auths_cli/errors/

registry.rs

//! Error code registry — **generated** by `cargo xtask gen-error-docs`.
//!
//! Do not edit manually. Re-run the generator after changing any `AuthsErrorInfo` impl:
//! ```sh
//! cargo xtask gen-error-docs
//! ```
//!
//! ## Range Allocation
//!
//! | Range   | Crate            | Layer |
//! |---------|------------------|-------|
//! | E0xxx   | Reserved/meta    | -     |
//! | E1xxx   | auths-crypto     | 0     |
//! | E2xxx   | auths-verifier   | 1     |
//! | E3xxx   | auths-core       | 2     |
//! | E4xxx   | auths-id         | 3     |
//! | E5xxx   | auths-sdk        | 3-4   |
//! | E6xxx   | auths-cli        | 6     |

/// Returns the explanation markdown for a given error code, or `None` if unknown.
///
/// Args:
/// * `code`: An error code string like `"AUTHS-E3001"`.
#[rustfmt::skip]
pub fn explain(code: &str) -> Option<&'static str> {
    match code {
        // --- auths-crypto (CryptoError) ---
        "AUTHS-E1001" => Some("# AUTHS-E1001\n\n**Crate:** `auths-crypto`\n\n**Type:** `CryptoError::InvalidSignature`\n\n## Message\n\nInvalid signature\n\n## Suggestion\n\nThe signature does not match the data or public key\n"),
        "AUTHS-E1002" => Some("# AUTHS-E1002\n\n**Crate:** `auths-crypto`\n\n**Type:** `CryptoError::InvalidKeyLength`\n\n## Message\n\nInvalid public key length: expected {expected}, got {actual}\n\n## Suggestion\n\nEnsure the key length matches the declared curve (32 bytes Ed25519, 33 bytes P-256 compressed SEC1)\n"),
        "AUTHS-E1003" => Some("# AUTHS-E1003\n\n**Crate:** `auths-crypto`\n\n**Type:** `CryptoError::InvalidPrivateKey`\n\n## Message\n\nInvalid private key: {0}\n"),
        "AUTHS-E1004" => Some("# AUTHS-E1004\n\n**Crate:** `auths-crypto`\n\n**Type:** `CryptoError::OperationFailed`\n\n## Message\n\nCrypto operation failed: {0}\n"),
        "AUTHS-E1005" => Some("# AUTHS-E1005\n\n**Crate:** `auths-crypto`\n\n**Type:** `CryptoError::UnsupportedTarget`\n\n## Message\n\nOperation not supported on current compilation target\n\n## Suggestion\n\nThis operation is not available on the current platform\n"),

        // --- auths-crypto (DidKeyError) ---
        "AUTHS-E1101" => Some("# AUTHS-E1101\n\n**Crate:** `auths-crypto`\n\n**Type:** `DidKeyError::InvalidPrefix`\n\n## Message\n\nDID must start with 'did:key:z', got: {0}\n\n## Suggestion\n\nDID must start with 'did:key:z'\n"),
        "AUTHS-E1102" => Some("# AUTHS-E1102\n\n**Crate:** `auths-crypto`\n\n**Type:** `DidKeyError::Base58DecodeFailed`\n\n## Message\n\nBase58 decoding failed: {0}\n"),
        "AUTHS-E1103" => Some("# AUTHS-E1103\n\n**Crate:** `auths-crypto`\n\n**Type:** `DidKeyError::UnsupportedMulticodec`\n\n## Message\n\nUnsupported multicodec: expected Ed25519 [0xED, 0x01] or P-256 [0x80, 0x24]\n\n## Suggestion\n\nSupported key types: Ed25519, P-256 (secp256r1)\n"),
        "AUTHS-E1104" => Some("# AUTHS-E1104\n\n**Crate:** `auths-crypto`\n\n**Type:** `DidKeyError::InvalidKeyLength`\n\n## Message\n\nInvalid key length: got {0} bytes\n"),

        // --- auths-keri (KeriDecodeError) ---
        "AUTHS-E1201" => Some("# AUTHS-E1201\n\n**Crate:** `auths-keri`\n\n**Type:** `KeriDecodeError::UnsupportedKeyType`\n\n## Message\n\nUnsupported KERI key type: prefix '{0}'\n\n## Suggestion\n\nSupported verkey prefixes: 'D'/'B' (Ed25519 transferable/non-transferable), '1AAJ'/'1AAI' (P-256 transferable/non-transferable).\n"),
        "AUTHS-E1202" => Some("# AUTHS-E1202\n\n**Crate:** `auths-keri`\n\n**Type:** `KeriDecodeError::EmptyInput`\n\n## Message\n\nMissing KERI prefix: empty string\n\n## Suggestion\n\nProvide a non-empty KERI-encoded key string\n"),
        "AUTHS-E1203" => Some("# AUTHS-E1203\n\n**Crate:** `auths-keri`\n\n**Type:** `KeriDecodeError::DecodeError`\n\n## Message\n\nBase64url decode failed: {0}\n"),
        "AUTHS-E1204" => Some("# AUTHS-E1204\n\n**Crate:** `auths-keri`\n\n**Type:** `KeriDecodeError::InvalidLength`\n\n## Message\n\nInvalid key length: expected {expected} bytes, got {actual}\n"),

        // --- auths-crypto (SshKeyError) ---
        "AUTHS-E1301" => Some("# AUTHS-E1301\n\n**Crate:** `auths-crypto`\n\n**Type:** `SshKeyError::InvalidFormat`\n\n## Message\n\nMalformed or invalid OpenSSH public key: {0}\n\n## Suggestion\n\nCheck that the public key is a valid OpenSSH format\n"),
        "AUTHS-E1302" => Some("# AUTHS-E1302\n\n**Crate:** `auths-crypto`\n\n**Type:** `SshKeyError::UnsupportedKeyType`\n\n## Message\n\nUnsupported key type: expected ssh-ed25519 or ecdsa-sha2-nistp256\n\n## Suggestion\n\nSupported key types: ssh-ed25519, ecdsa-sha2-nistp256\n"),

        // --- auths-verifier (AttestationError) ---
        "AUTHS-E2001" => Some("# AUTHS-E2001\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::IssuerSignatureFailed`\n\n## Message\n\nIssuer signature verification failed: {0}\n\n## Suggestion\n\nVerify the attestation was signed with the correct issuer key\n"),
        "AUTHS-E2002" => Some("# AUTHS-E2002\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::DeviceSignatureFailed`\n\n## Message\n\nDevice signature verification failed: {0}\n\n## Suggestion\n\nVerify the device key matches the attestation\n"),
        "AUTHS-E2003" => Some("# AUTHS-E2003\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::AttestationExpired`\n\n## Message\n\nAttestation expired on {at}\n\n## Suggestion\n\nRequest a new attestation from the issuer\n"),
        "AUTHS-E2004" => Some("# AUTHS-E2004\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::AttestationRevoked`\n\n## Message\n\nAttestation revoked\n\n## Suggestion\n\nThis device has been revoked; contact the identity admin\n"),
        "AUTHS-E2005" => Some("# AUTHS-E2005\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::TimestampInFuture`\n\n## Message\n\nAttestation timestamp {at} is in the future\n\n## Suggestion\n\nCheck system clock synchronization\n"),
        "AUTHS-E2006" => Some("# AUTHS-E2006\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::MissingCapability`\n\n## Message\n\nMissing required capability: required {required:?}, available {available:?}\n\n## Suggestion\n\nRequest an attestation with the required capability\n"),
        "AUTHS-E2007" => Some("# AUTHS-E2007\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::SigningError`\n\n## Message\n\nSigning failed: {0}\n\n## Suggestion\n\nThe cryptographic signing operation failed; verify key material is valid\n"),
        "AUTHS-E2008" => Some("# AUTHS-E2008\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::DidResolutionError`\n\n## Message\n\nDID resolution failed: {0}\n\n## Suggestion\n\nCheck that the DID is valid and resolvable\n"),
        "AUTHS-E2009" => Some("# AUTHS-E2009\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::SerializationError`\n\n## Message\n\nSerialization error: {0}\n\n## Suggestion\n\nFailed to serialize/deserialize attestation data; check JSON format\n"),
        "AUTHS-E2010" => Some("# AUTHS-E2010\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::InputTooLarge`\n\n## Message\n\nInput too large: {0}\n\n## Suggestion\n\nReduce the size of the JSON input or split into smaller batches\n"),
        "AUTHS-E2011" => Some("# AUTHS-E2011\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::InvalidInput`\n\n## Message\n\nInvalid input: {0}\n\n## Suggestion\n\nCheck the input parameters and ensure they match the expected format\n"),
        "AUTHS-E2012" => Some("# AUTHS-E2012\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::CryptoError`\n\n## Message\n\nCrypto error: {0}\n\n## Suggestion\n\nA cryptographic operation failed; verify key material is valid\n"),
        "AUTHS-E2013" => Some("# AUTHS-E2013\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::InternalError`\n\n## Message\n\nInternal error: {0}\n\n## Suggestion\n\nAn unexpected internal error occurred; please report this issue\n"),
        "AUTHS-E2014" => Some("# AUTHS-E2014\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::OrgVerificationFailed`\n\n## Message\n\nOrganizational Attestation verification failed: {0}\n\n## Suggestion\n\nVerify organizational identity is properly configured\n"),
        "AUTHS-E2015" => Some("# AUTHS-E2015\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::OrgAttestationExpired`\n\n## Message\n\nOrganizational Attestation expired\n\n## Suggestion\n\nRequest a new organizational attestation from the admin\n"),
        "AUTHS-E2016" => Some("# AUTHS-E2016\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::OrgDidResolutionFailed`\n\n## Message\n\nOrganizational DID resolution failed: {0}\n\n## Suggestion\n\nCheck that the organization's DID is correctly configured\n"),
        "AUTHS-E2017" => Some("# AUTHS-E2017\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::BundleExpired`\n\n## Message\n\nBundle is {age_secs}s old (max {max_secs}s). Refresh with: auths id export-bundle\n\n## Suggestion\n\nRe-export the bundle: auths id export-bundle --alias <ALIAS> --output bundle.json --max-age-secs <SECS>\n"),
        "AUTHS-E2018" => Some("# AUTHS-E2018\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::AttestationTooOld`\n\n## Message\n\nAttestation is {age_secs}s old (max {max_secs}s)\n\n## Suggestion\n\nRequest a fresh attestation or increase the max_age threshold\n"),
        "AUTHS-E2019" => Some("# AUTHS-E2019\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::CapabilityEscalation`\n\n## Message\n\nDelegated attestation escalates capability beyond its delegator\n"),
        "AUTHS-E2020" => Some("# AUTHS-E2020\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::DelegationOutlivesParent`\n\n## Message\n\nDelegated attestation outlives its delegator\n"),
        "AUTHS-E2021" => Some("# AUTHS-E2021\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::DelegatorRevoked`\n\n## Message\n\nDelegator attestation is revoked\n"),
        "AUTHS-E2022" => Some("# AUTHS-E2022\n\n**Crate:** `auths-verifier`\n\n**Type:** `AttestationError::DelegatorUnresolved`\n\n## Message\n\nDelegator attestation could not be resolved\n\n## Suggestion\n\nRe-issue the delegated attestation within the delegator's capability and validity scope\n"),

        // --- auths-verifier (CommitVerificationError) ---
        "AUTHS-E2101" => Some("# AUTHS-E2101\n\n**Crate:** `auths-verifier`\n\n**Type:** `CommitVerificationError::UnsignedCommit`\n\n## Message\n\ncommit is unsigned\n\n## Suggestion\n\nThis commit has no Auths-Id/Auths-Device trailer. Run `auths init` so the prepare-commit-msg hook signs future commits, or backfill with `auths sign <ref>`.\n"),
        "AUTHS-E2102" => Some("# AUTHS-E2102\n\n**Crate:** `auths-verifier`\n\n**Type:** `CommitVerificationError::GpgNotSupported`\n\n## Message\n\nGPG signatures are not verified by Auths — use did:keri trailers via `auths init`\n\n## Suggestion\n\nAuths verifies its own did:keri commit trailers, not GPG or SSH signatures. Run `auths init` to enable Auths signing.\n"),
        "AUTHS-E2103" => Some("# AUTHS-E2103\n\n**Crate:** `auths-verifier`\n\n**Type:** `CommitVerificationError::SshSigParseFailed`\n\n## Message\n\nSSHSIG parse failed: {0}\n\n## Suggestion\n\nThe SSH signature could not be parsed; verify the commit was signed correctly\n"),
        "AUTHS-E2104" => Some("# AUTHS-E2104\n\n**Crate:** `auths-verifier`\n\n**Type:** `CommitVerificationError::UnsupportedKeyType`\n\n## Message\n\nunsupported SSH key type: {found}\n\n## Suggestion\n\nUse an Ed25519 or ECDSA P-256 SSH key for signing\n"),
        "AUTHS-E2105" => Some("# AUTHS-E2105\n\n**Crate:** `auths-verifier`\n\n**Type:** `CommitVerificationError::NamespaceMismatch`\n\n## Message\n\nnamespace mismatch: expected \\\"{expected}\\\", found \\\"{found}\\\"\n\n## Suggestion\n\nThe signature namespace doesn't match; ensure git config gpg.ssh.defaultKeyCommand is set correctly\n"),
        "AUTHS-E2106" => Some("# AUTHS-E2106\n\n**Crate:** `auths-verifier`\n\n**Type:** `CommitVerificationError::HashAlgorithmUnsupported`\n\n## Message\n\nunsupported hash algorithm: {0}\n\n## Suggestion\n\nUse SHA-256 or SHA-512 hash algorithm for signing\n"),
        "AUTHS-E2107" => Some("# AUTHS-E2107\n\n**Crate:** `auths-verifier`\n\n**Type:** `CommitVerificationError::SignatureInvalid`\n\n## Message\n\nsignature verification failed\n\n## Suggestion\n\nThe commit signature does not match the signed data; the commit may have been modified after signing\n"),
        "AUTHS-E2108" => Some("# AUTHS-E2108\n\n**Crate:** `auths-verifier`\n\n**Type:** `CommitVerificationError::UnknownSigner`\n\n## Message\n\nsigner identity is not trusted (no matching pinned root)\n\n## Suggestion\n\nThe signer's identity is not trusted here. Pin it with `auths trust pin --did <did>`, or add it to .auths/roots.\n"),
        "AUTHS-E2109" => Some("# AUTHS-E2109\n\n**Crate:** `auths-verifier`\n\n**Type:** `CommitVerificationError::CommitParseFailed`\n\n## Message\n\ncommit parse failed: {0}\n\n## Suggestion\n\nThe Git commit object is malformed; check repository integrity with `git fsck`\n"),

        // --- auths-verifier (OrgBundleError) ---
        "AUTHS-E2201" => Some("# AUTHS-E2201\n\n**Crate:** `auths-verifier`\n\n**Type:** `OrgBundleError::Integrity`\n\n## Message\n\nbundle integrity failure for '{id}': {reason}\n\n## Suggestion\n\nThe bundle was modified after it was produced; obtain a fresh, untampered bundle\n"),
        "AUTHS-E2202" => Some("# AUTHS-E2202\n\n**Crate:** `auths-verifier`\n\n**Type:** `OrgBundleError::MissingMemberKel`\n\n## Message\n\nbundle is missing the KEL for delegated member '{member}'\n\n## Suggestion\n\nThe bundle is incomplete; re-produce it with `auths org bundle`\n"),
        "AUTHS-E2203" => Some("# AUTHS-E2203\n\n**Crate:** `auths-verifier`\n\n**Type:** `OrgBundleError::MissingDelegatorSeal`\n\n## Message\n\nmember '{member}' has no delegation seal in the org KEL\n"),
        "AUTHS-E2204" => Some("# AUTHS-E2204\n\n**Crate:** `auths-verifier`\n\n**Type:** `OrgBundleError::Canonicalize`\n\n## Message\n\ncanonicalization failed: {0}\n\n## Suggestion\n\nThe file is not a valid air-gapped org bundle; re-export it\n"),
        "AUTHS-E2205" => Some("# AUTHS-E2205\n\n**Crate:** `auths-verifier`\n\n**Type:** `OrgBundleError::Parse`\n\n## Message\n\nparse failed: {0}\n"),
        "AUTHS-E2206" => Some("# AUTHS-E2206\n\n**Crate:** `auths-verifier`\n\n**Type:** `OrgBundleError::RecordInvalid`\n\n## Message\n\noffboarding record invalid: {0}\n\n## Suggestion\n\nThe off-boarding record does not match the org KEL; obtain a fresh bundle from the org\n"),

        // --- auths-verifier (EvidencePackError) ---
        "AUTHS-E2301" => Some("# AUTHS-E2301\n\n**Crate:** `auths-verifier`\n\n**Type:** `EvidencePackError::Canonicalize`\n\n## Message\n\ncanonicalization failed: {0}\n\n## Suggestion\n\nThe file is not a valid evidence pack; re-export it with `auths compliance report`\n"),
        "AUTHS-E2302" => Some("# AUTHS-E2302\n\n**Crate:** `auths-verifier`\n\n**Type:** `EvidencePackError::Decode`\n\n## Message\n\ndecode failed: {0}\n"),
        "AUTHS-E2303" => Some("# AUTHS-E2303\n\n**Crate:** `auths-verifier`\n\n**Type:** `EvidencePackError::OfflineVerification`\n\n## Message\n\noffline verification failed: {0}\n\n## Suggestion\n\nThe pack failed offline verification; obtain a fresh, untampered pack from the org\n"),

        // --- auths-core (AgentError) ---
        "AUTHS-E3001" => Some("# AUTHS-E3001\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::KeyNotFound`\n\n## Message\n\nKey not found\n\n## Suggestion\n\nRun `auths key list` to see available keys\n"),
        "AUTHS-E3002" => Some("# AUTHS-E3002\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::IncorrectPassphrase`\n\n## Message\n\nIncorrect passphrase\n\n## Suggestion\n\nCheck your passphrase and try again. Set AUTHS_PASSPHRASE for automation, or run `auths agent start` for session caching\n"),
        "AUTHS-E3003" => Some("# AUTHS-E3003\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::MissingPassphrase`\n\n## Message\n\nMissing Passphrase\n\n## Suggestion\n\nProvide a passphrase with --passphrase or set AUTHS_PASSPHRASE\n"),
        "AUTHS-E3004" => Some("# AUTHS-E3004\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::SecurityError`\n\n## Message\n\nSecurity error: {0}\n\n## Suggestion\n\nRun `auths doctor` to check system keychain access and security configuration\n"),
        "AUTHS-E3005" => Some("# AUTHS-E3005\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::CryptoError`\n\n## Message\n\nCrypto error: {0}\n\n## Suggestion\n\nA cryptographic operation failed; check key material with `auths key list`\n"),
        "AUTHS-E3006" => Some("# AUTHS-E3006\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::KeyDeserializationError`\n\n## Message\n\nKey deserialization error: {0}\n\n## Suggestion\n\nThe stored key is corrupted; re-import with `auths key import`\n"),
        "AUTHS-E3007" => Some("# AUTHS-E3007\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::SigningFailed`\n\n## Message\n\nSigning failed: {0}\n\n## Suggestion\n\nThe signing operation failed; verify your key is accessible with `auths key list`\n"),
        "AUTHS-E3008" => Some("# AUTHS-E3008\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::Proto`\n\n## Message\n\nProtocol error: {0}\n\n## Suggestion\n\nA protocol error occurred; check that both sides are running compatible versions\n"),
        "AUTHS-E3009" => Some("# AUTHS-E3009\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::IO`\n\n## Message\n\nIO error: {0}\n\n## Suggestion\n\nCheck file permissions and that the filesystem is not read-only\n"),
        "AUTHS-E3010" => Some("# AUTHS-E3010\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::GitError`\n\n## Message\n\ngit error: {0}\n\n## Suggestion\n\nEnsure you're in a Git repository\n"),
        "AUTHS-E3011" => Some("# AUTHS-E3011\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::InvalidInput`\n\n## Message\n\nInvalid input: {0}\n\n## Suggestion\n\nCheck the command arguments and try again\n"),
        "AUTHS-E3012" => Some("# AUTHS-E3012\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::MutexError`\n\n## Message\n\nMutex lock poisoned: {0}\n\n## Suggestion\n\nA concurrency error occurred; restart the operation\n"),
        "AUTHS-E3013" => Some("# AUTHS-E3013\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::StorageError`\n\n## Message\n\nStorage error: {0}\n\n## Suggestion\n\nCheck file permissions and disk space\n"),
        "AUTHS-E3014" => Some("# AUTHS-E3014\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::UserInputCancelled`\n\n## Message\n\nUser input cancelled\n\n## Suggestion\n\nRun the command again and provide the required input\n"),
        "AUTHS-E3015" => Some("# AUTHS-E3015\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::BackendUnavailable`\n\n## Message\n\nKeychain backend unavailable: {backend} - {reason}\n\n## Suggestion\n\nRun `auths doctor` to diagnose keychain issues\n"),
        "AUTHS-E3016" => Some("# AUTHS-E3016\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::StorageLocked`\n\n## Message\n\nStorage is locked, authentication required\n\n## Suggestion\n\nAuthenticate with your platform keychain\n"),
        "AUTHS-E3017" => Some("# AUTHS-E3017\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::BackendInitFailed`\n\n## Message\n\nFailed to initialize keychain backend: {backend} - {error}\n\n## Suggestion\n\nRun `auths doctor` to diagnose keychain issues\n"),
        "AUTHS-E3018" => Some("# AUTHS-E3018\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::CredentialTooLarge`\n\n## Message\n\nCredential too large for backend (max {max_bytes} bytes, got {actual_bytes})\n\n## Suggestion\n\nReduce the credential size or use file-based storage with AUTHS_KEYCHAIN_BACKEND=file\n"),
        "AUTHS-E3019" => Some("# AUTHS-E3019\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::AgentLocked`\n\n## Message\n\nAgent is locked. Unlock with 'auths agent unlock' or restart the agent.\n\n## Suggestion\n\nRun `auths agent unlock` or restart with `auths agent start`\n"),
        "AUTHS-E3020" => Some("# AUTHS-E3020\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::WeakPassphrase`\n\n## Message\n\nPassphrase too weak: {0}\n\n## Suggestion\n\nUse at least 12 characters with uppercase, lowercase, and a digit or symbol\n"),
        "AUTHS-E3021" => Some("# AUTHS-E3021\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmPinLocked`\n\n## Message\n\nHSM PIN is locked — reset required\n\n## Suggestion\n\nReset the HSM PIN using your HSM vendor's admin tools\n"),
        "AUTHS-E3022" => Some("# AUTHS-E3022\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmDeviceRemoved`\n\n## Message\n\nHSM device removed\n\n## Suggestion\n\nReconnect the HSM device and try again\n"),
        "AUTHS-E3023" => Some("# AUTHS-E3023\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmSessionExpired`\n\n## Message\n\nHSM session expired\n\n## Suggestion\n\nRetry the operation — a new session will be opened\n"),
        "AUTHS-E3024" => Some("# AUTHS-E3024\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HsmUnsupportedMechanism`\n\n## Message\n\nHSM does not support mechanism: {0}\n\n## Suggestion\n\nCheck that your HSM supports Ed25519 (CKM_EDDSA)\n"),
        "AUTHS-E3025" => Some("# AUTHS-E3025\n\n**Crate:** `auths-core`\n\n**Type:** `AgentError::HardwareKeyNotExportable`\n\n## Message\n\nOperation '{operation}' requires a software-backed key; hardware-backed keys (e.g. Secure Enclave) cannot export raw material\n\n## Suggestion\n\nUse a software-backed keychain backend for this operation, or re-initialize your identity without Secure Enclave\n"),

        // --- auths-core (TrustError) ---
        "AUTHS-E3101" => Some("# AUTHS-E3101\n\n**Crate:** `auths-core`\n\n**Type:** `TrustError::Io`\n\n## Message\n\nI/O error: {0}\n\n## Suggestion\n\nCheck disk space and file permissions\n"),
        "AUTHS-E3102" => Some("# AUTHS-E3102\n\n**Crate:** `auths-core`\n\n**Type:** `TrustError::InvalidData`\n\n## Message\n\n{0}\n\n## Suggestion\n\nThe trust store may be corrupted; delete and re-pin with `auths trust pin`\n"),
        "AUTHS-E3103" => Some("# AUTHS-E3103\n\n**Crate:** `auths-core`\n\n**Type:** `TrustError::NotFound`\n\n## Message\n\nnot found: {0}\n\n## Suggestion\n\nRun `auths trust list` to see pinned identities\n"),
        "AUTHS-E3104" => Some("# AUTHS-E3104\n\n**Crate:** `auths-core`\n\n**Type:** `TrustError::Serialization`\n\n## Message\n\nserialization error: {0}\n\n## Suggestion\n\nThe trust store data is corrupted; delete and re-pin with `auths trust pin`\n"),
        "AUTHS-E3105" => Some("# AUTHS-E3105\n\n**Crate:** `auths-core`\n\n**Type:** `TrustError::AlreadyExists`\n\n## Message\n\nalready exists: {0}\n\n## Suggestion\n\nRun `auths trust list` to see existing entries\n"),
        "AUTHS-E3106" => Some("# AUTHS-E3106\n\n**Crate:** `auths-core`\n\n**Type:** `TrustError::Lock`\n\n## Message\n\nlock acquisition failed: {0}\n\n## Suggestion\n\nCheck file permissions and try again\n"),
        "AUTHS-E3107" => Some("# AUTHS-E3107\n\n**Crate:** `auths-core`\n\n**Type:** `TrustError::PolicyRejected`\n\n## Message\n\npolicy rejected: {0}\n\n## Suggestion\n\nRun `auths trust pin` to pin this identity\n"),

        // --- auths-core (PairingError) ---
        "AUTHS-E3201" => Some("# AUTHS-E3201\n\n**Crate:** `auths-core`\n\n**Type:** `PairingError::Protocol`\n\n## Message\n\n_(transparent — see inner error)_\n\n## Suggestion\n\nEnsure both devices are running compatible auths versions\n"),
        "AUTHS-E3202" => Some("# AUTHS-E3202\n\n**Crate:** `auths-core`\n\n**Type:** `PairingError::QrCodeFailed`\n\n## Message\n\nQR code generation failed: {0}\n\n## Suggestion\n\nQR code generation failed; try relay-based pairing with `auths device pair --registry <url>` instead\n"),
        "AUTHS-E3203" => Some("# AUTHS-E3203\n\n**Crate:** `auths-core`\n\n**Type:** `PairingError::RelayError`\n\n## Message\n\nRelay error: {0}\n\n## Suggestion\n\nCheck your internet connection\n"),
        "AUTHS-E3204" => Some("# AUTHS-E3204\n\n**Crate:** `auths-core`\n\n**Type:** `PairingError::LocalServerError`\n\n## Message\n\nLocal server error: {0}\n\n## Suggestion\n\nThe local pairing server failed to start; check that the port is available\n"),
        "AUTHS-E3205" => Some("# AUTHS-E3205\n\n**Crate:** `auths-core`\n\n**Type:** `PairingError::MdnsError`\n\n## Message\n\nmDNS error: {0}\n\n## Suggestion\n\nmDNS discovery failed; try relay-based pairing with `auths device pair --registry <url>` instead\n"),
        "AUTHS-E3206" => Some("# AUTHS-E3206\n\n**Crate:** `auths-core`\n\n**Type:** `PairingError::NoPeerFound`\n\n## Message\n\nNo peer found on local network\n\n## Suggestion\n\nEnsure both devices are on the same network\n"),
        "AUTHS-E3207" => Some("# AUTHS-E3207\n\n**Crate:** `auths-core`\n\n**Type:** `PairingError::LanTimeout`\n\n## Message\n\nLAN pairing timed out\n\n## Suggestion\n\nCheck your network and try again\n"),

        // --- auths-core (CryptoError) ---
        "AUTHS-E3301" => Some("# AUTHS-E3301\n\n**Crate:** `auths-core`\n\n**Type:** `CryptoError::SshKeyConstruction`\n\n## Message\n\nSSH key construction failed: {0}\n"),
        "AUTHS-E3302" => Some("# AUTHS-E3302\n\n**Crate:** `auths-core`\n\n**Type:** `CryptoError::SigningFailed`\n\n## Message\n\nsigning failed: {0}\n"),
        "AUTHS-E3303" => Some("# AUTHS-E3303\n\n**Crate:** `auths-core`\n\n**Type:** `CryptoError::PemEncoding`\n\n## Message\n\nPEM encoding failed: {0}\n"),
        "AUTHS-E3304" => Some("# AUTHS-E3304\n\n**Crate:** `auths-core`\n\n**Type:** `CryptoError::InvalidSeedLength`\n\n## Message\n\ninvalid seed length: expected 32, got {0}\n\n## Suggestion\n\nEnsure the seed is exactly 32 bytes\n"),
        "AUTHS-E3305" => Some("# AUTHS-E3305\n\n**Crate:** `auths-core`\n\n**Type:** `CryptoError::InvalidKeyFormat`\n\n## Message\n\ninvalid key format: {0}\n\n## Suggestion\n\nCheck that the key file is a valid Ed25519 key\n"),

        // --- auths-keri (WitnessError) ---
        "AUTHS-E3401" => Some("# AUTHS-E3401\n\n**Crate:** `auths-keri`\n\n**Type:** `WitnessError::Network`\n\n## Message\n\nnetwork error: {0}\n\n## Suggestion\n\nCheck your internet connection\n"),
        "AUTHS-E3402" => Some("# AUTHS-E3402\n\n**Crate:** `auths-keri`\n\n**Type:** `WitnessError::Duplicity`\n\n## Message\n\nduplicity detected: {0}\n\n## Suggestion\n\nThis identity may be compromised — investigate immediately\n"),
        "AUTHS-E3403" => Some("# AUTHS-E3403\n\n**Crate:** `auths-keri`\n\n**Type:** `WitnessError::Rejected`\n\n## Message\n\nevent rejected: {reason}\n"),
        "AUTHS-E3404" => Some("# AUTHS-E3404\n\n**Crate:** `auths-keri`\n\n**Type:** `WitnessError::Timeout`\n\n## Message\n\ntimeout after {0}ms\n\n## Suggestion\n\nCheck witness endpoint availability and retry\n"),
        "AUTHS-E3405" => Some("# AUTHS-E3405\n\n**Crate:** `auths-keri`\n\n**Type:** `WitnessError::InvalidSignature`\n\n## Message\n\ninvalid receipt signature from witness {witness_id}\n"),
        "AUTHS-E3406" => Some("# AUTHS-E3406\n\n**Crate:** `auths-keri`\n\n**Type:** `WitnessError::InsufficientReceipts`\n\n## Message\n\ninsufficient receipts: got {got}, need {required}\n\n## Suggestion\n\nEnsure enough witnesses are online\n"),
        "AUTHS-E3407" => Some("# AUTHS-E3407\n\n**Crate:** `auths-keri`\n\n**Type:** `WitnessError::SaidMismatch`\n\n## Message\n\nreceipt SAID mismatch: expected {expected}, got {got}\n"),
        "AUTHS-E3408" => Some("# AUTHS-E3408\n\n**Crate:** `auths-keri`\n\n**Type:** `WitnessError::Storage`\n\n## Message\n\nstorage error: {0}\n"),
        "AUTHS-E3409" => Some("# AUTHS-E3409\n\n**Crate:** `auths-keri`\n\n**Type:** `WitnessError::Serialization`\n\n## Message\n\nserialization error: {0}\n"),

        // --- auths-core (StorageError) ---
        "AUTHS-E3501" => Some("# AUTHS-E3501\n\n**Crate:** `auths-core`\n\n**Type:** `StorageError::NotFound`\n\n## Message\n\nnot found: {path}\n"),
        "AUTHS-E3502" => Some("# AUTHS-E3502\n\n**Crate:** `auths-core`\n\n**Type:** `StorageError::AlreadyExists`\n\n## Message\n\nalready exists: {path}\n"),
        "AUTHS-E3503" => Some("# AUTHS-E3503\n\n**Crate:** `auths-core`\n\n**Type:** `StorageError::CasConflict`\n\n## Message\n\ncompare-and-swap conflict\n\n## Suggestion\n\nRetry the operation — another process made a concurrent change\n"),
        "AUTHS-E3504" => Some("# AUTHS-E3504\n\n**Crate:** `auths-core`\n\n**Type:** `StorageError::Io`\n\n## Message\n\nstorage I/O error: {0}\n\n## Suggestion\n\nCheck file permissions and disk space\n"),
        "AUTHS-E3505" => Some("# AUTHS-E3505\n\n**Crate:** `auths-core`\n\n**Type:** `StorageError::Internal`\n\n## Message\n\ninternal storage error: {0}\n"),

        // --- auths-core (NetworkError) ---
        "AUTHS-E3601" => Some("# AUTHS-E3601\n\n**Crate:** `auths-core`\n\n**Type:** `NetworkError::Unreachable`\n\n## Message\n\nendpoint unreachable: {endpoint}\n\n## Suggestion\n\nCheck your internet connection\n"),
        "AUTHS-E3602" => Some("# AUTHS-E3602\n\n**Crate:** `auths-core`\n\n**Type:** `NetworkError::Timeout`\n\n## Message\n\nrequest timed out: {endpoint}\n\n## Suggestion\n\nThe server may be overloaded — retry later\n"),
        "AUTHS-E3603" => Some("# AUTHS-E3603\n\n**Crate:** `auths-core`\n\n**Type:** `NetworkError::NotFound`\n\n## Message\n\nresource not found: {resource}\n\n## Suggestion\n\nThe requested resource was not found on the server; verify the URL or identifier\n"),
        "AUTHS-E3604" => Some("# AUTHS-E3604\n\n**Crate:** `auths-core`\n\n**Type:** `NetworkError::Unauthorized`\n\n## Message\n\nunauthorized\n\n## Suggestion\n\nCheck your authentication credentials\n"),
        "AUTHS-E3605" => Some("# AUTHS-E3605\n\n**Crate:** `auths-core`\n\n**Type:** `NetworkError::InvalidResponse`\n\n## Message\n\ninvalid response: {detail}\n\n## Suggestion\n\nThe server returned an unexpected response; check server compatibility\n"),
        "AUTHS-E3606" => Some("# AUTHS-E3606\n\n**Crate:** `auths-core`\n\n**Type:** `NetworkError::Internal`\n\n## Message\n\ninternal network error: {0}\n\n## Suggestion\n\nThe server encountered an internal error; retry later or contact the server administrator\n"),

        // --- auths-core (ResolutionError) ---
        "AUTHS-E3701" => Some("# AUTHS-E3701\n\n**Crate:** `auths-core`\n\n**Type:** `ResolutionError::DidNotFound`\n\n## Message\n\nDID not found: {did}\n\n## Suggestion\n\nVerify the DID is correct and the identity exists\n"),
        "AUTHS-E3702" => Some("# AUTHS-E3702\n\n**Crate:** `auths-core`\n\n**Type:** `ResolutionError::InvalidDid`\n\n## Message\n\ninvalid DID {did}: {reason}\n\n## Suggestion\n\nCheck the DID format (e.g., did:key:z6Mk... or did:keri:E...)\n"),
        "AUTHS-E3703" => Some("# AUTHS-E3703\n\n**Crate:** `auths-core`\n\n**Type:** `ResolutionError::KeyRevoked`\n\n## Message\n\nkey revoked for DID: {did}\n\n## Suggestion\n\nThis key has been revoked — contact the identity owner\n"),
        "AUTHS-E3704" => Some("# AUTHS-E3704\n\n**Crate:** `auths-core`\n\n**Type:** `ResolutionError::Network`\n\n## Message\n\nnetwork error: {0}\n\n## Suggestion\n\nCheck your internet connection\n"),

        // --- auths-core (PlatformError) ---
        "AUTHS-E3801" => Some("# AUTHS-E3801\n\n**Crate:** `auths-core`\n\n**Type:** `PlatformError::AuthorizationPending`\n\n## Message\n\nOAuth authorization pending\n\n## Suggestion\n\nComplete the authorization on the linked device, then the CLI will continue automatically\n"),
        "AUTHS-E3802" => Some("# AUTHS-E3802\n\n**Crate:** `auths-core`\n\n**Type:** `PlatformError::SlowDown`\n\n## Message\n\nOAuth slow down\n\n## Suggestion\n\nThe authorization server is rate-limiting; the CLI will retry automatically\n"),
        "AUTHS-E3803" => Some("# AUTHS-E3803\n\n**Crate:** `auths-core`\n\n**Type:** `PlatformError::AccessDenied`\n\n## Message\n\nOAuth access denied\n\n## Suggestion\n\nRe-run the command and approve the authorization request\n"),
        "AUTHS-E3804" => Some("# AUTHS-E3804\n\n**Crate:** `auths-core`\n\n**Type:** `PlatformError::ExpiredToken`\n\n## Message\n\ndevice code expired\n\n## Suggestion\n\nThe device code expired — restart the flow\n"),
        "AUTHS-E3805" => Some("# AUTHS-E3805\n\n**Crate:** `auths-core`\n\n**Type:** `PlatformError::Network`\n\n## Message\n\nnetwork error: {0}\n\n## Suggestion\n\nCheck your internet connection\n"),
        "AUTHS-E3806" => Some("# AUTHS-E3806\n\n**Crate:** `auths-core`\n\n**Type:** `PlatformError::Platform`\n\n## Message\n\nplatform error: {message}\n\n## Suggestion\n\nA platform-specific error occurred; run `auths doctor` to diagnose\n"),

        // --- auths-core (SshAgentError) ---
        "AUTHS-E3901" => Some("# AUTHS-E3901\n\n**Crate:** `auths-core`\n\n**Type:** `SshAgentError::CommandFailed`\n\n## Message\n\nssh-add command failed: {0}\n\n## Suggestion\n\nCheck that the key file exists and has correct permissions\n"),
        "AUTHS-E3902" => Some("# AUTHS-E3902\n\n**Crate:** `auths-core`\n\n**Type:** `SshAgentError::NotAvailable`\n\n## Message\n\nSSH agent not available: {0}\n\n## Suggestion\n\nStart the SSH agent: eval $(ssh-agent -s)\n"),
        "AUTHS-E3903" => Some("# AUTHS-E3903\n\n**Crate:** `auths-core`\n\n**Type:** `SshAgentError::IoError`\n\n## Message\n\nI/O error: {0}\n\n## Suggestion\n\nCheck file permissions\n"),

        // --- auths-core (ConfigStoreError) ---
        "AUTHS-E3951" => Some("# AUTHS-E3951\n\n**Crate:** `auths-core`\n\n**Type:** `ConfigStoreError::Read`\n\n## Message\n\nfailed to read config from {path}\n\n## Suggestion\n\nCheck that ~/.auths/config.toml exists and is readable\n"),
        "AUTHS-E3952" => Some("# AUTHS-E3952\n\n**Crate:** `auths-core`\n\n**Type:** `ConfigStoreError::Write`\n\n## Message\n\nfailed to write config to {path}\n\n## Suggestion\n\nCheck file permissions for ~/.auths/config.toml\n"),

        // --- auths-core (NamespaceVerifyError) ---
        "AUTHS-E3961" => Some("# AUTHS-E3961\n\n**Crate:** `auths-core`\n\n**Type:** `NamespaceVerifyError::UnsupportedEcosystem`\n\n## Message\n\nunsupported ecosystem: {ecosystem}\n\n## Suggestion\n\nSupported ecosystems: npm, pypi, cargo, docker, go, maven, nuget\n"),
        "AUTHS-E3962" => Some("# AUTHS-E3962\n\n**Crate:** `auths-core`\n\n**Type:** `NamespaceVerifyError::PackageNotFound`\n\n## Message\n\npackage '{package_name}' not found in {ecosystem}\n\n## Suggestion\n\nCheck the package name and ensure it exists on the registry\n"),
        "AUTHS-E3963" => Some("# AUTHS-E3963\n\n**Crate:** `auths-core`\n\n**Type:** `NamespaceVerifyError::OwnershipNotConfirmed`\n\n## Message\n\nownership of '{package_name}' on {ecosystem} not confirmed for the given identity\n\n## Suggestion\n\nEnsure you are listed as an owner/collaborator on the upstream registry\n"),
        "AUTHS-E3964" => Some("# AUTHS-E3964\n\n**Crate:** `auths-core`\n\n**Type:** `NamespaceVerifyError::ChallengeExpired`\n\n## Message\n\nverification challenge expired\n\n## Suggestion\n\nStart a new verification challenge\n"),
        "AUTHS-E3965" => Some("# AUTHS-E3965\n\n**Crate:** `auths-core`\n\n**Type:** `NamespaceVerifyError::InvalidToken`\n\n## Message\n\ninvalid verification token: {reason}\n\n## Suggestion\n\nTokens must start with 'auths-verify-' followed by a hex string\n"),
        "AUTHS-E3966" => Some("# AUTHS-E3966\n\n**Crate:** `auths-core`\n\n**Type:** `NamespaceVerifyError::InvalidPackageName`\n\n## Message\n\ninvalid package name '{name}': {reason}\n\n## Suggestion\n\nPackage names cannot be empty, contain control characters, or use path traversal\n"),
        "AUTHS-E3967" => Some("# AUTHS-E3967\n\n**Crate:** `auths-core`\n\n**Type:** `NamespaceVerifyError::NetworkError`\n\n## Message\n\nverification network error: {message}\n\n## Suggestion\n\nCheck your internet connection and try again\n"),
        "AUTHS-E3968" => Some("# AUTHS-E3968\n\n**Crate:** `auths-core`\n\n**Type:** `NamespaceVerifyError::RateLimited`\n\n## Message\n\nrate limited by {ecosystem} registry\n\n## Suggestion\n\nWait a moment and retry the verification\n"),

        // --- auths-id (FreezeError) ---
        "AUTHS-E4001" => Some("# AUTHS-E4001\n\n**Crate:** `auths-id`\n\n**Type:** `FreezeError::Io`\n\n## Message\n\n_(transparent — see inner error)_\n\n## Suggestion\n\nCheck file permissions and disk space\n"),
        "AUTHS-E4002" => Some("# AUTHS-E4002\n\n**Crate:** `auths-id`\n\n**Type:** `FreezeError::Deserialization`\n\n## Message\n\nfailed to parse freeze state: {0}\n\n## Suggestion\n\nThe freeze state file may be corrupted; try deleting it\n"),
        "AUTHS-E4003" => Some("# AUTHS-E4003\n\n**Crate:** `auths-id`\n\n**Type:** `FreezeError::InvalidDuration`\n\n## Message\n\ninvalid duration format: {0}\n\n## Suggestion\n\nUse a valid duration format (e.g. '30m', '2h', '7d')\n"),
        "AUTHS-E4004" => Some("# AUTHS-E4004\n\n**Crate:** `auths-id`\n\n**Type:** `FreezeError::ZeroDuration`\n\n## Message\n\nduration must be greater than zero\n\n## Suggestion\n\nSpecify a positive duration\n"),

        // --- auths-id (StorageError) ---
        "AUTHS-E4101" => Some("# AUTHS-E4101\n\n**Crate:** `auths-id`\n\n**Type:** `StorageError::Git`\n\n## Message\n\n_(transparent — see inner error)_\n\n## Suggestion\n\nCheck that the Git repository is not corrupted\n"),
        "AUTHS-E4102" => Some("# AUTHS-E4102\n\n**Crate:** `auths-id`\n\n**Type:** `StorageError::Serialization`\n\n## Message\n\nserialization error: {0}\n\n## Suggestion\n\nFailed to serialize storage data; this may indicate a version mismatch\n"),
        "AUTHS-E4103" => Some("# AUTHS-E4103\n\n**Crate:** `auths-id`\n\n**Type:** `StorageError::Io`\n\n## Message\n\nI/O error: {0}\n\n## Suggestion\n\nCheck file permissions and disk space\n"),
        "AUTHS-E4104" => Some("# AUTHS-E4104\n\n**Crate:** `auths-id`\n\n**Type:** `StorageError::NotFound`\n\n## Message\n\nnot found: {0}\n\n## Suggestion\n\nVerify the identity or resource exists\n"),
        "AUTHS-E4105" => Some("# AUTHS-E4105\n\n**Crate:** `auths-id`\n\n**Type:** `StorageError::InvalidData`\n\n## Message\n\n{0}\n\n## Suggestion\n\nThe stored data may be corrupted; try re-initializing\n"),
        "AUTHS-E4106" => Some("# AUTHS-E4106\n\n**Crate:** `auths-id`\n\n**Type:** `StorageError::SchemaValidation`\n\n## Message\n\nschema validation failed: {0}\n\n## Suggestion\n\nEnsure data matches the expected schema version\n"),
        "AUTHS-E4107" => Some("# AUTHS-E4107\n\n**Crate:** `auths-id`\n\n**Type:** `StorageError::Index`\n\n## Message\n\nindex error: {0}\n\n## Suggestion\n\nTry rebuilding the index\n"),

        // --- auths-id (InitError) ---
        "AUTHS-E4201" => Some("# AUTHS-E4201\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Git`\n\n## Message\n\n_(transparent — see inner error)_\n\n## Suggestion\n\nCheck that the Git repository is accessible\n"),
        "AUTHS-E4202" => Some("# AUTHS-E4202\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Keri`\n\n## Message\n\nKERI operation failed: {0}\n\n## Suggestion\n\nKERI event processing failed; check identity state\n"),
        "AUTHS-E4203" => Some("# AUTHS-E4203\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Key`\n\n## Message\n\nkey operation failed: {0}\n\n## Suggestion\n\nCheck keychain access and passphrase. Headless/CI (no Touch ID): set AUTHS_KEYCHAIN_BACKEND=file AUTHS_KEYCHAIN_FILE=<path> AUTHS_PASSPHRASE=<pass>, or run `auths init --profile ci`.\n"),
        "AUTHS-E4204" => Some("# AUTHS-E4204\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::InvalidData`\n\n## Message\n\n{0}\n\n## Suggestion\n\nIdentity data is malformed; try re-initializing with `auths init`\n"),
        "AUTHS-E4205" => Some("# AUTHS-E4205\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Storage`\n\n## Message\n\nstorage operation failed: {0}\n\n## Suggestion\n\nCheck storage backend connectivity\n"),
        "AUTHS-E4206" => Some("# AUTHS-E4206\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Registry`\n\n## Message\n\nregistry error: {0}\n\n## Suggestion\n\nCheck registry backend configuration\n"),
        "AUTHS-E4207" => Some("# AUTHS-E4207\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Crypto`\n\n## Message\n\ncrypto operation failed: {0}\n\n## Suggestion\n\nA cryptographic operation during initialization failed; check your keychain access\n"),
        "AUTHS-E4208" => Some("# AUTHS-E4208\n\n**Crate:** `auths-id`\n\n**Type:** `InitError::Identity`\n\n## Message\n\nidentity error: {0}\n\n## Suggestion\n\nIdentity initialization failed; check storage and keychain configuration\n"),

        // --- auths-id (IdentityError) ---
        "AUTHS-E4401" => Some("# AUTHS-E4401\n\n**Crate:** `auths-id`\n\n**Type:** `IdentityError::Keri`\n\n## Message\n\nKERI error: {0}\n\n## Suggestion\n\nKERI operation failed; check identity state\n"),
        "AUTHS-E4402" => Some("# AUTHS-E4402\n\n**Crate:** `auths-id`\n\n**Type:** `IdentityError::Pkcs8EncodeError`\n\n## Message\n\nPKCS#8 encoding error: {0}\n"),
        "AUTHS-E4403" => Some("# AUTHS-E4403\n\n**Crate:** `auths-id`\n\n**Type:** `IdentityError::Pkcs8DecodeError`\n\n## Message\n\nPKCS#8 decoding error: {0}\n\n## Suggestion\n\nThe key may be in an unsupported format\n"),
        "AUTHS-E4404" => Some("# AUTHS-E4404\n\n**Crate:** `auths-id`\n\n**Type:** `IdentityError::EmptyPassphrase`\n\n## Message\n\nPassphrase required\n\n## Suggestion\n\nProvide a non-empty passphrase\n"),
        "AUTHS-E4405" => Some("# AUTHS-E4405\n\n**Crate:** `auths-id`\n\n**Type:** `IdentityError::InvalidKeyLength`\n\n## Message\n\nInvalid key length: expected 32, got {0}\n\n## Suggestion\n\nExpected a 32-byte Ed25519 key\n"),
        "AUTHS-E4406" => Some("# AUTHS-E4406\n\n**Crate:** `auths-id`\n\n**Type:** `IdentityError::KeyStorage`\n\n## Message\n\nKey storage error: {0}\n\n## Suggestion\n\nCheck keychain permissions\n"),
        "AUTHS-E4407" => Some("# AUTHS-E4407\n\n**Crate:** `auths-id`\n\n**Type:** `IdentityError::KeyRetrieval`\n\n## Message\n\nKey retrieval error: {0}\n\n## Suggestion\n\nCheck that the key alias exists in the keychain\n"),
        "AUTHS-E4408" => Some("# AUTHS-E4408\n\n**Crate:** `auths-id`\n\n**Type:** `IdentityError::RingError`\n\n## Message\n\nRing crypto error: {0}\n"),

        // --- auths-id (StorageError) ---
        "AUTHS-E4409" => Some("# AUTHS-E4409\n\n**Crate:** `auths-id`\n\n**Type:** `StorageError::NotFound`\n\n## Message\n\n_(transparent — see inner error)_\n\n## Suggestion\n\nVerify the storage path exists and is initialized\n"),
        "AUTHS-E4410" => Some("# AUTHS-E4410\n\n**Crate:** `auths-id`\n\n**Type:** `StorageError::CasConflict`\n\n## Message\n\n_(transparent — see inner error)_\n\n## Suggestion\n\nA concurrent modification was detected; retry the operation\n"),
        "AUTHS-E4411" => Some("# AUTHS-E4411\n\n**Crate:** `auths-id`\n\n**Type:** `StorageError::Io`\n\n## Message\n\n_(transparent — see inner error)_\n\n## Suggestion\n\nCheck file permissions, disk space, and storage backend connectivity\n"),

        // --- auths-id (KelError) ---
        "AUTHS-E4601" => Some("# AUTHS-E4601\n\n**Crate:** `auths-id`\n\n**Type:** `KelError::Git`\n\n## Message\n\nGit error: {0}\n\n## Suggestion\n\nCheck that the Git repository is accessible and not corrupted\n"),
        "AUTHS-E4602" => Some("# AUTHS-E4602\n\n**Crate:** `auths-id`\n\n**Type:** `KelError::Serialization`\n\n## Message\n\nSerialization error: {0}\n"),
        "AUTHS-E4603" => Some("# AUTHS-E4603\n\n**Crate:** `auths-id`\n\n**Type:** `KelError::NotFound`\n\n## Message\n\nKEL not found for prefix: {0}\n\n## Suggestion\n\nInitialize the identity first with 'auths init'\n"),
        "AUTHS-E4604" => Some("# AUTHS-E4604\n\n**Crate:** `auths-id`\n\n**Type:** `KelError::InvalidOperation`\n\n## Message\n\nInvalid operation: {0}\n"),
        "AUTHS-E4605" => Some("# AUTHS-E4605\n\n**Crate:** `auths-id`\n\n**Type:** `KelError::InvalidData`\n\n## Message\n\nInvalid data: {0}\n\n## Suggestion\n\nThe KEL data may be corrupted; try re-syncing\n"),
        "AUTHS-E4606" => Some("# AUTHS-E4606\n\n**Crate:** `auths-id`\n\n**Type:** `KelError::ChainIntegrity`\n\n## Message\n\nChain integrity error: {0}\n\n## Suggestion\n\nThe KEL has non-linear history; this indicates tampering\n"),
        "AUTHS-E4607" => Some("# AUTHS-E4607\n\n**Crate:** `auths-id`\n\n**Type:** `KelError::ValidationFailed`\n\n## Message\n\nValidation failed: {0}\n"),

        // --- auths-id (ResolveError) ---
        "AUTHS-E4801" => Some("# AUTHS-E4801\n\n**Crate:** `auths-id`\n\n**Type:** `ResolveError::InvalidFormat`\n\n## Message\n\nInvalid DID format: {0}\n\n## Suggestion\n\nUse the format 'did:keri:E<prefix>'\n"),
        "AUTHS-E4802" => Some("# AUTHS-E4802\n\n**Crate:** `auths-id`\n\n**Type:** `ResolveError::NotFound`\n\n## Message\n\nKEL not found for prefix: {0}\n\n## Suggestion\n\nThe identity does not exist; check the DID prefix\n"),
        "AUTHS-E4803" => Some("# AUTHS-E4803\n\n**Crate:** `auths-id`\n\n**Type:** `ResolveError::Kel`\n\n## Message\n\nKEL error: {0}\n"),
        "AUTHS-E4804" => Some("# AUTHS-E4804\n\n**Crate:** `auths-id`\n\n**Type:** `ResolveError::Validation`\n\n## Message\n\nValidation error: {0}\n"),
        "AUTHS-E4805" => Some("# AUTHS-E4805\n\n**Crate:** `auths-id`\n\n**Type:** `ResolveError::InvalidKeyEncoding`\n\n## Message\n\nInvalid key encoding: {0}\n"),
        "AUTHS-E4806" => Some("# AUTHS-E4806\n\n**Crate:** `auths-id`\n\n**Type:** `ResolveError::NoCurrentKey`\n\n## Message\n\nNo current key in identity\n\n## Suggestion\n\nThe identity has no active key; it may be abandoned\n"),
        "AUTHS-E4807" => Some("# AUTHS-E4807\n\n**Crate:** `auths-id`\n\n**Type:** `ResolveError::UnknownKeyType`\n\n## Message\n\nUnknown key type: {0}\n\n## Suggestion\n\nOnly Ed25519 keys (D prefix) are currently supported\n"),

        // --- auths-id (RotationError) ---
        "AUTHS-E4821" => Some("# AUTHS-E4821\n\n**Crate:** `auths-id`\n\n**Type:** `RotationError::Kel`\n\n## Message\n\nKEL error: {0}\n"),
        "AUTHS-E4822" => Some("# AUTHS-E4822\n\n**Crate:** `auths-id`\n\n**Type:** `RotationError::Validation`\n\n## Message\n\nValidation error: {0}\n"),
        "AUTHS-E4823" => Some("# AUTHS-E4823\n\n**Crate:** `auths-id`\n\n**Type:** `RotationError::KeyGeneration`\n\n## Message\n\nKey generation failed: {0}\n"),
        "AUTHS-E4824" => Some("# AUTHS-E4824\n\n**Crate:** `auths-id`\n\n**Type:** `RotationError::InvalidKey`\n\n## Message\n\nInvalid key: {0}\n"),
        "AUTHS-E4825" => Some("# AUTHS-E4825\n\n**Crate:** `auths-id`\n\n**Type:** `RotationError::CommitmentMismatch`\n\n## Message\n\nKey commitment mismatch\n\n## Suggestion\n\nThe provided key does not match the pre-committed next key. Use the key that was generated during initialization or the last rotation.\n"),
        "AUTHS-E4826" => Some("# AUTHS-E4826\n\n**Crate:** `auths-id`\n\n**Type:** `RotationError::IdentityAbandoned`\n\n## Message\n\nIdentity is abandoned (empty next commitment)\n\n## Suggestion\n\nThis identity has been permanently abandoned. Create a new identity with 'auths init'.\n"),
        "AUTHS-E4827" => Some("# AUTHS-E4827\n\n**Crate:** `auths-id`\n\n**Type:** `RotationError::Serialization`\n\n## Message\n\nSerialization error: {0}\n"),
        "AUTHS-E4828" => Some("# AUTHS-E4828\n\n**Crate:** `auths-id`\n\n**Type:** `RotationError::Storage`\n\n## Message\n\nStorage error: {0}\n"),
        "AUTHS-E4829" => Some("# AUTHS-E4829\n\n**Crate:** `auths-id`\n\n**Type:** `RotationError::RotationFailed`\n\n## Message\n\nRotation failed: {0}\n"),
        "AUTHS-E4830" => Some("# AUTHS-E4830\n\n**Crate:** `auths-id`\n\n**Type:** `RotationError::KeyNotFound`\n\n## Message\n\nKey not found: {0}\n"),
        "AUTHS-E4831" => Some("# AUTHS-E4831\n\n**Crate:** `auths-id`\n\n**Type:** `RotationError::KeyDecryptionFailed`\n\n## Message\n\nKey decryption failed: {0}\n"),

        // --- auths-id (TenantIdError) ---
        "AUTHS-E4851" => Some("# AUTHS-E4851\n\n**Crate:** `auths-id`\n\n**Type:** `TenantIdError::InvalidLength`\n\n## Message\n\nmust be 1–64 characters (got {0})\n\n## Suggestion\n\nTenant ID must be between 1 and 64 characters\n"),
        "AUTHS-E4852" => Some("# AUTHS-E4852\n\n**Crate:** `auths-id`\n\n**Type:** `TenantIdError::InvalidCharacter`\n\n## Message\n\ncontains disallowed character {0:?} (only [a-z0-9_-] allowed)\n\n## Suggestion\n\nOnly lowercase letters, digits, hyphens, and underscores are allowed\n"),
        "AUTHS-E4853" => Some("# AUTHS-E4853\n\n**Crate:** `auths-id`\n\n**Type:** `TenantIdError::Reserved`\n\n## Message\n\n'{0}' is reserved\n\n## Suggestion\n\nChoose a different tenant ID; this name is reserved\n"),

        // --- auths-id (RegistryError) ---
        "AUTHS-E4861" => Some("# AUTHS-E4861\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::Storage`\n\n## Message\n\nStorage error: {0}\n\n## Suggestion\n\nCheck storage backend connectivity\n"),
        "AUTHS-E4862" => Some("# AUTHS-E4862\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::InvalidPrefix`\n\n## Message\n\nInvalid prefix '{prefix}': {reason}\n\n## Suggestion\n\nKERI prefixes must start with 'E' (Blake3 SAID)\n"),
        "AUTHS-E4863" => Some("# AUTHS-E4863\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::InvalidDeviceDid`\n\n## Message\n\nInvalid device DID '{did}': {reason}\n\n## Suggestion\n\nDevice DIDs must be in 'did:key:z...' format\n"),
        "AUTHS-E4864" => Some("# AUTHS-E4864\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::EventExists`\n\n## Message\n\nEvent already exists: {prefix} seq {seq}\n\n## Suggestion\n\nThis event has already been appended to the KEL\n"),
        "AUTHS-E4865" => Some("# AUTHS-E4865\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::SequenceGap`\n\n## Message\n\nSequence gap for {prefix}: expected {expected}, got {got}\n\n## Suggestion\n\nEvents must be appended in strict sequence order\n"),
        "AUTHS-E4866" => Some("# AUTHS-E4866\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::NotFound`\n\n## Message\n\nNot found: {entity_type} '{id}'\n"),
        "AUTHS-E4867" => Some("# AUTHS-E4867\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::Serialization`\n\n## Message\n\nSerialization error: {0}\n"),
        "AUTHS-E4868" => Some("# AUTHS-E4868\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::ConcurrentModification`\n\n## Message\n\nConcurrent modification: {0}\n\n## Suggestion\n\nRetry the operation; another process modified the registry\n"),
        "AUTHS-E4869" => Some("# AUTHS-E4869\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::SaidMismatch`\n\n## Message\n\nSAID mismatch: expected {expected}, got {actual}\n\n## Suggestion\n\nThe event content does not match its declared SAID\n"),
        "AUTHS-E4870" => Some("# AUTHS-E4870\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::InvalidEvent`\n\n## Message\n\nInvalid event: {reason}\n"),
        "AUTHS-E4871" => Some("# AUTHS-E4871\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::Io`\n\n## Message\n\nI/O error: {0}\n\n## Suggestion\n\nCheck file permissions and disk space\n"),
        "AUTHS-E4872" => Some("# AUTHS-E4872\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::Internal`\n\n## Message\n\nInternal error: {0}\n"),
        "AUTHS-E4873" => Some("# AUTHS-E4873\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::InvalidTenantId`\n\n## Message\n\ninvalid tenant ID '{tenant_id}': {kind}\n"),
        "AUTHS-E4874" => Some("# AUTHS-E4874\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::Attestation`\n\n## Message\n\nAttestation error: {0}\n"),
        "AUTHS-E4875" => Some("# AUTHS-E4875\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::StaleAttestation`\n\n## Message\n\nStale attestation: {0}\n\n## Suggestion\n\nThe attestation has been superseded by a newer version\n"),
        "AUTHS-E4876" => Some("# AUTHS-E4876\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::NotImplemented`\n\n## Message\n\nNot implemented: {method}\n\n## Suggestion\n\nThis operation is not supported by the current backend\n"),
        "AUTHS-E4877" => Some("# AUTHS-E4877\n\n**Crate:** `auths-id`\n\n**Type:** `RegistryError::BatchValidationFailed`\n\n## Message\n\nBatch validation failed at index {index}: {source}\n"),

        // --- auths-id (InceptionError) ---
        "AUTHS-E4901" => Some("# AUTHS-E4901\n\n**Crate:** `auths-id`\n\n**Type:** `InceptionError::KeyGeneration`\n\n## Message\n\nKey generation failed: {0}\n"),
        "AUTHS-E4902" => Some("# AUTHS-E4902\n\n**Crate:** `auths-id`\n\n**Type:** `InceptionError::Kel`\n\n## Message\n\nKEL error: {0}\n\n## Suggestion\n\nCheck the KEL state; a KEL may already exist for this prefix\n"),
        "AUTHS-E4903" => Some("# AUTHS-E4903\n\n**Crate:** `auths-id`\n\n**Type:** `InceptionError::Storage`\n\n## Message\n\nStorage error: {0}\n\n## Suggestion\n\nCheck storage backend connectivity\n"),
        "AUTHS-E4904" => Some("# AUTHS-E4904\n\n**Crate:** `auths-id`\n\n**Type:** `InceptionError::Validation`\n\n## Message\n\nValidation error: {0}\n"),
        "AUTHS-E4905" => Some("# AUTHS-E4905\n\n**Crate:** `auths-id`\n\n**Type:** `InceptionError::Serialization`\n\n## Message\n\nSerialization error: {0}\n"),
        "AUTHS-E4906" => Some("# AUTHS-E4906\n\n**Crate:** `auths-id`\n\n**Type:** `InceptionError::InvalidThreshold`\n\n## Message\n\nInvalid threshold {threshold} for key_count={key_count}: {reason}\n\n## Suggestion\n\nEnsure the threshold count does not exceed the number of keys, and that weighted clauses have one weight per key summing to at least 1\n"),

        // --- auths-id (IncrementalError) ---
        "AUTHS-E4951" => Some("# AUTHS-E4951\n\n**Crate:** `auths-id`\n\n**Type:** `IncrementalError::Kel`\n\n## Message\n\nKEL error: {0}\n"),
        "AUTHS-E4952" => Some("# AUTHS-E4952\n\n**Crate:** `auths-id`\n\n**Type:** `IncrementalError::ChainContinuity`\n\n## Message\n\nChain continuity error: expected previous SAID {expected}, got {actual}\n\n## Suggestion\n\nThe KEL chain is broken; clear the cache and retry\n"),
        "AUTHS-E4953" => Some("# AUTHS-E4953\n\n**Crate:** `auths-id`\n\n**Type:** `IncrementalError::SequenceError`\n\n## Message\n\nSequence error: expected {expected}, got {actual}\n\n## Suggestion\n\nThe KEL has sequence gaps; re-sync from a trusted source\n"),
        "AUTHS-E4954" => Some("# AUTHS-E4954\n\n**Crate:** `auths-id`\n\n**Type:** `IncrementalError::MalformedSequence`\n\n## Message\n\nMalformed sequence number: {raw:?}\n"),
        "AUTHS-E4955" => Some("# AUTHS-E4955\n\n**Crate:** `auths-id`\n\n**Type:** `IncrementalError::InvalidEventType`\n\n## Message\n\nInvalid event type in KEL: {0}\n"),
        "AUTHS-E4956" => Some("# AUTHS-E4956\n\n**Crate:** `auths-id`\n\n**Type:** `IncrementalError::NonLinearHistory`\n\n## Message\n\nKEL history is non-linear: commit {commit} has {parent_count} parents (expected 1)\n\n## Suggestion\n\nThe KEL has merge commits, indicating tampering\n"),
        "AUTHS-E4957" => Some("# AUTHS-E4957\n\n**Crate:** `auths-id`\n\n**Type:** `IncrementalError::MissingParent`\n\n## Message\n\nKEL history is corrupted: commit {commit} has no parent but is not inception\n\n## Suggestion\n\nThe KEL commit history is corrupted\n"),

        // --- auths-id (AnchorError) ---
        "AUTHS-E4961" => Some("# AUTHS-E4961\n\n**Crate:** `auths-id`\n\n**Type:** `AnchorError::Kel`\n\n## Message\n\nKEL error: {0}\n"),
        "AUTHS-E4962" => Some("# AUTHS-E4962\n\n**Crate:** `auths-id`\n\n**Type:** `AnchorError::Validation`\n\n## Message\n\nValidation error: {0}\n"),
        "AUTHS-E4963" => Some("# AUTHS-E4963\n\n**Crate:** `auths-id`\n\n**Type:** `AnchorError::Serialization`\n\n## Message\n\nSerialization error: {0}\n"),
        "AUTHS-E4964" => Some("# AUTHS-E4964\n\n**Crate:** `auths-id`\n\n**Type:** `AnchorError::InvalidDid`\n\n## Message\n\nInvalid DID format: {0}\n\n## Suggestion\n\nUse the format 'did:keri:E<prefix>'\n"),
        "AUTHS-E4965" => Some("# AUTHS-E4965\n\n**Crate:** `auths-id`\n\n**Type:** `AnchorError::NotFound`\n\n## Message\n\nKEL not found for prefix: {0}\n\n## Suggestion\n\nInitialize the identity first with 'auths init'\n"),
        "AUTHS-E4966" => Some("# AUTHS-E4966\n\n**Crate:** `auths-id`\n\n**Type:** `AnchorError::Signing`\n\n## Message\n\nSigning error: {0}\n\n## Suggestion\n\nCheck that the key alias exists and the passphrase is correct\n"),
        "AUTHS-E4967" => Some("# AUTHS-E4967\n\n**Crate:** `auths-id`\n\n**Type:** `AnchorError::IxnForbidden`\n\n## Message\n\nIdentity cannot emit interaction events: {0}\n\n## Suggestion\n\nDevice authorization requires a transferable identity (non-empty n[]) without establishment-only restriction (no EO in c[]). Create a new identity with auths init.\n"),
        "AUTHS-E4968" => Some("# AUTHS-E4968\n\n**Crate:** `auths-id`\n\n**Type:** `AnchorError::WitnessQuorumNotMet`\n\n## Message\n\nWitness quorum not met: {0}\n\n## Suggestion\n\nCheck witness server connectivity and threshold configuration\n"),

        // --- auths-id (WitnessIntegrationError) ---
        "AUTHS-E4971" => Some("# AUTHS-E4971\n\n**Crate:** `auths-id`\n\n**Type:** `WitnessIntegrationError::Collection`\n\n## Message\n\nReceipt collection failed: {0}\n\n## Suggestion\n\nCheck witness server connectivity and threshold configuration\n"),
        "AUTHS-E4972" => Some("# AUTHS-E4972\n\n**Crate:** `auths-id`\n\n**Type:** `WitnessIntegrationError::Storage`\n\n## Message\n\nReceipt storage failed: {0}\n\n## Suggestion\n\nCheck storage backend permissions\n"),
        "AUTHS-E4973" => Some("# AUTHS-E4973\n\n**Crate:** `auths-id`\n\n**Type:** `WitnessIntegrationError::Runtime`\n\n## Message\n\nTokio runtime error: {0}\n"),
        "AUTHS-E4974" => Some("# AUTHS-E4974\n\n**Crate:** `auths-id`\n\n**Type:** `WitnessIntegrationError::QuorumNotMet`\n\n## Message\n\nwitness quorum not met: {valid} valid receipt(s), need {required}\n\n## Suggestion\n\nToo few witnesses returned a valid, verifiable receipt for this event\n"),

        // --- auths-id (CredentialRegistryError) ---
        "AUTHS-E4981" => Some("# AUTHS-E4981\n\n**Crate:** `auths-id`\n\n**Type:** `CredentialRegistryError::ThresholdUnsupported`\n\n## Message\n\nissuer '{issuer}' is multi-signature (kt≥2); credential registry anchoring is single-author only\n\n## Suggestion\n\nCredential issuance currently requires a single-signature (kt=1) issuer\n"),
        "AUTHS-E4982" => Some("# AUTHS-E4982\n\n**Crate:** `auths-id`\n\n**Type:** `CredentialRegistryError::Tel`\n\n## Message\n\nTEL event error: {0}\n"),
        "AUTHS-E4983" => Some("# AUTHS-E4983\n\n**Crate:** `auths-id`\n\n**Type:** `CredentialRegistryError::Anchor`\n\n## Message\n\nKEL anchoring failed: {0}\n"),
        "AUTHS-E4984" => Some("# AUTHS-E4984\n\n**Crate:** `auths-id`\n\n**Type:** `CredentialRegistryError::Storage`\n\n## Message\n\nregistry storage error: {0}\n"),

        // --- auths-id (CacheError) ---
        "AUTHS-E4986" => Some("# AUTHS-E4986\n\n**Crate:** `auths-id`\n\n**Type:** `CacheError::Io`\n\n## Message\n\nI/O error: {0}\n\n## Suggestion\n\nCheck cache directory permissions; the cache is optional and can be cleared\n"),
        "AUTHS-E4987" => Some("# AUTHS-E4987\n\n**Crate:** `auths-id`\n\n**Type:** `CacheError::Json`\n\n## Message\n\nJSON serialization error: {0}\n\n## Suggestion\n\nThe cache file may be corrupted; try clearing it with 'auths cache clear'\n"),
        "AUTHS-E4988" => Some("# AUTHS-E4988\n\n**Crate:** `auths-id`\n\n**Type:** `CacheError::InvalidDid`\n\n## Message\n\ninvalid DID: {0}\n\n## Suggestion\n\nThe DID must be a 'did:keri:' identity\n"),

        // --- auths-id (HookError) ---
        "AUTHS-E4991" => Some("# AUTHS-E4991\n\n**Crate:** `auths-id`\n\n**Type:** `HookError::Io`\n\n## Message\n\nIO error: {0}\n\n## Suggestion\n\nCheck file permissions on the Git hooks directory\n"),
        "AUTHS-E4992" => Some("# AUTHS-E4992\n\n**Crate:** `auths-id`\n\n**Type:** `HookError::NotGitRepo`\n\n## Message\n\nNot a Git repository: {0}\n\n## Suggestion\n\nEnsure the path points to a valid Git repository\n"),

        // --- auths-sdk (SetupError) ---
        "AUTHS-E5001" => Some("# AUTHS-E5001\n\n**Crate:** `auths-sdk`\n\n**Type:** `SetupError::IdentityAlreadyExists`\n\n## Message\n\nidentity already exists: {did}\n\n## Suggestion\n\nUse `auths id show` to inspect the existing identity\n"),
        "AUTHS-E5002" => Some("# AUTHS-E5002\n\n**Crate:** `auths-sdk`\n\n**Type:** `SetupError::KeychainUnavailable`\n\n## Message\n\nkeychain unavailable ({backend}): {reason}\n\n## Suggestion\n\nRun `auths doctor` to diagnose keychain issues\n"),
        "AUTHS-E5004" => Some("# AUTHS-E5004\n\n**Crate:** `auths-sdk`\n\n**Type:** `SetupError::GitConfigError`\n\n## Message\n\ngit config error: {0}\n\n## Suggestion\n\nEnsure Git is configured: git config --global user.name/email\n"),
        "AUTHS-E5006" => Some("# AUTHS-E5006\n\n**Crate:** `auths-sdk`\n\n**Type:** `SetupError::PlatformVerificationFailed`\n\n## Message\n\nplatform verification failed: {0}\n\n## Suggestion\n\nPlatform identity verification failed; check your platform credentials and network connectivity\n"),
        "AUTHS-E5007" => Some("# AUTHS-E5007\n\n**Crate:** `auths-sdk`\n\n**Type:** `SetupError::InvalidSetupConfig`\n\n## Message\n\ninvalid setup config: {0}\n"),
        "AUTHS-E5008" => Some("# AUTHS-E5008\n\n**Crate:** `auths-sdk`\n\n**Type:** `SetupError::WeakPassphrase`\n\n## Message\n\npassphrase from {source_name} is too weak: {reason}\n\n## Suggestion\n\nUse at least 12 characters with 3 of 4 character classes (lowercase, uppercase, digit, symbol)\n"),

        // --- auths-sdk (DeviceError) ---
        "AUTHS-E5101" => Some("# AUTHS-E5101\n\n**Crate:** `auths-sdk`\n\n**Type:** `DeviceError::IdentityNotFound`\n\n## Message\n\nidentity not found: {did}\n\n## Suggestion\n\nRun `auths init` to create an identity first\n"),
        "AUTHS-E5102" => Some("# AUTHS-E5102\n\n**Crate:** `auths-sdk`\n\n**Type:** `DeviceError::DeviceNotFound`\n\n## Message\n\ndevice not found: {did}\n\n## Suggestion\n\nRun `auths device list` to see linked devices\n"),
        "AUTHS-E5103" => Some("# AUTHS-E5103\n\n**Crate:** `auths-sdk`\n\n**Type:** `DeviceError::AttestationError`\n\n## Message\n\nattestation error: {0}\n\n## Suggestion\n\nThe attestation operation failed; run `auths device list` to check device status\n"),
        "AUTHS-E5105" => Some("# AUTHS-E5105\n\n**Crate:** `auths-sdk`\n\n**Type:** `DeviceError::DeviceDidMismatch`\n\n## Message\n\ndevice DID mismatch: expected {expected}, got {actual}\n\n## Suggestion\n\nCheck that --device matches the key name\n"),
        "AUTHS-E5106" => Some("# AUTHS-E5106\n\n**Crate:** `auths-sdk`\n\n**Type:** `DeviceError::DelegationError`\n\n## Message\n\ndevice delegation failed: {0}\n\n## Suggestion\n\nThe device delegation could not be authored or anchored; check the root identity\n"),

        // --- auths-sdk (DeviceExtensionError) ---
        "AUTHS-E5201" => Some("# AUTHS-E5201\n\n**Crate:** `auths-sdk`\n\n**Type:** `DeviceExtensionError::IdentityNotFound`\n\n## Message\n\nidentity not found\n\n## Suggestion\n\nRun `auths init` to create an identity first\n"),
        "AUTHS-E5202" => Some("# AUTHS-E5202\n\n**Crate:** `auths-sdk`\n\n**Type:** `DeviceExtensionError::NoAttestationFound`\n\n## Message\n\nno attestation found for device {device_did}\n\n## Suggestion\n\nRun `auths device link` to create an attestation for this device\n"),
        "AUTHS-E5203" => Some("# AUTHS-E5203\n\n**Crate:** `auths-sdk`\n\n**Type:** `DeviceExtensionError::AlreadyRevoked`\n\n## Message\n\ndevice {device_did} is already revoked\n\n## Suggestion\n\nThis device has been revoked and cannot be extended; link a new device with `auths device link`\n"),
        "AUTHS-E5204" => Some("# AUTHS-E5204\n\n**Crate:** `auths-sdk`\n\n**Type:** `DeviceExtensionError::AttestationFailed`\n\n## Message\n\nattestation creation failed: {0}\n\n## Suggestion\n\nFailed to create the extension attestation; check key access and try again\n"),

        // --- auths-sdk (RotationError) ---
        "AUTHS-E5301" => Some("# AUTHS-E5301\n\n**Crate:** `auths-sdk`\n\n**Type:** `RotationError::IdentityNotFound`\n\n## Message\n\nidentity not found at {path}\n\n## Suggestion\n\nRun `auths init` to create an identity first\n"),
        "AUTHS-E5302" => Some("# AUTHS-E5302\n\n**Crate:** `auths-sdk`\n\n**Type:** `RotationError::KeyNotFound`\n\n## Message\n\nkey not found: {0}\n\n## Suggestion\n\nRun `auths key list` to see available keys\n"),
        "AUTHS-E5303" => Some("# AUTHS-E5303\n\n**Crate:** `auths-sdk`\n\n**Type:** `RotationError::KeyDecryptionFailed`\n\n## Message\n\nkey decryption failed: {0}\n\n## Suggestion\n\nCheck your passphrase and try again\n"),
        "AUTHS-E5304" => Some("# AUTHS-E5304\n\n**Crate:** `auths-sdk`\n\n**Type:** `RotationError::KelHistoryFailed`\n\n## Message\n\nKEL history error: {0}\n\n## Suggestion\n\nRun `auths doctor` to check KEL integrity\n"),
        "AUTHS-E5305" => Some("# AUTHS-E5305\n\n**Crate:** `auths-sdk`\n\n**Type:** `RotationError::RotationFailed`\n\n## Message\n\nrotation failed: {0}\n\n## Suggestion\n\nKey rotation failed; verify your current key is accessible with `auths key list`\n"),
        "AUTHS-E5306" => Some("# AUTHS-E5306\n\n**Crate:** `auths-sdk`\n\n**Type:** `RotationError::PartialRotation`\n\n## Message\n\nrotation event committed to KEL but keychain write failed — manual recovery required: {0}\n\n## Suggestion\n\nRe-run the rotation with the same new key to complete the keychain write\n"),
        "AUTHS-E5307" => Some("# AUTHS-E5307\n\n**Crate:** `auths-sdk`\n\n**Type:** `RotationError::HardwareKeyNotRotatable`\n\n## Message\n\nrotation requires a software-backed key; alias '{alias}' is hardware-backed (Secure Enclave) and cannot export the raw key material rotation needs\n\n## Suggestion\n\nHardware-backed keys (Secure Enclave / HSM) cannot be rotated in-place; provision a software-backed identity or rotate by creating a new identity\n"),

        // --- auths-sdk (AgentError) ---
        "AUTHS-E5311" => Some("# AUTHS-E5311\n\n**Crate:** `auths-sdk`\n\n**Type:** `AgentError::IdentityNotFound`\n\n## Message\n\nidentity not found: {did}\n\n## Suggestion\n\nRun `auths init` to create a root identity first\n"),
        "AUTHS-E5312" => Some("# AUTHS-E5312\n\n**Crate:** `auths-sdk`\n\n**Type:** `AgentError::AlreadyDelegated`\n\n## Message\n\nan agent key already exists under alias '{alias}'\n\n## Suggestion\n\nAn agent already exists under this alias. Reuse it, rotate it with `auths id agent rotate`, or pass a fresh --label; `auths id agent list` shows existing agents.\n"),
        "AUTHS-E5313" => Some("# AUTHS-E5313\n\n**Crate:** `auths-sdk`\n\n**Type:** `AgentError::DelegationError`\n\n## Message\n\nagent delegation failed: {0}\n\n## Suggestion\n\nThe agent delegation could not be authored or anchored; check the root identity\n"),
        "AUTHS-E5314" => Some("# AUTHS-E5314\n\n**Crate:** `auths-sdk`\n\n**Type:** `AgentError::AgentNotFound`\n\n## Message\n\nagent not found: {did}\n\n## Suggestion\n\nRun `auths id agent list` to see the agents this identity has delegated\n"),
        "AUTHS-E5315" => Some("# AUTHS-E5315\n\n**Crate:** `auths-sdk`\n\n**Type:** `AgentError::Revoked`\n\n## Message\n\nagent {did} is revoked\n\n## Suggestion\n\nThis agent was revoked and cannot be rotated; delegate a new agent instead\n"),
        "AUTHS-E5316" => Some("# AUTHS-E5316\n\n**Crate:** `auths-sdk`\n\n**Type:** `AgentError::OutsideDelegatorScope`\n\n## Message\n\nrequested capability '{capability}' exceeds the delegator's scope\n\n## Suggestion\n\nNarrow the agent's --scope to a subset of the delegator's own capabilities\n"),
        "AUTHS-E5317" => Some("# AUTHS-E5317\n\n**Crate:** `auths-sdk`\n\n**Type:** `AgentError::AttestationError`\n\n## Message\n\nagent delegation attestation failed: {0}\n\n## Suggestion\n\nThe delegation attestation could not be signed; check the keychain aliases\n"),
        "AUTHS-E5318" => Some("# AUTHS-E5318\n\n**Crate:** `auths-sdk`\n\n**Type:** `AgentError::AnchorError`\n\n## Message\n\nagent delegation attestation anchoring failed: {0}\n\n## Suggestion\n\nThe delegation attestation could not be anchored; check the root identity's KEL\n"),

        // --- auths-sdk (RegistrationError) ---
        "AUTHS-E5400" => Some("# AUTHS-E5400\n\n**Crate:** `auths-sdk`\n\n**Type:** `RegistrationError::NoRegistryConfigured`\n\n## Message\n\nno registry configured. Auths needs no registry: identity, signing and verification are local and git-native, and a signer's KEL reaches a verifier over the same git remote as the code. Pass --registry <url> or set AUTHS_REGISTRY_URL only if you are running one.\n\n## Suggestion\n\nRegistration is optional — signing and verification need no registry. Pass --registry <url> or set AUTHS_REGISTRY_URL only if you run one\n"),
        "AUTHS-E5401" => Some("# AUTHS-E5401\n\n**Crate:** `auths-sdk`\n\n**Type:** `RegistrationError::AlreadyRegistered`\n\n## Message\n\nidentity already registered at this registry\n\n## Suggestion\n\nThis identity is already registered; use `auths id show` to see registration details\n"),
        "AUTHS-E5402" => Some("# AUTHS-E5402\n\n**Crate:** `auths-sdk`\n\n**Type:** `RegistrationError::QuotaExceeded`\n\n## Message\n\nregistration quota exceeded — try again later\n\n## Suggestion\n\nWait a few minutes and try again\n"),
        "AUTHS-E5403" => Some("# AUTHS-E5403\n\n**Crate:** `auths-sdk`\n\n**Type:** `RegistrationError::InvalidDidFormat`\n\n## Message\n\ninvalid DID format: {did}\n\n## Suggestion\n\nRun `auths doctor` to check local identity data\n"),
        "AUTHS-E5404" => Some("# AUTHS-E5404\n\n**Crate:** `auths-sdk`\n\n**Type:** `RegistrationError::IdentityLoadError`\n\n## Message\n\nidentity load error: {0}\n\n## Suggestion\n\nRun `auths doctor` to check local identity data\n"),
        "AUTHS-E5405" => Some("# AUTHS-E5405\n\n**Crate:** `auths-sdk`\n\n**Type:** `RegistrationError::RegistryReadError`\n\n## Message\n\nregistry read error: {0}\n\n## Suggestion\n\nRun `auths doctor` to check local identity data\n"),
        "AUTHS-E5406" => Some("# AUTHS-E5406\n\n**Crate:** `auths-sdk`\n\n**Type:** `RegistrationError::SerializationError`\n\n## Message\n\nserialization error: {0}\n\n## Suggestion\n\nRun `auths doctor` to check local identity data\n"),

        // --- auths-sdk (McpAuthError) ---
        "AUTHS-E5501" => Some("# AUTHS-E5501\n\n**Crate:** `auths-sdk`\n\n**Type:** `McpAuthError::BridgeUnreachable`\n\n## Message\n\nbridge unreachable: {0}\n\n## Suggestion\n\nCheck network connectivity to the OIDC bridge\n"),
        "AUTHS-E5502" => Some("# AUTHS-E5502\n\n**Crate:** `auths-sdk`\n\n**Type:** `McpAuthError::TokenExchangeFailed`\n\n## Message\n\ntoken exchange failed (HTTP {status}): {body}\n\n## Suggestion\n\nVerify your credentials and try again\n"),
        "AUTHS-E5503" => Some("# AUTHS-E5503\n\n**Crate:** `auths-sdk`\n\n**Type:** `McpAuthError::InvalidResponse`\n\n## Message\n\ninvalid response: {0}\n\n## Suggestion\n\nThe OIDC bridge returned an unexpected response; verify the bridge URL and try again\n"),
        "AUTHS-E5504" => Some("# AUTHS-E5504\n\n**Crate:** `auths-sdk`\n\n**Type:** `McpAuthError::InsufficientCapabilities`\n\n## Message\n\ninsufficient capabilities: requested {requested:?}\n\n## Suggestion\n\nRequest fewer capabilities or contact your administrator\n"),

        // --- auths-sdk (TrustError) ---
        "AUTHS-E5551" => Some("# AUTHS-E5551\n\n**Crate:** `auths-sdk`\n\n**Type:** `TrustError::UnknownIdentity`\n\n## Message\n\nUnknown identity '{did}' and trust policy is '{policy}'\n\n## Suggestion\n\nRun `auths trust pin --did <did>` or add the identity to .auths/roots.json\n"),
        "AUTHS-E5552" => Some("# AUTHS-E5552\n\n**Crate:** `auths-sdk`\n\n**Type:** `TrustError::KeyResolutionFailed`\n\n## Message\n\nFailed to resolve public key for identity {did}\n\n## Suggestion\n\nVerify the identity exists and has a valid public key registered\n"),
        "AUTHS-E5553" => Some("# AUTHS-E5553\n\n**Crate:** `auths-sdk`\n\n**Type:** `TrustError::InvalidTrustStore`\n\n## Message\n\nInvalid trust store: {0}\n\n## Suggestion\n\nCheck the format of your trust store (roots.json or ~/.auths/known_identities.json)\n"),
        "AUTHS-E5554" => Some("# AUTHS-E5554\n\n**Crate:** `auths-sdk`\n\n**Type:** `TrustError::TofuRequiresInteraction`\n\n## Message\n\nTOFU trust decision required but running in non-interactive mode\n\n## Suggestion\n\nRun interactively (on a TTY), or pre-pin the identity with `auths trust pin` so no interactive decision is needed\n"),

        // --- auths-sdk (OrgError) ---
        "AUTHS-E5601" => Some("# AUTHS-E5601\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::AdminNotFound`\n\n## Message\n\nno admin with the given public key found in organization '{org}'\n\n## Suggestion\n\nVerify you are using the correct admin key for this organization\n"),
        "AUTHS-E5602" => Some("# AUTHS-E5602\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::MemberNotFound`\n\n## Message\n\nmember '{did}' not found in organization '{org}'\n\n## Suggestion\n\nRun `auths org list-members` to see current members\n"),
        "AUTHS-E5603" => Some("# AUTHS-E5603\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::AlreadyRevoked`\n\n## Message\n\nmember '{did}' is already revoked\n\n## Suggestion\n\nThis member has already been revoked from the organization\n"),
        "AUTHS-E5604" => Some("# AUTHS-E5604\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::InvalidCapability`\n\n## Message\n\ninvalid capability '{cap}': {reason}\n\n## Suggestion\n\nUse a valid capability (e.g., 'sign_commit', 'manage_members', 'admin')\n"),
        "AUTHS-E5605" => Some("# AUTHS-E5605\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::InvalidDid`\n\n## Message\n\ninvalid organization DID: {0}\n\n## Suggestion\n\nOrganization DIDs must be valid did:keri identifiers\n"),
        "AUTHS-E5606" => Some("# AUTHS-E5606\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::InvalidPublicKey`\n\n## Message\n\ninvalid public key: {0}\n\n## Suggestion\n\nPublic keys must be hex-encoded Ed25519 keys\n"),
        "AUTHS-E5607" => Some("# AUTHS-E5607\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::Signing`\n\n## Message\n\nsigning error: {0}\n\n## Suggestion\n\nThe signing operation failed; check your key access with `auths key list`\n"),
        "AUTHS-E5608" => Some("# AUTHS-E5608\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::Identity`\n\n## Message\n\nidentity error: {0}\n\n## Suggestion\n\nFailed to load identity; run `auths id show` to check identity status\n"),
        "AUTHS-E5609" => Some("# AUTHS-E5609\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::KeyStorage`\n\n## Message\n\nkey storage error: {0}\n\n## Suggestion\n\nFailed to access key storage; run `auths doctor` to diagnose\n"),
        "AUTHS-E5610" => Some("# AUTHS-E5610\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::Storage`\n\n## Message\n\nstorage error: {0}\n\n## Suggestion\n\nFailed to access organization storage; check repository permissions\n"),
        "AUTHS-E5611" => Some("# AUTHS-E5611\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::Anchor`\n\n## Message\n\nanchor error: {0}\n\n## Suggestion\n\nKEL anchoring failed; check identity and registry state\n"),
        "AUTHS-E5612" => Some("# AUTHS-E5612\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::OrgThresholdDelegationUnsupported`\n\n## Message\n\norganization '{org}' uses a multi-signature controller (kt≥2); KERI-native member delegation requires a single-signature (kt=1) org\n\n## Suggestion\n\nMulti-signature org anchoring is not yet supported; use a single-signature (kt=1) org\n"),
        "AUTHS-E5613" => Some("# AUTHS-E5613\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::MemberKeyExists`\n\n## Message\n\na member key already exists under alias '{alias}'\n\n## Suggestion\n\nChoose a different member alias; run `auths org list-members` to see existing members\n"),
        "AUTHS-E5614" => Some("# AUTHS-E5614\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::Delegation`\n\n## Message\n\nmember delegation failed: {0}\n\n## Suggestion\n\nThe member delegation could not be authored or anchored; check the org identity\n"),
        "AUTHS-E5615" => Some("# AUTHS-E5615\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::IdentityExists`\n\n## Message\n\nan identity already exists at {location}; refusing to create an organization over it\n\n## Suggestion\n\nAn identity already exists here; use a fresh repository path to create a new organization\n"),
        "AUTHS-E5616" => Some("# AUTHS-E5616\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::IdentityInit`\n\n## Message\n\nfailed to initialize organization identity: {0}\n\n## Suggestion\n\nFailed to initialize the org identity; check key access and repository state\n"),
        "AUTHS-E5617" => Some("# AUTHS-E5617\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::Attestation`\n\n## Message\n\nfailed to create admin attestation: {0}\n\n## Suggestion\n\nFailed to sign the admin attestation; check your key access with `auths key list`\n"),
        "AUTHS-E5618" => Some("# AUTHS-E5618\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::MemberNotDelegable`\n\n## Message\n\nmember '{did}' is not a delegated identifier of organization '{org}'\n\n## Suggestion\n\nThe member must first incept a delegated identity naming this org as delegator (pairing) before it can be off-boarded\n"),
        "AUTHS-E5622" => Some("# AUTHS-E5622\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::PolicyCompile`\n\n## Message\n\ninvalid org policy: {reason}\n\n## Suggestion\n\nFix the policy JSON (a serialized `Expr`); see `auths org policy show` for the current policy\n"),
        "AUTHS-E5623" => Some("# AUTHS-E5623\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::PolicyBlobMissing`\n\n## Message\n\norg policy blob for hash '{hash}' is missing from storage\n\n## Suggestion\n\nThe policy blob is missing; re-anchor it with `auths org policy set`\n"),
        "AUTHS-E5624" => Some("# AUTHS-E5624\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::PolicyIntegrity`\n\n## Message\n\norg policy integrity failure: KEL committed hash '{expected}' but the stored blob hashes to '{actual}'\n\n## Suggestion\n\nThe stored policy was modified after anchoring; re-anchor a trusted policy with `auths org policy set`\n"),
        "AUTHS-E5625" => Some("# AUTHS-E5625\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::ChainCycle`\n\n## Message\n\ndelegation chain cycle detected at '{did}'\n\n## Suggestion\n\nThe delegation chain is malformed (a cycle); inspect the identifiers' KELs\n"),
        "AUTHS-E5626" => Some("# AUTHS-E5626\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::ChainTooDeep`\n\n## Message\n\ndelegation chain exceeds the maximum depth of {max} hops\n\n## Suggestion\n\nThe delegation chain is too deep; reduce delegation nesting\n"),
        "AUTHS-E5627" => Some("# AUTHS-E5627\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::ChainBrokenHop`\n\n## Message\n\ndelegation chain is broken: no KEL found for '{did}'\n\n## Suggestion\n\nA KEL in the delegation chain is missing; ensure all delegators' KELs are present\n"),
        "AUTHS-E5628" => Some("# AUTHS-E5628\n\n**Crate:** `auths-sdk`\n\n**Type:** `OrgError::OidcPolicyInvalid`\n\n## Message\n\ninvalid OIDC-subject policy: {reason}\n\n## Suggestion\n\nFix the OIDC-subject policy JSON (issuer + repository, optional workflow_ref); nothing was anchored\n"),

        // --- auths-sdk (ApprovalError) ---
        "AUTHS-E5701" => Some("# AUTHS-E5701\n\n**Crate:** `auths-sdk`\n\n**Type:** `ApprovalError::NotApprovalRequired`\n\n## Message\n\ndecision is not RequiresApproval\n\n## Suggestion\n\nThis operation does not require approval; run it directly without the --approve flag\n"),
        "AUTHS-E5702" => Some("# AUTHS-E5702\n\n**Crate:** `auths-sdk`\n\n**Type:** `ApprovalError::RequestNotFound`\n\n## Message\n\napproval request not found: {hash}\n\n## Suggestion\n\nRun `auths approval list` to see pending requests\n"),
        "AUTHS-E5703" => Some("# AUTHS-E5703\n\n**Crate:** `auths-sdk`\n\n**Type:** `ApprovalError::RequestExpired`\n\n## Message\n\napproval request expired at {expires_at}\n\n## Suggestion\n\nSubmit a new approval request\n"),
        "AUTHS-E5704" => Some("# AUTHS-E5704\n\n**Crate:** `auths-sdk`\n\n**Type:** `ApprovalError::ApprovalAlreadyUsed`\n\n## Message\n\napproval already used (JTI: {jti})\n\n## Suggestion\n\nSubmit a new approval request\n"),
        "AUTHS-E5705" => Some("# AUTHS-E5705\n\n**Crate:** `auths-sdk`\n\n**Type:** `ApprovalError::PartialApproval`\n\n## Message\n\napproval partially applied — attestation stored but nonce/cleanup failed: {0}\n\n## Suggestion\n\nCheck approval status and retry if needed\n"),
        "AUTHS-E5706" => Some("# AUTHS-E5706\n\n**Crate:** `auths-sdk`\n\n**Type:** `ApprovalError::ApprovalStorage`\n\n## Message\n\nstorage error: {0}\n\n## Suggestion\n\nCheck file permissions and disk space\n"),

        // --- auths-sdk (ArtifactSigningError) ---
        "AUTHS-E5850" => Some("# AUTHS-E5850\n\n**Crate:** `auths-sdk`\n\n**Type:** `ArtifactSigningError::IdentityNotFound`\n\n## Message\n\nidentity not found in configured identity storage\n\n## Suggestion\n\nRun `auths init` to create an identity, or `auths key import` to restore one\n"),
        "AUTHS-E5851" => Some("# AUTHS-E5851\n\n**Crate:** `auths-sdk`\n\n**Type:** `ArtifactSigningError::KeyResolutionFailed`\n\n## Message\n\nkey resolution failed: {0}\n\n## Suggestion\n\nRun `auths status` to see available device aliases\n"),
        "AUTHS-E5852" => Some("# AUTHS-E5852\n\n**Crate:** `auths-sdk`\n\n**Type:** `ArtifactSigningError::KeyDecryptionFailed`\n\n## Message\n\nkey decryption failed: {0}\n\n## Suggestion\n\nCheck your passphrase and try again\n"),
        "AUTHS-E5853" => Some("# AUTHS-E5853\n\n**Crate:** `auths-sdk`\n\n**Type:** `ArtifactSigningError::DigestFailed`\n\n## Message\n\ndigest computation failed: {0}\n\n## Suggestion\n\nVerify the file exists and is readable\n"),
        "AUTHS-E5854" => Some("# AUTHS-E5854\n\n**Crate:** `auths-sdk`\n\n**Type:** `ArtifactSigningError::AttestationFailed`\n\n## Message\n\nattestation creation failed: {0}\n\n## Suggestion\n\nCheck identity storage with `auths status`\n"),
        "AUTHS-E5855" => Some("# AUTHS-E5855\n\n**Crate:** `auths-sdk`\n\n**Type:** `ArtifactSigningError::ResignFailed`\n\n## Message\n\nattestation re-signing failed: {0}\n\n## Suggestion\n\nVerify your device key is accessible with `auths status`\n"),
        "AUTHS-E5856" => Some("# AUTHS-E5856\n\n**Crate:** `auths-sdk`\n\n**Type:** `ArtifactSigningError::InvalidCommitSha`\n\n## Message\n\ninvalid commit SHA: {0} (expected 40 or 64 hex characters)\n\n## Suggestion\n\nProvide a full SHA-1 (40 hex chars) or SHA-256 (64 hex chars) commit hash\n"),
        "AUTHS-E5857" => Some("# AUTHS-E5857\n\n**Crate:** `auths-sdk`\n\n**Type:** `ArtifactSigningError::DeviceRevoked`\n\n## Message\n\ndevice revoked: {0}\n\n## Suggestion\n\nThis device has been removed; pair a new device or sign from an active one\n"),
        "AUTHS-E5858" => Some("# AUTHS-E5858\n\n**Crate:** `auths-sdk`\n\n**Type:** `ArtifactSigningError::KeyRotatedOut`\n\n## Message\n\nsigning key rotated out of the KEL: {0}\n\n## Suggestion\n\nThis key was rotated out; sign with the identity's current key\n"),

        // --- auths-sdk (SigningError) ---
        "AUTHS-E5901" => Some("# AUTHS-E5901\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::IdentityFrozen`\n\n## Message\n\nidentity is frozen: {0}\n\n## Suggestion\n\nTo unfreeze: auths emergency unfreeze\n"),
        "AUTHS-E5902" => Some("# AUTHS-E5902\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::KeyResolution`\n\n## Message\n\nkey resolution failed: {0}\n\n## Suggestion\n\nRun `auths key list` to check available keys\n"),
        "AUTHS-E5903" => Some("# AUTHS-E5903\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::SigningFailed`\n\n## Message\n\nsigning operation failed: {0}\n\n## Suggestion\n\nThe signing operation failed; verify your key is accessible with `auths key list`\n"),
        "AUTHS-E5904" => Some("# AUTHS-E5904\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::InvalidPassphrase`\n\n## Message\n\ninvalid passphrase\n\n## Suggestion\n\nCheck your passphrase and try again\n"),
        "AUTHS-E5905" => Some("# AUTHS-E5905\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::PemEncoding`\n\n## Message\n\nPEM encoding failed: {0}\n\n## Suggestion\n\nFailed to encode the key in PEM format; the key material may be corrupted\n"),
        "AUTHS-E5906" => Some("# AUTHS-E5906\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::AgentUnavailable`\n\n## Message\n\nagent unavailable: {0}\n\n## Suggestion\n\nStart the agent with `auths agent start`\n"),
        "AUTHS-E5907" => Some("# AUTHS-E5907\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::AgentSigningFailed`\n\n## Message\n\nagent signing failed\n\n## Suggestion\n\nCheck agent logs with `auths agent status`\n"),
        "AUTHS-E5908" => Some("# AUTHS-E5908\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::PassphraseExhausted`\n\n## Message\n\npassphrase exhausted after {attempts} attempt(s)\n\n## Suggestion\n\nThe passphrase you entered is incorrect (tried 3 times). Verify it matches what you set during init, or try: auths key export --key-alias <alias> --format pub\n"),
        "AUTHS-E5909" => Some("# AUTHS-E5909\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::KeychainUnavailable`\n\n## Message\n\nkeychain unavailable: {0}\n\n## Suggestion\n\nRun `auths doctor` to diagnose keychain issues\n"),
        "AUTHS-E5910" => Some("# AUTHS-E5910\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::KeyDecryptionFailed`\n\n## Message\n\nkey decryption failed: {0}\n\n## Suggestion\n\nCheck your passphrase and try again\n"),
        "AUTHS-E5911" => Some("# AUTHS-E5911\n\n**Crate:** `auths-sdk`\n\n**Type:** `SigningError::KeyNotFound`\n\n## Message\n\nno signing key under alias '{alias}'\n\n## Suggestion\n\nRun `auths key list` to see available aliases, or `auths init` to create one\n"),

        // --- auths-sdk (AuthChallengeError) ---
        "AUTHS-E6001" => Some("# AUTHS-E6001\n\n**Crate:** `auths-sdk`\n\n**Type:** `AuthChallengeError::EmptyNonce`\n\n## Message\n\nnonce must not be empty\n\n## Suggestion\n\nProvide the nonce from the authentication challenge\n"),
        "AUTHS-E6002" => Some("# AUTHS-E6002\n\n**Crate:** `auths-sdk`\n\n**Type:** `AuthChallengeError::EmptyDomain`\n\n## Message\n\ndomain must not be empty\n\n## Suggestion\n\nProvide the domain (e.g. auths.dev)\n"),
        "AUTHS-E6003" => Some("# AUTHS-E6003\n\n**Crate:** `auths-sdk`\n\n**Type:** `AuthChallengeError::Canonicalization`\n\n## Message\n\ncanonical JSON serialization failed: {0}\n\n## Suggestion\n\nThis is an internal error; please report it as a bug\n"),

        // --- auths-sdk (CredentialError) ---
        "AUTHS-E6101" => Some("# AUTHS-E6101\n\n**Crate:** `auths-sdk`\n\n**Type:** `CredentialError::IssueeNotFound`\n\n## Message\n\nissuee identity not found (no KEL): {did}\n\n## Suggestion\n\nThe issuee must have an incepted identity (KEL) before it can be credentialed\n"),
        "AUTHS-E6102" => Some("# AUTHS-E6102\n\n**Crate:** `auths-sdk`\n\n**Type:** `CredentialError::RegistryError`\n\n## Message\n\ncredential registry error: {0}\n\n## Suggestion\n\nCheck the issuer identity and registry storage are reachable\n"),
        "AUTHS-E6103" => Some("# AUTHS-E6103\n\n**Crate:** `auths-sdk`\n\n**Type:** `CredentialError::AlreadyRevoked`\n\n## Message\n\ncredential already revoked: {said}\n\n## Suggestion\n\nThis credential is already revoked; no further action is needed\n"),
        "AUTHS-E6104" => Some("# AUTHS-E6104\n\n**Crate:** `auths-sdk`\n\n**Type:** `CredentialError::KtThresholdUnsupported`\n\n## Message\n\nissuer is multi-signature (kt≥2); credential anchoring is single-author only\n\n## Suggestion\n\nCredential issuance currently requires a single-signature (kt=1) issuer\n"),
        "AUTHS-E6105" => Some("# AUTHS-E6105\n\n**Crate:** `auths-sdk`\n\n**Type:** `CredentialError::SchemaUnknown`\n\n## Message\n\ncapability schema unknown or uncomputable\n\n## Suggestion\n\nThe compiled-in capability schema is unavailable; this is a build defect\n"),
        "AUTHS-E6106" => Some("# AUTHS-E6106\n\n**Crate:** `auths-sdk`\n\n**Type:** `CredentialError::StaleOrUnresolvable`\n\n## Message\n\ncredential status is stale or unresolvable: {reason}\n\n## Suggestion\n\nNo fresh witnessed tip was reachable; sync the issuer KEL/receipts and retry, or relax --require-witnesses\n"),
        "AUTHS-E6107" => Some("# AUTHS-E6107\n\n**Crate:** `auths-sdk`\n\n**Type:** `CredentialError::MalformedUsageCap`\n\n## Message\n\nmalformed quantitative usage cap '{cap}': a calls: capability must carry a non-negative integer bound (e.g. calls:3)\n\n## Suggestion\n\nUse a quantitative cap with a non-negative integer bound, e.g. --cap calls:3\n"),

        // --- auths-cli (SignerKelError) ---
        "AUTHS-E6301" => Some("# AUTHS-E6301\n\n**Crate:** `auths-cli`\n\n**Type:** `SignerKelError::Unavailable`\n\n## Message\n\nsigner's KEL for {did} is not available locally: {reason}\n\n## Suggestion\n\nFetch the signer's KEL with `git fetch <remote> 'refs/auths/*:refs/auths/*'`, or verify against an evidence bundle with `--identity-bundle`.\n"),

        // --- auths-oidc-port (OidcError) ---
        "AUTHS-E8001" => Some("# AUTHS-E8001\n\n**Crate:** `auths-oidc-port`\n\n**Type:** `OidcError::JwtDecode`\n\n## Message\n\nJWT decode failed: {0}\n\n## Suggestion\n\nVerify the token format and ensure it is a valid JWT\n"),
        "AUTHS-E8002" => Some("# AUTHS-E8002\n\n**Crate:** `auths-oidc-port`\n\n**Type:** `OidcError::SignatureVerificationFailed`\n\n## Message\n\nsignature verification failed\n\n## Suggestion\n\nCheck that the JWKS endpoint is up-to-date and the token is from a trusted issuer\n"),
        "AUTHS-E8003" => Some("# AUTHS-E8003\n\n**Crate:** `auths-oidc-port`\n\n**Type:** `OidcError::ClaimsValidationFailed`\n\n## Message\n\nclaim validation failed - {claim}: {reason}\n\n## Suggestion\n\nThe token has expired; acquire a new token from the OIDC provider\n"),
        "AUTHS-E8004" => Some("# AUTHS-E8004\n\n**Crate:** `auths-oidc-port`\n\n**Type:** `OidcError::UnknownKeyId`\n\n## Message\n\nunknown key ID: {0}\n\n## Suggestion\n\nThe JWKS cache may be stale; refresh the JWKS from the issuer endpoint\n"),
        "AUTHS-E8005" => Some("# AUTHS-E8005\n\n**Crate:** `auths-oidc-port`\n\n**Type:** `OidcError::JwksResolutionFailed`\n\n## Message\n\nJWKS resolution failed: {0}\n\n## Suggestion\n\nCheck network connectivity to the JWKS endpoint and ensure the issuer URL is correct\n"),
        "AUTHS-E8006" => Some("# AUTHS-E8006\n\n**Crate:** `auths-oidc-port`\n\n**Type:** `OidcError::AlgorithmMismatch`\n\n## Message\n\nalgorithm mismatch: expected {expected}, got {got}\n\n## Suggestion\n\nVerify that the expected algorithm matches the algorithm used by the OIDC provider\n"),
        "AUTHS-E8007" => Some("# AUTHS-E8007\n\n**Crate:** `auths-oidc-port`\n\n**Type:** `OidcError::ClockSkewExceeded`\n\n## Message\n\ntoken expired (exp: {token_exp}, now: {current_time}, leeway: {leeway}s)\n\n## Suggestion\n\nSynchronize the system clock or increase the configured clock skew tolerance\n"),
        "AUTHS-E8008" => Some("# AUTHS-E8008\n\n**Crate:** `auths-oidc-port`\n\n**Type:** `OidcError::TokenReplayDetected`\n\n## Message\n\ntoken replay detected (jti: {0})\n\n## Suggestion\n\nA token with this ID has already been used; acquire a new token from the OIDC provider\n"),

        // --- auths-core (LogError) ---
        "AUTHS-E9001" => Some("# AUTHS-E9001\n\n**Crate:** `auths-core`\n\n**Type:** `LogError::SubmissionRejected`\n\n## Message\n\nsubmission rejected: {reason}\n\n## Suggestion\n\nCheck the attestation format and payload size\n"),
        "AUTHS-E9002" => Some("# AUTHS-E9002\n\n**Crate:** `auths-core`\n\n**Type:** `LogError::NetworkError`\n\n## Message\n\nnetwork error: {0}\n\n## Suggestion\n\nCheck your internet connection and the log's API URL\n"),
        "AUTHS-E9003" => Some("# AUTHS-E9003\n\n**Crate:** `auths-core`\n\n**Type:** `LogError::RateLimited`\n\n## Message\n\nrate limited, retry after {retry_after_secs}s\n\n## Suggestion\n\nWait and retry; the log is rate-limiting requests\n"),
        "AUTHS-E9004" => Some("# AUTHS-E9004\n\n**Crate:** `auths-core`\n\n**Type:** `LogError::InvalidResponse`\n\n## Message\n\ninvalid response: {0}\n\n## Suggestion\n\nThe log returned an unexpected response; check the log version\n"),
        "AUTHS-E9005" => Some("# AUTHS-E9005\n\n**Crate:** `auths-core`\n\n**Type:** `LogError::EntryNotFound`\n\n## Message\n\nentry not found\n\n## Suggestion\n\nThe entry may not be sequenced yet; retry after a moment\n"),
        "AUTHS-E9006" => Some("# AUTHS-E9006\n\n**Crate:** `auths-core`\n\n**Type:** `LogError::ConsistencyViolation`\n\n## Message\n\nconsistency violation: {0}\n\n## Suggestion\n\nThe log returned data that does not match what was submitted\n"),
        "AUTHS-E9007" => Some("# AUTHS-E9007\n\n**Crate:** `auths-core`\n\n**Type:** `LogError::Unavailable`\n\n## Message\n\nlog unavailable: {0}\n\n## Suggestion\n\nThe transparency log is unavailable; retry later or use --allow-unlogged\n"),

        _ => None,
    }
}

/// Returns a sorted slice of all registered error codes.
#[rustfmt::skip]
pub fn all_codes() -> &'static [&'static str] {
    static CODES: &[&str] = &[
        "AUTHS-E1001",
        "AUTHS-E1002",
        "AUTHS-E1003",
        "AUTHS-E1004",
        "AUTHS-E1005",
        "AUTHS-E1101",
        "AUTHS-E1102",
        "AUTHS-E1103",
        "AUTHS-E1104",
        "AUTHS-E1201",
        "AUTHS-E1202",
        "AUTHS-E1203",
        "AUTHS-E1204",
        "AUTHS-E1301",
        "AUTHS-E1302",
        "AUTHS-E2001",
        "AUTHS-E2002",
        "AUTHS-E2003",
        "AUTHS-E2004",
        "AUTHS-E2005",
        "AUTHS-E2006",
        "AUTHS-E2007",
        "AUTHS-E2008",
        "AUTHS-E2009",
        "AUTHS-E2010",
        "AUTHS-E2011",
        "AUTHS-E2012",
        "AUTHS-E2013",
        "AUTHS-E2014",
        "AUTHS-E2015",
        "AUTHS-E2016",
        "AUTHS-E2017",
        "AUTHS-E2018",
        "AUTHS-E2019",
        "AUTHS-E2020",
        "AUTHS-E2021",
        "AUTHS-E2022",
        "AUTHS-E2101",
        "AUTHS-E2102",
        "AUTHS-E2103",
        "AUTHS-E2104",
        "AUTHS-E2105",
        "AUTHS-E2106",
        "AUTHS-E2107",
        "AUTHS-E2108",
        "AUTHS-E2109",
        "AUTHS-E2201",
        "AUTHS-E2202",
        "AUTHS-E2203",
        "AUTHS-E2204",
        "AUTHS-E2205",
        "AUTHS-E2206",
        "AUTHS-E2301",
        "AUTHS-E2302",
        "AUTHS-E2303",
        "AUTHS-E3001",
        "AUTHS-E3002",
        "AUTHS-E3003",
        "AUTHS-E3004",
        "AUTHS-E3005",
        "AUTHS-E3006",
        "AUTHS-E3007",
        "AUTHS-E3008",
        "AUTHS-E3009",
        "AUTHS-E3010",
        "AUTHS-E3011",
        "AUTHS-E3012",
        "AUTHS-E3013",
        "AUTHS-E3014",
        "AUTHS-E3015",
        "AUTHS-E3016",
        "AUTHS-E3017",
        "AUTHS-E3018",
        "AUTHS-E3019",
        "AUTHS-E3020",
        "AUTHS-E3021",
        "AUTHS-E3022",
        "AUTHS-E3023",
        "AUTHS-E3024",
        "AUTHS-E3025",
        "AUTHS-E3101",
        "AUTHS-E3102",
        "AUTHS-E3103",
        "AUTHS-E3104",
        "AUTHS-E3105",
        "AUTHS-E3106",
        "AUTHS-E3107",
        "AUTHS-E3201",
        "AUTHS-E3202",
        "AUTHS-E3203",
        "AUTHS-E3204",
        "AUTHS-E3205",
        "AUTHS-E3206",
        "AUTHS-E3207",
        "AUTHS-E3301",
        "AUTHS-E3302",
        "AUTHS-E3303",
        "AUTHS-E3304",
        "AUTHS-E3305",
        "AUTHS-E3401",
        "AUTHS-E3402",
        "AUTHS-E3403",
        "AUTHS-E3404",
        "AUTHS-E3405",
        "AUTHS-E3406",
        "AUTHS-E3407",
        "AUTHS-E3408",
        "AUTHS-E3409",
        "AUTHS-E3501",
        "AUTHS-E3502",
        "AUTHS-E3503",
        "AUTHS-E3504",
        "AUTHS-E3505",
        "AUTHS-E3601",
        "AUTHS-E3602",
        "AUTHS-E3603",
        "AUTHS-E3604",
        "AUTHS-E3605",
        "AUTHS-E3606",
        "AUTHS-E3701",
        "AUTHS-E3702",
        "AUTHS-E3703",
        "AUTHS-E3704",
        "AUTHS-E3801",
        "AUTHS-E3802",
        "AUTHS-E3803",
        "AUTHS-E3804",
        "AUTHS-E3805",
        "AUTHS-E3806",
        "AUTHS-E3901",
        "AUTHS-E3902",
        "AUTHS-E3903",
        "AUTHS-E3951",
        "AUTHS-E3952",
        "AUTHS-E3961",
        "AUTHS-E3962",
        "AUTHS-E3963",
        "AUTHS-E3964",
        "AUTHS-E3965",
        "AUTHS-E3966",
        "AUTHS-E3967",
        "AUTHS-E3968",
        "AUTHS-E4001",
        "AUTHS-E4002",
        "AUTHS-E4003",
        "AUTHS-E4004",
        "AUTHS-E4101",
        "AUTHS-E4102",
        "AUTHS-E4103",
        "AUTHS-E4104",
        "AUTHS-E4105",
        "AUTHS-E4106",
        "AUTHS-E4107",
        "AUTHS-E4201",
        "AUTHS-E4202",
        "AUTHS-E4203",
        "AUTHS-E4204",
        "AUTHS-E4205",
        "AUTHS-E4206",
        "AUTHS-E4207",
        "AUTHS-E4208",
        "AUTHS-E4401",
        "AUTHS-E4402",
        "AUTHS-E4403",
        "AUTHS-E4404",
        "AUTHS-E4405",
        "AUTHS-E4406",
        "AUTHS-E4407",
        "AUTHS-E4408",
        "AUTHS-E4409",
        "AUTHS-E4410",
        "AUTHS-E4411",
        "AUTHS-E4601",
        "AUTHS-E4602",
        "AUTHS-E4603",
        "AUTHS-E4604",
        "AUTHS-E4605",
        "AUTHS-E4606",
        "AUTHS-E4607",
        "AUTHS-E4801",
        "AUTHS-E4802",
        "AUTHS-E4803",
        "AUTHS-E4804",
        "AUTHS-E4805",
        "AUTHS-E4806",
        "AUTHS-E4807",
        "AUTHS-E4821",
        "AUTHS-E4822",
        "AUTHS-E4823",
        "AUTHS-E4824",
        "AUTHS-E4825",
        "AUTHS-E4826",
        "AUTHS-E4827",
        "AUTHS-E4828",
        "AUTHS-E4829",
        "AUTHS-E4830",
        "AUTHS-E4831",
        "AUTHS-E4851",
        "AUTHS-E4852",
        "AUTHS-E4853",
        "AUTHS-E4861",
        "AUTHS-E4862",
        "AUTHS-E4863",
        "AUTHS-E4864",
        "AUTHS-E4865",
        "AUTHS-E4866",
        "AUTHS-E4867",
        "AUTHS-E4868",
        "AUTHS-E4869",
        "AUTHS-E4870",
        "AUTHS-E4871",
        "AUTHS-E4872",
        "AUTHS-E4873",
        "AUTHS-E4874",
        "AUTHS-E4875",
        "AUTHS-E4876",
        "AUTHS-E4877",
        "AUTHS-E4901",
        "AUTHS-E4902",
        "AUTHS-E4903",
        "AUTHS-E4904",
        "AUTHS-E4905",
        "AUTHS-E4906",
        "AUTHS-E4951",
        "AUTHS-E4952",
        "AUTHS-E4953",
        "AUTHS-E4954",
        "AUTHS-E4955",
        "AUTHS-E4956",
        "AUTHS-E4957",
        "AUTHS-E4961",
        "AUTHS-E4962",
        "AUTHS-E4963",
        "AUTHS-E4964",
        "AUTHS-E4965",
        "AUTHS-E4966",
        "AUTHS-E4967",
        "AUTHS-E4968",
        "AUTHS-E4971",
        "AUTHS-E4972",
        "AUTHS-E4973",
        "AUTHS-E4974",
        "AUTHS-E4981",
        "AUTHS-E4982",
        "AUTHS-E4983",
        "AUTHS-E4984",
        "AUTHS-E4986",
        "AUTHS-E4987",
        "AUTHS-E4988",
        "AUTHS-E4991",
        "AUTHS-E4992",
        "AUTHS-E5001",
        "AUTHS-E5002",
        "AUTHS-E5004",
        "AUTHS-E5006",
        "AUTHS-E5007",
        "AUTHS-E5008",
        "AUTHS-E5101",
        "AUTHS-E5102",
        "AUTHS-E5103",
        "AUTHS-E5105",
        "AUTHS-E5106",
        "AUTHS-E5201",
        "AUTHS-E5202",
        "AUTHS-E5203",
        "AUTHS-E5204",
        "AUTHS-E5301",
        "AUTHS-E5302",
        "AUTHS-E5303",
        "AUTHS-E5304",
        "AUTHS-E5305",
        "AUTHS-E5306",
        "AUTHS-E5307",
        "AUTHS-E5311",
        "AUTHS-E5312",
        "AUTHS-E5313",
        "AUTHS-E5314",
        "AUTHS-E5315",
        "AUTHS-E5316",
        "AUTHS-E5317",
        "AUTHS-E5318",
        "AUTHS-E5400",
        "AUTHS-E5401",
        "AUTHS-E5402",
        "AUTHS-E5403",
        "AUTHS-E5404",
        "AUTHS-E5405",
        "AUTHS-E5406",
        "AUTHS-E5501",
        "AUTHS-E5502",
        "AUTHS-E5503",
        "AUTHS-E5504",
        "AUTHS-E5551",
        "AUTHS-E5552",
        "AUTHS-E5553",
        "AUTHS-E5554",
        "AUTHS-E5601",
        "AUTHS-E5602",
        "AUTHS-E5603",
        "AUTHS-E5604",
        "AUTHS-E5605",
        "AUTHS-E5606",
        "AUTHS-E5607",
        "AUTHS-E5608",
        "AUTHS-E5609",
        "AUTHS-E5610",
        "AUTHS-E5611",
        "AUTHS-E5612",
        "AUTHS-E5613",
        "AUTHS-E5614",
        "AUTHS-E5615",
        "AUTHS-E5616",
        "AUTHS-E5617",
        "AUTHS-E5618",
        "AUTHS-E5622",
        "AUTHS-E5623",
        "AUTHS-E5624",
        "AUTHS-E5625",
        "AUTHS-E5626",
        "AUTHS-E5627",
        "AUTHS-E5628",
        "AUTHS-E5701",
        "AUTHS-E5702",
        "AUTHS-E5703",
        "AUTHS-E5704",
        "AUTHS-E5705",
        "AUTHS-E5706",
        "AUTHS-E5850",
        "AUTHS-E5851",
        "AUTHS-E5852",
        "AUTHS-E5853",
        "AUTHS-E5854",
        "AUTHS-E5855",
        "AUTHS-E5856",
        "AUTHS-E5857",
        "AUTHS-E5858",
        "AUTHS-E5901",
        "AUTHS-E5902",
        "AUTHS-E5903",
        "AUTHS-E5904",
        "AUTHS-E5905",
        "AUTHS-E5906",
        "AUTHS-E5907",
        "AUTHS-E5908",
        "AUTHS-E5909",
        "AUTHS-E5910",
        "AUTHS-E5911",
        "AUTHS-E6001",
        "AUTHS-E6002",
        "AUTHS-E6003",
        "AUTHS-E6101",
        "AUTHS-E6102",
        "AUTHS-E6103",
        "AUTHS-E6104",
        "AUTHS-E6105",
        "AUTHS-E6106",
        "AUTHS-E6107",
        "AUTHS-E6301",
        "AUTHS-E8001",
        "AUTHS-E8002",
        "AUTHS-E8003",
        "AUTHS-E8004",
        "AUTHS-E8005",
        "AUTHS-E8006",
        "AUTHS-E8007",
        "AUTHS-E8008",
        "AUTHS-E9001",
        "AUTHS-E9002",
        "AUTHS-E9003",
        "AUTHS-E9004",
        "AUTHS-E9005",
        "AUTHS-E9006",
        "AUTHS-E9007",
    ];
    CODES
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn explain_returns_content_for_known_code() {
        assert!(explain("AUTHS-E1001").is_some());
    }

    #[test]
    fn explain_returns_none_for_unknown_code() {
        assert!(explain("AUTHS-E9999").is_none());
    }

    #[test]
    fn all_codes_is_sorted() {
        let codes = all_codes();
        assert!(!codes.is_empty());
        for window in codes.windows(2) {
            assert!(
                window[0] < window[1],
                "codes not sorted: {} >= {}",
                window[0],
                window[1]
            );
        }
    }

    #[test]
    fn all_codes_count_matches_registry() {
        assert_eq!(all_codes().len(), 373);
    }
}