@wildo-ai/saas-frontend-lib 1.1.10 → 1.1.11

package/dist/esm/core/config/settings-hub-gating.frontend.utils.d.ts

@@ -13,9 +13,8 @@
  *    hidden when no organization is selected). Scope-agnostic categories always
  *    pass.
  * 2. **Capability** — `runtimeAvailability.requiredCapabilities` evaluated via
- *    {@link areLauncherCapabilitiesSatisfied}, the capability half of the launcher
- *    filter the sidebar and command menu use (e.g. `billingEnabled`). The launcher's
- *    `visibleToRoles` is not read here: a section's roles are rule 3.
+ *    the SAME {@link isLauncherRuntimeAvailabilitySatisfied} the sidebar/command
+ *    menu use (e.g. `billingEnabled`).
  * 3. **Role** — `requiredRoles` (OR semantics) evaluated against the merged
  *    app-level + current-organization role set (`buildFeaturePolicyRoles`).
  * 4. **Feature** — `requiredFeatures` ({@link RequiredFeaturesConfig}) boolean
@@ -23,12 +22,17 @@
  *    intentionally ignored: a settings section is shown or hidden, never
  *    "over-limit".
  *
+ * A SUB_TABS section's tabs then pass the capability gate one by one (#2649): a
+ * tab whose `runtimeAvailability` fails is left out, and a section left with no
+ * tab is left out with it.
+ *
  * @see settings-hub.frontend.schemas.ts — the gated section contract
  * @see useVisibleSettingsHubConfig.ts — the hook that wires live signals into this
  */
 import { ResourcePrimaryScope } from '@wildo-ai/saas-models';
 import type { RequiredFeaturesConfig } from '@wildo-ai/saas-models';
 import { type LauncherRuntimeAvailabilityContext } from '../../core/navigation/launcher-runtime-availability';
+import { type LauncherEffectiveRoles } from '../../core/navigation/launcher-resolution';
 import type { ResolvedSettingsHubConfig } from './settings-hub.frontend.schemas';
 /** The current primary-scope values used to evaluate category scope availability. */
 export interface SettingsScopeIds {
@@ -40,12 +44,12 @@ export interface SettingsScopeIds {
 /** Everything the pure filter needs to decide section visibility. */
 export interface SettingsHubGatingContext {
     scopeIds: SettingsScopeIds;
-    /** Merged app-level + current-org roles (from `buildFeaturePolicyRoles`). */
-    userRoles: string[];
     /** Resolved boolean feature identifiers currently enabled. */
     enabledFeatures: string[];
-    /** Runtime-capability context (reused verbatim from the launcher layer). */
+    /** Runtime-capability context (reused verbatim from the launcher layer). Its `effectiveRoles` decide `requiredRoles`. */
     runtimeContext: LauncherRuntimeAvailabilityContext;
+    /** The engine capabilities the application enables (`AppConfiguration_Shared.enabledEngineCapabilities`). */
+    enabledEngineCapabilities: readonly string[];
 }
 /**
  * Whether a category's primary scope currently has a value. A category without a
@@ -53,17 +57,24 @@ export interface SettingsHubGatingContext {
  */
 export declare function isSettingsScopeAvailable(scope: ResourcePrimaryScope | undefined, scopeIds: SettingsScopeIds): boolean;
 /**
- * OR-semantics role check: a section with no `requiredRoles` is open; otherwise
- * the user must hold AT LEAST ONE of the required roles. Matches the role
- * semantics in `evaluateGuidanceAudience`.
+ * Whether the viewer may see a section with these `requiredRoles`: the app shell's ONE role-visibility decision
+ * ({@link viewerHoldsOneOfRoles}, OR through the role hierarchy), shared with every launcher item (#2376).
+ *
+ * It used to compare role names with no hierarchy, so an owner failed a gate naming only the administrator role,
+ * while a launcher row and the backend would have let them through.
  */
-export declare function hasRequiredSettingsRoles(requiredRoles: string[] | undefined, userRoles: string[]): boolean;
+export declare function hasRequiredSettingsRoles(requiredRoles: string[] | undefined, effectiveRoles: LauncherEffectiveRoles): boolean;
 /**
  * Boolean feature gate mirroring {@link RequiredFeaturesConfig} semantics
  * (shorthand `string[]` = OR; full form honours `mode`). `limitChecks` are not
  * evaluated for visibility. A section with no `requiredFeatures` is open.
  */
 export declare function areSettingsFeaturesSatisfied(requiredFeatures: RequiredFeaturesConfig | undefined, enabledFeatures: string[]): boolean;
+/**
+ * Engine-capability gate (#2314): a section that serves engine capabilities appears only while the application
+ * enables every one of them. A section declaring none is open.
+ */
+export declare function areSettingsEngineCapabilitiesEnabled(requiredEngineCapabilities: readonly string[] | undefined, enabledEngineCapabilities: readonly string[]): boolean;
 /**
  * Filter a raw {@link ResolvedSettingsHubConfig} down to what the current user may see.
  *

package/dist/esm/core/config/settings-hub-gating.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-hub-gating.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/config/settings-hub-gating.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAEL,KAAK,kCAAkC,EACxC,MAAM,mEAAmE,CAAC;AAC3E,OAAO,KAAK,EACV,yBAAyB,EAG1B,MAAM,iCAAiC,CAAC;AAEzC,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,6EAA6E;IAC7E,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,8DAA8D;IAC9D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,cAAc,EAAE,kCAAkC,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,oBAAoB,GAAG,SAAS,EACvC,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAaT;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EAAE,GAAG,SAAS,EACnC,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAGT;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,gBAAgB,EAAE,sBAAsB,GAAG,SAAS,EACpD,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAYT;AAYD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,yBAAyB,EACjC,MAAM,EAAE,wBAAwB,GAC/B,yBAAyB,CA0B3B"}
+{"version":3,"file":"settings-hub-gating.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/config/settings-hub-gating.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAEL,KAAK,kCAAkC,EACxC,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAyB,KAAK,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AAE7H,OAAO,KAAK,EACV,yBAAyB,EAG1B,MAAM,iCAAiC,CAAC;AAEzC,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,8DAA8D;IAC9D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,yHAAyH;IACzH,cAAc,EAAE,kCAAkC,CAAC;IACnD,6GAA6G;IAC7G,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,oBAAoB,GAAG,SAAS,EACvC,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAaT;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EAAE,GAAG,SAAS,EACnC,cAAc,EAAE,sBAAsB,GACrC,OAAO,CAET;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,gBAAgB,EAAE,sBAAsB,GAAG,SAAS,EACpD,eAAe,EAAE,MAAM,EAAE,GACxB,OAAO,CAYT;AAED;;;GAGG;AACH,wBAAgB,oCAAoC,CAClD,0BAA0B,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACzD,yBAAyB,EAAE,SAAS,MAAM,EAAE,GAC3C,OAAO,CAET;AA6BD;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,yBAAyB,EACjC,MAAM,EAAE,wBAAwB,GAC/B,yBAAyB,CA4B3B"}

package/dist/esm/core/config/settings-hub-gating.frontend.utils.js

@@ -13,9 +13,8 @@
  *    hidden when no organization is selected). Scope-agnostic categories always
  *    pass.
  * 2. **Capability** — `runtimeAvailability.requiredCapabilities` evaluated via
- *    {@link areLauncherCapabilitiesSatisfied}, the capability half of the launcher
- *    filter the sidebar and command menu use (e.g. `billingEnabled`). The launcher's
- *    `visibleToRoles` is not read here: a section's roles are rule 3.
+ *    the SAME {@link isLauncherRuntimeAvailabilitySatisfied} the sidebar/command
+ *    menu use (e.g. `billingEnabled`).
  * 3. **Role** — `requiredRoles` (OR semantics) evaluated against the merged
  *    app-level + current-organization role set (`buildFeaturePolicyRoles`).
  * 4. **Feature** — `requiredFeatures` ({@link RequiredFeaturesConfig}) boolean
@@ -23,11 +22,17 @@
  *    intentionally ignored: a settings section is shown or hidden, never
  *    "over-limit".
  *
+ * A SUB_TABS section's tabs then pass the capability gate one by one (#2649): a
+ * tab whose `runtimeAvailability` fails is left out, and a section left with no
+ * tab is left out with it.
+ *
  * @see settings-hub.frontend.schemas.ts — the gated section contract
  * @see useVisibleSettingsHubConfig.ts — the hook that wires live signals into this
  */
 import { ResourcePrimaryScope } from '@wildo-ai/saas-models';
-import { areLauncherCapabilitiesSatisfied, } from '../../core/navigation/launcher-runtime-availability.js';
+import { isLauncherRuntimeAvailabilitySatisfied, } from '../../core/navigation/launcher-runtime-availability.js';
+import { viewerHoldsOneOfRoles } from '../../core/navigation/launcher-resolution.js';
+import { SettingsSectionTargetKind } from './settings-hub.frontend.schemas.js';
 /**
  * Whether a category's primary scope currently has a value. A category without a
  * `scope` is scope-agnostic and always available.
@@ -47,14 +52,14 @@ export function isSettingsScopeAvailable(scope, scopeIds) {
     }
 }
 /**
- * OR-semantics role check: a section with no `requiredRoles` is open; otherwise
- * the user must hold AT LEAST ONE of the required roles. Matches the role
- * semantics in `evaluateGuidanceAudience`.
+ * Whether the viewer may see a section with these `requiredRoles`: the app shell's ONE role-visibility decision
+ * ({@link viewerHoldsOneOfRoles}, OR through the role hierarchy), shared with every launcher item (#2376).
+ *
+ * It used to compare role names with no hierarchy, so an owner failed a gate naming only the administrator role,
+ * while a launcher row and the backend would have let them through.
  */
-export function hasRequiredSettingsRoles(requiredRoles, userRoles) {
-    if (!requiredRoles?.length)
-        return true;
-    return requiredRoles.some(role => userRoles.includes(role));
+export function hasRequiredSettingsRoles(requiredRoles, effectiveRoles) {
+    return viewerHoldsOneOfRoles(requiredRoles, effectiveRoles);
 }
 /**
  * Boolean feature gate mirroring {@link RequiredFeaturesConfig} semantics
@@ -74,14 +79,36 @@ export function areSettingsFeaturesSatisfied(requiredFeatures, enabledFeatures)
         ? featureList.some(feature => enabledFeatures.includes(feature))
         : featureList.every(feature => enabledFeatures.includes(feature));
 }
+/**
+ * Engine-capability gate (#2314): a section that serves engine capabilities appears only while the application
+ * enables every one of them. A section declaring none is open.
+ */
+export function areSettingsEngineCapabilitiesEnabled(requiredEngineCapabilities, enabledEngineCapabilities) {
+    return (requiredEngineCapabilities ?? []).every(capability => enabledEngineCapabilities.includes(capability));
+}
 /** A section passes every gate except its category's scope (checked at the category level). */
 function isSectionVisible(section, gating) {
-    return (
-    // Capabilities only: a settings section's roles are `requiredRoles` below, never the launcher's `visibleToRoles`.
-    areLauncherCapabilitiesSatisfied(section.runtimeAvailability, gating.runtimeContext) &&
-        hasRequiredSettingsRoles(section.requiredRoles, gating.userRoles) &&
+    return (areSettingsEngineCapabilitiesEnabled(section.requiredEngineCapabilities, gating.enabledEngineCapabilities) &&
+        isLauncherRuntimeAvailabilitySatisfied(section.runtimeAvailability, gating.runtimeContext) &&
+        hasRequiredSettingsRoles(section.requiredRoles, gating.runtimeContext.effectiveRoles) &&
         areSettingsFeaturesSatisfied(section.requiredFeatures, gating.enabledFeatures));
 }
+/**
+ * The section with only the sub-tabs whose own `runtimeAvailability` holds (#2649), or `null` when a SUB_TABS section
+ * keeps none: an empty tab strip is a section with nothing in it, which the rail does not offer.
+ *
+ * Gated HERE, in the one pure filter, rather than where the strip renders, so every reader of the gated config agrees
+ * on what a section shows: the strip, the default tab a link falls back to, and the width the overlay derives from the
+ * section's targets (`settings-hub-presentation.frontend.utils.ts`).
+ */
+function withVisibleSubTabs(section, gating) {
+    if (section.target.kind !== SettingsSectionTargetKind.SUB_TABS)
+        return section;
+    const subTabs = section.target.subTabs.filter(subTab => isLauncherRuntimeAvailabilitySatisfied(subTab.runtimeAvailability, gating.runtimeContext));
+    if (subTabs.length === 0)
+        return null;
+    return subTabs.length === section.target.subTabs.length ? section : { ...section, target: { ...section.target, subTabs } };
+}
 /**
  * Filter a raw {@link ResolvedSettingsHubConfig} down to what the current user may see.
  *
@@ -93,7 +120,12 @@ function isSectionVisible(section, gating) {
 export function filterSettingsHubConfig(config, gating) {
     const scopedCategories = config.categories.filter(category => isSettingsScopeAvailable(category.scope, gating.scopeIds));
     const scopedCategoryRefs = new Set(scopedCategories.map(category => category.ref));
-    const visibleSections = config.sections.filter(section => scopedCategoryRefs.has(section.categoryRef) && isSectionVisible(section, gating));
+    const visibleSections = config.sections.flatMap((section) => {
+        if (!scopedCategoryRefs.has(section.categoryRef) || !isSectionVisible(section, gating))
+            return [];
+        const gatedSection = withVisibleSubTabs(section, gating);
+        return gatedSection ? [gatedSection] : [];
+    });
     // Drop categories that ended up with zero visible sections.
     const populatedCategoryRefs = new Set(visibleSections.map(section => section.categoryRef));
     const visibleCategories = scopedCategories.filter(category => populatedCategoryRefs.has(category.ref));

package/dist/esm/core/config/settings-hub-gating.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings-hub-gating.frontend.utils.js","sourceRoot":"","sources":["../../../../src/core/config/settings-hub-gating.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EACL,gCAAgC,GAEjC,MAAM,mEAAmE,CAAC;AA0B3E;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAuC,EACvC,QAA0B;IAE1B,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC;QACd,KAAK,oBAAoB,CAAC,SAAS;YACjC,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzC,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACjD,KAAK,oBAAoB,CAAC,WAAW;YACnC,OAAO,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAChD,KAAK,oBAAoB,CAAC,SAAS;YACjC,OAAO,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAmC,EACnC,SAAmB;IAEnB,IAAI,CAAC,aAAa,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,gBAAoD,EACpD,eAAyB;IAEzB,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjD,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IACtF,OAAO,IAAI,KAAK,IAAI;QAClB,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,+FAA+F;AAC/F,SAAS,gBAAgB,CAAC,OAAwB,EAAE,MAAgC;IAClF,OAAO;IACL,kHAAkH;IAClH,gCAAgC,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,cAAc,CAAC;QACpF,wBAAwB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC;QACjE,4BAA4B,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,eAAe,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAiC,EACjC,MAAgC;IAEhC,MAAM,gBAAgB,GAAuB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAC/E,wBAAwB,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAC1D,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAEnF,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAC5C,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAC5F,CAAC;IAEF,4DAA4D;IAC5D,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3F,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAC3D,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CACxC,CAAC;IAEF,MAAM,iBAAiB,GACrB,MAAM,CAAC,iBAAiB,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,iBAAiB,CAAC;QACnG,CAAC,CAAC,MAAM,CAAC,iBAAiB;QAC1B,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IAE9B,OAAO;QACL,UAAU,EAAE,iBAAiB;QAC7B,QAAQ,EAAE,eAAe;QACzB,iBAAiB;KAClB,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Settings Hub — Section Gating (\"face to right management of the user\")\n *\n * Pure, React-free evaluation of which categories/sections the current user may\n * see. Kept separate from the {@link useVisibleSettingsHubConfig} hook so the\n * gating decisions are unit-testable without a React tree.\n *\n * Four orthogonal gates, mirroring the framework's existing launcher/view gating\n * semantics so settings sections behave identically to every other gated surface:\n *\n * 1. **Scope** — a category bound to a {@link ResourcePrimaryScope} is hidden\n *    when that scope has no current value (e.g. the `ORGANIZATIONS` category is\n *    hidden when no organization is selected). Scope-agnostic categories always\n *    pass.\n * 2. **Capability** — `runtimeAvailability.requiredCapabilities` evaluated via\n *    {@link areLauncherCapabilitiesSatisfied}, the capability half of the launcher\n *    filter the sidebar and command menu use (e.g. `billingEnabled`). The launcher's\n *    `visibleToRoles` is not read here: a section's roles are rule 3.\n * 3. **Role** — `requiredRoles` (OR semantics) evaluated against the merged\n *    app-level + current-organization role set (`buildFeaturePolicyRoles`).\n * 4. **Feature** — `requiredFeatures` ({@link RequiredFeaturesConfig}) boolean\n *    presence check against the resolved feature list. `limitChecks` are\n *    intentionally ignored: a settings section is shown or hidden, never\n *    \"over-limit\".\n *\n * @see settings-hub.frontend.schemas.ts — the gated section contract\n * @see useVisibleSettingsHubConfig.ts — the hook that wires live signals into this\n */\n\nimport { ResourcePrimaryScope } from '@wildo-ai/saas-models';\nimport type { RequiredFeaturesConfig } from '@wildo-ai/saas-models';\nimport {\n  areLauncherCapabilitiesSatisfied,\n  type LauncherRuntimeAvailabilityContext,\n} from '~wildo-frontend-lib/core/navigation/launcher-runtime-availability';\nimport type {\n  ResolvedSettingsHubConfig,\n  SettingsCategory,\n  SettingsSection,\n} from './settings-hub.frontend.schemas';\n\n/** The current primary-scope values used to evaluate category scope availability. */\nexport interface SettingsScopeIds {\n  currentUserId?: string | null;\n  currentOrganizationId?: string | null;\n  currentApplicationId?: string | null;\n  currentAnonymousUserId?: string | null;\n}\n\n/** Everything the pure filter needs to decide section visibility. */\nexport interface SettingsHubGatingContext {\n  scopeIds: SettingsScopeIds;\n  /** Merged app-level + current-org roles (from `buildFeaturePolicyRoles`). */\n  userRoles: string[];\n  /** Resolved boolean feature identifiers currently enabled. */\n  enabledFeatures: string[];\n  /** Runtime-capability context (reused verbatim from the launcher layer). */\n  runtimeContext: LauncherRuntimeAvailabilityContext;\n}\n\n/**\n * Whether a category's primary scope currently has a value. A category without a\n * `scope` is scope-agnostic and always available.\n */\nexport function isSettingsScopeAvailable(\n  scope: ResourcePrimaryScope | undefined,\n  scopeIds: SettingsScopeIds,\n): boolean {\n  switch (scope) {\n    case undefined:\n      return true;\n    case ResourcePrimaryScope.USER_SELF:\n      return Boolean(scopeIds.currentUserId);\n    case ResourcePrimaryScope.ORGANIZATIONS:\n      return Boolean(scopeIds.currentOrganizationId);\n    case ResourcePrimaryScope.APPLICATION:\n      return Boolean(scopeIds.currentApplicationId);\n    case ResourcePrimaryScope.ANONYMOUS:\n      return Boolean(scopeIds.currentAnonymousUserId);\n  }\n}\n\n/**\n * OR-semantics role check: a section with no `requiredRoles` is open; otherwise\n * the user must hold AT LEAST ONE of the required roles. Matches the role\n * semantics in `evaluateGuidanceAudience`.\n */\nexport function hasRequiredSettingsRoles(\n  requiredRoles: string[] | undefined,\n  userRoles: string[],\n): boolean {\n  if (!requiredRoles?.length) return true;\n  return requiredRoles.some(role => userRoles.includes(role));\n}\n\n/**\n * Boolean feature gate mirroring {@link RequiredFeaturesConfig} semantics\n * (shorthand `string[]` = OR; full form honours `mode`). `limitChecks` are not\n * evaluated for visibility. A section with no `requiredFeatures` is open.\n */\nexport function areSettingsFeaturesSatisfied(\n  requiredFeatures: RequiredFeaturesConfig | undefined,\n  enabledFeatures: string[],\n): boolean {\n  if (!requiredFeatures) return true;\n\n  const featureList = Array.isArray(requiredFeatures)\n    ? requiredFeatures\n    : (requiredFeatures.features ?? []);\n  if (featureList.length === 0) return true;\n\n  const mode = Array.isArray(requiredFeatures) ? 'OR' : (requiredFeatures.mode ?? 'OR');\n  return mode === 'OR'\n    ? featureList.some(feature => enabledFeatures.includes(feature))\n    : featureList.every(feature => enabledFeatures.includes(feature));\n}\n\n/** A section passes every gate except its category's scope (checked at the category level). */\nfunction isSectionVisible(section: SettingsSection, gating: SettingsHubGatingContext): boolean {\n  return (\n    // Capabilities only: a settings section's roles are `requiredRoles` below, never the launcher's `visibleToRoles`.\n    areLauncherCapabilitiesSatisfied(section.runtimeAvailability, gating.runtimeContext) &&\n    hasRequiredSettingsRoles(section.requiredRoles, gating.userRoles) &&\n    areSettingsFeaturesSatisfied(section.requiredFeatures, gating.enabledFeatures)\n  );\n}\n\n/**\n * Filter a raw {@link ResolvedSettingsHubConfig} down to what the current user may see.\n *\n * Categories are dropped when their scope is unavailable OR when every one of\n * their sections is gated out (an empty rail group would be visual noise). The\n * `defaultSectionRef` is recomputed when the configured default is no longer\n * visible, so the hub never tries to open a section the user cannot access.\n */\nexport function filterSettingsHubConfig(\n  config: ResolvedSettingsHubConfig,\n  gating: SettingsHubGatingContext,\n): ResolvedSettingsHubConfig {\n  const scopedCategories: SettingsCategory[] = config.categories.filter(category =>\n    isSettingsScopeAvailable(category.scope, gating.scopeIds),\n  );\n  const scopedCategoryRefs = new Set(scopedCategories.map(category => category.ref));\n\n  const visibleSections = config.sections.filter(\n    section => scopedCategoryRefs.has(section.categoryRef) && isSectionVisible(section, gating),\n  );\n\n  // Drop categories that ended up with zero visible sections.\n  const populatedCategoryRefs = new Set(visibleSections.map(section => section.categoryRef));\n  const visibleCategories = scopedCategories.filter(category =>\n    populatedCategoryRefs.has(category.ref),\n  );\n\n  const defaultSectionRef =\n    config.defaultSectionRef && visibleSections.some(section => section.ref === config.defaultSectionRef)\n      ? config.defaultSectionRef\n      : visibleSections[0]?.ref;\n\n  return {\n    categories: visibleCategories,\n    sections: visibleSections,\n    defaultSectionRef,\n  };\n}\n"]}
+{"version":3,"file":"settings-hub-gating.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/config/settings-hub-gating.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EACL,sCAAsC,GAEvC,MAAM,mEAAmE,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAA+B,MAAM,yDAAyD,CAAC;AAC7H,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AA0B5E;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAuC,EACvC,QAA0B;IAE1B,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC;QACd,KAAK,oBAAoB,CAAC,SAAS;YACjC,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzC,KAAK,oBAAoB,CAAC,aAAa;YACrC,OAAO,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QACjD,KAAK,oBAAoB,CAAC,WAAW;YACnC,OAAO,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QAChD,KAAK,oBAAoB,CAAC,SAAS;YACjC,OAAO,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAmC,EACnC,cAAsC;IAEtC,OAAO,qBAAqB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAC1C,gBAAoD,EACpD,eAAyB;IAEzB,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjD,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;IACtF,OAAO,IAAI,KAAK,IAAI;QAClB,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oCAAoC,CAClD,0BAAyD,EACzD,yBAA4C;IAE5C,OAAO,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,yBAAyB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AAChH,CAAC;AAED,+FAA+F;AAC/F,SAAS,gBAAgB,CAAC,OAAwB,EAAE,MAAgC;IAClF,OAAO,CACL,oCAAoC,CAAC,OAAO,CAAC,0BAA0B,EAAE,MAAM,CAAC,yBAAyB,CAAC;QAC1G,sCAAsC,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,cAAc,CAAC;QAC1F,wBAAwB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC;QACrF,4BAA4B,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,eAAe,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,OAAwB,EAAE,MAAgC;IACpF,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,yBAAyB,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC/E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CACrD,sCAAsC,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,cAAc,CAAC,CAC1F,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;AAC7H,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAiC,EACjC,MAAgC;IAEhC,MAAM,gBAAgB,GAAuB,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAC/E,wBAAwB,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAC1D,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAEnF,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC1D,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAClG,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,4DAA4D;IAC5D,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3F,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAC3D,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CACxC,CAAC;IAEF,MAAM,iBAAiB,GACrB,MAAM,CAAC,iBAAiB,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,iBAAiB,CAAC;QACnG,CAAC,CAAC,MAAM,CAAC,iBAAiB;QAC1B,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IAE9B,OAAO;QACL,UAAU,EAAE,iBAAiB;QAC7B,QAAQ,EAAE,eAAe;QACzB,iBAAiB;KAClB,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Settings Hub — Section Gating (\"face to right management of the user\")\n *\n * Pure, React-free evaluation of which categories/sections the current user may\n * see. Kept separate from the {@link useVisibleSettingsHubConfig} hook so the\n * gating decisions are unit-testable without a React tree.\n *\n * Four orthogonal gates, mirroring the framework's existing launcher/view gating\n * semantics so settings sections behave identically to every other gated surface:\n *\n * 1. **Scope** — a category bound to a {@link ResourcePrimaryScope} is hidden\n *    when that scope has no current value (e.g. the `ORGANIZATIONS` category is\n *    hidden when no organization is selected). Scope-agnostic categories always\n *    pass.\n * 2. **Capability** — `runtimeAvailability.requiredCapabilities` evaluated via\n *    the SAME {@link isLauncherRuntimeAvailabilitySatisfied} the sidebar/command\n *    menu use (e.g. `billingEnabled`).\n * 3. **Role** — `requiredRoles` (OR semantics) evaluated against the merged\n *    app-level + current-organization role set (`buildFeaturePolicyRoles`).\n * 4. **Feature** — `requiredFeatures` ({@link RequiredFeaturesConfig}) boolean\n *    presence check against the resolved feature list. `limitChecks` are\n *    intentionally ignored: a settings section is shown or hidden, never\n *    \"over-limit\".\n *\n * A SUB_TABS section's tabs then pass the capability gate one by one (#2649): a\n * tab whose `runtimeAvailability` fails is left out, and a section left with no\n * tab is left out with it.\n *\n * @see settings-hub.frontend.schemas.ts — the gated section contract\n * @see useVisibleSettingsHubConfig.ts — the hook that wires live signals into this\n */\n\nimport { ResourcePrimaryScope } from '@wildo-ai/saas-models';\nimport type { RequiredFeaturesConfig } from '@wildo-ai/saas-models';\nimport {\n  isLauncherRuntimeAvailabilitySatisfied,\n  type LauncherRuntimeAvailabilityContext,\n} from '~wildo-frontend-lib/core/navigation/launcher-runtime-availability';\nimport { viewerHoldsOneOfRoles, type LauncherEffectiveRoles } from '~wildo-frontend-lib/core/navigation/launcher-resolution';\nimport { SettingsSectionTargetKind } from './settings-hub.frontend.schemas';\nimport type {\n  ResolvedSettingsHubConfig,\n  SettingsCategory,\n  SettingsSection,\n} from './settings-hub.frontend.schemas';\n\n/** The current primary-scope values used to evaluate category scope availability. */\nexport interface SettingsScopeIds {\n  currentUserId?: string | null;\n  currentOrganizationId?: string | null;\n  currentApplicationId?: string | null;\n  currentAnonymousUserId?: string | null;\n}\n\n/** Everything the pure filter needs to decide section visibility. */\nexport interface SettingsHubGatingContext {\n  scopeIds: SettingsScopeIds;\n  /** Resolved boolean feature identifiers currently enabled. */\n  enabledFeatures: string[];\n  /** Runtime-capability context (reused verbatim from the launcher layer). Its `effectiveRoles` decide `requiredRoles`. */\n  runtimeContext: LauncherRuntimeAvailabilityContext;\n  /** The engine capabilities the application enables (`AppConfiguration_Shared.enabledEngineCapabilities`). */\n  enabledEngineCapabilities: readonly string[];\n}\n\n/**\n * Whether a category's primary scope currently has a value. A category without a\n * `scope` is scope-agnostic and always available.\n */\nexport function isSettingsScopeAvailable(\n  scope: ResourcePrimaryScope | undefined,\n  scopeIds: SettingsScopeIds,\n): boolean {\n  switch (scope) {\n    case undefined:\n      return true;\n    case ResourcePrimaryScope.USER_SELF:\n      return Boolean(scopeIds.currentUserId);\n    case ResourcePrimaryScope.ORGANIZATIONS:\n      return Boolean(scopeIds.currentOrganizationId);\n    case ResourcePrimaryScope.APPLICATION:\n      return Boolean(scopeIds.currentApplicationId);\n    case ResourcePrimaryScope.ANONYMOUS:\n      return Boolean(scopeIds.currentAnonymousUserId);\n  }\n}\n\n/**\n * Whether the viewer may see a section with these `requiredRoles`: the app shell's ONE role-visibility decision\n * ({@link viewerHoldsOneOfRoles}, OR through the role hierarchy), shared with every launcher item (#2376).\n *\n * It used to compare role names with no hierarchy, so an owner failed a gate naming only the administrator role,\n * while a launcher row and the backend would have let them through.\n */\nexport function hasRequiredSettingsRoles(\n  requiredRoles: string[] | undefined,\n  effectiveRoles: LauncherEffectiveRoles,\n): boolean {\n  return viewerHoldsOneOfRoles(requiredRoles, effectiveRoles);\n}\n\n/**\n * Boolean feature gate mirroring {@link RequiredFeaturesConfig} semantics\n * (shorthand `string[]` = OR; full form honours `mode`). `limitChecks` are not\n * evaluated for visibility. A section with no `requiredFeatures` is open.\n */\nexport function areSettingsFeaturesSatisfied(\n  requiredFeatures: RequiredFeaturesConfig | undefined,\n  enabledFeatures: string[],\n): boolean {\n  if (!requiredFeatures) return true;\n\n  const featureList = Array.isArray(requiredFeatures)\n    ? requiredFeatures\n    : (requiredFeatures.features ?? []);\n  if (featureList.length === 0) return true;\n\n  const mode = Array.isArray(requiredFeatures) ? 'OR' : (requiredFeatures.mode ?? 'OR');\n  return mode === 'OR'\n    ? featureList.some(feature => enabledFeatures.includes(feature))\n    : featureList.every(feature => enabledFeatures.includes(feature));\n}\n\n/**\n * Engine-capability gate (#2314): a section that serves engine capabilities appears only while the application\n * enables every one of them. A section declaring none is open.\n */\nexport function areSettingsEngineCapabilitiesEnabled(\n  requiredEngineCapabilities: readonly string[] | undefined,\n  enabledEngineCapabilities: readonly string[],\n): boolean {\n  return (requiredEngineCapabilities ?? []).every(capability => enabledEngineCapabilities.includes(capability));\n}\n\n/** A section passes every gate except its category's scope (checked at the category level). */\nfunction isSectionVisible(section: SettingsSection, gating: SettingsHubGatingContext): boolean {\n  return (\n    areSettingsEngineCapabilitiesEnabled(section.requiredEngineCapabilities, gating.enabledEngineCapabilities) &&\n    isLauncherRuntimeAvailabilitySatisfied(section.runtimeAvailability, gating.runtimeContext) &&\n    hasRequiredSettingsRoles(section.requiredRoles, gating.runtimeContext.effectiveRoles) &&\n    areSettingsFeaturesSatisfied(section.requiredFeatures, gating.enabledFeatures)\n  );\n}\n\n/**\n * The section with only the sub-tabs whose own `runtimeAvailability` holds (#2649), or `null` when a SUB_TABS section\n * keeps none: an empty tab strip is a section with nothing in it, which the rail does not offer.\n *\n * Gated HERE, in the one pure filter, rather than where the strip renders, so every reader of the gated config agrees\n * on what a section shows: the strip, the default tab a link falls back to, and the width the overlay derives from the\n * section's targets (`settings-hub-presentation.frontend.utils.ts`).\n */\nfunction withVisibleSubTabs(section: SettingsSection, gating: SettingsHubGatingContext): SettingsSection | null {\n  if (section.target.kind !== SettingsSectionTargetKind.SUB_TABS) return section;\n  const subTabs = section.target.subTabs.filter(subTab =>\n    isLauncherRuntimeAvailabilitySatisfied(subTab.runtimeAvailability, gating.runtimeContext),\n  );\n  if (subTabs.length === 0) return null;\n  return subTabs.length === section.target.subTabs.length ? section : { ...section, target: { ...section.target, subTabs } };\n}\n\n/**\n * Filter a raw {@link ResolvedSettingsHubConfig} down to what the current user may see.\n *\n * Categories are dropped when their scope is unavailable OR when every one of\n * their sections is gated out (an empty rail group would be visual noise). The\n * `defaultSectionRef` is recomputed when the configured default is no longer\n * visible, so the hub never tries to open a section the user cannot access.\n */\nexport function filterSettingsHubConfig(\n  config: ResolvedSettingsHubConfig,\n  gating: SettingsHubGatingContext,\n): ResolvedSettingsHubConfig {\n  const scopedCategories: SettingsCategory[] = config.categories.filter(category =>\n    isSettingsScopeAvailable(category.scope, gating.scopeIds),\n  );\n  const scopedCategoryRefs = new Set(scopedCategories.map(category => category.ref));\n\n  const visibleSections = config.sections.flatMap((section) => {\n    if (!scopedCategoryRefs.has(section.categoryRef) || !isSectionVisible(section, gating)) return [];\n    const gatedSection = withVisibleSubTabs(section, gating);\n    return gatedSection ? [gatedSection] : [];\n  });\n\n  // Drop categories that ended up with zero visible sections.\n  const populatedCategoryRefs = new Set(visibleSections.map(section => section.categoryRef));\n  const visibleCategories = scopedCategories.filter(category =>\n    populatedCategoryRefs.has(category.ref),\n  );\n\n  const defaultSectionRef =\n    config.defaultSectionRef && visibleSections.some(section => section.ref === config.defaultSectionRef)\n      ? config.defaultSectionRef\n      : visibleSections[0]?.ref;\n\n  return {\n    categories: visibleCategories,\n    sections: visibleSections,\n    defaultSectionRef,\n  };\n}\n"]}

package/dist/esm/core/config/settings-hub-presentation.frontend.utils.d.ts

@@ -10,12 +10,12 @@ export declare function settingsSectionTargetRendersCollection(target: SettingsS
  *
  * - the section renders a COLLECTION, so the pane holds a table;
  * - the resource's layout declares a NAVIGATION container mode, so the pane holds a second vertical
- *   rail of its own. SSO config is the case: seven groups of fields, presented as vertical tabs, and
+ *   rail of its own. SSO config is the case: five groups of fields, presented as vertical tabs, and
  *   `w-48` of rail comes out of the same content column the 240px hub rail already took. At the
  *   record width that leaves about 400px for a label-left / value-right row.
  *
  * The second reason is why `ResourceLayoutConfig.defaultDisplaySectionAppearance` is a layout
- * DECLARATION and not seven `appearance` props inside a template: a prop inside a React template is
+ * DECLARATION and not five `appearance` props inside a template: a prop inside a React template is
  * invisible to anything that has to size the surface around it.
  */
 export declare function settingsSectionNeedsWideFrame(sections: readonly SettingsSection[], sectionRef: string | undefined, resolveLayoutSectionAppearance: (resourceType: string) => ContainerSectionMode | undefined): boolean;

package/dist/esm/core/config/settings-hub-presentation.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-hub-presentation.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/config/settings-hub-presentation.frontend.utils.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAe,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,+DAA+D,CAAC;AAoCvE,wBAAgB,sCAAsC,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAE7F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,8BAA8B,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,oBAAoB,GAAG,SAAS,GACzF,OAAO,CAiBT"}
+{"version":3,"file":"settings-hub-presentation.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/config/settings-hub-presentation.frontend.utils.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAe,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,+DAA+D,CAAC;AAsEvE,wBAAgB,sCAAsC,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAE7F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,8BAA8B,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,oBAAoB,GAAG,SAAS,GACzF,OAAO,CAiBT"}

package/dist/esm/core/config/settings-hub-presentation.frontend.utils.js

@@ -16,15 +16,15 @@
  *
  * Deliberately conservative in both directions:
  *
- * - An operation this cannot classify — a custom verb, a bespoke engine panel, an app component —
- *   is NOT a collection. The narrow width is the current behaviour, so an unclassifiable section is
+ * - An operation this cannot classify — a custom verb or an app component — is NOT a collection.
+ *   An ENGINE panel is classified by `ENGINE_PANEL_RENDERS_SIDE_BY_SIDE_ITEMS`, which names every panel. The narrow width is the current behaviour, so an unclassifiable section is
  *   unchanged rather than guessed at.
  * - A SUB_TABS section counts as a collection when ANY of its tabs is one. The tab a reader opens is
  *   their choice and the overlay cannot resize under them without the panel reflowing mid-read.
  */
 import { CoreResourceOperation } from '@wildo-ai/saas-models';
 import { SectionMode } from '@wildo-ai/zod-decorators';
-import { SettingsSectionTargetKind, } from '../../core/config/settings-hub.frontend.schemas.js';
+import { SettingsPanelRef, SettingsSectionTargetKind, } from '../../core/config/settings-hub.frontend.schemas.js';
 /**
  * The core operations that render a COLLECTION rather than one record.
  *
@@ -48,7 +48,40 @@ function leafTargets(target) {
 function isNavigationContainerSectionMode(mode) {
     return mode === SectionMode.VERTICAL_TABS;
 }
+/**
+ * Which ENGINE panels lay out a set of items SIDE BY SIDE, and so need the collection width.
+ *
+ * An engine panel is bespoke, so no operation names what it renders, and before this every panel was
+ * sized as a record. Billing is the case that broke it: its plan catalog puts each plan in a card of its
+ * own, in one row, and the record width squeezed that row (Paul, 2026-10-02: "Billing plan should be
+ * full width").
+ *
+ * A `Record` over the whole enum on purpose. A panel the framework adds tomorrow does not compile until
+ * somebody says which shape it has, so the answer is decided where the panel is written rather than
+ * defaulted to the record width by omission.
+ */
+const ENGINE_PANEL_RENDERS_SIDE_BY_SIDE_ITEMS = {
+    [SettingsPanelRef.SECURITY]: false,
+    [SettingsPanelRef.APPEARANCE]: false,
+    [SettingsPanelRef.INVITATIONS]: false,
+    // The plan catalog: one card per plan, in a row.
+    [SettingsPanelRef.BILLING]: true,
+    [SettingsPanelRef.CONNECTED_ACCOUNTS]: false,
+    [SettingsPanelRef.ORGANIZATION_CONNECTED_ACCOUNTS]: false,
+    [SettingsPanelRef.AGENT_WORK_OVERRIDE_RATE]: false,
+    // One card per agent, stacked: each carries tables that want the width.
+    [SettingsPanelRef.AUTONOMOUS_AGENTS]: false,
+    [SettingsPanelRef.MODEL_COST_BREAKDOWN]: false,
+    // The same table, for a representing organization's own cost (#2618).
+    [SettingsPanelRef.REPRESENTING_ORGANIZATION_MODEL_COST_BREAKDOWN]: false,
+    // One table of rows (#2874).
+    [SettingsPanelRef.REPRESENTATIVE_ACTIVITY]: false,
+    [SettingsPanelRef.AGENT_WORK_EVALUATION_EXPORT]: false,
+};
 function leafTargetRendersCollection(target) {
+    if (target.kind === SettingsSectionTargetKind.ENGINE_PANEL) {
+        return ENGINE_PANEL_RENDERS_SIDE_BY_SIDE_ITEMS[target.panelRef];
+    }
     if (target.kind !== SettingsSectionTargetKind.RESOURCE_OPERATION) {
         return false;
     }
@@ -66,12 +99,12 @@ export function settingsSectionTargetRendersCollection(target) {
  *
  * - the section renders a COLLECTION, so the pane holds a table;
  * - the resource's layout declares a NAVIGATION container mode, so the pane holds a second vertical
- *   rail of its own. SSO config is the case: seven groups of fields, presented as vertical tabs, and
+ *   rail of its own. SSO config is the case: five groups of fields, presented as vertical tabs, and
  *   `w-48` of rail comes out of the same content column the 240px hub rail already took. At the
  *   record width that leaves about 400px for a label-left / value-right row.
  *
  * The second reason is why `ResourceLayoutConfig.defaultDisplaySectionAppearance` is a layout
- * DECLARATION and not seven `appearance` props inside a template: a prop inside a React template is
+ * DECLARATION and not five `appearance` props inside a template: a prop inside a React template is
  * invisible to anything that has to size the surface around it.
  */
 export function settingsSectionNeedsWideFrame(sections, sectionRef, resolveLayoutSectionAppearance) {

package/dist/esm/core/config/settings-hub-presentation.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings-hub-presentation.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/config/settings-hub-presentation.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAA6B,MAAM,0BAA0B,CAAC;AAClF,OAAO,EACL,yBAAyB,GAI1B,MAAM,+DAA+D,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,oCAAoC,GAAsB;IAC9D,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF,SAAS,WAAW,CAAC,MAA6B;IAChD,OAAO,MAAM,CAAC,IAAI,KAAK,yBAAyB,CAAC,QAAQ;QACvD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/C,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,gCAAgC,CAAC,IAAsC;IAC9E,OAAO,IAAI,KAAK,WAAW,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED,SAAS,2BAA2B,CAAC,MAA0B;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,yBAAyB,CAAC,kBAAkB,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,oCAAoC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,MAA6B;IAClF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAoC,EACpC,UAA8B,EAC9B,8BAA0F;IAE1F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,sCAAsC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACjD,MAAM,CAAC,IAAI,KAAK,yBAAyB,CAAC,kBAAkB;WACzD,gCAAgC,CAAC,8BAA8B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC","sourcesContent":["/**\n * How WIDE the Settings Hub needs to be, derived from what the open section renders.\n *\n * The hub is one overlay serving two different kinds of surface, and until now one constant served\n * both. `max-w-4xl` (896px) minus the `w-60` rail (240px) leaves roughly 640px of content. That is\n * generous for a settings RECORD — a column of label-left / value-right rows, read one at a time to\n * decide something — and cramped for a COLLECTION: the organization-members table alone carries\n * name, email, role, status, joined and an actions column, and a table squeezed to 640px is the\n * surface an administrator came to the hub to work in.\n *\n * So the width is DERIVED from the section's declared target rather than authored per section. The\n * discriminator already exists: a `RESOURCE_OPERATION` target names the operation it renders, and\n * `LIST` / `SEARCH` are the two core operations that produce a collection. Nothing new is asked of\n * an application, a section added tomorrow is sized by what it declares, and there is no per-section\n * width to keep in step with the content.\n *\n * Deliberately conservative in both directions:\n *\n * - An operation this cannot classify — a custom verb, a bespoke engine panel, an app component —\n *   is NOT a collection. The narrow width is the current behaviour, so an unclassifiable section is\n *   unchanged rather than guessed at.\n * - A SUB_TABS section counts as a collection when ANY of its tabs is one. The tab a reader opens is\n *   their choice and the overlay cannot resize under them without the panel reflowing mid-read.\n */\nimport { CoreResourceOperation } from '@wildo-ai/saas-models';\nimport { SectionMode, type ContainerSectionMode } from '@wildo-ai/zod-decorators';\nimport {\n  SettingsSectionTargetKind,\n  type SettingsLeafTarget,\n  type SettingsSection,\n  type SettingsSectionTarget,\n} from '~wildo-frontend-lib/core/config/settings-hub.frontend.schemas';\n\n/**\n * The core operations that render a COLLECTION rather than one record.\n *\n * Total over the vocabulary at the point it is read: a core operation added tomorrow is classified\n * here or is not a collection, and either answer is deliberate rather than silent.\n */\nconst COLLECTION_RENDERING_CORE_OPERATIONS: readonly string[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.SEARCH,\n];\n\nfunction leafTargets(target: SettingsSectionTarget): SettingsLeafTarget[] {\n  return target.kind === SettingsSectionTargetKind.SUB_TABS\n    ? target.subTabs.map((subTab) => subTab.target)\n    : [target];\n}\n\n/**\n * The container modes that show ONE section at a time behind their own navigation control. Only\n * `VERTICAL_TABS` actually spends horizontal room — a horizontal strip and a pill row cost height —\n * so this is deliberately not \"every navigation mode\".\n */\nfunction isNavigationContainerSectionMode(mode: ContainerSectionMode | undefined): boolean {\n  return mode === SectionMode.VERTICAL_TABS;\n}\n\nfunction leafTargetRendersCollection(target: SettingsLeafTarget): boolean {\n  if (target.kind !== SettingsSectionTargetKind.RESOURCE_OPERATION) {\n    return false;\n  }\n\n  return COLLECTION_RENDERING_CORE_OPERATIONS.includes(String(target.operation));\n}\n\nexport function settingsSectionTargetRendersCollection(target: SettingsSectionTarget): boolean {\n  return leafTargets(target).some(leafTargetRendersCollection);\n}\n\n/**\n * Whether the pane at `sectionRef` needs the wide frame. An unresolvable ref — no section, or the\n * hub opened before its config resolved — answers `false`, which is the narrow width the hub has\n * always used.\n *\n * TWO reasons, and they are the same question asked of different things:\n *\n * - the section renders a COLLECTION, so the pane holds a table;\n * - the resource's layout declares a NAVIGATION container mode, so the pane holds a second vertical\n *   rail of its own. SSO config is the case: seven groups of fields, presented as vertical tabs, and\n *   `w-48` of rail comes out of the same content column the 240px hub rail already took. At the\n *   record width that leaves about 400px for a label-left / value-right row.\n *\n * The second reason is why `ResourceLayoutConfig.defaultDisplaySectionAppearance` is a layout\n * DECLARATION and not seven `appearance` props inside a template: a prop inside a React template is\n * invisible to anything that has to size the surface around it.\n */\nexport function settingsSectionNeedsWideFrame(\n  sections: readonly SettingsSection[],\n  sectionRef: string | undefined,\n  resolveLayoutSectionAppearance: (resourceType: string) => ContainerSectionMode | undefined,\n): boolean {\n  if (!sectionRef) {\n    return false;\n  }\n\n  const section = sections.find((candidate) => candidate.ref === sectionRef);\n  if (!section) {\n    return false;\n  }\n\n  if (settingsSectionTargetRendersCollection(section.target)) {\n    return true;\n  }\n\n  return leafTargets(section.target).some((target) =>\n    target.kind === SettingsSectionTargetKind.RESOURCE_OPERATION\n    && isNavigationContainerSectionMode(resolveLayoutSectionAppearance(target.resourceType)));\n}\n"]}
+{"version":3,"file":"settings-hub-presentation.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/config/settings-hub-presentation.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAA6B,MAAM,0BAA0B,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,yBAAyB,GAI1B,MAAM,+DAA+D,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,oCAAoC,GAAsB;IAC9D,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,MAAM;CAC7B,CAAC;AAEF,SAAS,WAAW,CAAC,MAA6B;IAChD,OAAO,MAAM,CAAC,IAAI,KAAK,yBAAyB,CAAC,QAAQ;QACvD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/C,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,gCAAgC,CAAC,IAAsC;IAC9E,OAAO,IAAI,KAAK,WAAW,CAAC,aAAa,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,uCAAuC,GAAgD;IAC3F,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,KAAK;IAClC,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,KAAK;IACpC,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,KAAK;IACrC,iDAAiD;IACjD,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI;IAChC,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,KAAK;IAC5C,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,EAAE,KAAK;IACzD,CAAC,gBAAgB,CAAC,wBAAwB,CAAC,EAAE,KAAK;IAClD,wEAAwE;IACxE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,KAAK;IAC3C,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,KAAK;IAC9C,sEAAsE;IACtE,CAAC,gBAAgB,CAAC,8CAA8C,CAAC,EAAE,KAAK;IACxE,6BAA6B;IAC7B,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,EAAE,KAAK;IACjD,CAAC,gBAAgB,CAAC,4BAA4B,CAAC,EAAE,KAAK;CACvD,CAAC;AAEF,SAAS,2BAA2B,CAAC,MAA0B;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,yBAAyB,CAAC,YAAY,EAAE,CAAC;QAC3D,OAAO,uCAAuC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,yBAAyB,CAAC,kBAAkB,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,oCAAoC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,MAA6B;IAClF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAoC,EACpC,UAA8B,EAC9B,8BAA0F;IAE1F,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,sCAAsC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACjD,MAAM,CAAC,IAAI,KAAK,yBAAyB,CAAC,kBAAkB;WACzD,gCAAgC,CAAC,8BAA8B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC","sourcesContent":["/**\n * How WIDE the Settings Hub needs to be, derived from what the open section renders.\n *\n * The hub is one overlay serving two different kinds of surface, and until now one constant served\n * both. `max-w-4xl` (896px) minus the `w-60` rail (240px) leaves roughly 640px of content. That is\n * generous for a settings RECORD — a column of label-left / value-right rows, read one at a time to\n * decide something — and cramped for a COLLECTION: the organization-members table alone carries\n * name, email, role, status, joined and an actions column, and a table squeezed to 640px is the\n * surface an administrator came to the hub to work in.\n *\n * So the width is DERIVED from the section's declared target rather than authored per section. The\n * discriminator already exists: a `RESOURCE_OPERATION` target names the operation it renders, and\n * `LIST` / `SEARCH` are the two core operations that produce a collection. Nothing new is asked of\n * an application, a section added tomorrow is sized by what it declares, and there is no per-section\n * width to keep in step with the content.\n *\n * Deliberately conservative in both directions:\n *\n * - An operation this cannot classify — a custom verb or an app component — is NOT a collection.\n *   An ENGINE panel is classified by `ENGINE_PANEL_RENDERS_SIDE_BY_SIDE_ITEMS`, which names every panel. The narrow width is the current behaviour, so an unclassifiable section is\n *   unchanged rather than guessed at.\n * - A SUB_TABS section counts as a collection when ANY of its tabs is one. The tab a reader opens is\n *   their choice and the overlay cannot resize under them without the panel reflowing mid-read.\n */\nimport { CoreResourceOperation } from '@wildo-ai/saas-models';\nimport { SectionMode, type ContainerSectionMode } from '@wildo-ai/zod-decorators';\nimport {\n  SettingsPanelRef,\n  SettingsSectionTargetKind,\n  type SettingsLeafTarget,\n  type SettingsSection,\n  type SettingsSectionTarget,\n} from '~wildo-frontend-lib/core/config/settings-hub.frontend.schemas';\n\n/**\n * The core operations that render a COLLECTION rather than one record.\n *\n * Total over the vocabulary at the point it is read: a core operation added tomorrow is classified\n * here or is not a collection, and either answer is deliberate rather than silent.\n */\nconst COLLECTION_RENDERING_CORE_OPERATIONS: readonly string[] = [\n  CoreResourceOperation.LIST,\n  CoreResourceOperation.SEARCH,\n];\n\nfunction leafTargets(target: SettingsSectionTarget): SettingsLeafTarget[] {\n  return target.kind === SettingsSectionTargetKind.SUB_TABS\n    ? target.subTabs.map((subTab) => subTab.target)\n    : [target];\n}\n\n/**\n * The container modes that show ONE section at a time behind their own navigation control. Only\n * `VERTICAL_TABS` actually spends horizontal room — a horizontal strip and a pill row cost height —\n * so this is deliberately not \"every navigation mode\".\n */\nfunction isNavigationContainerSectionMode(mode: ContainerSectionMode | undefined): boolean {\n  return mode === SectionMode.VERTICAL_TABS;\n}\n\n/**\n * Which ENGINE panels lay out a set of items SIDE BY SIDE, and so need the collection width.\n *\n * An engine panel is bespoke, so no operation names what it renders, and before this every panel was\n * sized as a record. Billing is the case that broke it: its plan catalog puts each plan in a card of its\n * own, in one row, and the record width squeezed that row (Paul, 2026-10-02: \"Billing plan should be\n * full width\").\n *\n * A `Record` over the whole enum on purpose. A panel the framework adds tomorrow does not compile until\n * somebody says which shape it has, so the answer is decided where the panel is written rather than\n * defaulted to the record width by omission.\n */\nconst ENGINE_PANEL_RENDERS_SIDE_BY_SIDE_ITEMS: Readonly<Record<SettingsPanelRef, boolean>> = {\n  [SettingsPanelRef.SECURITY]: false,\n  [SettingsPanelRef.APPEARANCE]: false,\n  [SettingsPanelRef.INVITATIONS]: false,\n  // The plan catalog: one card per plan, in a row.\n  [SettingsPanelRef.BILLING]: true,\n  [SettingsPanelRef.CONNECTED_ACCOUNTS]: false,\n  [SettingsPanelRef.ORGANIZATION_CONNECTED_ACCOUNTS]: false,\n  [SettingsPanelRef.AGENT_WORK_OVERRIDE_RATE]: false,\n  // One card per agent, stacked: each carries tables that want the width.\n  [SettingsPanelRef.AUTONOMOUS_AGENTS]: false,\n  [SettingsPanelRef.MODEL_COST_BREAKDOWN]: false,\n  // The same table, for a representing organization's own cost (#2618).\n  [SettingsPanelRef.REPRESENTING_ORGANIZATION_MODEL_COST_BREAKDOWN]: false,\n  // One table of rows (#2874).\n  [SettingsPanelRef.REPRESENTATIVE_ACTIVITY]: false,\n  [SettingsPanelRef.AGENT_WORK_EVALUATION_EXPORT]: false,\n};\n\nfunction leafTargetRendersCollection(target: SettingsLeafTarget): boolean {\n  if (target.kind === SettingsSectionTargetKind.ENGINE_PANEL) {\n    return ENGINE_PANEL_RENDERS_SIDE_BY_SIDE_ITEMS[target.panelRef];\n  }\n  if (target.kind !== SettingsSectionTargetKind.RESOURCE_OPERATION) {\n    return false;\n  }\n\n  return COLLECTION_RENDERING_CORE_OPERATIONS.includes(String(target.operation));\n}\n\nexport function settingsSectionTargetRendersCollection(target: SettingsSectionTarget): boolean {\n  return leafTargets(target).some(leafTargetRendersCollection);\n}\n\n/**\n * Whether the pane at `sectionRef` needs the wide frame. An unresolvable ref — no section, or the\n * hub opened before its config resolved — answers `false`, which is the narrow width the hub has\n * always used.\n *\n * TWO reasons, and they are the same question asked of different things:\n *\n * - the section renders a COLLECTION, so the pane holds a table;\n * - the resource's layout declares a NAVIGATION container mode, so the pane holds a second vertical\n *   rail of its own. SSO config is the case: five groups of fields, presented as vertical tabs, and\n *   `w-48` of rail comes out of the same content column the 240px hub rail already took. At the\n *   record width that leaves about 400px for a label-left / value-right row.\n *\n * The second reason is why `ResourceLayoutConfig.defaultDisplaySectionAppearance` is a layout\n * DECLARATION and not five `appearance` props inside a template: a prop inside a React template is\n * invisible to anything that has to size the surface around it.\n */\nexport function settingsSectionNeedsWideFrame(\n  sections: readonly SettingsSection[],\n  sectionRef: string | undefined,\n  resolveLayoutSectionAppearance: (resourceType: string) => ContainerSectionMode | undefined,\n): boolean {\n  if (!sectionRef) {\n    return false;\n  }\n\n  const section = sections.find((candidate) => candidate.ref === sectionRef);\n  if (!section) {\n    return false;\n  }\n\n  if (settingsSectionTargetRendersCollection(section.target)) {\n    return true;\n  }\n\n  return leafTargets(section.target).some((target) =>\n    target.kind === SettingsSectionTargetKind.RESOURCE_OPERATION\n    && isNavigationContainerSectionMode(resolveLayoutSectionAppearance(target.resourceType)));\n}\n"]}

package/dist/esm/core/config/settings-hub.frontend.schemas.d.ts

@@ -26,15 +26,8 @@
  * @see .claude/plans/unified-settings-hub.md — design + layer trace
  */
 import { ResourcePrimaryScope } from '@wildo-ai/saas-models';
-import type { RequiredFeaturesConfig } from '@wildo-ai/saas-models';
+import type { EngineCapability, RequiredFeaturesConfig } from '@wildo-ai/saas-models';
 import type { LauncherRuntimeAvailabilityConfig } from './launcher-items.frontend.schemas';
-/**
- * A settings destination's runtime availability: CAPABILITIES only. Its roles are `requiredRoles`, an exact match the
- * settings hub has always applied, so the launcher's `visibleToRoles` (which also counts core-role inheritance) is
- * deliberately not accepted here: one decision with two role rules that disagree on an organization owner is the drift
- * to avoid. The placement plan refuses an audience on the settings rail for the same reason.
- */
-export type SettingsRuntimeAvailabilityConfig = Omit<LauncherRuntimeAvailabilityConfig, 'visibleToRoles'>;
 /** @wildo_source:part:start saas.frontend.settings-hub.placement */
 /**
  * What a settings section renders in its content panel.
@@ -95,8 +88,9 @@ export declare enum SettingsPanelRef {
      * no mechanism for an ACTION of that shape, which is why the whole outbound-authorization lane had
      * no surface that could begin it until this existed.
      *
-     * Paired with, never replacing, the credential list: this panel answers what MAY be connected and
-     * the list answers what IS, and the empty answer to the second is exactly when the first matters.
+     * Since #2319 it is also the one list of what IS connected: every held connection with its acts, then
+     * every provider nothing is held for. A separate credential list beside it made a person match the
+     * same rows up by name.
      */
     CONNECTED_ACCOUNTS = "connected-accounts",
     /**
@@ -109,14 +103,50 @@ export declare enum SettingsPanelRef {
      */
     ORGANIZATION_CONNECTED_ACCOUNTS = "organization-connected-accounts",
     /**
-     * How often the organization's experts override its agents (#1599), per agent, tool, case or reviewer, over a
+     * How often the organization's deciders override its agents (#1599), per agent, tool, case or reviewer, over a
      * window: the counts behind the rate, the decisions nobody took counted apart, and a group where nothing was decided
      * shown as that rather than as 0 %.
      *
      * Bespoke because the rate is not a row: it is a summary the engine computes from the decision records on request
      * (`POST /agent-work/override-rate`), and no resource surface can render a computed aggregate.
      */
-    AGENT_WORK_OVERRIDE_RATE = "agent-work-override-rate"
+    AGENT_WORK_OVERRIDE_RATE = "agent-work-override-rate",
+    /**
+     * An organization's autonomous agents (#2528): when each runs, its latest runs and its latest refusals with their
+     * reason in words.
+     *
+     * Bespoke because the answer is one read across two stores: the runs are execution rows, and a turn that did not run
+     * left no row at all, only an audit record of its refusal (`GET /flows-actors/autonomous-agents`).
+     */
+    AUTONOMOUS_AGENTS = "autonomous-agents",
+    /**
+     * What model calls cost per case, organization, agent or model over a window, in money (#2528): the Breakdown tab of
+     * Administration > Model costs, beside the monthly records.
+     *
+     * Bespoke because the breakdown is not a row: it is a summary the engine computes on request from the call records
+     * (`POST /model-cost/summary`), with the calls it could not attribute or price counted apart.
+     */
+    MODEL_COST_BREAKDOWN = "model-cost-breakdown",
+    /**
+     * What a REPRESENTING organization's own model calls cost (#2618): the same breakdown as
+     * {@link SettingsPanelRef.MODEL_COST_BREAKDOWN}, for the current organization's administrator, holding only its own work
+     * (its calls through the relationships it represents in, and its own tenant's own calls). The Model cost tab of the
+     * representing side's relationships section.
+     */
+    REPRESENTING_ORGANIZATION_MODEL_COST_BREAKDOWN = "representing-organization-model-cost-breakdown",
+    /**
+     * What a REPRESENTING organization's own people did in the organizations it represents (#2874): the rows their acts
+     * wrote in those organizations' trails, as far as each discloses them. The Activity tab of the representing side's
+     * relationships section. Bespoke because the rows live in other tenants and only `POST /representative-activity`
+     * reaches them.
+     */
+    REPRESENTATIVE_ACTIVITY = "representative-activity",
+    /**
+     * Running an evaluation export (#2327): one agent, a window and where the dataset goes, then the dataset downloaded.
+     * Bespoke because `POST /agent-work/evaluation-exports` answers with the dataset itself, and its record is the export
+     * ledger the next tab lists.
+     */
+    AGENT_WORK_EVALUATION_EXPORT = "agent-work-evaluation-export"
 }
 /** @wildo_source:part:start saas.frontend.settings-hub.placement */
 /** Renders a framework-owned bespoke panel. */
@@ -159,6 +189,15 @@ export interface SettingsSubTab {
     icon?: string;
     /** What this sub-tab renders. Sub-tabs hold leaf targets only. */
     target: SettingsLeafTarget;
+    /**
+     * Declarative runtime capability gating for this one tab, the same contract as the section's own (#2649). A tab
+     * whose capabilities are off is left out of the section, and a section left with no tab is left out of the rail.
+     *
+     * For a section whose tabs are not all meaningful in every state: the SCIM section shows its tokens wherever the
+     * organization holds one it can only revoke, while its provisioning tab needs a type a directory may provision.
+     * Omit for a tab that is always shown when its section is.
+     */
+    runtimeAvailability?: LauncherRuntimeAvailabilityConfig;
 }
 /** Splits a section into horizontal sub-tabs rendered above the panel content. */
 export interface SettingsSubTabsTarget {
@@ -173,15 +212,17 @@ export type SettingsSectionTarget = SettingsLeafTarget | SettingsSubTabsTarget;
 /** @wildo_source:part:end saas.frontend.settings-hub.placement */
 /**
  * A category groups sections in the vertical rail (the `Account` / `Organization`
- * group headers in the BetterStack reference). Rendered as a label + separator
- * inside the `TabsList` — NOT a separate nav widget (the `Tabs` primitive stays
- * the section mechanism).
+ * group headers in the BetterStack reference). The rail is a `<nav>` of links:
+ * each category is a labelled group with a separator before it, and inside it
+ * its ungrouped sections first, then its sub-category `groups` (#2329), each
+ * under its own heading.
  *
  * `scope` ties the category to a primary-scope axis so the runtime can hide it
  * when the scope is unavailable — e.g. an `ORGANIZATIONS` category is hidden when
  * no organization is selected. It is derived against `AppScope`, not authored
  * per-user.
  */
+/** @wildo_source:part:start saas.frontend.settings-hub.placement */
 export interface SettingsCategory {
     /** Category reference — app-defined, referenced by `SettingsSection.categoryRef`. */
     ref: string;
@@ -197,7 +238,23 @@ export interface SettingsCategory {
     icon?: string;
     /** Sort order among categories in the rail (lower = higher). */
     order?: number;
+    /**
+     * Sub-categories of this category's rail (#2329): People, Security & access, Integrations and the like. A placement
+     * names one through `groupRef`; the rail draws each group's heading above its sections, ungrouped sections first.
+     * Declared like categories, so the application arranges its own rail.
+     */
+    groups?: SettingsCategoryGroup[];
+}
+/** One sub-category of a {@link SettingsCategory}'s rail (#2329). */
+export interface SettingsCategoryGroup {
+    /** Group reference, unique within its category; named by `SettingsPlacement.groupRef`. */
+    ref: string;
+    /** Group heading (authored English; `settings_hub.categories.<categoryRef>.groups.<ref>.label` overrides it). */
+    label: string;
+    /** Sort order among the category's groups (lower = higher). */
+    order?: number;
 }
+/** @wildo_source:part:end saas.frontend.settings-hub.placement */
 /** @wildo_source:part:start saas.frontend.settings-hub.placement facet:layer:frontend facet:family:config facet:audience:app-developer */
 /**
  * An addressable settings DESTINATION — what a settings surface *is*, with no
@@ -221,14 +278,28 @@ export interface SettingsDestination {
     ref: string;
     /** What the destination renders in its content panel. */
     target: SettingsSectionTarget;
-    /** Declarative runtime capability gating (launcher items' `requiredCapabilities`; roles are `requiredRoles`). */
-    runtimeAvailability?: SettingsRuntimeAvailabilityConfig;
+    /**
+     * The destination's icon ref — what the settings rail draws beside its name, and what every shortcut into it
+     * (the identity menu's Profile, a sidebar row naming a section) draws. Every engine destination declares one; a
+     * placement's own `icon` overrides it.
+     */
+    icon?: string;
+    /** Declarative runtime capability gating (same contract as launcher items). */
+    runtimeAvailability?: LauncherRuntimeAvailabilityConfig;
     /** Feature flags required to surface this destination (plan/subscription gating). */
     requiredFeatures?: RequiredFeaturesConfig;
     /** RBAC roles required to surface this destination (OR semantics). */
     requiredRoles?: string[];
     /** Optional CoreFeature id this destination's content is ENTITLED by (soft gate — renders an upgrade prompt). */
     entitlementFeatureId?: string;
+    /**
+     * Engine capabilities this destination serves, ALL of which the application must enable for it to appear
+     * (#2314). A section about a capability the application does not have is noise at best, and at worst a page whose
+     * actions fail: agent work review without a language model, email domains without inbound email. Read from the
+     * application's declared `engineCapabilities` (`AppConfiguration_Shared.enabledEngineCapabilities`), so it is the
+     * same whoever is looking.
+     */
+    requiredEngineCapabilities?: readonly EngineCapability[];
 }
 /**
  * An application's explicit PLACEMENT of one destination in its settings rail.
@@ -252,9 +323,11 @@ export interface SettingsPlacement {
     destinationRef: string;
     /** Which category (rail group) this destination sits under. */
     categoryRef: string;
-    /** Sort order within the category (lower = higher). */
+    /** Which of that category's `groups` it sits under (#2329). Omit to place it above the groups. Refused at DEV startup when unknown. */
+    groupRef?: string;
+    /** Sort order within the category, or within its group (lower = higher). */
     order?: number;
-    /** Optional icon ref for the rail entry. */
+    /** Icon ref for the rail entry, overriding the destination's own `icon`. Omit to keep the destination's. */
     icon?: string;
     /** Rail label override. Omit to take `settings_hub.sections.<ref>.label`. */
     label?: string;
@@ -268,7 +341,7 @@ export interface SettingsPlacement {
  * Produced by `resolveSettingsHubConfig()`; never authored directly. It
  * belongs to a category, addresses a target, and reuses the existing launcher
  * gating stack:
- * - `runtimeAvailability` — survives the app-shell filtering pass (capabilities only; roles are `requiredRoles`).
+ * - `runtimeAvailability` — survives the app-shell filtering pass (capabilities).
  * - `requiredFeatures` — plan/subscription gating once resolved.
  * - `requiredRoles` — RBAC gating (e.g. org-admin-only sections).
  *
@@ -279,6 +352,8 @@ export interface SettingsSection {
     ref: string;
     /** Which category (rail group) this section sits under. */
     categoryRef: string;
+    /** Which of the category's sub-category groups it sits under, when its placement named one. */
+    groupRef?: string;
     /** Rail label (i18n ref). */
     label: string;
     /** Optional icon ref for the rail entry. */
@@ -287,8 +362,8 @@ export interface SettingsSection {
     order?: number;
     /** What the section renders in its content panel. */
     target: SettingsSectionTarget;
-    /** Declarative runtime capability gating (launcher items' `requiredCapabilities`; roles are `requiredRoles`). */
-    runtimeAvailability?: SettingsRuntimeAvailabilityConfig;
+    /** Declarative runtime capability gating (same contract as launcher items). */
+    runtimeAvailability?: LauncherRuntimeAvailabilityConfig;
     /**
      * Feature flags required to surface this section (plan/subscription gating).
      *
@@ -318,6 +393,8 @@ export interface SettingsSection {
      * app does NOT offer at all is hidden outright while an offered one prompts.
      */
     entitlementFeatureId?: string;
+    /** Engine capabilities the destination serves; see {@link SettingsDestination.requiredEngineCapabilities}. */
+    requiredEngineCapabilities?: readonly EngineCapability[];
 }
 /** @wildo_source:part:start saas.frontend.settings-hub.placement */
 /**