@wildo-ai/saas-frontend-lib 1.0.1 → 1.1.1

package/dist/esm/core/config/engine-settings-destinations.js

@@ -0,0 +1,364 @@
+/**
+ * The engine's settings DESTINATION catalog — addressable, and deliberately unplaced.
+ *
+ * Each entry says what a settings surface IS: its target, and the gating that
+ * decides whether the current principal may see it at all. **No entry carries a
+ * `categoryRef`, an `order` or a `label`**, because those are placement, and
+ * placement belongs to the application (`SettingsPlacement`).
+ *
+ * This file replaced `settings-hub.frontend.defaults.ts`, which shipped a fully
+ * PLACED hub as a framework default. That default was the reason an application
+ * could not add, remove, reorder or rename a settings section: the render path
+ * read the framework's arrangement, so an application had no arrangement of its
+ * own to read. Splitting destination from placement keeps the engine owning what
+ * a destination MEANS while the application owns where it sits — and makes
+ * "remove this section" expressible, which under a merged default it was not.
+ *
+ * Gating notes carried over from the previous default, because they are
+ * destination facts rather than placement facts:
+ *
+ * - Account destinations are `USER_SELF`-shaped and always available to an
+ *   authenticated user; the category's scope does the hiding.
+ * - Organization destinations gate on org owner/admin roles, and several
+ *   additionally on a runtime capability, so an application that excludes the
+ *   backing resource surfaces nothing. This is the "face to right management of
+ *   the user" gating — a member who cannot manage the org sees no such section.
+ *
+ * Sub-tab labels stay on the target: they describe the destination's internal
+ * structure, not its position in the rail.
+ */
+import { CoreFeature, CoreResourceOperation, CoreResourceType, CORE_ORG_ROLES, ResourcePrimaryScope } from '@wildo-ai/saas-models';
+import { SettingsPanelRef, SettingsSectionTargetKind } from './settings-hub.frontend.schemas.js';
+/** @wildo_source:part:start saas.frontend.settings-hub.engine-destinations facet:layer:frontend facet:family:config facet:audience:app-developer */
+/**
+ * Every settings destination the engine ships, as a named vocabulary.
+ *
+ * Exists because these refs are a CLOSED vocabulary that engine code addresses
+ * by name — the billing command-menu entry opens `/settings/billing`, and any
+ * future engine launcher will do the same. Before this enum, `'billing'` was a
+ * bare literal in `billing-launcher.ts` with nothing tying it to the catalog
+ * entry it names: rename the destination and the command silently resolves to
+ * the hub's DEFAULT section instead of failing, so a menu item labelled
+ * "Billing" would open Profile.
+ *
+ * **Engine code must address a destination through this enum. Application
+ * config addresses one by string**, deliberately: a placement is authored data,
+ * an application should not import an engine enum to write its own rail, and a
+ * typo there is caught at DEV startup by `verifySettingsHubContent`.
+ */
+export var EngineSettingsDestinationRef;
+(function (EngineSettingsDestinationRef) {
+    /** The signed-in user's own profile record. */
+    EngineSettingsDestinationRef["PROFILE"] = "profile";
+    /** Password, MFA, sessions — a bespoke engine panel. */
+    EngineSettingsDestinationRef["SECURITY"] = "security";
+    /** Theme and appearance preferences — a bespoke engine panel. */
+    EngineSettingsDestinationRef["APPEARANCE"] = "appearance";
+    /** The signed-in user's own preference record. */
+    EngineSettingsDestinationRef["PREFERENCES"] = "preferences";
+    /** Invitations addressed TO the signed-in user, across organizations they have not joined. */
+    EngineSettingsDestinationRef["MY_INVITATIONS"] = "my-invitations";
+    /** The current organization's own record. Org owner/admin only. */
+    EngineSettingsDestinationRef["ORGANIZATION_GENERAL"] = "organization-general";
+    /** Organization membership list, including INVITED rows. Org owner/admin only. */
+    EngineSettingsDestinationRef["MEMBERS"] = "members";
+    /** Billing home — subscription, plans, usage, invoices. Gated on the `billingEnabled` capability. */
+    EngineSettingsDestinationRef["BILLING"] = "billing";
+    /** Organization API keys. Org owner/admin only. */
+    EngineSettingsDestinationRef["API_KEYS"] = "api-keys";
+    /** Single sign-on configuration and connections. */
+    EngineSettingsDestinationRef["SSO"] = "sso";
+    /** SCIM directory provisioning configuration and tokens. */
+    EngineSettingsDestinationRef["SCIM"] = "scim";
+    /** Audit-event streaming configuration and failed-delivery queue. */
+    EngineSettingsDestinationRef["SIEM"] = "siem";
+    /** Outbound webhook endpoints and delivery log. */
+    EngineSettingsDestinationRef["WEBHOOKS"] = "webhooks";
+    /** The organization's audit log. Org owner/admin only. */
+    EngineSettingsDestinationRef["AUDIT_LOGS"] = "audit-logs";
+})(EngineSettingsDestinationRef || (EngineSettingsDestinationRef = {}));
+/** @wildo_source:part:end saas.frontend.settings-hub.engine-destinations */
+/** Org-management destinations are visible to organization owners and admins. */
+const ORG_MANAGEMENT_ROLES = [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN];
+/**
+ * Runtime capability key for "billing is enabled for this app". Wired in
+ * `useLauncherRuntimeAvailabilityContext` (`runtimeCapabilities.billingEnabled`);
+ * there is no enum for capability keys yet, so the launcher-config string is the
+ * single source of truth.
+ */
+const BILLING_ENABLED_CAPABILITY = 'billingEnabled';
+/**
+ * Runtime capability keys for the enterprise-config features. Unlike billing
+ * (which reads `appConfig.billing.enabled`), these have no app-config toggle —
+ * they are wired in `useLauncherRuntimeAvailabilityContext` from
+ * resource-registration presence (`hasResource(ORGANIZATION_*_CONFIG)`), so a
+ * destination auto-hides when its app excludes the resource and otherwise
+ * degrades to org-admin role gating. Keep these string literals in sync with the
+ * keys emitted there.
+ */
+const SSO_ENABLED_CAPABILITY = 'ssoEnabled';
+const SCIM_ENABLED_CAPABILITY = 'scimEnabled';
+const SIEM_ENABLED_CAPABILITY = 'siemEnabled';
+const WEBHOOKS_ENABLED_CAPABILITY = 'webhooksEnabled';
+/**
+ * Every settings destination the engine ships, keyed by `ref`.
+ *
+ * An application places these by ref. A placement naming a ref absent from this
+ * catalog is refused at DEV startup rather than silently dropped — a settings
+ * section that quietly fails to appear is indistinguishable from one an author
+ * meant to remove.
+ */
+export const ENGINE_SETTINGS_DESTINATIONS = [
+    // ── Account ────────────────────────────────────────────────────
+    {
+        ref: EngineSettingsDestinationRef.PROFILE,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.USER_SELF_PROFILES,
+            operation: CoreResourceOperation.READ,
+        },
+    },
+    {
+        ref: EngineSettingsDestinationRef.SECURITY,
+        target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.SECURITY },
+    },
+    {
+        ref: EngineSettingsDestinationRef.APPEARANCE,
+        target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.APPEARANCE },
+    },
+    {
+        ref: EngineSettingsDestinationRef.PREFERENCES,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.USER_SELF_PREFERENCES,
+            operation: CoreResourceOperation.READ,
+        },
+    },
+    {
+        // The caller's OWN received invitations (Approach P) — their own INVITED membership
+        // rows across orgs they haven't joined yet. Distinct from the org-admin's view of
+        // sent invites, which are now just INVITED-status rows in the 'members' list (no
+        // separate org 'invitations' section). No `requiredRoles`: any authenticated user
+        // can act on invitations addressed to them (authorized server-side by userId-ownership).
+        ref: EngineSettingsDestinationRef.MY_INVITATIONS,
+        target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.INVITATIONS },
+    },
+    // ── Organization ───────────────────────────────────────────────
+    {
+        ref: EngineSettingsDestinationRef.ORGANIZATION_GENERAL,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.ORGANIZATIONS,
+            operation: CoreResourceOperation.READ,
+        },
+    },
+    {
+        // NOTE: no separate org-level "invitations" destination — invitations are now
+        // INVITED-status rows inside the ORGANIZATION_MEMBERS junction, so they surface
+        // in this list (filter by status) rather than a parallel destination. The
+        // invitee's own pending invitations live in the 'my-invitations' panel.
+        ref: EngineSettingsDestinationRef.MEMBERS,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.ORGANIZATION_MEMBERS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        ref: EngineSettingsDestinationRef.BILLING,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        runtimeAvailability: { requiredCapabilities: [BILLING_ENABLED_CAPABILITY] },
+        // THE billing home — a bespoke panel over the aggregated BillingContext
+        // state (subscription, plans + checkout, usage, invoices, portal link).
+        // Deliberately NOT per-resource LIST sub-tabs: the billing child resources
+        // are routed under the billing account (`REQUIRES_CONTEXT`), so org-scoped
+        // generic panels cannot address them, while the aggregated state endpoint is
+        // org-addressable and auto-creates the account.
+        target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.BILLING },
+    },
+    {
+        ref: EngineSettingsDestinationRef.API_KEYS,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.ORG_API_KEYS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    // ── Organization · enterprise credentials & compliance ─────────
+    // Each gates on org-admin role + a per-feature runtime capability
+    // (resource-registration presence). Multi-resource domains split into
+    // sub-tabs pairing the singleton config (READ) with its collection (LIST).
+    {
+        ref: EngineSettingsDestinationRef.SSO,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        runtimeAvailability: { requiredCapabilities: [SSO_ENABLED_CAPABILITY] },
+        entitlementFeatureId: CoreFeature.SINGLE_SIGN_ON,
+        target: {
+            kind: SettingsSectionTargetKind.SUB_TABS,
+            subTabs: [
+                {
+                    ref: 'sso-configuration',
+                    label: 'Configuration',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG,
+                        operation: CoreResourceOperation.READ,
+                    },
+                },
+                {
+                    ref: 'sso-connections',
+                    label: 'Connections',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.ORGANIZATION_SSO_CONNECTIONS,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+            ],
+        },
+    },
+    {
+        ref: EngineSettingsDestinationRef.SCIM,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        runtimeAvailability: { requiredCapabilities: [SCIM_ENABLED_CAPABILITY] },
+        entitlementFeatureId: CoreFeature.DIRECTORY_PROVISIONING,
+        target: {
+            kind: SettingsSectionTargetKind.SUB_TABS,
+            subTabs: [
+                {
+                    ref: 'scim-provisioning',
+                    label: 'Provisioning',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG,
+                        operation: CoreResourceOperation.READ,
+                    },
+                },
+                {
+                    ref: 'scim-tokens',
+                    label: 'Tokens',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.ORGANIZATION_SCIM_TOKENS,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+            ],
+        },
+    },
+    {
+        ref: EngineSettingsDestinationRef.SIEM,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        runtimeAvailability: { requiredCapabilities: [SIEM_ENABLED_CAPABILITY] },
+        entitlementFeatureId: CoreFeature.SECURITY_EVENT_EXPORT,
+        target: {
+            kind: SettingsSectionTargetKind.SUB_TABS,
+            subTabs: [
+                {
+                    ref: 'siem-export',
+                    label: 'Export',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG,
+                        operation: CoreResourceOperation.READ,
+                    },
+                },
+                {
+                    ref: 'siem-failed-deliveries',
+                    label: 'Failed deliveries',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.ORGANIZATION_SIEM_DELIVERY_DLQ,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+            ],
+        },
+    },
+    {
+        ref: EngineSettingsDestinationRef.WEBHOOKS,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        runtimeAvailability: { requiredCapabilities: [WEBHOOKS_ENABLED_CAPABILITY] },
+        entitlementFeatureId: CoreFeature.M2M_WEBHOOK_DELIVERY,
+        target: {
+            kind: SettingsSectionTargetKind.SUB_TABS,
+            subTabs: [
+                {
+                    ref: 'webhooks-endpoints',
+                    label: 'Endpoints',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.ORGANIZATION_WEBHOOK_CONFIG,
+                        operation: CoreResourceOperation.READ,
+                    },
+                },
+                {
+                    ref: 'webhooks-delivery-log',
+                    label: 'Delivery log',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+            ],
+        },
+    },
+    {
+        ref: EngineSettingsDestinationRef.AUDIT_LOGS,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.AUDIT_LOGS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+];
+/** Every destination ref the engine ships — the set a placement is validated against. */
+export const ENGINE_SETTINGS_DESTINATION_REFS = new Set(ENGINE_SETTINGS_DESTINATIONS.map(destination => destination.ref));
+/**
+ * The full placement set `wildo init` scaffolds into a new application's config.
+ *
+ * **This is GENERATION INPUT, not a runtime fallback.** Nothing in the render
+ * path may read it — `resolveSettingsHubConfig()` resolves the application's own
+ * authored config and nothing else. The distinction is the entire point of the
+ * split: a scaffold is a starting arrangement an author edits and owns, whereas
+ * a default is an arrangement that reasserts itself and cannot be edited away.
+ *
+ * It places every engine destination so a new application starts complete and
+ * edits DOWN, which is the direction that surfaces what exists. Starting empty
+ * would hide the catalog behind documentation.
+ *
+ * The `label`s here are the English strings the previous framework default
+ * carried, and they are NOT a temporary convenience to be removed once label
+ * generation runs. The companion feeds each authored label to the labellize
+ * prompt as that key's `purpose`, so it is the wording INTENT generation
+ * translates — delete it and the model falls back to inventing from the ref.
+ */
+export const SCAFFOLD_SETTINGS_HUB_CONFIG = {
+    categories: [
+        { ref: 'account', label: 'Account', scope: ResourcePrimaryScope.USER_SELF, order: 0 },
+        { ref: 'organization', label: 'Organization', scope: ResourcePrimaryScope.ORGANIZATIONS, order: 1 },
+    ],
+    placements: [
+        { destinationRef: EngineSettingsDestinationRef.PROFILE, categoryRef: 'account', label: 'Profile', order: 0 },
+        { destinationRef: EngineSettingsDestinationRef.SECURITY, categoryRef: 'account', label: 'Security', order: 1 },
+        { destinationRef: EngineSettingsDestinationRef.APPEARANCE, categoryRef: 'account', label: 'Appearance', order: 2 },
+        { destinationRef: EngineSettingsDestinationRef.PREFERENCES, categoryRef: 'account', label: 'Preferences', order: 3 },
+        { destinationRef: EngineSettingsDestinationRef.MY_INVITATIONS, categoryRef: 'account', label: 'Invitations', order: 4 },
+        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_GENERAL, categoryRef: 'organization', label: 'General', order: 0 },
+        { destinationRef: EngineSettingsDestinationRef.MEMBERS, categoryRef: 'organization', label: 'Members', order: 1 },
+        { destinationRef: EngineSettingsDestinationRef.BILLING, categoryRef: 'organization', label: 'Billing', order: 3 },
+        { destinationRef: EngineSettingsDestinationRef.API_KEYS, categoryRef: 'organization', label: 'API keys', order: 4 },
+        { destinationRef: EngineSettingsDestinationRef.SSO, categoryRef: 'organization', label: 'Single sign-on', order: 5 },
+        { destinationRef: EngineSettingsDestinationRef.SCIM, categoryRef: 'organization', label: 'User provisioning', order: 6 },
+        { destinationRef: EngineSettingsDestinationRef.SIEM, categoryRef: 'organization', label: 'Audit streaming', order: 7 },
+        { destinationRef: EngineSettingsDestinationRef.WEBHOOKS, categoryRef: 'organization', label: 'Webhooks', order: 8 },
+        { destinationRef: EngineSettingsDestinationRef.AUDIT_LOGS, categoryRef: 'organization', label: 'Audit log', order: 9 },
+    ],
+    defaultSectionRef: 'profile',
+};
+//# sourceMappingURL=engine-settings-destinations.js.map

package/dist/esm/core/config/engine-settings-destinations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-settings-destinations.js","sourceRoot":"","sources":["../../../../../src/core/config/engine-settings-destinations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACnI,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAG9F,oJAAoJ;AACpJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,4BA6BX;AA7BD,WAAY,4BAA4B;IACtC,+CAA+C;IAC/C,mDAAmB,CAAA;IACnB,wDAAwD;IACxD,qDAAqB,CAAA;IACrB,iEAAiE;IACjE,yDAAyB,CAAA;IACzB,kDAAkD;IAClD,2DAA2B,CAAA;IAC3B,8FAA8F;IAC9F,iEAAiC,CAAA;IACjC,mEAAmE;IACnE,6EAA6C,CAAA;IAC7C,kFAAkF;IAClF,mDAAmB,CAAA;IACnB,qGAAqG;IACrG,mDAAmB,CAAA;IACnB,mDAAmD;IACnD,qDAAqB,CAAA;IACrB,oDAAoD;IACpD,2CAAW,CAAA;IACX,4DAA4D;IAC5D,6CAAa,CAAA;IACb,qEAAqE;IACrE,6CAAa,CAAA;IACb,mDAAmD;IACnD,qDAAqB,CAAA;IACrB,0DAA0D;IAC1D,yDAAyB,CAAA;AAC3B,CAAC,EA7BW,4BAA4B,KAA5B,4BAA4B,QA6BvC;AACD,4EAA4E;AAE5E,iFAAiF;AACjF,MAAM,oBAAoB,GAAa,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAC5C,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAC9C,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAC9C,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAmC;IAC1E,kEAAkE;IAClE;QACE,GAAG,EAAE,4BAA4B,CAAC,OAAO;QACzC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,kBAAkB;YACjD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,QAAQ;QAC1C,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE;KAC9F;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,UAAU;QAC5C,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,UAAU,EAAE;KAChG;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,WAAW;QAC7C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,qBAAqB;YACpD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,oFAAoF;QACpF,kFAAkF;QAClF,iFAAiF;QACjF,kFAAkF;QAClF,yFAAyF;QACzF,GAAG,EAAE,4BAA4B,CAAC,cAAc;QAChD,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,WAAW,EAAE;KACjG;IACD,kEAAkE;IAClE;QACE,GAAG,EAAE,4BAA4B,CAAC,oBAAoB;QACtD,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,aAAa;YAC5C,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,8EAA8E;QAC9E,gFAAgF;QAChF,0EAA0E;QAC1E,wEAAwE;QACxE,GAAG,EAAE,4BAA4B,CAAC,OAAO;QACzC,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,OAAO;QACzC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,0BAA0B,CAAC,EAAE;QAC3E,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,gDAAgD;QAChD,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,OAAO,EAAE;KAC7F;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,QAAQ;QAC1C,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,YAAY;YAC3C,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD,kEAAkE;IAClE,kEAAkE;IAClE,sEAAsE;IACtE,2EAA2E;IAC3E;QACE,GAAG,EAAE,4BAA4B,CAAC,GAAG;QACrC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,sBAAsB,CAAC,EAAE;QACvE,oBAAoB,EAAE,WAAW,CAAC,cAAc;QAChD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,mBAAmB;oBACxB,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,uBAAuB;wBACtD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,4BAA4B;wBAC3D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,IAAI;QACtC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,uBAAuB,CAAC,EAAE;QACxE,oBAAoB,EAAE,WAAW,CAAC,sBAAsB;QACxD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,mBAAmB;oBACxB,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,qCAAqC;wBACpE,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,aAAa;oBAClB,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,wBAAwB;wBACvD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,IAAI;QACtC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,uBAAuB,CAAC,EAAE;QACxE,oBAAoB,EAAE,WAAW,CAAC,qBAAqB;QACvD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,aAAa;oBAClB,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,+BAA+B;wBAC9D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,wBAAwB;oBAC7B,KAAK,EAAE,mBAAmB;oBAC1B,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,8BAA8B;wBAC7D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,QAAQ;QAC1C,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,2BAA2B,CAAC,EAAE;QAC5E,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;QACtD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,oBAAoB;oBACzB,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,2BAA2B;wBAC1D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,qCAAqC;wBACpE,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,UAAU;QAC5C,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,UAAU;YACzC,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;CACF,CAAC;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,gCAAgC,GAAwB,IAAI,GAAG,CAC1E,4BAA4B,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CACjE,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,UAAU,EAAE;QACV,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QACrF,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;KACpG;IACD,UAAU,EAAE;QACV,EAAE,cAAc,EAAE,4BAA4B,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QAC5G,EAAE,cAAc,EAAE,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QAC9G,EAAE,cAAc,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE;QAClH,EAAE,cAAc,EAAE,4BAA4B,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;QACpH,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;QACvH,EAAE,cAAc,EAAE,4BAA4B,CAAC,oBAAoB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QAC9H,EAAE,cAAc,EAAE,4BAA4B,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QACjH,EAAE,cAAc,EAAE,4BAA4B,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QACjH,EAAE,cAAc,EAAE,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QACnH,EAAE,cAAc,EAAE,4BAA4B,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE;QACpH,EAAE,cAAc,EAAE,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE;QACxH,EAAE,cAAc,EAAE,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE;QACtH,EAAE,cAAc,EAAE,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QACnH,EAAE,cAAc,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE;KACvH;IACD,iBAAiB,EAAE,SAAS;CAC7B,CAAC","sourcesContent":["/**\n * The engine's settings DESTINATION catalog — addressable, and deliberately unplaced.\n *\n * Each entry says what a settings surface IS: its target, and the gating that\n * decides whether the current principal may see it at all. **No entry carries a\n * `categoryRef`, an `order` or a `label`**, because those are placement, and\n * placement belongs to the application (`SettingsPlacement`).\n *\n * This file replaced `settings-hub.frontend.defaults.ts`, which shipped a fully\n * PLACED hub as a framework default. That default was the reason an application\n * could not add, remove, reorder or rename a settings section: the render path\n * read the framework's arrangement, so an application had no arrangement of its\n * own to read. Splitting destination from placement keeps the engine owning what\n * a destination MEANS while the application owns where it sits — and makes\n * \"remove this section\" expressible, which under a merged default it was not.\n *\n * Gating notes carried over from the previous default, because they are\n * destination facts rather than placement facts:\n *\n * - Account destinations are `USER_SELF`-shaped and always available to an\n *   authenticated user; the category's scope does the hiding.\n * - Organization destinations gate on org owner/admin roles, and several\n *   additionally on a runtime capability, so an application that excludes the\n *   backing resource surfaces nothing. This is the \"face to right management of\n *   the user\" gating — a member who cannot manage the org sees no such section.\n *\n * Sub-tab labels stay on the target: they describe the destination's internal\n * structure, not its position in the rail.\n */\nimport { CoreFeature, CoreResourceOperation, CoreResourceType, CORE_ORG_ROLES, ResourcePrimaryScope } from '@wildo-ai/saas-models';\nimport { SettingsPanelRef, SettingsSectionTargetKind } from './settings-hub.frontend.schemas';\nimport type { SettingsDestination, SettingsHubConfig } from './settings-hub.frontend.schemas';\n\n/** @wildo_source:part:start saas.frontend.settings-hub.engine-destinations facet:layer:frontend facet:family:config facet:audience:app-developer */\n/**\n * Every settings destination the engine ships, as a named vocabulary.\n *\n * Exists because these refs are a CLOSED vocabulary that engine code addresses\n * by name — the billing command-menu entry opens `/settings/billing`, and any\n * future engine launcher will do the same. Before this enum, `'billing'` was a\n * bare literal in `billing-launcher.ts` with nothing tying it to the catalog\n * entry it names: rename the destination and the command silently resolves to\n * the hub's DEFAULT section instead of failing, so a menu item labelled\n * \"Billing\" would open Profile.\n *\n * **Engine code must address a destination through this enum. Application\n * config addresses one by string**, deliberately: a placement is authored data,\n * an application should not import an engine enum to write its own rail, and a\n * typo there is caught at DEV startup by `verifySettingsHubContent`.\n */\nexport enum EngineSettingsDestinationRef {\n  /** The signed-in user's own profile record. */\n  PROFILE = 'profile',\n  /** Password, MFA, sessions — a bespoke engine panel. */\n  SECURITY = 'security',\n  /** Theme and appearance preferences — a bespoke engine panel. */\n  APPEARANCE = 'appearance',\n  /** The signed-in user's own preference record. */\n  PREFERENCES = 'preferences',\n  /** Invitations addressed TO the signed-in user, across organizations they have not joined. */\n  MY_INVITATIONS = 'my-invitations',\n  /** The current organization's own record. Org owner/admin only. */\n  ORGANIZATION_GENERAL = 'organization-general',\n  /** Organization membership list, including INVITED rows. Org owner/admin only. */\n  MEMBERS = 'members',\n  /** Billing home — subscription, plans, usage, invoices. Gated on the `billingEnabled` capability. */\n  BILLING = 'billing',\n  /** Organization API keys. Org owner/admin only. */\n  API_KEYS = 'api-keys',\n  /** Single sign-on configuration and connections. */\n  SSO = 'sso',\n  /** SCIM directory provisioning configuration and tokens. */\n  SCIM = 'scim',\n  /** Audit-event streaming configuration and failed-delivery queue. */\n  SIEM = 'siem',\n  /** Outbound webhook endpoints and delivery log. */\n  WEBHOOKS = 'webhooks',\n  /** The organization's audit log. Org owner/admin only. */\n  AUDIT_LOGS = 'audit-logs',\n}\n/** @wildo_source:part:end saas.frontend.settings-hub.engine-destinations */\n\n/** Org-management destinations are visible to organization owners and admins. */\nconst ORG_MANAGEMENT_ROLES: string[] = [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN];\n\n/**\n * Runtime capability key for \"billing is enabled for this app\". Wired in\n * `useLauncherRuntimeAvailabilityContext` (`runtimeCapabilities.billingEnabled`);\n * there is no enum for capability keys yet, so the launcher-config string is the\n * single source of truth.\n */\nconst BILLING_ENABLED_CAPABILITY = 'billingEnabled';\n\n/**\n * Runtime capability keys for the enterprise-config features. Unlike billing\n * (which reads `appConfig.billing.enabled`), these have no app-config toggle —\n * they are wired in `useLauncherRuntimeAvailabilityContext` from\n * resource-registration presence (`hasResource(ORGANIZATION_*_CONFIG)`), so a\n * destination auto-hides when its app excludes the resource and otherwise\n * degrades to org-admin role gating. Keep these string literals in sync with the\n * keys emitted there.\n */\nconst SSO_ENABLED_CAPABILITY = 'ssoEnabled';\nconst SCIM_ENABLED_CAPABILITY = 'scimEnabled';\nconst SIEM_ENABLED_CAPABILITY = 'siemEnabled';\nconst WEBHOOKS_ENABLED_CAPABILITY = 'webhooksEnabled';\n\n/**\n * Every settings destination the engine ships, keyed by `ref`.\n *\n * An application places these by ref. A placement naming a ref absent from this\n * catalog is refused at DEV startup rather than silently dropped — a settings\n * section that quietly fails to appear is indistinguishable from one an author\n * meant to remove.\n */\nexport const ENGINE_SETTINGS_DESTINATIONS: readonly SettingsDestination[] = [\n  // ── Account ────────────────────────────────────────────────────\n  {\n    ref: EngineSettingsDestinationRef.PROFILE,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.USER_SELF_PROFILES,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.SECURITY,\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.SECURITY },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPEARANCE,\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.APPEARANCE },\n  },\n  {\n    ref: EngineSettingsDestinationRef.PREFERENCES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.USER_SELF_PREFERENCES,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    // The caller's OWN received invitations (Approach P) — their own INVITED membership\n    // rows across orgs they haven't joined yet. Distinct from the org-admin's view of\n    // sent invites, which are now just INVITED-status rows in the 'members' list (no\n    // separate org 'invitations' section). No `requiredRoles`: any authenticated user\n    // can act on invitations addressed to them (authorized server-side by userId-ownership).\n    ref: EngineSettingsDestinationRef.MY_INVITATIONS,\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.INVITATIONS },\n  },\n  // ── Organization ───────────────────────────────────────────────\n  {\n    ref: EngineSettingsDestinationRef.ORGANIZATION_GENERAL,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATIONS,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    // NOTE: no separate org-level \"invitations\" destination — invitations are now\n    // INVITED-status rows inside the ORGANIZATION_MEMBERS junction, so they surface\n    // in this list (filter by status) rather than a parallel destination. The\n    // invitee's own pending invitations live in the 'my-invitations' panel.\n    ref: EngineSettingsDestinationRef.MEMBERS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATION_MEMBERS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.BILLING,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [BILLING_ENABLED_CAPABILITY] },\n    // THE billing home — a bespoke panel over the aggregated BillingContext\n    // state (subscription, plans + checkout, usage, invoices, portal link).\n    // Deliberately NOT per-resource LIST sub-tabs: the billing child resources\n    // are routed under the billing account (`REQUIRES_CONTEXT`), so org-scoped\n    // generic panels cannot address them, while the aggregated state endpoint is\n    // org-addressable and auto-creates the account.\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.BILLING },\n  },\n  {\n    ref: EngineSettingsDestinationRef.API_KEYS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORG_API_KEYS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  // ── Organization · enterprise credentials & compliance ─────────\n  // Each gates on org-admin role + a per-feature runtime capability\n  // (resource-registration presence). Multi-resource domains split into\n  // sub-tabs pairing the singleton config (READ) with its collection (LIST).\n  {\n    ref: EngineSettingsDestinationRef.SSO,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [SSO_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.SINGLE_SIGN_ON,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'sso-configuration',\n          label: 'Configuration',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'sso-connections',\n          label: 'Connections',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SSO_CONNECTIONS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.SCIM,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [SCIM_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.DIRECTORY_PROVISIONING,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'scim-provisioning',\n          label: 'Provisioning',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'scim-tokens',\n          label: 'Tokens',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SCIM_TOKENS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.SIEM,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [SIEM_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.SECURITY_EVENT_EXPORT,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'siem-export',\n          label: 'Export',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'siem-failed-deliveries',\n          label: 'Failed deliveries',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SIEM_DELIVERY_DLQ,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.WEBHOOKS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [WEBHOOKS_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.M2M_WEBHOOK_DELIVERY,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'webhooks-endpoints',\n          label: 'Endpoints',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_WEBHOOK_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'webhooks-delivery-log',\n          label: 'Delivery log',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.AUDIT_LOGS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.AUDIT_LOGS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n];\n\n/** Every destination ref the engine ships — the set a placement is validated against. */\nexport const ENGINE_SETTINGS_DESTINATION_REFS: ReadonlySet<string> = new Set(\n  ENGINE_SETTINGS_DESTINATIONS.map(destination => destination.ref),\n);\n\n/**\n * The full placement set `wildo init` scaffolds into a new application's config.\n *\n * **This is GENERATION INPUT, not a runtime fallback.** Nothing in the render\n * path may read it — `resolveSettingsHubConfig()` resolves the application's own\n * authored config and nothing else. The distinction is the entire point of the\n * split: a scaffold is a starting arrangement an author edits and owns, whereas\n * a default is an arrangement that reasserts itself and cannot be edited away.\n *\n * It places every engine destination so a new application starts complete and\n * edits DOWN, which is the direction that surfaces what exists. Starting empty\n * would hide the catalog behind documentation.\n *\n * The `label`s here are the English strings the previous framework default\n * carried, and they are NOT a temporary convenience to be removed once label\n * generation runs. The companion feeds each authored label to the labellize\n * prompt as that key's `purpose`, so it is the wording INTENT generation\n * translates — delete it and the model falls back to inventing from the ref.\n */\nexport const SCAFFOLD_SETTINGS_HUB_CONFIG: SettingsHubConfig = {\n  categories: [\n    { ref: 'account', label: 'Account', scope: ResourcePrimaryScope.USER_SELF, order: 0 },\n    { ref: 'organization', label: 'Organization', scope: ResourcePrimaryScope.ORGANIZATIONS, order: 1 },\n  ],\n  placements: [\n    { destinationRef: EngineSettingsDestinationRef.PROFILE, categoryRef: 'account', label: 'Profile', order: 0 },\n    { destinationRef: EngineSettingsDestinationRef.SECURITY, categoryRef: 'account', label: 'Security', order: 1 },\n    { destinationRef: EngineSettingsDestinationRef.APPEARANCE, categoryRef: 'account', label: 'Appearance', order: 2 },\n    { destinationRef: EngineSettingsDestinationRef.PREFERENCES, categoryRef: 'account', label: 'Preferences', order: 3 },\n    { destinationRef: EngineSettingsDestinationRef.MY_INVITATIONS, categoryRef: 'account', label: 'Invitations', order: 4 },\n    { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_GENERAL, categoryRef: 'organization', label: 'General', order: 0 },\n    { destinationRef: EngineSettingsDestinationRef.MEMBERS, categoryRef: 'organization', label: 'Members', order: 1 },\n    { destinationRef: EngineSettingsDestinationRef.BILLING, categoryRef: 'organization', label: 'Billing', order: 3 },\n    { destinationRef: EngineSettingsDestinationRef.API_KEYS, categoryRef: 'organization', label: 'API keys', order: 4 },\n    { destinationRef: EngineSettingsDestinationRef.SSO, categoryRef: 'organization', label: 'Single sign-on', order: 5 },\n    { destinationRef: EngineSettingsDestinationRef.SCIM, categoryRef: 'organization', label: 'User provisioning', order: 6 },\n    { destinationRef: EngineSettingsDestinationRef.SIEM, categoryRef: 'organization', label: 'Audit streaming', order: 7 },\n    { destinationRef: EngineSettingsDestinationRef.WEBHOOKS, categoryRef: 'organization', label: 'Webhooks', order: 8 },\n    { destinationRef: EngineSettingsDestinationRef.AUDIT_LOGS, categoryRef: 'organization', label: 'Audit log', order: 9 },\n  ],\n  defaultSectionRef: 'profile',\n};\n"]}