *\n   * This stays additive when #1056 widens the facet set: an instance that omitted the field is\n   * refused on the day its facet gains a second kind, which is exactly the day its author acquires a\n   * real decision.\n   */\n  credential: z.strictObject({ kind: z.enum(SystemOfRecordCredentialKind) }).optional(),\n\n  /**\n   * The pace this deployment may call the instance at, across EVERY resource bound to it (#1056 §3).\n   *\n   * Per INSTANCE because that is the unit the vendor accounts for: two resources bound to one\n   * Dataverse are one application user to Dataverse, so two independent per-binding budgets would\n   * each believe they were within a limit the pair together exceeds.\n   *\n   * A binding's own `remoteCallSemantics.maxRequestsPerMinute` stays, and becomes a CEILING UNDER\n   * this one: it answers a different question — how much of the shared allowance may ONE resource\n   * take — which matters when a pipeline load and an interactive read share an instance. Both are\n   * consumed for every call, and a call proceeds only if both have room.\n   *\n   * Omitted means unlimited HERE, which is the honest default: the framework does not know the\n   * vendor's contract, and inventing a number would either throttle a deployment that paid for more\n   * or fail to protect one that has less.\n   */\n  maxRequestsPerMinute: z.number().int().min(1).max(600_000).optional(),\n\n  /**\n   * Whether THIS deployment's data is partitioned, and its rows therefore confined to organization\n   * units of the owner organization (#1058).\n   *\n   * ## The reservation this replaces\n   *\n   * #1055 declared this field `z.never()` and refused it by name, because accepting a declaration the\n   * mechanism could not honour would let an author believe their rows were narrowed while every\n   * member still saw every row. That refusal did its job and is now lifted.\n   *\n   * ## Why the VENDOR says how and the INSTANCE says whether\n   *\n   * How a vendor partitions — which field, what shape, what codec — is a property of the vendor and\n   * lives on its facet. Whether a given deployment's data is partitioned is a property of the\n   * deployment: a single-company Odoo has a `company_id` on every row and nothing to confine, and\n   * asking its operator to restate the field name would be asking a question the facet answers.\n   *\n   * Opting in against a facet that declares no partitioning is refused at boot, naming the vendor —\n   * the alternative is a `true` that does nothing, which is the shape the reservation existed to\n   * prevent in the first place.\n   */\n  partition: z.boolean().optional(),\n\n  /**\n   * The PACKAGES whose facet augmentation applies to this instance (#1675) — npm package names, each of which\n   * must ship an augmentation for this instance's vendor from its `./systems-of-record` export.\n   *\n   * An explicit opt-in per INSTANCE, never implied by installation, because what an augmentation adds can be a\n   * partition declaration, and the facet is the single authority on how a tenant's rows are confined. Two\n   * instances of one vendor may therefore differ: one opts a package's partition in, the other does not.\n   * A package named here that ships no augmentation for the vendor refuses at startup, naming it.\n   *\n   * Naming a package here is also what ADMITS its `./systems-of-record` module to discovery (#2013): apart from the\n   * framework library `@wildo-ai/systems-of-record`, a facet module is recorded only from a package some instance\n   * names. The package must still be walked — named `<scope>/provider-*`, or listed in `providers.packages`.\n   */\n  facetAugmentations: z.array(z.string().min(1).max(214)).min(1).refine(\n    (packages) => new Set(packages).size === packages.length,\n    'A package is named twice in facetAugmentations.',\n  ).optional(),\n\n  /**\n   * Whether the personal data in THIS deployment can have come from publicly accessible sources — see\n   * {@link SystemOfRecordPersonalDataOrigin}. A property of the deployment, not the vendor: two Odoo\n   * instances may be fed differently. Optional; omitted, the privacy notice marks that statement owed\n   * for every resource read from this instance, and never states \"not from public sources\" by default.\n   */\n  personalDataOrigin: z.enum(SystemOfRecordPersonalDataOrigin).optional(),\n});\nexport type SystemOfRecordDeclaration = z.infer<typeof SystemOfRecordDeclarationSchema>;\n\n/**\n * Every instance this application declares, keyed by name.\n *\n * Optional as a whole: an application that reads nothing out of another system declares nothing, and\n * declaring this block is what ENABLES the external-data lane (#1055 D3) rather than an engine\n * capability flag — the lane has no meaning without an instance to point at.\n */\nexport const SystemsOfRecordConfigSchema = z\n  .record(SystemOfRecordNameSchema, SystemOfRecordDeclarationSchema)\n  .superRefine((systemsOfRecord, ctx) => {\n    if (Object.keys(systemsOfRecord).length === 0) {\n      ctx.addIssue({\n        code: 'custom',\n        path: [],\n        message:\n          'An empty `systemsOfRecord` declares nothing and enables nothing. Omit the block entirely, or declare the '\n          + 'instance the application reads.',\n      });\n    }\n  });\nexport type SystemsOfRecordConfig = z.infer<typeof SystemsOfRecordConfigSchema>;\n/** @wildo_source:part:end saas.models.systems-of-record */\n"]}

package/dist/esm/systems-of-record/system-of-record-env.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-env.shared.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,+FAA+F;AAC/F,eAAO,MAAM,2BAA2B,eAAe,CAAC;AAExD,qGAAqG;AACrG,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,mGAAmG;AACnG,eAAO,MAAM,kCAAkC,QAAwB,CAAC;AAExE;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,YAAY,CAAC;AAYvD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ7F;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElF;AAQD,gDAAgD;AAChD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAgBlG"}
+{"version":3,"file":"system-of-record-env.shared.d.ts","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,+FAA+F;AAC/F,eAAO,MAAM,2BAA2B,eAAe,CAAC;AAExD,qGAAqG;AACrG,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,mGAAmG;AACnG,eAAO,MAAM,kCAAkC,QAAwB,CAAC;AAExE;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,YAAY,CAAC;AAYvD;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ7F;AAED;;;;;GAKG;AACH,wBAAgB,qCAAqC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAElF;AAQD,gDAAgD;AAChD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,GAAG,IAAI,CAgBlG"}

package/dist/esm/systems-of-record/system-of-record-env.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-env.shared.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAE9F,+FAA+F;AAC/F,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AAExD,qGAAqG;AACrG,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,mGAAmG;AACnG,MAAM,CAAC,MAAM,kCAAkC,GAAG,qBAAqB,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC;AAEvD,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,mGAAmG;AACnG,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,YAAoB,EAAE,QAAgB;IACnF,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,IAAI,YAAY,6FAA6F,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,IAAI,QAAQ,8EAA8E,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,GAAG,2BAA2B,GAAG,kBAAkB,CAAC,YAAY,CAAC,GAAG,8BAA8B,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzI,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB;IACxE,OAAO,8BAA8B,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;AACrF,CAAC;AAED,wGAAwG;AACxG,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrH,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAAkB;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACpE,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,uFAAuF;IACvF,IAAI,WAAW,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC","sourcesContent":["/**\n * `WILDO_SOR_<NAME>__<SLOT>` — the ONE derivation of a system-of-record environment-variable name.\n *\n * ## Derived, never authored, and why that is the whole design\n *\n * The lane this replaces put the variable NAMES in the vendor's module — `ODOO_BASE_URL`,\n * `ODOO_DB`, `ODOO_LOGIN`, `ODOO_API_KEY` — so a second Odoo was unrepresentable: the name space was\n * the vendor's, not the instance's. Deriving from the instance NAME instead means two instances of\n * one vendor cost nothing (`WILDO_SOR_ODOO_FR__BASE_URL` beside `WILDO_SOR_ODOO_DE__BASE_URL`), and\n * an author never invents a variable name that some other layer then has to guess.\n *\n * ## Why the delimiter is a DOUBLE underscore (#1055 R4)\n *\n * The pair must be RECOVERABLE — the secrets section is a flat map keyed by variable name (R5), and\n * per-instance structure is recovered by parsing the key back. With a single underscore,\n * `odoo-api` + `key` and `odoo` + `apiKey` both derive `WILDO_SOR_ODOO_API_KEY` and nothing could\n * tell them apart. `__` cannot be produced by either half: an instance name admits only\n * `[a-z0-9-]` and a slot slug only `[a-zA-Z0-9]`, so neither can emit an underscore at all, and the\n * only `__` in a derived name is the delimiter. The collision is impossible by construction rather\n * than checked for.\n *\n * That property is load-bearing, so the two charset laws are not cosmetic: widening either one\n * silently reintroduces the ambiguity. `SYSTEM_OF_RECORD_NAME_PATTERN` and the slot-slug regex are\n * pinned against this file's round trip for that reason.\n *\n * ## Four readers, one authority\n *\n * The backend `.env` writer, the k8s secrets generator, the CI secret collector and the backend\n * registry all need the same name, and three of them live in different packages. Re-deriving it at\n * each would be the enumeration failure `invariant-call-site-enumeration.md` records — so this module\n * is the authority and every one of them imports it.\n */\n\nimport { SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas';\n\n/** Every system-of-record variable starts here, which is what makes a prefix scan possible. */\nexport const SYSTEM_OF_RECORD_ENV_PREFIX = 'WILDO_SOR_';\n\n/** The delimiter between the instance name and the slot. See the module header for why it is two. */\nexport const SYSTEM_OF_RECORD_ENV_DELIMITER = '__';\n\n/** The charset law for a slot slug, shared with the facet schema so the two cannot drift apart. */\nexport const SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN = /^[a-z][a-zA-Z0-9]*$/;\n\n/**\n * The slot slug an instance may never declare, because the environment builder emits it itself.\n *\n * `WILDO_SOR_<NAME>__ENABLED=false` is how an environment says it has NO access to this system —\n * a developer laptop, a staging with no ERP (#1055 E3, R6). A facet declaring a slot named `enabled`\n * would produce the same variable and make \"declared absent\" indistinguishable from \"an address slot\n * whose value happens to be false\", so the name is reserved and the facet schema refuses it.\n */\nexport const SYSTEM_OF_RECORD_ENABLED_SLOT = 'enabled';\n\n/** `odoo-fr` → `ODOO_FR`. The only transformation a name undergoes. */\nfunction encodeInstanceName(instanceName: string): string {\n  return instanceName.toUpperCase().replaceAll('-', '_');\n}\n\n/** `apiKey` → `API_KEY`, `baseUrl` → `BASE_URL`. lowerCamelCase to UPPER_SNAKE, and back below. */\nfunction encodeSlotSlug(slotSlug: string): string {\n  return slotSlug.replace(/([A-Z])/g, '_$1').toUpperCase();\n}\n\n/**\n * The name of the environment variable carrying one slot of one instance.\n *\n * Throws on a name or slug outside its charset law rather than emitting a name that cannot be parsed\n * back: both halves are validated where they are authored, so reaching here with a bad one means a\n * caller skipped a schema, and a silently unparseable variable is worse than a loud refusal.\n */\nexport function deriveSystemOfRecordEnvVarName(instanceName: string, slotSlug: string): string {\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName)) {\n    throw new Error(`\"${instanceName}\" is not a valid system-of-record instance name (lower-kebab-case, starting with a letter).`);\n  }\n  if (!SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) {\n    throw new Error(`\"${slotSlug}\" is not a valid system-of-record slot slug (lowerCamelCase, no separators).`);\n  }\n  return `${SYSTEM_OF_RECORD_ENV_PREFIX}${encodeInstanceName(instanceName)}${SYSTEM_OF_RECORD_ENV_DELIMITER}${encodeSlotSlug(slotSlug)}`;\n}\n\n/**\n * `WILDO_SOR_<NAME>__ENABLED` — present and `false` when an environment declares it has no access to\n * this instance (E3). Its ABSENCE, with required slots missing, is the different and louder case:\n * an environment that simply forgot (E4). Silence is never a declaration, which is why the two are\n * distinguishable at all.\n */\nexport function deriveSystemOfRecordEnabledEnvVarName(instanceName: string): string {\n  return deriveSystemOfRecordEnvVarName(instanceName, SYSTEM_OF_RECORD_ENABLED_SLOT);\n}\n\n/** `API_KEY` → `apiKey`. The inverse of `encodeSlotSlug`, exact because a slug carries no separator. */\nfunction decodeSlotSlug(encoded: string): string {\n  const [head, ...rest] = encoded.toLowerCase().split('_');\n  return [head, ...rest.map((part) => (part.length === 0 ? part : part[0]!.toUpperCase() + part.slice(1)))].join('');\n}\n\n/** What a derived variable name was made of. */\nexport interface SystemOfRecordEnvVarParts {\n  readonly instanceName: string;\n  readonly slotSlug: string;\n}\n\n/**\n * Recover the `(instance, slot)` pair from a derived variable name, or `null` when the name is not\n * one of ours.\n *\n * `null` rather than a throw because the callers scan a MIXED environment — every variable a\n * deployment carries goes past this function, and most of them are not system-of-record variables.\n * A name that starts with the prefix and still does not parse is also `null`: it is not ours either,\n * and refusing an operator's unrelated `WILDO_SOR_SOMETHING` would be this module deciding what an\n * environment may contain.\n */\nexport function parseSystemOfRecordEnvVarName(envVarName: string): SystemOfRecordEnvVarParts | null {\n  if (!envVarName.startsWith(SYSTEM_OF_RECORD_ENV_PREFIX)) return null;\n  const body = envVarName.slice(SYSTEM_OF_RECORD_ENV_PREFIX.length);\n  const delimiterIndex = body.indexOf(SYSTEM_OF_RECORD_ENV_DELIMITER);\n  if (delimiterIndex <= 0) return null;\n\n  const instanceName = body.slice(0, delimiterIndex).toLowerCase().replaceAll('_', '-');\n  const encodedSlot = body.slice(delimiterIndex + SYSTEM_OF_RECORD_ENV_DELIMITER.length);\n  if (encodedSlot.length === 0) return null;\n  // A second delimiter means the name was not produced here: neither half can emit `__`.\n  if (encodedSlot.includes(SYSTEM_OF_RECORD_ENV_DELIMITER)) return null;\n\n  const slotSlug = decodeSlotSlug(encodedSlot);\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName) || !SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) return null;\n\n  return { instanceName, slotSlug };\n}\n"]}
+{"version":3,"file":"system-of-record-env.shared.js","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-env.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAE9F,+FAA+F;AAC/F,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AAExD,qGAAqG;AACrG,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,mGAAmG;AACnG,MAAM,CAAC,MAAM,kCAAkC,GAAG,qBAAqB,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,SAAS,CAAC;AAEvD,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,OAAO,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,mGAAmG;AACnG,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,YAAoB,EAAE,QAAgB;IACnF,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,IAAI,YAAY,6FAA6F,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,IAAI,QAAQ,8EAA8E,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,GAAG,2BAA2B,GAAG,kBAAkB,CAAC,YAAY,CAAC,GAAG,8BAA8B,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzI,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB;IACxE,OAAO,8BAA8B,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;AACrF,CAAC;AAED,wGAAwG;AACxG,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrH,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAAkB;IAC9D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,2BAA2B,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACpE,IAAI,cAAc,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACvF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,uFAAuF;IACvF,IAAI,WAAW,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC","sourcesContent":["/**\n * `WILDO_SOR_<NAME>__<SLOT>` — the ONE derivation of a system-of-record environment-variable name.\n *\n * ## Derived, never authored, and why that is the whole design\n *\n * The lane this replaces put the variable NAMES in the vendor's module — `ODOO_BASE_URL`,\n * `ODOO_DB`, `ODOO_LOGIN`, `ODOO_API_KEY` — so a second Odoo was unrepresentable: the name space was\n * the vendor's, not the instance's. Deriving from the instance NAME instead means two instances of\n * one vendor cost nothing (`WILDO_SOR_ODOO_FR__BASE_URL` beside `WILDO_SOR_ODOO_DE__BASE_URL`), and\n * an author never invents a variable name that some other layer then has to guess.\n *\n * ## Why the delimiter is a DOUBLE underscore (#1055 R4)\n *\n * The pair must be RECOVERABLE — the secrets section is a flat map keyed by variable name (R5), and\n * per-instance structure is recovered by parsing the key back. With a single underscore,\n * `odoo-api` + `key` and `odoo` + `apiKey` both derive `WILDO_SOR_ODOO_API_KEY` and nothing could\n * tell them apart. `__` cannot be produced by either half: an instance name admits only\n * `[a-z0-9-]` and a slot slug only `[a-zA-Z0-9]`, so neither can emit an underscore at all, and the\n * only `__` in a derived name is the delimiter. The collision is impossible by construction rather\n * than checked for.\n *\n * That property is load-bearing, so the two charset laws are not cosmetic: widening either one\n * silently reintroduces the ambiguity. `SYSTEM_OF_RECORD_NAME_PATTERN` and the slot-slug regex are\n * pinned against this file's round trip for that reason.\n *\n * ## Four readers, one authority\n *\n * The backend `.env` writer, the k8s secrets generator, the CI secret collector and the backend\n * registry all need the same name, and three of them live in different packages. Re-deriving it at\n * each would be the enumeration failure `invariant-call-site-enumeration.md` records — so this module\n * is the authority and every one of them imports it.\n */\n\nimport { SYSTEM_OF_RECORD_NAME_PATTERN } from './system-of-record-declaration.shared.schemas';\n\n/** Every system-of-record variable starts here, which is what makes a prefix scan possible. */\nexport const SYSTEM_OF_RECORD_ENV_PREFIX = 'WILDO_SOR_';\n\n/** The delimiter between the instance name and the slot. See the module header for why it is two. */\nexport const SYSTEM_OF_RECORD_ENV_DELIMITER = '__';\n\n/** The charset law for a slot slug, shared with the facet schema so the two cannot drift apart. */\nexport const SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN = /^[a-z][a-zA-Z0-9]*$/;\n\n/**\n * The slot slug an instance may never declare, because the environment builder emits it itself.\n *\n * `WILDO_SOR_<NAME>__ENABLED=false` is how an environment says it has NO access to this system —\n * a developer laptop, a staging with no ERP (#1055 E3, R6). A facet declaring a slot named `enabled`\n * would produce the same variable and make \"declared absent\" indistinguishable from \"an address slot\n * whose value happens to be false\", so the name is reserved and the facet schema refuses it.\n */\nexport const SYSTEM_OF_RECORD_ENABLED_SLOT = 'enabled';\n\n/** `odoo-fr` → `ODOO_FR`. The only transformation a name undergoes. */\nfunction encodeInstanceName(instanceName: string): string {\n  return instanceName.toUpperCase().replaceAll('-', '_');\n}\n\n/** `apiKey` → `API_KEY`, `baseUrl` → `BASE_URL`. lowerCamelCase to UPPER_SNAKE, and back below. */\nfunction encodeSlotSlug(slotSlug: string): string {\n  return slotSlug.replace(/([A-Z])/g, '_$1').toUpperCase();\n}\n\n/**\n * The name of the environment variable carrying one slot of one instance.\n *\n * Throws on a name or slug outside its charset law rather than emitting a name that cannot be parsed\n * back: both halves are validated where they are authored, so reaching here with a bad one means a\n * caller skipped a schema, and a silently unparseable variable is worse than a loud refusal.\n */\nexport function deriveSystemOfRecordEnvVarName(instanceName: string, slotSlug: string): string {\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName)) {\n    throw new Error(`\"${instanceName}\" is not a valid system-of-record instance name (lower-kebab-case, starting with a letter).`);\n  }\n  if (!SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) {\n    throw new Error(`\"${slotSlug}\" is not a valid system-of-record slot slug (lowerCamelCase, no separators).`);\n  }\n  return `${SYSTEM_OF_RECORD_ENV_PREFIX}${encodeInstanceName(instanceName)}${SYSTEM_OF_RECORD_ENV_DELIMITER}${encodeSlotSlug(slotSlug)}`;\n}\n\n/**\n * `WILDO_SOR_<NAME>__ENABLED` — present and `false` when an environment declares it has no access to\n * this instance (E3). Its ABSENCE, with required slots missing, is the different and louder case:\n * an environment that simply forgot (E4). Silence is never a declaration, which is why the two are\n * distinguishable at all.\n */\nexport function deriveSystemOfRecordEnabledEnvVarName(instanceName: string): string {\n  return deriveSystemOfRecordEnvVarName(instanceName, SYSTEM_OF_RECORD_ENABLED_SLOT);\n}\n\n/** `API_KEY` → `apiKey`. The inverse of `encodeSlotSlug`, exact because a slug carries no separator. */\nfunction decodeSlotSlug(encoded: string): string {\n  const [head, ...rest] = encoded.toLowerCase().split('_');\n  return [head, ...rest.map((part) => (part.length === 0 ? part : part[0]!.toUpperCase() + part.slice(1)))].join('');\n}\n\n/** What a derived variable name was made of. */\nexport interface SystemOfRecordEnvVarParts {\n  readonly instanceName: string;\n  readonly slotSlug: string;\n}\n\n/**\n * Recover the `(instance, slot)` pair from a derived variable name, or `null` when the name is not\n * one of ours.\n *\n * `null` rather than a throw because the callers scan a MIXED environment — every variable a\n * deployment carries goes past this function, and most of them are not system-of-record variables.\n * A name that starts with the prefix and still does not parse is also `null`: it is not ours either,\n * and refusing an operator's unrelated `WILDO_SOR_SOMETHING` would be this module deciding what an\n * environment may contain.\n */\nexport function parseSystemOfRecordEnvVarName(envVarName: string): SystemOfRecordEnvVarParts | null {\n  if (!envVarName.startsWith(SYSTEM_OF_RECORD_ENV_PREFIX)) return null;\n  const body = envVarName.slice(SYSTEM_OF_RECORD_ENV_PREFIX.length);\n  const delimiterIndex = body.indexOf(SYSTEM_OF_RECORD_ENV_DELIMITER);\n  if (delimiterIndex <= 0) return null;\n\n  const instanceName = body.slice(0, delimiterIndex).toLowerCase().replaceAll('_', '-');\n  const encodedSlot = body.slice(delimiterIndex + SYSTEM_OF_RECORD_ENV_DELIMITER.length);\n  if (encodedSlot.length === 0) return null;\n  // A second delimiter means the name was not produced here: neither half can emit `__`.\n  if (encodedSlot.includes(SYSTEM_OF_RECORD_ENV_DELIMITER)) return null;\n\n  const slotSlug = decodeSlotSlug(encodedSlot);\n  if (!SYSTEM_OF_RECORD_NAME_PATTERN.test(instanceName) || !SYSTEM_OF_RECORD_SLOT_SLUG_PATTERN.test(slotSlug)) return null;\n\n  return { instanceName, slotSlug };\n}\n"]}

package/dist/esm/systems-of-record/system-of-record-error-codes.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-error-codes.shared.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-error-codes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;OAOG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;OAKG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;;;OAOG;IACH,4BAA4B,kDAAkD;IAE9E;;;;OAIG;IACH,0BAA0B,gDAAgD;IAE1E;;;;;OAKG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;OAKG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;;OAMG;IACH,4BAA4B,kDAAkD;IAE9E;;OAEG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;OAKG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;OAOG;IACH,qBAAqB,2CAA2C;IAEhE;;;;;;OAMG;IACH,+BAA+B,qDAAqD;IAEpF;;;;;;OAMG;IACH,qCAAqC,2DAA2D;IAEhG;;;;;;OAMG;IACH,0BAA0B,gDAAgD;IAE1E;;;;;;;;OAQG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,uCAAuC;IAExD;;;;;;;;;OASG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,iCAAiC,uDAAuD;IAExF;;;;;;;;;OASG;IACH,0BAA0B,gDAAgD;IAS1E;;;;;;;OAOG;IACH,6BAA6B,mDAAmD;IAEhF;;;;;;;OAOG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,6BAA6B,mDAAmD;IAEhF;;;OAGG;IACH,uBAAuB,6CAA6C;IAEpE;;;;;;;OAOG;IACH,wBAAwB,8CAA8C;IAEtE;;;;;;;OAOG;IACH,qBAAqB,2CAA2C;IAEhE;;;;;OAKG;IACH,iBAAiB,uCAAuC;IAExD;;;;;;;;;;;;OAYG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,8BAA8B,oDAAoD;IAUlF;;;;OAIG;IACH,yCAAyC,+DAA+D;IAExG;;;;OAIG;IACH,sBAAsB,4CAA4C;IAElE;;;;;;;;OAQG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;;OAMG;IACH,4BAA4B,kDAAkD;IAQ9E;;;;;;;;;OASG;IACH,yBAAyB,+CAA+C;IAExE;;;;OAIG;IACH,gCAAgC,sDAAsD;IAQtF;;;OAGG;IACH,yCAAyC,+DAA+D;IAExG;;;;OAIG;IACH,gCAAgC,sDAAsD;IAEtF,yHAAyH;IACzH,sBAAsB,4CAA4C;IAElE,6EAA6E;IAC7E,mBAAmB,yCAAyC;IAE5D;;;;OAIG;IACH,8BAA8B,oDAAoD;IAElF;;;OAGG;IACH,6BAA6B,mDAAmD;IAEhF,mGAAmG;IACnG,oBAAoB,0CAA0C;IAE9D,+GAA+G;IAC/G,oBAAoB,0CAA0C;IAE9D;;;OAGG;IACH,+BAA+B,qDAAqD;IAEpF;;;OAGG;IACH,8BAA8B,oDAAoD;IAElF;;;OAGG;IACH,wBAAwB,8CAA8C;IAEtE;;;;OAIG;IACH,2BAA2B,iDAAiD;IAE5E,qGAAqG;IACrG,qBAAqB,2CAA2C;IAEhE;;;;;OAKG;IACH,eAAe,qCAAqC;CACrD;AAED;;;;;;GAMG;AACH,oBAAY,mCAAmC;IAC7C,wEAAwE;IACxE,kBAAkB,uBAAuB;IACzC,qGAAqG;IACrG,qBAAqB,0BAA0B;IAC/C;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D,2GAA2G;IAC3G,wBAAwB,6BAA6B;IACrD,mHAAmH;IACnH,gBAAgB,qBAAqB;IACrC;;;OAGG;IACH,gCAAgC,qCAAqC;CACtE;AACD,sEAAsE;AAEtE;;;GAGG;AACH,eAAO,MAAM,4CAA4C,QAEqD,CAAC"}
+{"version":3,"file":"system-of-record-error-codes.shared.d.ts","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-error-codes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;GAMG;AACH,oBAAY,uBAAuB;IACjC;;;;;;;OAOG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;OAKG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;;;OAOG;IACH,4BAA4B,kDAAkD;IAE9E;;;;OAIG;IACH,0BAA0B,gDAAgD;IAE1E;;;;;OAKG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;OAKG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;;OAMG;IACH,4BAA4B,kDAAkD;IAE9E;;OAEG;IACH,2BAA2B,iDAAiD;IAE5E;;;;;OAKG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;OAOG;IACH,qBAAqB,2CAA2C;IAEhE;;;;;;OAMG;IACH,+BAA+B,qDAAqD;IAEpF;;;;;;OAMG;IACH,qCAAqC,2DAA2D;IAEhG;;;;;;OAMG;IACH,0BAA0B,gDAAgD;IAE1E;;;;;;;;OAQG;IACH,yBAAyB,+CAA+C;IAExE;;;;;;;;;;;;;OAaG;IACH,iBAAiB,uCAAuC;IAExD;;;;;;;;;OASG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,iCAAiC,uDAAuD;IAExF;;;;;;;;;OASG;IACH,0BAA0B,gDAAgD;IAS1E;;;;;;;OAOG;IACH,6BAA6B,mDAAmD;IAEhF;;;;;;;OAOG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,6BAA6B,mDAAmD;IAEhF;;;OAGG;IACH,uBAAuB,6CAA6C;IAEpE;;;;;;;OAOG;IACH,wBAAwB,8CAA8C;IAEtE;;;;;;;OAOG;IACH,qBAAqB,2CAA2C;IAEhE;;;;;OAKG;IACH,iBAAiB,uCAAuC;IAExD;;;;;;;;;;;;OAYG;IACH,4BAA4B,kDAAkD;IAE9E;;;;;;;OAOG;IACH,8BAA8B,oDAAoD;IAUlF;;;;OAIG;IACH,yCAAyC,+DAA+D;IAExG;;;;OAIG;IACH,sBAAsB,4CAA4C;IAElE;;;;;;;;OAQG;IACH,mBAAmB,yCAAyC;IAE5D;;;;;;OAMG;IACH,4BAA4B,kDAAkD;IAQ9E;;;;;;;;;OASG;IACH,yBAAyB,+CAA+C;IAExE;;;;OAIG;IACH,gCAAgC,sDAAsD;IAQtF;;;OAGG;IACH,yCAAyC,+DAA+D;IAExG;;;;OAIG;IACH,gCAAgC,sDAAsD;IAEtF,yHAAyH;IACzH,sBAAsB,4CAA4C;IAElE,6EAA6E;IAC7E,mBAAmB,yCAAyC;IAE5D;;;;OAIG;IACH,8BAA8B,oDAAoD;IAElF;;;OAGG;IACH,6BAA6B,mDAAmD;IAEhF,mGAAmG;IACnG,oBAAoB,0CAA0C;IAE9D,+GAA+G;IAC/G,oBAAoB,0CAA0C;IAE9D;;;OAGG;IACH,+BAA+B,qDAAqD;IAEpF;;;OAGG;IACH,8BAA8B,oDAAoD;IAElF;;;OAGG;IACH,wBAAwB,8CAA8C;IAEtE;;;;OAIG;IACH,2BAA2B,iDAAiD;IAE5E,qGAAqG;IACrG,qBAAqB,2CAA2C;IAEhE;;;;;OAKG;IACH,eAAe,qCAAqC;CACrD;AAED;;;;;;GAMG;AACH,oBAAY,mCAAmC;IAC7C,wEAAwE;IACxE,kBAAkB,uBAAuB;IACzC,qGAAqG;IACrG,qBAAqB,0BAA0B;IAC/C;;;;OAIG;IACH,2BAA2B,gCAAgC;IAC3D,2GAA2G;IAC3G,wBAAwB,6BAA6B;IACrD,mHAAmH;IACnH,gBAAgB,qBAAqB;IACrC;;;OAGG;IACH,gCAAgC,qCAAqC;CACtE;AACD,sEAAsE;AAEtE;;;GAGG;AACH,eAAO,MAAM,4CAA4C,QAEqD,CAAC"}

package/dist/esm/systems-of-record/system-of-record-error-codes.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-error-codes.shared.js","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-error-codes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,uBA8ZX;AA9ZD,WAAY,uBAAuB;IACjC;;;;;;;OAOG;IACH,uFAA4D,CAAA;IAE5D;;;;;OAKG;IACH,uGAA4E,CAAA;IAE5E;;;;;;;OAOG;IACH,yGAA8E,CAAA;IAE9E;;;;OAIG;IACH,qGAA0E,CAAA;IAE1E;;;;;OAKG;IACH,uFAA4D,CAAA;IAE5D;;;;;OAKG;IACH,uGAA4E,CAAA;IAE5E;;;;;;OAMG;IACH,yGAA8E,CAAA;IAE9E;;OAEG;IACH,uGAA4E,CAAA;IAE5E;;;;;OAKG;IACH,mGAAwE,CAAA;IAExE;;;;;;;OAOG;IACH,2FAAgE,CAAA;IAEhE;;;;;;OAMG;IACH,+GAAoF,CAAA;IAEpF;;;;;;OAMG;IACH,2HAAgG,CAAA;IAEhG;;;;;;OAMG;IACH,qGAA0E,CAAA;IAE1E;;;;;;;;OAQG;IACH,mGAAwE,CAAA;IAExE;;;;;;;;;;;;;OAaG;IACH,mFAAwD,CAAA;IAExD;;;;;;;;;OASG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,mHAAwF,CAAA;IAExF;;;;;;;;;OASG;IACH,qGAA0E,CAAA;IAE1E,mGAAmG;IACnG,EAAE;IACF,gGAAgG;IAChG,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IAEnG;;;;;;;OAOG;IACH,2GAAgF,CAAA;IAEhF;;;;;;;OAOG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,2GAAgF,CAAA;IAEhF;;;OAGG;IACH,+FAAoE,CAAA;IAEpE;;;;;;;OAOG;IACH,iGAAsE,CAAA;IAEtE;;;;;;;OAOG;IACH,2FAAgE,CAAA;IAEhE;;;;;OAKG;IACH,mFAAwD,CAAA;IAExD;;;;;;;;;;;;OAYG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,6GAAkF,CAAA;IAElF,mGAAmG;IACnG,EAAE;IACF,sHAAsH;IACtH,uHAAuH;IACvH,oHAAoH;IACpH,kHAAkH;IAClH,2GAA2G;IAE3G;;;;OAIG;IACH,mIAAwG,CAAA;IAExG;;;;OAIG;IACH,6FAAkE,CAAA;IAElE;;;;;;;;OAQG;IACH,uFAA4D,CAAA;IAE5D;;;;;;OAMG;IACH,yGAA8E,CAAA;IAE9E,mGAAmG;IACnG,EAAE;IACF,iHAAiH;IACjH,8GAA8G;IAC9G,uBAAuB;IAEvB;;;;;;;;;OASG;IACH,mGAAwE,CAAA;IAExE;;;;OAIG;IACH,iHAAsF,CAAA;IAEtF,kGAAkG;IAClG,EAAE;IACF,mHAAmH;IACnH,uHAAuH;IACvH,+KAA+K;IAE/K;;;OAGG;IACH,mIAAwG,CAAA;IAExG;;;;OAIG;IACH,iHAAsF,CAAA;IAEtF,yHAAyH;IACzH,6FAAkE,CAAA;IAElE,6EAA6E;IAC7E,uFAA4D,CAAA;IAE5D;;;;OAIG;IACH,6GAAkF,CAAA;IAElF;;;OAGG;IACH,2GAAgF,CAAA;IAEhF,mGAAmG;IACnG,yFAA8D,CAAA;IAE9D,+GAA+G;IAC/G,yFAA8D,CAAA;IAE9D;;;OAGG;IACH,+GAAoF,CAAA;IAEpF;;;OAGG;IACH,6GAAkF,CAAA;IAElF;;;OAGG;IACH,iGAAsE,CAAA;IAEtE;;;;OAIG;IACH,uGAA4E,CAAA;IAE5E,qGAAqG;IACrG,2FAAgE,CAAA;IAEhE;;;;;OAKG;IACH,+EAAoD,CAAA;AACtD,CAAC,EA9ZW,uBAAuB,KAAvB,uBAAuB,QA8ZlC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,mCAoBX;AApBD,WAAY,mCAAmC;IAC7C,wEAAwE;IACxE,gFAAyC,CAAA;IACzC,qGAAqG;IACrG,sFAA+C,CAAA;IAC/C;;;;OAIG;IACH,kGAA2D,CAAA;IAC3D,2GAA2G;IAC3G,4FAAqD,CAAA;IACrD,mHAAmH;IACnH,4EAAqC,CAAA;IACrC;;;OAGG;IACH,4GAAqE,CAAA;AACvE,CAAC,EApBW,mCAAmC,KAAnC,mCAAmC,QAoB9C;AACD,sEAAsE;AAEtE;;;GAGG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,6DAA6D;MACrH,4HAA4H;MAC5H,0GAA0G,CAAC","sourcesContent":["/**\n * Stable codes a client can branch on when a system of record refuses (#1055).\n *\n * Two audiences, and the split matters because the remedies are different people's work:\n *\n * - **Boot codes** name an incoherent DECLARATION — a vendor nothing ships, a dialect the facet does\n *   not speak, a slot the environment never supplied. Every one of them is fixed by editing a file\n *   and restarting, which needs no running companion, so refusing at boot is legitimate\n *   (`continuity-drift-and-cas-basis.md` Rule 3 — the remedy does not route back through the thing\n *   that just refused).\n * - **Request codes** name a state of the WORLD at the moment of a read or a write: this environment\n *   has no access to the instance, the owner organization is not seeded yet, a write landed in a\n *   partition the caller may not touch, or its outcome is unknown. None is an authoring mistake, and\n *   each must answer with a code rather than a 500 or a silent empty list.\n *\n * Carried in the error's `context.code`, which survives `sanitizeErrorForClient` for `CONFLICT` and\n * `VALIDATION` — the reason those two error types are used here rather than `AUTHORIZATION`, whose\n * context is stripped entirely. A refusal a client cannot branch on is a refusal a client will retry.\n */\n\n/**\n * @wildo_source:part:start saas.models.system-of-record-error-codes facet:layer:shared facet:audience:app-developer\n *\n * Why a system of record could not be prepared, read, or written — the stable `context.code` a client branches on.\n * Imported from `@wildo-ai/saas-models`. Request codes ride a `CONFLICT` (409) or `VALIDATION` (400) answer, the two\n * error types whose context reaches the client.\n */\nexport enum SystemOfRecordErrorCode {\n  /**\n   * BOOT — an instance names a vendor no facet answers to.\n   *\n   * The framework's facets ship in the opt-in library `@wildo-ai/systems-of-record` (#2013), and an augmentation\n   * package an instance opts into may add others, so this means the vendor is spelled wrong OR the package that\n   * owns it is not installed. The message names both, because from inside the registry the two are\n   * indistinguishable, and names the library and its remedy.\n   */\n  VENDOR_HAS_NO_FACET = 'SYSTEM_OF_RECORD_VENDOR_HAS_NO_FACET',\n\n  /**\n   * BOOT — the application declares systems of record, but its provider runtime artifact lists no facet\n   * modules at all: it predates the field, or was never generated. Distinct from\n   * {@link VENDOR_HAS_NO_FACET}, because the remedy is a regeneration rather than a spelling or an\n   * install, and reporting it as that one sent a correct configuration looking for a typo (2026-09-24).\n   */\n  FACET_MODULES_NOT_GENERATED = 'SYSTEM_OF_RECORD_FACET_MODULES_NOT_GENERATED',\n\n  /**\n   * BOOT — an instance opts into a facet AUGMENTATION (#1675) from a package that ships none for its\n   * vendor: `wildo config sync` did not record its `<package>/systems-of-record` module (a package discovery\n   * does not walk by name must be listed in `providers.packages`, #1676), the recorded module fails to load\n   * (the import error is named), or it augments other vendors only. `wildo config sync` refuses the first\n   * case too, before anything starts. Named rather than ignored, because an augmentation the author believes\n   * applies — a partition declaration, say — that silently does not is a confinement they think they have.\n   */\n  FACET_AUGMENTATION_NOT_FOUND = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_NOT_FOUND',\n\n  /**\n   * BOOT — an opted-in augmentation (#1675) fails the augmentation schema, or the facet it produces once\n   * merged into the base fails the facet schema. The refusal names the package and the instance rather\n   * than surfacing a bare schema error that names neither.\n   */\n  FACET_AUGMENTATION_INVALID = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_INVALID',\n\n  /**\n   * BOOT — two facet modules each present a BASE facet for one vendor (#1675). Refused naming both,\n   * because the base carries the vendor's partition and \"first in module order\" would let whichever\n   * package name sorts first decide how a tenant's rows are confined. A package that adds to a vendor it\n   * does not own ships an augmentation an instance opts into.\n   */\n  FACET_BASE_CONFLICT = 'SYSTEM_OF_RECORD_FACET_BASE_CONFLICT',\n\n  /**\n   * BOOT — two sources declare the same thing for one instance's vendor (#1675): a partition declared by\n   * the base facet AND an augmentation, or by two augmentations; one credential kind offered twice. The\n   * facet is the single partition authority, so which declaration confines a tenant's rows must never\n   * depend on order. The refusal names both sources.\n   */\n  FACET_AUGMENTATION_CONFLICT = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_CONFLICT',\n\n  /**\n   * BOOT — the instance declares a dialect its vendor's facet does not speak.\n   *\n   * A vendor may legitimately offer several (a service reachable over OData v4 and a bespoke REST\n   * surface is one vendor, two ways in), so this is checked against the facet's list rather than\n   * assumed from the vendor.\n   */\n  DIALECT_NOT_SPOKEN_BY_VENDOR = 'SYSTEM_OF_RECORD_DIALECT_NOT_SPOKEN_BY_VENDOR',\n\n  /**\n   * BOOT — the instance names a credential kind its vendor does not offer.\n   */\n  CREDENTIAL_KIND_NOT_OFFERED = 'SYSTEM_OF_RECORD_CREDENTIAL_KIND_NOT_OFFERED',\n\n  /**\n   * BOOT — the vendor offers several credential kinds and the instance named none.\n   *\n   * Only reachable once a facet offers more than one (#1056). Until then the kind is DERIVED and an\n   * author is never asked for something with a single legal answer.\n   */\n  CREDENTIAL_KIND_AMBIGUOUS = 'SYSTEM_OF_RECORD_CREDENTIAL_KIND_AMBIGUOUS',\n\n  /**\n   * BOOT — a required slot's environment variable is unset while the environment DID author a block\n   * for the instance (#1055 E4).\n   *\n   * Distinct from the instance being declared absent: an environment that has no access says so with\n   * `{ enabled: false }`, and this is what is left — an environment that meant to have access and is\n   * missing a value. Silence is not a declaration, which is why these two are separable at all.\n   */\n  REQUIRED_SLOT_MISSING = 'SYSTEM_OF_RECORD_REQUIRED_SLOT_MISSING',\n\n  /**\n   * BOOT — a resource's `httpApiBinding` names an instance the application does not declare.\n   *\n   * Checked at REGISTRATION rather than in the resource factory, because the factory runs in the\n   * application's `shared-lib` where the saas configuration is not in scope. The factory checks\n   * SHAPE; this checks AGREEMENT, at the first moment both are visible.\n   */\n  BINDING_NAMES_UNDECLARED_SYSTEM = 'SYSTEM_OF_RECORD_BINDING_NAMES_UNDECLARED_SYSTEM',\n\n  /**\n   * BOOT — a binding's dialect and its instance's dialect disagree.\n   *\n   * Both are authored, in different files, and the binding's is the discriminator of its own\n   * per-dialect union — so the binding cannot simply inherit the instance's, and the disagreement has\n   * to be refused where both are known.\n   */\n  BINDING_DIALECT_DISAGREES_WITH_SYSTEM = 'SYSTEM_OF_RECORD_BINDING_DIALECT_DISAGREES_WITH_SYSTEM',\n\n  /**\n   * REQUEST — this environment declared it has no access to the instance (#1055 E3).\n   *\n   * A developer laptop and a staging with no ERP are the ordinary case. The application boots, every\n   * other resource works, and a read on a bound resource answers this rather than a transport error\n   * against an address nobody authored.\n   */\n  UNAVAILABLE_IN_ENVIRONMENT = 'SYSTEM_OF_RECORD_UNAVAILABLE_IN_ENVIRONMENT',\n\n  /**\n   * REQUEST — the application has no owner organization to stamp remote rows with (#1055 E10,\n   * resting on #1054 E1).\n   *\n   * A fresh install before bootstrap runs is the real case. Rows read out of a system of record carry\n   * the owner organization's id so the per-row tenant gate passes without an exemption; with no owner\n   * there is nothing to stamp, and answering an empty list would say \"this system holds nothing about\n   * you\", which is false.\n   */\n  OWNER_ORGANIZATION_ABSENT = 'SYSTEM_OF_RECORD_OWNER_ORGANIZATION_ABSENT',\n\n  /**\n   * REQUEST — the instance's token endpoint could not be reached, refused to mint, or answered\n   * something that is not a token (#1056 E2, E3; R11).\n   *\n   * ONE code for the whole family rather than one per failure, with a `reason` in the context and an\n   * optional `retryAfterSeconds` taken from the answer's `Retry-After`. The family is deliberately\n   * coarse because every member has the same shape from a caller's side: the remote is not currently\n   * giving us an identity, the request cannot proceed, and retrying later may work. Splitting it\n   * would ask a client to branch on a distinction it cannot act on differently.\n   *\n   * Never carries the token endpoint's own `error_description` verbatim into a client-visible\n   * message: an authorization server is entitled to say things about the credential, and a\n   * credential's failure mode is not an application user's business. The detail is logged.\n   */\n  TOKEN_UNAVAILABLE = 'SYSTEM_OF_RECORD_TOKEN_UNAVAILABLE',\n\n  /**\n   * BOOT — the instance's credential material cannot produce a credential at all: an encrypted\n   * private key (#1056 E6), a certificate whose validity window does not contain now (E7), a BASIC\n   * username carrying the `:` that RFC 7617 makes the delimiter (E11).\n   *\n   * Separate from {@link REQUIRED_SLOT_MISSING} because the remedy is different: a value IS present\n   * and it is the wrong KIND of value, so an operator re-reading their environment for a blank finds\n   * nothing. Refused at boot rather than at the first read — the material is known then, and a\n   * certificate that expired last week should not first be noticed by a user.\n   */\n  CREDENTIAL_MATERIAL_UNUSABLE = 'SYSTEM_OF_RECORD_CREDENTIAL_MATERIAL_UNUSABLE',\n\n  /**\n   * BOOT — the instance opts into partitioning and its vendor declares none (#1058).\n   *\n   * Refused rather than ignored, for the reason the `partition` field was RESERVED for three slices:\n   * an author who writes `partition: true` and sees it accepted believes their rows are confined to\n   * organization units while every member still sees every row. An accepted declaration that does\n   * nothing is worse than a refusal, because only one of the two is visible.\n   */\n  PARTITION_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_PARTITION_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * BOOT — the instance opts into partitioning and its vendor partitions by a PATH SEGMENT, which\n   * this engine cannot confine (#1058 E9).\n   *\n   * A path segment is chosen before the request is built, so it cannot express \"these three\n   * companies\" in one read: the confinement would have to fan out into one request per unit, which is\n   * a different MECHANISM rather than a different predicate. Distinct from the code above because the\n   * remedy differs — there the vendor has no partitions at all, here it has partitions this engine\n   * does not yet reach, and only the second is a gap on our side.\n   */\n  PARTITION_KIND_UNSUPPORTED = 'SYSTEM_OF_RECORD_PARTITION_KIND_UNSUPPORTED',\n\n  // ─── Writes (#1679) ─────────────────────────────────────────────────────────────────────────────\n  //\n  // Every REQUEST code below is raised BEFORE anything is sent, except the two that name what the\n  // remote did (OUTCOME_UNKNOWN, APPLIED_FOLLOW_UP_FAILED) and the admission codes, which name what a\n  // retried request would do. A refusal before the send is safe to retry once the cause is fixed;\n  // the other two are the cases a client must NOT blindly retry, which is why they are codes at all.\n\n  /**\n   * BOOT — a binding opens a write verb whose DIALECT has no write implementation in this engine yet.\n   *\n   * Refused at boot rather than at the first write, for the reason every declaration refusal here is:\n   * the remedy is editing a file (remove the verb, or wait for the dialect), so nothing needs a\n   * running application to fix it. The message names the dialect, because that is the half an author\n   * cannot see from their own binding.\n   */\n  WRITE_DIALECT_NOT_IMPLEMENTED = 'SYSTEM_OF_RECORD_WRITE_DIALECT_NOT_IMPLEMENTED',\n\n  /**\n   * REQUEST — the write was scoped to an organization that does not own the application.\n   *\n   * A system of record's rows belong to the OWNER organization (#1055 Q2). A read under another\n   * organization answers an empty page, because an empty page is a true statement about what that\n   * tenant may see; a write has no such honest empty answer, so it is refused, before anything is\n   * sent, and the refusal is audited.\n   */\n  WRITE_ORGANIZATION_NOT_OWNER = 'SYSTEM_OF_RECORD_WRITE_ORGANIZATION_NOT_OWNER',\n\n  /**\n   * REQUEST — a CREATE on a partitioned instance could not tell which organization unit the new row\n   * belongs to, and the caller must name one (`organizationUnitId` in the payload).\n   *\n   * Reached by a member confined to SEVERAL units that own a partition of this instance, and by an\n   * organization-wide caller, who is entitled to every assigned partition and so has no single answer.\n   * Distinct from {@link WRITE_PARTITION_REFUSED} because the remedy is to ADD something, not to change it.\n   */\n  WRITE_PARTITION_UNIT_REQUIRED = 'SYSTEM_OF_RECORD_WRITE_PARTITION_UNIT_REQUIRED',\n\n  /**\n   * REQUEST — the partition this write would land in is not one the caller may write. The context\n   * carries a {@link SystemOfRecordWritePartitionRefusal} naming which rule refused.\n   */\n  WRITE_PARTITION_REFUSED = 'SYSTEM_OF_RECORD_WRITE_PARTITION_REFUSED',\n\n  /**\n   * REQUEST — the payload writes a field the engine owns: the partition field (it is DERIVED from the\n   * organization unit on create and never moves afterwards), the owner organization stamp, the unit\n   * stamp on update, or a key component.\n   *\n   * Refused rather than stripped. A caller who sends a partition value believes it decides where the\n   * row lands; silently discarding it would put the row somewhere they did not ask for.\n   */\n  WRITE_FIELD_NOT_WRITABLE = 'SYSTEM_OF_RECORD_WRITE_FIELD_NOT_WRITABLE',\n\n  /**\n   * REQUEST — the write was SENT and nobody knows whether the system of record applied it: the call\n   * timed out, the connection dropped after the request left, or a gateway answered for the vendor.\n   *\n   * The one answer a client must not treat as \"not written\". A retry with the SAME `Idempotency-Key`\n   * answers this again without sending anything; the way forward is to READ the row (or search for it)\n   * and decide, then send a NEW request under a new key if it is genuinely missing.\n   */\n  WRITE_OUTCOME_UNKNOWN = 'SYSTEM_OF_RECORD_WRITE_OUTCOME_UNKNOWN',\n\n  /**\n   * REQUEST — a request with this `Idempotency-Key` is being sent right now. The client retried before\n   * the first attempt settled; answering it would mean sending the write twice.\n   *\n   * Answered `409` (a CONFLICT carrying this code): wait, then retry the SAME request under the same key.\n   */\n  WRITE_IN_PROGRESS = 'SYSTEM_OF_RECORD_WRITE_IN_PROGRESS',\n\n  /**\n   * REQUEST — this `Idempotency-Key` was already used for a DIFFERENT write (another target, verb or\n   * payload). A key names one request; replaying the first request's outcome for a second one would\n   * tell the caller something false about the second.\n   *\n   * Answered `422` with `customMessageReference: IDEMPOTENCY_KEY_REUSED` (#1941) — the status and the\n   * reference the engine's generic request idempotency answers a reused key with, so a client learns ONE\n   * spelling. A 422's context is stripped on the wire, so THIS code does not reach an HTTP client: it is\n   * what an in-process caller catching the error reads (`context.code`), and what the trail and the\n   * refusal audit row record. Never retry the request as it is; send a new request under a new key.\n   * spec-cite: draft-ietf-httpapi-idempotency-key-header-07 §2.7 (reused key with a different payload → 422;\n   * a request still being processed → 409).\n   */\n  WRITE_IDEMPOTENCY_KEY_REUSED = 'SYSTEM_OF_RECORD_WRITE_IDEMPOTENCY_KEY_REUSED',\n\n  /**\n   * REQUEST — the system of record APPLIED the write, and something the engine did after it failed\n   * (a postfix hook, a local lifecycle step, the response description).\n   *\n   * Never reported as a failure to write: the remote change is durable and nothing here can undo it.\n   * The context names the written row, so the caller can read it; a retry with the same key replays\n   * the applied outcome rather than writing again.\n   */\n  WRITE_APPLIED_FOLLOW_UP_FAILED = 'SYSTEM_OF_RECORD_WRITE_APPLIED_FOLLOW_UP_FAILED',\n\n  // ─── Version-checked updates (#1724, #1726) ─────────────────────────────────────────────────────\n  //\n  // A binding may declare `writeConcurrency: VERSION_CHECKED`: the caller sends the row version it read, and the engine\n  // compares it with the row it reads just before sending. On a system with no CONDITIONAL write (Odoo) that NARROWS the\n  // lost-update race and does not close it — the comparison and the write are two calls, and a change landing between\n  // them is overwritten. On OData the same version then travels as `If-Match`, and the vendor closes the gap itself\n  // (`WRITE_PRECONDITION_FAILED` below). The request codes in this block are raised BEFORE anything is sent.\n\n  /**\n   * BOOT — a binding declares `writeConcurrency: VERSION_CHECKED` and its vendor facet names no row version field\n   * (`rowVersionField`), or the binding's version field does not map onto that remote field. The check would compare a\n   * value the vendor does not maintain, and so would refuse or admit writes for no reason at all.\n   */\n  WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * REQUEST — an UPDATE on a `VERSION_CHECKED` binding carried no row version. The binding declared that every change is\n   * checked against the version its author read; an update without one would silently be last-writer-wins. Send the\n   * version field exactly as the read answered it.\n   */\n  WRITE_VERSION_REQUIRED = 'SYSTEM_OF_RECORD_WRITE_VERSION_REQUIRED',\n\n  /**\n   * REQUEST — the row changed since the caller read it: the version it sent is not the version the system of record\n   * answered just before the write. Nothing was sent. Read the row again and decide.\n   *\n   * BEST-EFFORT on Odoo, and the refusal's message says so: a change landing between that read and the write is not\n   * seen, and a vendor that serves its version coarsely (Odoo serves `write_date` to the SECOND) cannot tell two changes\n   * made in the same second apart. The absence of this code is therefore not proof that nobody else changed the row. On\n   * OData the change landing in that gap is refused by the vendor instead, as `WRITE_PRECONDITION_FAILED`.\n   */\n  WRITE_VERSION_STALE = 'SYSTEM_OF_RECORD_WRITE_VERSION_STALE',\n\n  /**\n   * REQUEST — an UPDATE on a `VERSION_CHECKED` binding, and the row the engine read just before writing carries NO\n   * version at all (#1726). Not \"stale\": nobody changed anything. The vendor serves no version for this row — an OData\n   * service that returns no `@odata.etag` for this entity set, although OData lets each set decide — so the binding's\n   * stance cannot be honoured for it. Nothing was sent. The remedy is the\n   * binding's, not the caller's: declare `LAST_WRITER_WINS` for this entity set, or have the vendor serve its versions.\n   */\n  WRITE_ROW_VERSION_NOT_SERVED = 'SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SERVED',\n\n  // ─── Conditional writes (#1726) ─────────────────────────────────────────────────────────────────\n  //\n  // A vendor that offers a real precondition (OData `If-Match` against the row's entity tag) refuses a stale write\n  // ITSELF, atomically — so the refusal arrives from the remote, after the write was sent, and still means that\n  // nothing was applied.\n\n  /**\n   * REQUEST — the system of record refused an UPDATE or DELETE because the row's version no longer matched the one the\n   * write was conditioned on: an OData `412 Precondition Failed` answering the `If-Match` the engine sent (#1726).\n   *\n   * Unlike {@link WRITE_VERSION_STALE} this is the VENDOR's decision, taken atomically against the row it was about to\n   * change, and the protocol requires that it change nothing — so it is a definite refusal, never an unknown outcome,\n   * and it is never retried: re-sending the same precondition would only be refused again. Read the row again and\n   * decide.\n   * spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match).\n   */\n  WRITE_PRECONDITION_FAILED = 'SYSTEM_OF_RECORD_WRITE_PRECONDITION_FAILED',\n\n  /**\n   * BOOT — a binding opens writes toward a vendor whose facet lists a step it requires before any modifying request\n   * (`writePrerequisites`, e.g. SAP Gateway's `X-CSRF-Token` handshake) that this engine does not perform (#1726). Every\n   * such write would be refused by the vendor; the binding stays read-only until the engine performs the step.\n   */\n  WRITE_PREREQUISITE_NOT_SUPPORTED = 'SYSTEM_OF_RECORD_WRITE_PREREQUISITE_NOT_SUPPORTED',\n\n  // ── Declared ACTIONS (#1678) ───────────────────────────────────────────────────────────────────\n  //\n  // An action re-uses the write path's key-ledger answers as they are — WRITE_OUTCOME_UNKNOWN, WRITE_IN_PROGRESS and\n  // WRITE_IDEMPOTENCY_KEY_REUSED mean exactly the same thing for an action as for a row write, and a client that already\n  // branches on them must not learn a second spelling. Both doors answer them from one table, statuses included (#1941). What follows is what only an action can be refused for.\n\n  /**\n   * BOOT — a binding declares an action whose call shape the instance's vendor facet does not list\n   * (`actionCallShapes`). The vendor's product does not expose actions that way, so the declaration could never run.\n   */\n  ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * BOOT — a record-free action toward a PARTITIONED instance declares no partition stance. It must say either why it\n   * reaches no partitioned data, or which parameter carries the partition the engine derives from the caller's unit;\n   * otherwise one member's action could land in every company.\n   */\n  ACTION_PARTITION_STANCE_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_STANCE_REQUIRED',\n\n  /** BOOT — two bindings of one instance declare the same action name; callers address an action by `(system, action)`. */\n  ACTION_NAME_DUPLICATED = 'SYSTEM_OF_RECORD_ACTION_NAME_DUPLICATED',\n\n  /** REQUEST — no binding of this instance declares an action of that name. */\n  ACTION_NOT_DECLARED = 'SYSTEM_OF_RECORD_ACTION_NOT_DECLARED',\n\n  /**\n   * REQUEST — this kind of context may not run this action: an anonymous or public execution, an application-scoped\n   * machine with no organization, or a system context (batch, cron, webhook, an autonomous agent with nobody behind it)\n   * on an action that does not declare `admitsSystemInitiation`.\n   */\n  ACTION_INITIATION_NOT_ADMITTED = 'SYSTEM_OF_RECORD_ACTION_INITIATION_NOT_ADMITTED',\n\n  /**\n   * REQUEST — the action was initiated for an organization that does not own the application. A system of record's rows\n   * and actions belong to the owner organization; a tenant that is not the owner never reaches the ERP.\n   */\n  ACTION_ORGANIZATION_NOT_OWNER = 'SYSTEM_OF_RECORD_ACTION_ORGANIZATION_NOT_OWNER',\n\n  /** REQUEST — the caller holds none of the roles the action declares, in the owner organization. */\n  ACTION_ROLE_NOT_HELD = 'SYSTEM_OF_RECORD_ACTION_ROLE_NOT_HELD',\n\n  /** REQUEST — the input does not satisfy the action's declared input schema; the context carries the issues. */\n  ACTION_INPUT_INVALID = 'SYSTEM_OF_RECORD_ACTION_INPUT_INVALID',\n\n  /**\n   * REQUEST — a WRITING action was called without an Idempotency-Key. A remote change cannot be rolled back, so every\n   * caller names its request; a retry under the same key then replays the first outcome instead of acting twice.\n   */\n  ACTION_IDEMPOTENCY_KEY_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_IDEMPOTENCY_KEY_REQUIRED',\n\n  /**\n   * REQUEST — a record-free action that carries the partition must know the caller's unit, and the caller is a member\n   * of several units owning partitions of this instance. Name one in `organizationUnitId`.\n   */\n  ACTION_PARTITION_UNIT_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_UNIT_REQUIRED',\n\n  /**\n   * REQUEST — the partition the action would land in is not one the caller may act in. The context carries a\n   * {@link SystemOfRecordWritePartitionRefusal} naming which rule refused — the same rules a read-through create obeys.\n   */\n  ACTION_PARTITION_REFUSED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_REFUSED',\n\n  /**\n   * REQUEST — the record a record-targeted action names is not one this caller may act on: absent, or outside its\n   * partition, or (for a shared record) not writable by a unit-confined caller. Answered as NOT_FOUND and\n   * indistinguishably, as a read answers, so an action cannot probe for records the caller may not see.\n   */\n  ACTION_TARGET_NOT_REACHABLE = 'SYSTEM_OF_RECORD_ACTION_TARGET_NOT_REACHABLE',\n\n  /** REQUEST — the system of record refused the action with a definite answer; nothing was applied. */\n  ACTION_REMOTE_REFUSED = 'SYSTEM_OF_RECORD_ACTION_REMOTE_REFUSED',\n\n  /**\n   * REQUEST — the action could not be SENT: the instance's access could not be resolved, its handshake failed, the\n   * connection was refused before the request left, the rate budget was spent, or the read-first could not reach the\n   * record. Nothing reached the vendor as an action, so nothing was applied and the Idempotency-Key may be spent again.\n   * The context carries the transport KIND (and status), never the transport's message, which names the URL.\n   */\n  ACTION_NOT_SENT = 'SYSTEM_OF_RECORD_ACTION_NOT_SENT',\n}\n\n/**\n * Which rule refused a write's PARTITION (#1679), carried as `context.reason` beside\n * {@link SystemOfRecordErrorCode.WRITE_PARTITION_REFUSED}.\n *\n * Distinct members because the remedy differs for each, and every one is somebody else's work: an\n * operator assigns partitions, an administrator grants units, an author declares the instance.\n */\nexport enum SystemOfRecordWritePartitionRefusal {\n  /** The unit named (or derived) is not one the caller's grant covers. */\n  UNIT_OUTSIDE_GRANT = 'unit_outside_grant',\n  /** The unit owns no partition of this instance, so a row created \"for it\" would belong to nobody. */\n  UNIT_HAS_NO_PARTITION = 'unit_has_no_partition',\n  /**\n   * The unit owns SEVERAL partitions of this instance, so the unit alone does not say which one the row\n   * belongs to. The operator's assignment map decides this, not the caller: one unit, one partition is\n   * what makes a create's destination derivable.\n   */\n  UNIT_HAS_SEVERAL_PARTITIONS = 'unit_has_several_partitions',\n  /** A unit was named for a write to an instance that is not partitioned — a stamp nothing would enforce. */\n  INSTANCE_NOT_PARTITIONED = 'instance_not_partitioned',\n  /** The narrowing authority denied the caller every unit (no decision, a registry disagreement, an empty grant). */\n  NARROWING_DENIED = 'narrowing_denied',\n  /**\n   * A UNIT-ONLY principal (a unit-scoped service-provider expert, #1597) writing a resource that does not\n   * narrow. The organization-wide admission such a principal may hold covers reads only.\n   */\n  UNIT_ONLY_PRINCIPAL_NOT_ADMITTED = 'unit_only_principal_not_admitted',\n}\n/** @wildo_source:part:end saas.models.system-of-record-error-codes */\n\n/**\n * Why an opted-in package whose module `wildo config sync` did not record is refused, and what to do (#1675, #1676).\n * One sentence for the backend's resolver, `wildo secrets` and config sync's own check, so the three agree.\n */\nexport const SYSTEM_OF_RECORD_FACET_MODULE_NOT_DISCOVERED = '`wildo config sync` did not discover it. A package outside '\n  + 'the framework\\'s own names and the application\\'s `<scope>/provider-*` is walked only when `providers.packages` lists it, '\n  + 'and the backend must depend on it and it must export `./systems-of-record`; then run `wildo config sync`';\n"]}
+{"version":3,"file":"system-of-record-error-codes.shared.js","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-error-codes.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,uBA8ZX;AA9ZD,WAAY,uBAAuB;IACjC;;;;;;;OAOG;IACH,uFAA4D,CAAA;IAE5D;;;;;OAKG;IACH,uGAA4E,CAAA;IAE5E;;;;;;;OAOG;IACH,yGAA8E,CAAA;IAE9E;;;;OAIG;IACH,qGAA0E,CAAA;IAE1E;;;;;OAKG;IACH,uFAA4D,CAAA;IAE5D;;;;;OAKG;IACH,uGAA4E,CAAA;IAE5E;;;;;;OAMG;IACH,yGAA8E,CAAA;IAE9E;;OAEG;IACH,uGAA4E,CAAA;IAE5E;;;;;OAKG;IACH,mGAAwE,CAAA;IAExE;;;;;;;OAOG;IACH,2FAAgE,CAAA;IAEhE;;;;;;OAMG;IACH,+GAAoF,CAAA;IAEpF;;;;;;OAMG;IACH,2HAAgG,CAAA;IAEhG;;;;;;OAMG;IACH,qGAA0E,CAAA;IAE1E;;;;;;;;OAQG;IACH,mGAAwE,CAAA;IAExE;;;;;;;;;;;;;OAaG;IACH,mFAAwD,CAAA;IAExD;;;;;;;;;OASG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,mHAAwF,CAAA;IAExF;;;;;;;;;OASG;IACH,qGAA0E,CAAA;IAE1E,mGAAmG;IACnG,EAAE;IACF,gGAAgG;IAChG,oGAAoG;IACpG,gGAAgG;IAChG,mGAAmG;IAEnG;;;;;;;OAOG;IACH,2GAAgF,CAAA;IAEhF;;;;;;;OAOG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,2GAAgF,CAAA;IAEhF;;;OAGG;IACH,+FAAoE,CAAA;IAEpE;;;;;;;OAOG;IACH,iGAAsE,CAAA;IAEtE;;;;;;;OAOG;IACH,2FAAgE,CAAA;IAEhE;;;;;OAKG;IACH,mFAAwD,CAAA;IAExD;;;;;;;;;;;;OAYG;IACH,yGAA8E,CAAA;IAE9E;;;;;;;OAOG;IACH,6GAAkF,CAAA;IAElF,mGAAmG;IACnG,EAAE;IACF,sHAAsH;IACtH,uHAAuH;IACvH,oHAAoH;IACpH,kHAAkH;IAClH,2GAA2G;IAE3G;;;;OAIG;IACH,mIAAwG,CAAA;IAExG;;;;OAIG;IACH,6FAAkE,CAAA;IAElE;;;;;;;;OAQG;IACH,uFAA4D,CAAA;IAE5D;;;;;;OAMG;IACH,yGAA8E,CAAA;IAE9E,mGAAmG;IACnG,EAAE;IACF,iHAAiH;IACjH,8GAA8G;IAC9G,uBAAuB;IAEvB;;;;;;;;;OASG;IACH,mGAAwE,CAAA;IAExE;;;;OAIG;IACH,iHAAsF,CAAA;IAEtF,kGAAkG;IAClG,EAAE;IACF,mHAAmH;IACnH,uHAAuH;IACvH,+KAA+K;IAE/K;;;OAGG;IACH,mIAAwG,CAAA;IAExG;;;;OAIG;IACH,iHAAsF,CAAA;IAEtF,yHAAyH;IACzH,6FAAkE,CAAA;IAElE,6EAA6E;IAC7E,uFAA4D,CAAA;IAE5D;;;;OAIG;IACH,6GAAkF,CAAA;IAElF;;;OAGG;IACH,2GAAgF,CAAA;IAEhF,mGAAmG;IACnG,yFAA8D,CAAA;IAE9D,+GAA+G;IAC/G,yFAA8D,CAAA;IAE9D;;;OAGG;IACH,+GAAoF,CAAA;IAEpF;;;OAGG;IACH,6GAAkF,CAAA;IAElF;;;OAGG;IACH,iGAAsE,CAAA;IAEtE;;;;OAIG;IACH,uGAA4E,CAAA;IAE5E,qGAAqG;IACrG,2FAAgE,CAAA;IAEhE;;;;;OAKG;IACH,+EAAoD,CAAA;AACtD,CAAC,EA9ZW,uBAAuB,KAAvB,uBAAuB,QA8ZlC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,mCAoBX;AApBD,WAAY,mCAAmC;IAC7C,wEAAwE;IACxE,gFAAyC,CAAA;IACzC,qGAAqG;IACrG,sFAA+C,CAAA;IAC/C;;;;OAIG;IACH,kGAA2D,CAAA;IAC3D,2GAA2G;IAC3G,4FAAqD,CAAA;IACrD,mHAAmH;IACnH,4EAAqC,CAAA;IACrC;;;OAGG;IACH,4GAAqE,CAAA;AACvE,CAAC,EApBW,mCAAmC,KAAnC,mCAAmC,QAoB9C;AACD,sEAAsE;AAEtE;;;GAGG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,6DAA6D;MACrH,4HAA4H;MAC5H,0GAA0G,CAAC","sourcesContent":["/**\n * Stable codes a client can branch on when a system of record refuses (#1055).\n *\n * Two audiences, and the split matters because the remedies are different people's work:\n *\n * - **Boot codes** name an incoherent DECLARATION — a vendor nothing ships, a dialect the facet does\n *   not speak, a slot the environment never supplied. Every one of them is fixed by editing a file\n *   and restarting, which needs no running companion, so refusing at boot is legitimate\n *   (`continuity-drift-and-cas-basis.md` Rule 3 — the remedy does not route back through the thing\n *   that just refused).\n * - **Request codes** name a state of the WORLD at the moment of a read or a write: this environment\n *   has no access to the instance, the owner organization is not seeded yet, a write landed in a\n *   partition the caller may not touch, or its outcome is unknown. None is an authoring mistake, and\n *   each must answer with a code rather than a 500 or a silent empty list.\n *\n * Carried in the error's `context.code`, which survives `sanitizeErrorForClient` for `CONFLICT` and\n * `VALIDATION` — the reason those two error types are used here rather than `AUTHORIZATION`, whose\n * context is stripped entirely. A refusal a client cannot branch on is a refusal a client will retry.\n */\n\n/**\n * @wildo_source:part:start saas.models.system-of-record-error-codes facet:layer:shared facet:audience:app-developer\n *\n * Why a system of record could not be prepared, read, or written — the stable `context.code` a client branches on.\n * Imported from `@wildo-ai/saas-models`. Request codes ride a `CONFLICT` (409) or `VALIDATION` (400) answer, the two\n * error types whose context reaches the client.\n */\nexport enum SystemOfRecordErrorCode {\n  /**\n   * BOOT — an instance names a vendor no facet answers to.\n   *\n   * The framework's facets ship in the opt-in library `@wildo-ai/systems-of-record` (#2013), and an augmentation\n   * package an instance opts into may add others, so this means the vendor is spelled wrong OR the package that\n   * owns it is not installed. The message names both, because from inside the registry the two are\n   * indistinguishable, and names the library and its remedy.\n   */\n  VENDOR_HAS_NO_FACET = 'SYSTEM_OF_RECORD_VENDOR_HAS_NO_FACET',\n\n  /**\n   * BOOT — the application declares systems of record, but its provider runtime artifact lists no facet\n   * modules at all: it predates the field, or was never generated. Distinct from\n   * {@link VENDOR_HAS_NO_FACET}, because the remedy is a regeneration rather than a spelling or an\n   * install, and reporting it as that one sent a correct configuration looking for a typo (2026-09-24).\n   */\n  FACET_MODULES_NOT_GENERATED = 'SYSTEM_OF_RECORD_FACET_MODULES_NOT_GENERATED',\n\n  /**\n   * BOOT — an instance opts into a facet AUGMENTATION (#1675) from a package that ships none for its\n   * vendor: `wildo config sync` did not record its `<package>/systems-of-record` module (a package discovery\n   * does not walk by name must be listed in `providers.packages`, #1676), the recorded module fails to load\n   * (the import error is named), or it augments other vendors only. `wildo config sync` refuses the first\n   * case too, before anything starts. Named rather than ignored, because an augmentation the author believes\n   * applies — a partition declaration, say — that silently does not is a confinement they think they have.\n   */\n  FACET_AUGMENTATION_NOT_FOUND = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_NOT_FOUND',\n\n  /**\n   * BOOT — an opted-in augmentation (#1675) fails the augmentation schema, or the facet it produces once\n   * merged into the base fails the facet schema. The refusal names the package and the instance rather\n   * than surfacing a bare schema error that names neither.\n   */\n  FACET_AUGMENTATION_INVALID = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_INVALID',\n\n  /**\n   * BOOT — two facet modules each present a BASE facet for one vendor (#1675). Refused naming both,\n   * because the base carries the vendor's partition and \"first in module order\" would let whichever\n   * package name sorts first decide how a tenant's rows are confined. A package that adds to a vendor it\n   * does not own ships an augmentation an instance opts into.\n   */\n  FACET_BASE_CONFLICT = 'SYSTEM_OF_RECORD_FACET_BASE_CONFLICT',\n\n  /**\n   * BOOT — two sources declare the same thing for one instance's vendor (#1675): a partition declared by\n   * the base facet AND an augmentation, or by two augmentations; one credential kind offered twice. The\n   * facet is the single partition authority, so which declaration confines a tenant's rows must never\n   * depend on order. The refusal names both sources.\n   */\n  FACET_AUGMENTATION_CONFLICT = 'SYSTEM_OF_RECORD_FACET_AUGMENTATION_CONFLICT',\n\n  /**\n   * BOOT — the instance declares a dialect its vendor's facet does not speak.\n   *\n   * A vendor may legitimately offer several (a service reachable over OData v4 and a bespoke REST\n   * surface is one vendor, two ways in), so this is checked against the facet's list rather than\n   * assumed from the vendor.\n   */\n  DIALECT_NOT_SPOKEN_BY_VENDOR = 'SYSTEM_OF_RECORD_DIALECT_NOT_SPOKEN_BY_VENDOR',\n\n  /**\n   * BOOT — the instance names a credential kind its vendor does not offer.\n   */\n  CREDENTIAL_KIND_NOT_OFFERED = 'SYSTEM_OF_RECORD_CREDENTIAL_KIND_NOT_OFFERED',\n\n  /**\n   * BOOT — the vendor offers several credential kinds and the instance named none.\n   *\n   * Only reachable once a facet offers more than one (#1056). Until then the kind is DERIVED and an\n   * author is never asked for something with a single legal answer.\n   */\n  CREDENTIAL_KIND_AMBIGUOUS = 'SYSTEM_OF_RECORD_CREDENTIAL_KIND_AMBIGUOUS',\n\n  /**\n   * BOOT — a required slot's environment variable is unset while the environment DID author a block\n   * for the instance (#1055 E4).\n   *\n   * Distinct from the instance being declared absent: an environment that has no access says so with\n   * `{ enabled: false }`, and this is what is left — an environment that meant to have access and is\n   * missing a value. Silence is not a declaration, which is why these two are separable at all.\n   */\n  REQUIRED_SLOT_MISSING = 'SYSTEM_OF_RECORD_REQUIRED_SLOT_MISSING',\n\n  /**\n   * BOOT — a resource's `httpApiBinding` names an instance the application does not declare.\n   *\n   * Checked at REGISTRATION rather than in the resource factory, because the factory runs in the\n   * application's `shared-lib` where the saas configuration is not in scope. The factory checks\n   * SHAPE; this checks AGREEMENT, at the first moment both are visible.\n   */\n  BINDING_NAMES_UNDECLARED_SYSTEM = 'SYSTEM_OF_RECORD_BINDING_NAMES_UNDECLARED_SYSTEM',\n\n  /**\n   * BOOT — a binding's dialect and its instance's dialect disagree.\n   *\n   * Both are authored, in different files, and the binding's is the discriminator of its own\n   * per-dialect union — so the binding cannot simply inherit the instance's, and the disagreement has\n   * to be refused where both are known.\n   */\n  BINDING_DIALECT_DISAGREES_WITH_SYSTEM = 'SYSTEM_OF_RECORD_BINDING_DIALECT_DISAGREES_WITH_SYSTEM',\n\n  /**\n   * REQUEST — this environment declared it has no access to the instance (#1055 E3).\n   *\n   * A developer laptop and a staging with no ERP are the ordinary case. The application boots, every\n   * other resource works, and a read on a bound resource answers this rather than a transport error\n   * against an address nobody authored.\n   */\n  UNAVAILABLE_IN_ENVIRONMENT = 'SYSTEM_OF_RECORD_UNAVAILABLE_IN_ENVIRONMENT',\n\n  /**\n   * REQUEST — the application has no owner organization to stamp remote rows with (#1055 E10,\n   * resting on #1054 E1).\n   *\n   * A fresh install before bootstrap runs is the real case. Rows read out of a system of record carry\n   * the owner organization's id so the per-row tenant gate passes without an exemption; with no owner\n   * there is nothing to stamp, and answering an empty list would say \"this system holds nothing about\n   * you\", which is false.\n   */\n  OWNER_ORGANIZATION_ABSENT = 'SYSTEM_OF_RECORD_OWNER_ORGANIZATION_ABSENT',\n\n  /**\n   * REQUEST — the instance's token endpoint could not be reached, refused to mint, or answered\n   * something that is not a token (#1056 E2, E3; R11).\n   *\n   * ONE code for the whole family rather than one per failure, with a `reason` in the context and an\n   * optional `retryAfterSeconds` taken from the answer's `Retry-After`. The family is deliberately\n   * coarse because every member has the same shape from a caller's side: the remote is not currently\n   * giving us an identity, the request cannot proceed, and retrying later may work. Splitting it\n   * would ask a client to branch on a distinction it cannot act on differently.\n   *\n   * Never carries the token endpoint's own `error_description` verbatim into a client-visible\n   * message: an authorization server is entitled to say things about the credential, and a\n   * credential's failure mode is not an application user's business. The detail is logged.\n   */\n  TOKEN_UNAVAILABLE = 'SYSTEM_OF_RECORD_TOKEN_UNAVAILABLE',\n\n  /**\n   * BOOT — the instance's credential material cannot produce a credential at all: an encrypted\n   * private key (#1056 E6), a certificate whose validity window does not contain now (E7), a BASIC\n   * username carrying the `:` that RFC 7617 makes the delimiter (E11).\n   *\n   * Separate from {@link REQUIRED_SLOT_MISSING} because the remedy is different: a value IS present\n   * and it is the wrong KIND of value, so an operator re-reading their environment for a blank finds\n   * nothing. Refused at boot rather than at the first read — the material is known then, and a\n   * certificate that expired last week should not first be noticed by a user.\n   */\n  CREDENTIAL_MATERIAL_UNUSABLE = 'SYSTEM_OF_RECORD_CREDENTIAL_MATERIAL_UNUSABLE',\n\n  /**\n   * BOOT — the instance opts into partitioning and its vendor declares none (#1058).\n   *\n   * Refused rather than ignored, for the reason the `partition` field was RESERVED for three slices:\n   * an author who writes `partition: true` and sees it accepted believes their rows are confined to\n   * organization units while every member still sees every row. An accepted declaration that does\n   * nothing is worse than a refusal, because only one of the two is visible.\n   */\n  PARTITION_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_PARTITION_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * BOOT — the instance opts into partitioning and its vendor partitions by a PATH SEGMENT, which\n   * this engine cannot confine (#1058 E9).\n   *\n   * A path segment is chosen before the request is built, so it cannot express \"these three\n   * companies\" in one read: the confinement would have to fan out into one request per unit, which is\n   * a different MECHANISM rather than a different predicate. Distinct from the code above because the\n   * remedy differs — there the vendor has no partitions at all, here it has partitions this engine\n   * does not yet reach, and only the second is a gap on our side.\n   */\n  PARTITION_KIND_UNSUPPORTED = 'SYSTEM_OF_RECORD_PARTITION_KIND_UNSUPPORTED',\n\n  // ─── Writes (#1679) ─────────────────────────────────────────────────────────────────────────────\n  //\n  // Every REQUEST code below is raised BEFORE anything is sent, except the two that name what the\n  // remote did (OUTCOME_UNKNOWN, APPLIED_FOLLOW_UP_FAILED) and the admission codes, which name what a\n  // retried request would do. A refusal before the send is safe to retry once the cause is fixed;\n  // the other two are the cases a client must NOT blindly retry, which is why they are codes at all.\n\n  /**\n   * BOOT — a binding opens a write verb whose DIALECT has no write implementation in this engine yet.\n   *\n   * Refused at boot rather than at the first write, for the reason every declaration refusal here is:\n   * the remedy is editing a file (remove the verb, or wait for the dialect), so nothing needs a\n   * running application to fix it. The message names the dialect, because that is the half an author\n   * cannot see from their own binding.\n   */\n  WRITE_DIALECT_NOT_IMPLEMENTED = 'SYSTEM_OF_RECORD_WRITE_DIALECT_NOT_IMPLEMENTED',\n\n  /**\n   * REQUEST — the write was scoped to an organization that does not own the application.\n   *\n   * A system of record's rows belong to the OWNER organization (#1055 Q2). A read under another\n   * organization answers an empty page, because an empty page is a true statement about what that\n   * tenant may see; a write has no such honest empty answer, so it is refused, before anything is\n   * sent, and the refusal is audited.\n   */\n  WRITE_ORGANIZATION_NOT_OWNER = 'SYSTEM_OF_RECORD_WRITE_ORGANIZATION_NOT_OWNER',\n\n  /**\n   * REQUEST — a CREATE on a partitioned instance could not tell which organization unit the new row\n   * belongs to, and the caller must name one (`organizationUnitId` in the payload).\n   *\n   * Reached by a member confined to SEVERAL units that own a partition of this instance, and by an\n   * organization-wide caller, who is entitled to every assigned partition and so has no single answer.\n   * Distinct from {@link WRITE_PARTITION_REFUSED} because the remedy is to ADD something, not to change it.\n   */\n  WRITE_PARTITION_UNIT_REQUIRED = 'SYSTEM_OF_RECORD_WRITE_PARTITION_UNIT_REQUIRED',\n\n  /**\n   * REQUEST — the partition this write would land in is not one the caller may write. The context\n   * carries a {@link SystemOfRecordWritePartitionRefusal} naming which rule refused.\n   */\n  WRITE_PARTITION_REFUSED = 'SYSTEM_OF_RECORD_WRITE_PARTITION_REFUSED',\n\n  /**\n   * REQUEST — the payload writes a field the engine owns: the partition field (it is DERIVED from the\n   * organization unit on create and never moves afterwards), the owner organization stamp, the unit\n   * stamp on update, or a key component.\n   *\n   * Refused rather than stripped. A caller who sends a partition value believes it decides where the\n   * row lands; silently discarding it would put the row somewhere they did not ask for.\n   */\n  WRITE_FIELD_NOT_WRITABLE = 'SYSTEM_OF_RECORD_WRITE_FIELD_NOT_WRITABLE',\n\n  /**\n   * REQUEST — the write was SENT and nobody knows whether the system of record applied it: the call\n   * timed out, the connection dropped after the request left, or a gateway answered for the vendor.\n   *\n   * The one answer a client must not treat as \"not written\". A retry with the SAME `Idempotency-Key`\n   * answers this again without sending anything; the way forward is to READ the row (or search for it)\n   * and decide, then send a NEW request under a new key if it is genuinely missing.\n   */\n  WRITE_OUTCOME_UNKNOWN = 'SYSTEM_OF_RECORD_WRITE_OUTCOME_UNKNOWN',\n\n  /**\n   * REQUEST — a request with this `Idempotency-Key` is being sent right now. The client retried before\n   * the first attempt settled; answering it would mean sending the write twice.\n   *\n   * Answered `409` (a CONFLICT carrying this code): wait, then retry the SAME request under the same key.\n   */\n  WRITE_IN_PROGRESS = 'SYSTEM_OF_RECORD_WRITE_IN_PROGRESS',\n\n  /**\n   * REQUEST — this `Idempotency-Key` was already used for a DIFFERENT write (another target, verb or\n   * payload). A key names one request; replaying the first request's outcome for a second one would\n   * tell the caller something false about the second.\n   *\n   * Answered `422` with `customMessageReference: IDEMPOTENCY_KEY_REUSED` (#1941) — the status and the\n   * reference the engine's generic request idempotency answers a reused key with, so a client learns ONE\n   * spelling. A 422's context is stripped on the wire, so THIS code does not reach an HTTP client: it is\n   * what an in-process caller catching the error reads (`context.code`), and what the trail and the\n   * refusal audit row record. Never retry the request as it is; send a new request under a new key.\n   * spec-cite: draft-ietf-httpapi-idempotency-key-header-07 §2.7 (reused key with a different payload → 422;\n   * a request still being processed → 409).\n   */\n  WRITE_IDEMPOTENCY_KEY_REUSED = 'SYSTEM_OF_RECORD_WRITE_IDEMPOTENCY_KEY_REUSED',\n\n  /**\n   * REQUEST — the system of record APPLIED the write, and something the engine did after it failed\n   * (a postfix hook, a local lifecycle step, the response description).\n   *\n   * Never reported as a failure to write: the remote change is durable and nothing here can undo it.\n   * The context names the written row, so the caller can read it; a retry with the same key replays\n   * the applied outcome rather than writing again.\n   */\n  WRITE_APPLIED_FOLLOW_UP_FAILED = 'SYSTEM_OF_RECORD_WRITE_APPLIED_FOLLOW_UP_FAILED',\n\n  // ─── Version-checked updates (#1724, #1726) ─────────────────────────────────────────────────────\n  //\n  // A binding may declare `writeConcurrency: VERSION_CHECKED`: the caller sends the row version it read, and the engine\n  // compares it with the row it reads just before sending. On a system with no CONDITIONAL write (Odoo) that NARROWS the\n  // lost-update race and does not close it — the comparison and the write are two calls, and a change landing between\n  // them is overwritten. On OData the same version then travels as `If-Match`, and the vendor closes the gap itself\n  // (`WRITE_PRECONDITION_FAILED` below). The request codes in this block are raised BEFORE anything is sent.\n\n  /**\n   * BOOT — a binding declares `writeConcurrency: VERSION_CHECKED` and its vendor facet names no row version field\n   * (`rowVersionField`), or the binding's version field does not map onto that remote field. The check would compare a\n   * value the vendor does not maintain, and so would refuse or admit writes for no reason at all.\n   */\n  WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * REQUEST — an UPDATE on a `VERSION_CHECKED` binding carried no row version. The binding declared that every change is\n   * checked against the version its author read; an update without one would silently be last-writer-wins. Send the\n   * version field exactly as the read answered it.\n   */\n  WRITE_VERSION_REQUIRED = 'SYSTEM_OF_RECORD_WRITE_VERSION_REQUIRED',\n\n  /**\n   * REQUEST — the row changed since the caller read it: the version it sent is not the version the system of record\n   * answered just before the write. Nothing was sent. Read the row again and decide.\n   *\n   * BEST-EFFORT on Odoo, and the refusal's message says so: a change landing between that read and the write is not\n   * seen, and a vendor that serves its version coarsely (Odoo serves `write_date` to the SECOND) cannot tell two changes\n   * made in the same second apart. The absence of this code is therefore not proof that nobody else changed the row. On\n   * OData the change landing in that gap is refused by the vendor instead, as `WRITE_PRECONDITION_FAILED`.\n   */\n  WRITE_VERSION_STALE = 'SYSTEM_OF_RECORD_WRITE_VERSION_STALE',\n\n  /**\n   * REQUEST — an UPDATE on a `VERSION_CHECKED` binding, and the row the engine read just before writing carries NO\n   * version at all (#1726). Not \"stale\": nobody changed anything. The vendor serves no version for this row — an OData\n   * service that returns no `@odata.etag` for this entity set, although OData lets each set decide — so the binding's\n   * stance cannot be honoured for it. Nothing was sent. The remedy is the\n   * binding's, not the caller's: declare `LAST_WRITER_WINS` for this entity set, or have the vendor serve its versions.\n   */\n  WRITE_ROW_VERSION_NOT_SERVED = 'SYSTEM_OF_RECORD_WRITE_ROW_VERSION_NOT_SERVED',\n\n  // ─── Conditional writes (#1726) ─────────────────────────────────────────────────────────────────\n  //\n  // A vendor that offers a real precondition (OData `If-Match` against the row's entity tag) refuses a stale write\n  // ITSELF, atomically — so the refusal arrives from the remote, after the write was sent, and still means that\n  // nothing was applied.\n\n  /**\n   * REQUEST — the system of record refused an UPDATE or DELETE because the row's version no longer matched the one the\n   * write was conditioned on: an OData `412 Precondition Failed` answering the `If-Match` the engine sent (#1726).\n   *\n   * Unlike {@link WRITE_VERSION_STALE} this is the VENDOR's decision, taken atomically against the row it was about to\n   * change, and the protocol requires that it change nothing — so it is a definite refusal, never an unknown outcome,\n   * and it is never retried: re-sending the same precondition would only be refused again. Read the row again and\n   * decide.\n   * spec-cite: OData Version 4.01 Part 1: Protocol §8.2.4 (Header If-Match).\n   */\n  WRITE_PRECONDITION_FAILED = 'SYSTEM_OF_RECORD_WRITE_PRECONDITION_FAILED',\n\n  /**\n   * BOOT — a binding opens writes toward a vendor whose facet lists a step it requires before any modifying request\n   * (`writePrerequisites`, e.g. SAP Gateway's `X-CSRF-Token` handshake) that this engine does not perform (#1726). Every\n   * such write would be refused by the vendor; the binding stays read-only until the engine performs the step.\n   */\n  WRITE_PREREQUISITE_NOT_SUPPORTED = 'SYSTEM_OF_RECORD_WRITE_PREREQUISITE_NOT_SUPPORTED',\n\n  // ── Declared ACTIONS (#1678) ───────────────────────────────────────────────────────────────────\n  //\n  // An action re-uses the write path's key-ledger answers as they are — WRITE_OUTCOME_UNKNOWN, WRITE_IN_PROGRESS and\n  // WRITE_IDEMPOTENCY_KEY_REUSED mean exactly the same thing for an action as for a row write, and a client that already\n  // branches on them must not learn a second spelling. Both doors answer them from one table, statuses included (#1941). What follows is what only an action can be refused for.\n\n  /**\n   * BOOT — a binding declares an action whose call shape the instance's vendor facet does not list\n   * (`actionCallShapes`). The vendor's product does not expose actions that way, so the declaration could never run.\n   */\n  ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR = 'SYSTEM_OF_RECORD_ACTION_CALL_SHAPE_NOT_SUPPORTED_BY_VENDOR',\n\n  /**\n   * BOOT — a record-free action toward a PARTITIONED instance declares no partition stance. It must say either why it\n   * reaches no partitioned data, or which parameter carries the partition the engine derives from the caller's unit;\n   * otherwise one member's action could land in every company.\n   */\n  ACTION_PARTITION_STANCE_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_STANCE_REQUIRED',\n\n  /** BOOT — two bindings of one instance declare the same action name; callers address an action by `(system, action)`. */\n  ACTION_NAME_DUPLICATED = 'SYSTEM_OF_RECORD_ACTION_NAME_DUPLICATED',\n\n  /** REQUEST — no binding of this instance declares an action of that name. */\n  ACTION_NOT_DECLARED = 'SYSTEM_OF_RECORD_ACTION_NOT_DECLARED',\n\n  /**\n   * REQUEST — this kind of context may not run this action: an anonymous or public execution, an application-scoped\n   * machine with no organization, or a system context (batch, cron, webhook, an autonomous agent with nobody behind it)\n   * on an action that does not declare `admitsSystemInitiation`.\n   */\n  ACTION_INITIATION_NOT_ADMITTED = 'SYSTEM_OF_RECORD_ACTION_INITIATION_NOT_ADMITTED',\n\n  /**\n   * REQUEST — the action was initiated for an organization that does not own the application. A system of record's rows\n   * and actions belong to the owner organization; a tenant that is not the owner never reaches the ERP.\n   */\n  ACTION_ORGANIZATION_NOT_OWNER = 'SYSTEM_OF_RECORD_ACTION_ORGANIZATION_NOT_OWNER',\n\n  /** REQUEST — the caller holds none of the roles the action declares, in the owner organization. */\n  ACTION_ROLE_NOT_HELD = 'SYSTEM_OF_RECORD_ACTION_ROLE_NOT_HELD',\n\n  /** REQUEST — the input does not satisfy the action's declared input schema; the context carries the issues. */\n  ACTION_INPUT_INVALID = 'SYSTEM_OF_RECORD_ACTION_INPUT_INVALID',\n\n  /**\n   * REQUEST — a WRITING action was called without an Idempotency-Key. A remote change cannot be rolled back, so every\n   * caller names its request; a retry under the same key then replays the first outcome instead of acting twice.\n   */\n  ACTION_IDEMPOTENCY_KEY_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_IDEMPOTENCY_KEY_REQUIRED',\n\n  /**\n   * REQUEST — a record-free action that carries the partition must know the caller's unit, and the caller is a member\n   * of several units owning partitions of this instance. Name one in `organizationUnitId`.\n   */\n  ACTION_PARTITION_UNIT_REQUIRED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_UNIT_REQUIRED',\n\n  /**\n   * REQUEST — the partition the action would land in is not one the caller may act in. The context carries a\n   * {@link SystemOfRecordWritePartitionRefusal} naming which rule refused — the same rules a read-through create obeys.\n   */\n  ACTION_PARTITION_REFUSED = 'SYSTEM_OF_RECORD_ACTION_PARTITION_REFUSED',\n\n  /**\n   * REQUEST — the record a record-targeted action names is not one this caller may act on: absent, or outside its\n   * partition, or (for a shared record) not writable by a unit-confined caller. Answered as NOT_FOUND and\n   * indistinguishably, as a read answers, so an action cannot probe for records the caller may not see.\n   */\n  ACTION_TARGET_NOT_REACHABLE = 'SYSTEM_OF_RECORD_ACTION_TARGET_NOT_REACHABLE',\n\n  /** REQUEST — the system of record refused the action with a definite answer; nothing was applied. */\n  ACTION_REMOTE_REFUSED = 'SYSTEM_OF_RECORD_ACTION_REMOTE_REFUSED',\n\n  /**\n   * REQUEST — the action could not be SENT: the instance's access could not be resolved, its handshake failed, the\n   * connection was refused before the request left, the rate budget was spent, or the read-first could not reach the\n   * record. Nothing reached the vendor as an action, so nothing was applied and the Idempotency-Key may be spent again.\n   * The context carries the transport KIND (and status), never the transport's message, which names the URL.\n   */\n  ACTION_NOT_SENT = 'SYSTEM_OF_RECORD_ACTION_NOT_SENT',\n}\n\n/**\n * Which rule refused a write's PARTITION (#1679), carried as `context.reason` beside\n * {@link SystemOfRecordErrorCode.WRITE_PARTITION_REFUSED}.\n *\n * Distinct members because the remedy differs for each, and every one is somebody else's work: an\n * operator assigns partitions, an administrator grants units, an author declares the instance.\n */\nexport enum SystemOfRecordWritePartitionRefusal {\n  /** The unit named (or derived) is not one the caller's grant covers. */\n  UNIT_OUTSIDE_GRANT = 'unit_outside_grant',\n  /** The unit owns no partition of this instance, so a row created \"for it\" would belong to nobody. */\n  UNIT_HAS_NO_PARTITION = 'unit_has_no_partition',\n  /**\n   * The unit owns SEVERAL partitions of this instance, so the unit alone does not say which one the row\n   * belongs to. The operator's assignment map decides this, not the caller: one unit, one partition is\n   * what makes a create's destination derivable.\n   */\n  UNIT_HAS_SEVERAL_PARTITIONS = 'unit_has_several_partitions',\n  /** A unit was named for a write to an instance that is not partitioned — a stamp nothing would enforce. */\n  INSTANCE_NOT_PARTITIONED = 'instance_not_partitioned',\n  /** The narrowing authority denied the caller every unit (no decision, a registry disagreement, an empty grant). */\n  NARROWING_DENIED = 'narrowing_denied',\n  /**\n   * A UNIT-ONLY principal (a unit-scoped service-provider expert, #1597) writing a resource that does not\n   * narrow. The organization-wide admission such a principal may hold covers reads only.\n   */\n  UNIT_ONLY_PRINCIPAL_NOT_ADMITTED = 'unit_only_principal_not_admitted',\n}\n/** @wildo_source:part:end saas.models.system-of-record-error-codes */\n\n/**\n * Why an opted-in package whose module `wildo config sync` did not record is refused, and what to do (#1675, #1676).\n * One sentence for the backend's resolver, `wildo secrets` and config sync's own check, so the three agree.\n */\nexport const SYSTEM_OF_RECORD_FACET_MODULE_NOT_DISCOVERED = '`wildo config sync` did not discover it. A package outside '\n  + 'the framework\\'s own names and the application\\'s `<scope>/provider-*` is walked only when `providers.packages` lists it, '\n  + 'and the backend must depend on it and it must export `./systems-of-record`; then run `wildo config sync`';\n"]}

package/dist/esm/systems-of-record/system-of-record-facet.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system-of-record-facet.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-facet.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAGH,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,qCAAqC,EAAE,MAAM,wDAAwD,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAA8C,MAAM,2CAA2C,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,6GAA6G;AAE7G;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;IACnC;;;OAGG;;IAWH;;;;OAIG;;IAEH,kFAAkF;;kBAElF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAuB1E;;;;;;;;GAQG;AACH,eAAO,MAAM,0CAA0C;;QAvDrD;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;;QApBlF;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;kBAsClF,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,0CAA0C,EAAE,QAAQ,CAAC,MAAM,CAAC,4BAA4B,EAAE,oCAAoC,CAAC,CA2H3I,CAAC;AAEF;;;;;GAKG;AACH,oBAAY,mCAAmC;IAC7C,+FAA+F;IAC/F,eAAe,oBAAoB;IACnC;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,2CAA2C;IACrD,0EAA0E;IAC1E,YAAY,iBAAiB;IAC7B,kEAAkE;IAClE,YAAY,iBAAiB;CAC9B;AAED;;;;GAIG;AACH,oBAAY,uCAAuC;IACjD,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;CAChB;AAYD;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC;;;;IAK5C,yGAAyG;;IAEzG,gIAAgI;;;;IAMhI,kDAAkD;;;;;;;;;;;;IAgBlD,uGAAuG;;;;;;;;4BAWzG,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;GAYG;AACH,oBAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;;;;;;OAUG;IACH,cAAc,mBAAmB;CAClC;AAED;;;;;;;GAOG;AACH,oBAAY,2BAA2B;IACrC;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;GAUG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,MAAM,WAAW;IACjB,iFAAiF;IACjF,aAAa,kBAAkB;CAChC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC;;IAE/C,+FAA+F;;IAE/F;;;;OAIG;;;kBAGH,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,gBAAgB,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,+BAA+B;IAC1C,6GAA6G;;IAE7G;;;;OAIG;;IAEH;;;OAGG;;QAvdH;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;IAqclF;;;;;;;;OAQG;;;;;QApMD,yGAAyG;;QAEzG,gIAAgI;;;;QAMhI,kDAAkD;;;;;;;;;;;;QAgBlD,uGAAuG;;;;;;;;;IA8KzG;;;;;;;;OAQG;;IAEH;;;;;;OAMG;;;QAvFH,+FAA+F;;QAE/F;;;;WAIG;;;;IAmFH;;;;;;;;;;OAUG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;;IAEH;;;;OAIG;;kBAsEH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,+CAA+C,CAAC;AAEjG,2FAA2F;AAC3F,eAAO,MAAM,qCAAqC,uBAAuB,CAAC;AAC1E,2DAA2D;AAE3D;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,oGAAoG;AACpG,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iHAAiH;IACjH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,gCAAgC,GACxC;IAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC;AAEtF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,SAAS,gCAAgC,EAAE,CAAC;CAClE,GAAG,gCAAgC,GAAG,SAAS,CAY/C;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2CAA2C;IACtD,0EAA0E;;IAE1E,2EAA2E;;;QAvU3E,+FAA+F;;QAE/F;;;;WAIG;;;;IAmUH,6FAA6F;;;;;QAxc3F,yGAAyG;;QAEzG,gIAAgI;;;;QAMhI,kDAAkD;;;;;;;;;;;;QAgBlD,uGAAuG;;;;;;;;;kBA6bzG,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,+HAA+H;AAC/H,eAAO,MAAM,iDAAiD,4DAA4D,CAAC;AAC3H,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,WAAW,yCAAyC;IACxD,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,kEAAkE;AAClE,oBAAY,0CAA0C;IACpD,4EAA4E;IAC5E,SAAS,cAAc;IACvB,iEAAiE;IACjE,QAAQ,aAAa;IACrB,qFAAqF;IACrF,OAAO,YAAY;CACpB;AAED,MAAM,MAAM,qCAAqC,GAC7C;IAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,yCAAyC,CAAA;CAAE,GAC9G;IAAE,QAAQ,CAAC,OAAO,EAAE,0CAA0C,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC;AAEnJ;;;;;;;;;;;;GAYG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QACtB;;;WAGG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;CACJ,GAAG,qCAAqC,CAwFxC;AAED;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,yBAAyB,GAAG,6BAA6B,CAEpH;AAED,kGAAkG;AAClG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,4BAA4B,GAC3C,6BAA6B,GAAG,SAAS,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kCAAkC,CAChD,YAAY,EAAE,4BAA4B,GAAG,SAAS,EACtD,KAAK,EAAE,yBAAyB,GAE9B;IAAE,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC,2BAA2B,GAAG,uBAAuB,CAAC,yBAAyB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAA;CAAE,CAM3L;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,4BAA4B,GAC3C,2BAA2B,CAmB7B"}
+{"version":3,"file":"system-of-record-facet.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/systems-of-record/system-of-record-facet.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAGH,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,qCAAqC,EAAE,MAAM,wDAAwD,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,6BAA6B,EAA8C,MAAM,2CAA2C,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,6GAA6G;AAE7G;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;IACnC;;;OAGG;;IAWH;;;;OAIG;;IAEH,kFAAkF;;kBAElF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAuB1E;;;;;;;;GAQG;AACH,eAAO,MAAM,0CAA0C;;QAvDrD;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;;QApBlF;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;kBAsClF,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,0CAA0C,EAAE,QAAQ,CAAC,MAAM,CAAC,4BAA4B,EAAE,oCAAoC,CAAC,CA2H3I,CAAC;AAEF;;;;;GAKG;AACH,oBAAY,mCAAmC;IAC7C,+FAA+F;IAC/F,eAAe,oBAAoB;IACnC;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,2CAA2C;IACrD,0EAA0E;IAC1E,YAAY,iBAAiB;IAC7B,kEAAkE;IAClE,YAAY,iBAAiB;CAC9B;AAED;;;;GAIG;AACH,oBAAY,uCAAuC;IACjD,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;CAChB;AAYD;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC;;;;IAK5C,yGAAyG;;IAEzG,gIAAgI;;;;IAMhI,kDAAkD;;;;;;;;;;;;IAgBlD,uGAAuG;;;;;;;;4BAWzG,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;GAYG;AACH,oBAAY,6BAA6B;IACvC;;;;;;OAMG;IACH,IAAI,SAAS;IACb;;;;;;;;;;OAUG;IACH,cAAc,mBAAmB;CAClC;AAED;;;;;;;GAOG;AACH,oBAAY,2BAA2B;IACrC;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;GAUG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,MAAM,WAAW;IACjB,iFAAiF;IACjF,aAAa,kBAAkB;CAChC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC;;IAE/C,+FAA+F;;IAE/F;;;;OAIG;;;kBAGH,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oCAAoC,gBAAgB,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,+BAA+B;IAC1C,6GAA6G;;IAE7G;;;;OAIG;;IAEH;;;OAGG;;QAvdH;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;IAqclF;;;;;;;;OAQG;;;;;QApMD,yGAAyG;;QAEzG,gIAAgI;;;;QAMhI,kDAAkD;;;;;;;;;;;;QAgBlD,uGAAuG;;;;;;;;;IA8KzG;;;;;;;;OAQG;;IAEH;;;;;;OAMG;;;QAvFH,+FAA+F;;QAE/F;;;;WAIG;;;;IAmFH;;;;;;;;;;OAUG;;IAEH;;;;;;;;;;OAUG;;IAEH;;;;;;;;OAQG;;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;;IAEH;;;;OAIG;;kBAsEH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF;;;;GAIG;AACH,eAAO,MAAM,oCAAoC,+CAA+C,CAAC;AAEjG,2FAA2F;AAC3F,eAAO,MAAM,qCAAqC,uBAAuB,CAAC;AAC1E,2DAA2D;AAE3D;;;GAGG;AACH,wBAAgB,kCAAkC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,oGAAoG;AACpG,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iHAAiH;IACjH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,gCAAgC,GACxC;IAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC;AAEtF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,SAAS,gCAAgC,EAAE,CAAC;CAClE,GAAG,gCAAgC,GAAG,SAAS,CAY/C;AAED,4HAA4H;AAC5H;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2CAA2C;IACtD,0EAA0E;;IAE1E,2EAA2E;;;QAvU3E,+FAA+F;;QAE/F;;;;WAIG;;;;IAmUH,6FAA6F;;;;;QAxc3F,yGAAyG;;QAEzG,gIAAgI;;;;QAMhI,kDAAkD;;;;;;;;;;;;QAgBlD,uGAAuG;;;;;;;;;kBA6bzG,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,+HAA+H;AAC/H,eAAO,MAAM,iDAAiD,4DAA4D,CAAC;AAC3H,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,WAAW,yCAAyC;IACxD,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5D;AAED,kEAAkE;AAClE,oBAAY,0CAA0C;IACpD,4EAA4E;IAC5E,SAAS,cAAc;IACvB,iEAAiE;IACjE,QAAQ,aAAa;IACrB,qFAAqF;IACrF,OAAO,YAAY;CACpB;AAED,MAAM,MAAM,qCAAqC,GAC7C;IAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,yCAAyC,CAAA;CAAE,GAC9G;IAAE,QAAQ,CAAC,OAAO,EAAE,0CAA0C,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAAE,CAAC;AAEnJ;;;;;;;;;;;;GAYG;AACH,wBAAgB,qCAAqC,CAAC,KAAK,EAAE;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QACtB;;;WAGG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;CACJ,GAAG,qCAAqC,CAwFxC;AAED;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,yBAAyB,GAAG,6BAA6B,CAEpH;AAED,kGAAkG;AAClG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,4BAA4B,GAC3C,6BAA6B,GAAG,SAAS,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kCAAkC,CAChD,YAAY,EAAE,4BAA4B,GAAG,SAAS,EACtD,KAAK,EAAE,yBAAyB,GAE9B;IAAE,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC,2BAA2B,GAAG,uBAAuB,CAAC,yBAAyB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAA;CAAE,CAM3L;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,4BAA4B,GAC3C,2BAA2B,CAmB7B"}