@wildo-ai/saas-frontend-lib 1.1.4 → 1.1.6

package/dist/esm/core/config/settings-hub.frontend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings-hub.frontend.schemas.js","sourceRoot":"","sources":["../../../../src/core/config/settings-hub.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,mEAAmE;AACnE,+DAA+D;AAC/D,mEAAmE;AAEnE;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,yBASX;AATD,WAAY,yBAAyB;IACnC,iEAAiE;IACjE,0DAA6B,CAAA;IAC7B,+FAA+F;IAC/F,sEAAyC,CAAA;IACzC,sFAAsF;IACtF,kEAAqC,CAAA;IACrC,0GAA0G;IAC1G,kDAAqB,CAAA;AACvB,CAAC,EATW,yBAAyB,KAAzB,yBAAyB,QASpC;AAED,mEAAmE;AACnE,6DAA6D;AAC7D,mEAAmE;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,gBA0CX;AA1CD,WAAY,gBAAgB;IAC1B,wGAAwG;IACxG,yCAAqB,CAAA;IACrB,qEAAqE;IACrE,6CAAyB,CAAA;IACzB,oFAAoF;IACpF,+CAA2B,CAAA;IAC3B;;;;;;;;;;;OAWG;IACH,uCAAmB,CAAA;IACnB;;;;;;;;;;;OAWG;IACH,6DAAyC,CAAA;IACzC;;;;;;;OAOG;IACH,uFAAmE,CAAA;AACrE,CAAC,EA1CW,gBAAgB,KAAhB,gBAAgB,QA0C3B;AAgRD,kEAAkE","sourcesContent":["/**\n * Settings Hub — Declarative Section Registry\n *\n * The Settings Hub is the framework's single point of configuration: one overlay\n * surface that consolidates every settings destination (account, security,\n * appearance, organization, members, billing, …) behind a vertical `Tabs` rail\n * grouped by category. Many entry points (user dropdown, sidebar, command menu)\n * all converge on this one hub; links differ only by which section they pre-open.\n *\n * This file owns the **config-time** registry contract. It is declaration-first\n * and mirrors `launcher-items.frontend.schemas.ts`:\n * - `SettingsSectionTarget` is an interface-based discriminated union on `kind`\n *   (exactly like `LauncherItemRef`), because section targets are config-time\n *   descriptors resolved by the runtime — not Zod-validated wire payloads.\n * - The framework seeds a default `SettingsHubConfig`; apps merge/extend it\n *   (same model as the sidebar/launcher config).\n *\n * Runtime concerns live elsewhere:\n * - `NavigationContentType.SETTINGS_HUB` (navigation.schemas.ts) — what renders\n *   in the overlay zone.\n * - `SettingsHub` component (components/settings/) — resolves a section's target\n *   to a rendered panel.\n *\n * @see launcher-items.frontend.schemas.ts — the sibling launcher registry this mirrors\n * @see .claude/plans/unified-settings-hub.md — design + layer trace\n */\n\nimport { ResourcePrimaryScope } from '@wildo-ai/saas-models';\nimport type { RequiredFeaturesConfig } from '@wildo-ai/saas-models';\nimport type { LauncherRuntimeAvailabilityConfig } from './launcher-items.frontend.schemas';\n\n// ════════════════════════════════════════════════════════════════\n// Section Target Kind — discriminant for SettingsSectionTarget\n// ════════════════════════════════════════════════════════════════\n\n/**\n * What a settings section renders in its content panel.\n *\n * Discriminant for the `SettingsSectionTarget` union. The default for\n * data-backed settings is `RESOURCE_OPERATION` (reuse the auto-rendered\n * resource surface); `ENGINE_PANEL` is reserved for the few sections whose\n * bespoke layout earns it (Security, Appearance).\n */\nexport enum SettingsSectionTargetKind {\n  /** A framework-owned bespoke panel (Security, Appearance, …). */\n  ENGINE_PANEL = 'engine_panel',\n  /** An auto-rendered resource-operation surface (members, API tokens, billing, preferences). */\n  RESOURCE_OPERATION = 'resource_operation',\n  /** An app-registered custom React component (resolved via the component registry). */\n  CUSTOM_COMPONENT = 'custom_component',\n  /** A section that itself splits into horizontal sub-tabs (e.g. Teams → Members / Roles & Permissions). */\n  SUB_TABS = 'sub_tabs',\n}\n\n// ════════════════════════════════════════════════════════════════\n// Engine Panel Ref — framework-owned bespoke settings panels\n// ════════════════════════════════════════════════════════════════\n\n/**\n * Framework-provided settings panels with bespoke (non-CRUD) layout.\n *\n * Closed enum — only framework panels belong here. Most settings sections should\n * be `RESOURCE_OPERATION` targets instead; a panel earns a slot here only when a\n * standard resource surface cannot express it (multi-factor enrollment flows,\n * theme/dark-mode toggles, …).\n *\n * The runtime maps each ref to a registered panel component in the\n * `SettingsHub` resolver.\n */\nexport enum SettingsPanelRef {\n  /** Password, MFA enrollment, passkeys, identity links (wraps the former `AppPage_SecuritySettings`). */\n  SECURITY = 'security',\n  /** Theme, dark-mode, density and other look-and-feel preferences. */\n  APPEARANCE = 'appearance',\n  /** The caller's own pending org invitations — accept/reject in-app (Approach P). */\n  INVITATIONS = 'invitations',\n  /**\n   * The billing home: subscription status, plan catalog + checkout, usage,\n   * invoices and the provider portal link — composed from the BillingContext\n   * aggregated state (`GET_STATE`), NOT from per-resource LIST surfaces.\n   *\n   * Bespoke on purpose: the billing child resources (subscriptions, invoice\n   * refs, usage records) are routed UNDER the billing account\n   * (`REQUIRES_CONTEXT`), so a generic org-scoped `RESOURCE_OPERATION` panel\n   * cannot build their URLs. The aggregated billing state is org-addressable\n   * and auto-creates the account, which makes it the correct settings-surface\n   * data source.\n   */\n  BILLING = 'billing',\n  /**\n   * Where a person CONNECTS one of their own third-party accounts.\n   *\n   * Bespoke because connecting is not a row somebody creates: it is a flow that leaves the\n   * application, obtains consent at a vendor, and returns with a grant nobody typed. The generic\n   * resource surface can list, inspect and delete the resulting credentials perfectly — it simply has\n   * no mechanism for an ACTION of that shape, which is why the whole outbound-authorization lane had\n   * no surface that could begin it until this existed.\n   *\n   * Paired with, never replacing, the credential list: this panel answers what MAY be connected and\n   * the list answers what IS, and the empty answer to the second is exactly when the first matters.\n   */\n  CONNECTED_ACCOUNTS = 'connected-accounts',\n  /**\n   * The same act at the TENANT's scope: connecting an account the whole organization acts as.\n   *\n   * A distinct ref rather than a parameterised one, because a settings destination resolves a ref to\n   * a panel and carries no arguments — and because the two must never be reachable from each other's\n   * screen. The component behind them IS shared: the act is identical, and duplicating it would\n   * guarantee the two drift. What is never shared is the data.\n   */\n  ORGANIZATION_CONNECTED_ACCOUNTS = 'organization-connected-accounts',\n}\n\n// ════════════════════════════════════════════════════════════════\n// Section Target — discriminated union on `kind`\n// ════════════════════════════════════════════════════════════════\n\n/** Renders a framework-owned bespoke panel. */\nexport interface SettingsEnginePanelTarget {\n  kind: SettingsSectionTargetKind.ENGINE_PANEL;\n  panelRef: SettingsPanelRef;\n}\n\n/**\n * Renders an auto-generated resource-operation surface inside the section panel.\n * Resolved against the resource registry exactly like a launcher\n * `RESOURCE_OPERATION` target.\n */\nexport interface SettingsResourceOperationTarget {\n  kind: SettingsSectionTargetKind.RESOURCE_OPERATION;\n  resourceType: string;\n  operation: string;\n  operationVariant?: string;\n}\n\n/** Renders an app-registered custom React component (resolved by `componentRef`). */\nexport interface SettingsCustomComponentTarget {\n  kind: SettingsSectionTargetKind.CUSTOM_COMPONENT;\n  componentRef: string;\n}\n\n/**\n * Leaf targets renderable directly in a panel. Sub-tabs may only point at leaf\n * targets — sub-tabs cannot nest further sub-tabs (one level of in-section\n * tabbing, matching the BetterStack reference).\n */\nexport type SettingsLeafTarget =\n  | SettingsEnginePanelTarget\n  | SettingsResourceOperationTarget\n  | SettingsCustomComponentTarget;\n\n/**\n * One horizontal sub-tab within a section (e.g. the \"Members\" / \"Roles &\n * Permissions\" tabs inside a Teams section).\n */\nexport interface SettingsSubTab {\n  /** Sub-tab reference — app-defined, used for i18n + the `value` of the inner Tabs. */\n  ref: string;\n  /** Display label (i18n ref). */\n  label: string;\n  /** Optional icon ref for the sub-tab trigger. */\n  icon?: string;\n  /** What this sub-tab renders. Sub-tabs hold leaf targets only. */\n  target: SettingsLeafTarget;\n}\n\n/** Splits a section into horizontal sub-tabs rendered above the panel content. */\nexport interface SettingsSubTabsTarget {\n  kind: SettingsSectionTargetKind.SUB_TABS;\n  subTabs: SettingsSubTab[];\n}\n\n/**\n * What a settings section renders. Discriminated on `kind`; the `SettingsHub`\n * resolver dispatches on it to produce the panel content.\n */\nexport type SettingsSectionTarget = SettingsLeafTarget | SettingsSubTabsTarget;\n\n// ════════════════════════════════════════════════════════════════\n// Category — the rail group\n// ════════════════════════════════════════════════════════════════\n\n/**\n * A category groups sections in the vertical rail (the `Account` / `Organization`\n * group headers in the BetterStack reference). Rendered as a label + separator\n * inside the `TabsList` — NOT a separate nav widget (the `Tabs` primitive stays\n * the section mechanism).\n *\n * `scope` ties the category to a primary-scope axis so the runtime can hide it\n * when the scope is unavailable — e.g. an `ORGANIZATIONS` category is hidden when\n * no organization is selected. It is derived against `AppScope`, not authored\n * per-user.\n */\nexport interface SettingsCategory {\n  /** Category reference — app-defined, referenced by `SettingsSection.categoryRef`. */\n  ref: string;\n  /** Group header label (i18n ref). */\n  label: string;\n  /**\n   * Primary scope this category belongs to. Drives rail grouping order and\n   * scope-gated visibility (org categories hide when no org is selected).\n   * Omit for a scope-agnostic category.\n   */\n  scope?: ResourcePrimaryScope;\n  /** Optional icon ref for the group header. */\n  icon?: string;\n  /** Sort order among categories in the rail (lower = higher). */\n  order?: number;\n}\n\n// ════════════════════════════════════════════════════════════════\n// Section — one vertical tab in the rail\n// ════════════════════════════════════════════════════════════════\n\n/** @wildo_source:part:start saas.frontend.settings-hub.placement facet:layer:frontend facet:family:config facet:audience:app-developer */\n/**\n * An addressable settings DESTINATION — what a settings surface *is*, with no\n * opinion on where it appears.\n *\n * This is the half the engine ships (`ENGINE_SETTINGS_DESTINATIONS`). It carries\n * the target and the gating stack, and deliberately carries **no `categoryRef`,\n * no `order` and no `label`**: those are placement, and placement is the\n * application's decision (`SettingsPlacement`).\n *\n * The split exists because the engine shipping a PLACED hub is what made the\n * settings rail unauthorable — an application could not add, remove, reorder or\n * rename a section without the framework agreeing. Splitting destination from\n * placement lets the engine keep owning what a destination MEANS (its target,\n * its roles, its entitlement) while the application owns where it sits.\n */\nexport interface SettingsDestination {\n  /** Destination reference — the `/settings/:sectionRef` URL segment and the id a placement names. */\n  ref: string;\n  /** What the destination renders in its content panel. */\n  target: SettingsSectionTarget;\n  /** Declarative runtime capability gating (same contract as launcher items). */\n  runtimeAvailability?: LauncherRuntimeAvailabilityConfig;\n  /** Feature flags required to surface this destination (plan/subscription gating). */\n  requiredFeatures?: RequiredFeaturesConfig;\n  /** RBAC roles required to surface this destination (OR semantics). */\n  requiredRoles?: string[];\n  /** Optional CoreFeature id this destination's content is ENTITLED by (soft gate — renders an upgrade prompt). */\n  entitlementFeatureId?: string;\n}\n\n/**\n * An application's explicit PLACEMENT of one destination in its settings rail.\n *\n * Authored in the application's own config. Nothing is placed implicitly: a\n * destination the application does not place does not render, which is the whole\n * point — \"we should just place things\", with no automatic inference.\n *\n * `label` is optional and is an OVERRIDE. The resolved label otherwise comes from\n * the `settings_hub.sections.<ref>.label` key, so a placed section is localizable\n * without the application authoring an English string.\n *\n * That namespace and its resolver (`tSettingsHubSection`) EXIST and already fall\n * back to the authored label. What does not exist is anything that generates the\n * units: `LabellingTypes.SETTINGS_HUB` is declared with an empty pattern and the\n * companion plans nothing for it, so today every rail label is the authored\n * English string. R9 is a wiring job, not a new mechanism.\n */\nexport interface SettingsPlacement {\n  /** The {@link SettingsDestination.ref} being placed. Refused at DEV startup when unknown. */\n  destinationRef: string;\n  /** Which category (rail group) this destination sits under. */\n  categoryRef: string;\n  /** Sort order within the category (lower = higher). */\n  order?: number;\n  /** Optional icon ref for the rail entry. */\n  icon?: string;\n  /** Rail label override. Omit to take `settings_hub.sections.<ref>.label`. */\n  label?: string;\n}\n/** @wildo_source:part:end saas.frontend.settings-hub.placement */\n\n/**\n * A settings section is one entry in the vertical rail (one `TabsTrigger`) —\n * the RESOLVED union of a {@link SettingsDestination} and the\n * {@link SettingsPlacement} that placed it.\n *\n * Produced by `resolveSettingsHubConfig()`; never authored directly. It\n * belongs to a category, addresses a target, and reuses the existing launcher\n * gating stack:\n * - `runtimeAvailability` — survives the app-shell filtering pass (capabilities).\n * - `requiredFeatures` — plan/subscription gating once resolved.\n * - `requiredRoles` — RBAC gating (e.g. org-admin-only sections).\n *\n * `ref` is the URL-addressable section id (`/settings/:sectionRef`).\n */\nexport interface SettingsSection {\n  /** Section reference — app-defined; the `/settings/:sectionRef` URL segment + Tabs `value`. */\n  ref: string;\n  /** Which category (rail group) this section sits under. */\n  categoryRef: string;\n  /** Rail label (i18n ref). */\n  label: string;\n  /** Optional icon ref for the rail entry. */\n  icon?: string;\n  /** Sort order within the category (lower = higher). */\n  order?: number;\n  /** What the section renders in its content panel. */\n  target: SettingsSectionTarget;\n  /** Declarative runtime capability gating (same contract as launcher items). */\n  runtimeAvailability?: LauncherRuntimeAvailabilityConfig;\n  /**\n   * Feature flags required to surface this section (plan/subscription gating).\n   *\n   * Uses the framework-canonical {@link RequiredFeaturesConfig} contract shared\n   * with views and resource operations — shorthand `string[]` (OR semantics) or\n   * the full `{ features, mode: 'OR' | 'AND' }` form. `limitChecks` are not\n   * evaluated for section visibility (a section is shown or hidden, never\n   * \"over-limit\"); use {@link requiredRoles} / capabilities for hard gating.\n   */\n  requiredFeatures?: RequiredFeaturesConfig;\n  /**\n   * RBAC roles required to surface this section (OR semantics — the user needs\n   * ANY one of these roles). Evaluated against the merged app-level + current-\n   * organization role set, the same effective surface the rest of the frontend\n   * gating layer resolves (see `buildFeaturePolicyRoles`). Org-management\n   * sections gate on `[CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN]`.\n   */\n  requiredRoles?: string[];\n  /**\n   * Optional CoreFeature id this section's content is ENTITLED by. Distinct from\n   * {@link requiredFeatures} (a HARD hide-gate): when set, the section still\n   * SURVIVES (per `runtimeAvailability`/roles) and its body is wrapped in a\n   * `FeatureGate` so an OFFERED-but-not-yet-entitled feature renders the\n   * policy-driven upgrade/add-on prompt (`unavailabilityPolicy`) instead of\n   * vanishing. Pair with a `runtimeAvailability.requiredCapabilities` gate whose\n   * capability is the plan-independent \"app offers X\" signal, so a feature the\n   * app does NOT offer at all is hidden outright while an offered one prompts.\n   */\n  entitlementFeatureId?: string;\n}\n\n// ════════════════════════════════════════════════════════════════\n// Hub Config — the registry root\n// ════════════════════════════════════════════════════════════════\n\n/** @wildo_source:part:start saas.frontend.settings-hub.placement */\n/**\n * The AUTHORED Settings Hub registry — an application's own settings rail.\n *\n * The framework ships destinations (`ENGINE_SETTINGS_DESTINATIONS`), never a\n * placed hub. This is the application's half: which categories exist, and which\n * destinations are placed where. `wildo init` scaffolds the full destination list\n * as placements so a new application starts complete and edits down.\n *\n * Resolve it with `resolveSettingsHubConfig()` to get the rendered\n * {@link SettingsSection} list; the render path never reads this shape directly.\n */\nexport interface SettingsHubConfig {\n  /** Rail groups, in render order (also orderable via `SettingsCategory.order`). */\n  categories: SettingsCategory[];\n  /**\n   * Every destination this application places, and where.\n   *\n   * A destination that appears in no placement does not render. That is\n   * deliberate: absence is how an application removes a settings section, and it\n   * must not be second-guessed by a merge against a framework default.\n   */\n  placements: SettingsPlacement[];\n  /**\n   * Section opened when the hub is launched without an explicit section\n   * (`/settings` with no `:sectionRef`). Falls back to the first section of the\n   * first category when omitted.\n   */\n  defaultSectionRef?: string;\n}\n\n/**\n * The RESOLVED hub — categories plus fully-resolved sections, ready to render.\n *\n * Distinct from {@link SettingsHubConfig} (what an application AUTHORS) because\n * conflating the two is what let a placed default ship from the engine. A\n * consumer that renders takes this; a consumer that configures takes the other.\n */\nexport interface ResolvedSettingsHubConfig {\n  categories: SettingsCategory[];\n  sections: SettingsSection[];\n  defaultSectionRef?: string;\n}\n/** @wildo_source:part:end saas.frontend.settings-hub.placement */\n"]}
+{"version":3,"file":"settings-hub.frontend.schemas.js","sourceRoot":"","sources":["../../../../../src/core/config/settings-hub.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,mEAAmE;AACnE,+DAA+D;AAC/D,mEAAmE;AAEnE,oEAAoE;AACpE;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,yBASX;AATD,WAAY,yBAAyB;IACnC,iEAAiE;IACjE,0DAA6B,CAAA;IAC7B,+FAA+F;IAC/F,sEAAyC,CAAA;IACzC,sFAAsF;IACtF,kEAAqC,CAAA;IACrC,0GAA0G;IAC1G,kDAAqB,CAAA;AACvB,CAAC,EATW,yBAAyB,KAAzB,yBAAyB,QASpC;AACD,kEAAkE;AAElE,mEAAmE;AACnE,6DAA6D;AAC7D,mEAAmE;AAEnE;;;;;;;;;;GAUG;AACH,MAAM,CAAN,IAAY,gBAmDX;AAnDD,WAAY,gBAAgB;IAC1B,wGAAwG;IACxG,yCAAqB,CAAA;IACrB,qEAAqE;IACrE,6CAAyB,CAAA;IACzB,oFAAoF;IACpF,+CAA2B,CAAA;IAC3B;;;;;;;;;;;OAWG;IACH,uCAAmB,CAAA;IACnB;;;;;;;;;;;OAWG;IACH,6DAAyC,CAAA;IACzC;;;;;;;OAOG;IACH,uFAAmE,CAAA;IACnE;;;;;;;OAOG;IACH,yEAAqD,CAAA;AACvD,CAAC,EAnDW,gBAAgB,KAAhB,gBAAgB,QAmD3B;AAgSD,kEAAkE","sourcesContent":["/**\n * Settings Hub — Declarative Section Registry\n *\n * The Settings Hub is the framework's single point of configuration: one overlay\n * surface that consolidates every settings destination (account, security,\n * appearance, organization, members, billing, …) behind a vertical `Tabs` rail\n * grouped by category. Many entry points (user dropdown, sidebar, command menu)\n * all converge on this one hub; links differ only by which section they pre-open.\n *\n * This file owns the **config-time** registry contract. It is declaration-first\n * and mirrors `launcher-items.frontend.schemas.ts`:\n * - `SettingsSectionTarget` is an interface-based discriminated union on `kind`\n *   (exactly like `LauncherItemRef`), because section targets are config-time\n *   descriptors resolved by the runtime — not Zod-validated wire payloads.\n * - The engine ships DESTINATIONS (`ENGINE_SETTINGS_DESTINATIONS`) and no\n *   arrangement; an application authors its own `SettingsHubConfig` — its\n *   categories, its placements, and any destinations of its own.\n *\n * Runtime concerns live elsewhere:\n * - `NavigationContentType.SETTINGS_HUB` (navigation.schemas.ts) — what renders\n *   in the overlay zone.\n * - `SettingsHub` component (components/settings/) — resolves a section's target\n *   to a rendered panel.\n *\n * @see launcher-items.frontend.schemas.ts — the sibling launcher registry this mirrors\n * @see .claude/plans/unified-settings-hub.md — design + layer trace\n */\n\nimport { ResourcePrimaryScope } from '@wildo-ai/saas-models';\nimport type { RequiredFeaturesConfig } from '@wildo-ai/saas-models';\nimport type { LauncherRuntimeAvailabilityConfig } from './launcher-items.frontend.schemas';\n\n// ════════════════════════════════════════════════════════════════\n// Section Target Kind — discriminant for SettingsSectionTarget\n// ════════════════════════════════════════════════════════════════\n\n/** @wildo_source:part:start saas.frontend.settings-hub.placement */\n/**\n * What a settings section renders in its content panel.\n *\n * Discriminant for the `SettingsSectionTarget` union. The default for\n * data-backed settings is `RESOURCE_OPERATION` (reuse the auto-rendered\n * resource surface); `ENGINE_PANEL` is reserved for the few sections whose\n * bespoke layout earns it (Security, Appearance).\n */\nexport enum SettingsSectionTargetKind {\n  /** A framework-owned bespoke panel (Security, Appearance, …). */\n  ENGINE_PANEL = 'engine_panel',\n  /** An auto-rendered resource-operation surface (members, API tokens, billing, preferences). */\n  RESOURCE_OPERATION = 'resource_operation',\n  /** An app-registered custom React component (resolved via the component registry). */\n  CUSTOM_COMPONENT = 'custom_component',\n  /** A section that itself splits into horizontal sub-tabs (e.g. Teams → Members / Roles & Permissions). */\n  SUB_TABS = 'sub_tabs',\n}\n/** @wildo_source:part:end saas.frontend.settings-hub.placement */\n\n// ════════════════════════════════════════════════════════════════\n// Engine Panel Ref — framework-owned bespoke settings panels\n// ════════════════════════════════════════════════════════════════\n\n/**\n * Framework-provided settings panels with bespoke (non-CRUD) layout.\n *\n * Closed enum — only framework panels belong here. Most settings sections should\n * be `RESOURCE_OPERATION` targets instead; a panel earns a slot here only when a\n * standard resource surface cannot express it (multi-factor enrollment flows,\n * theme/dark-mode toggles, …).\n *\n * The runtime maps each ref to a registered panel component in the\n * `SettingsHub` resolver.\n */\nexport enum SettingsPanelRef {\n  /** Password, MFA enrollment, passkeys, identity links (wraps the former `AppPage_SecuritySettings`). */\n  SECURITY = 'security',\n  /** Theme, dark-mode, density and other look-and-feel preferences. */\n  APPEARANCE = 'appearance',\n  /** The caller's own pending org invitations — accept/reject in-app (Approach P). */\n  INVITATIONS = 'invitations',\n  /**\n   * The billing home: subscription status, plan catalog + checkout, usage,\n   * invoices and the provider portal link — composed from the BillingContext\n   * aggregated state (`GET_STATE`), NOT from per-resource LIST surfaces.\n   *\n   * Bespoke on purpose: the billing child resources (subscriptions, invoice\n   * refs, usage records) are routed UNDER the billing account\n   * (`REQUIRES_CONTEXT`), so a generic org-scoped `RESOURCE_OPERATION` panel\n   * cannot build their URLs. The aggregated billing state is org-addressable\n   * and auto-creates the account, which makes it the correct settings-surface\n   * data source.\n   */\n  BILLING = 'billing',\n  /**\n   * Where a person CONNECTS one of their own third-party accounts.\n   *\n   * Bespoke because connecting is not a row somebody creates: it is a flow that leaves the\n   * application, obtains consent at a vendor, and returns with a grant nobody typed. The generic\n   * resource surface can list, inspect and delete the resulting credentials perfectly — it simply has\n   * no mechanism for an ACTION of that shape, which is why the whole outbound-authorization lane had\n   * no surface that could begin it until this existed.\n   *\n   * Paired with, never replacing, the credential list: this panel answers what MAY be connected and\n   * the list answers what IS, and the empty answer to the second is exactly when the first matters.\n   */\n  CONNECTED_ACCOUNTS = 'connected-accounts',\n  /**\n   * The same act at the TENANT's scope: connecting an account the whole organization acts as.\n   *\n   * A distinct ref rather than a parameterised one, because a settings destination resolves a ref to\n   * a panel and carries no arguments — and because the two must never be reachable from each other's\n   * screen. The component behind them IS shared: the act is identical, and duplicating it would\n   * guarantee the two drift. What is never shared is the data.\n   */\n  ORGANIZATION_CONNECTED_ACCOUNTS = 'organization-connected-accounts',\n  /**\n   * How often the organization's experts override its agents (#1599), per agent, tool, case or reviewer, over a\n   * window: the counts behind the rate, the decisions nobody took counted apart, and a group where nothing was decided\n   * shown as that rather than as 0 %.\n   *\n   * Bespoke because the rate is not a row: it is a summary the engine computes from the decision records on request\n   * (`POST /agent-work/override-rate`), and no resource surface can render a computed aggregate.\n   */\n  AGENT_WORK_OVERRIDE_RATE = 'agent-work-override-rate',\n}\n\n// ════════════════════════════════════════════════════════════════\n// Section Target — discriminated union on `kind`\n// ════════════════════════════════════════════════════════════════\n\n/** @wildo_source:part:start saas.frontend.settings-hub.placement */\n/** Renders a framework-owned bespoke panel. */\nexport interface SettingsEnginePanelTarget {\n  kind: SettingsSectionTargetKind.ENGINE_PANEL;\n  panelRef: SettingsPanelRef;\n}\n\n/**\n * Renders an auto-generated resource-operation surface inside the section panel.\n * Resolved against the resource registry exactly like a launcher\n * `RESOURCE_OPERATION` target.\n */\nexport interface SettingsResourceOperationTarget {\n  kind: SettingsSectionTargetKind.RESOURCE_OPERATION;\n  resourceType: string;\n  operation: string;\n  operationVariant?: string;\n}\n\n/** Renders an app-registered custom React component (resolved by `componentRef`). */\nexport interface SettingsCustomComponentTarget {\n  kind: SettingsSectionTargetKind.CUSTOM_COMPONENT;\n  componentRef: string;\n}\n\n/**\n * Leaf targets renderable directly in a panel. Sub-tabs may only point at leaf\n * targets — sub-tabs cannot nest further sub-tabs (one level of in-section\n * tabbing, matching the BetterStack reference).\n */\nexport type SettingsLeafTarget =\n  | SettingsEnginePanelTarget\n  | SettingsResourceOperationTarget\n  | SettingsCustomComponentTarget;\n\n/**\n * One horizontal sub-tab within a section (e.g. the \"Members\" / \"Roles &\n * Permissions\" tabs inside a Teams section).\n */\nexport interface SettingsSubTab {\n  /** Sub-tab reference — app-defined, used for i18n + the `value` of the inner Tabs. */\n  ref: string;\n  /** Display label (i18n ref). */\n  label: string;\n  /** Optional icon ref for the sub-tab trigger. */\n  icon?: string;\n  /** What this sub-tab renders. Sub-tabs hold leaf targets only. */\n  target: SettingsLeafTarget;\n}\n\n/** Splits a section into horizontal sub-tabs rendered above the panel content. */\nexport interface SettingsSubTabsTarget {\n  kind: SettingsSectionTargetKind.SUB_TABS;\n  subTabs: SettingsSubTab[];\n}\n\n/**\n * What a settings section renders. Discriminated on `kind`; the `SettingsHub`\n * resolver dispatches on it to produce the panel content.\n */\nexport type SettingsSectionTarget = SettingsLeafTarget | SettingsSubTabsTarget;\n/** @wildo_source:part:end saas.frontend.settings-hub.placement */\n\n// ════════════════════════════════════════════════════════════════\n// Category — the rail group\n// ════════════════════════════════════════════════════════════════\n\n/**\n * A category groups sections in the vertical rail (the `Account` / `Organization`\n * group headers in the BetterStack reference). Rendered as a label + separator\n * inside the `TabsList` — NOT a separate nav widget (the `Tabs` primitive stays\n * the section mechanism).\n *\n * `scope` ties the category to a primary-scope axis so the runtime can hide it\n * when the scope is unavailable — e.g. an `ORGANIZATIONS` category is hidden when\n * no organization is selected. It is derived against `AppScope`, not authored\n * per-user.\n */\nexport interface SettingsCategory {\n  /** Category reference — app-defined, referenced by `SettingsSection.categoryRef`. */\n  ref: string;\n  /** Group header label (i18n ref). */\n  label: string;\n  /**\n   * Primary scope this category belongs to. Drives rail grouping order and\n   * scope-gated visibility (org categories hide when no org is selected).\n   * Omit for a scope-agnostic category.\n   */\n  scope?: ResourcePrimaryScope;\n  /** Optional icon ref for the group header. */\n  icon?: string;\n  /** Sort order among categories in the rail (lower = higher). */\n  order?: number;\n}\n\n// ════════════════════════════════════════════════════════════════\n// Section — one vertical tab in the rail\n// ════════════════════════════════════════════════════════════════\n\n/** @wildo_source:part:start saas.frontend.settings-hub.placement facet:layer:frontend facet:family:config facet:audience:app-developer */\n/**\n * An addressable settings DESTINATION — what a settings surface *is*, with no\n * opinion on where it appears.\n *\n * The engine ships most of them (`ENGINE_SETTINGS_DESTINATIONS`); an application\n * may declare its own in `SettingsHubConfig.destinations` — a settings surface for\n * one of its OWN resources, or a component it registers. Either way a destination\n * carries the target and the gating stack, and deliberately carries **no\n * `categoryRef`, no `order` and no `label`**: those are placement, and placement is\n * the application's decision (`SettingsPlacement`).\n *\n * The split exists because the engine shipping a PLACED hub is what made the\n * settings rail unauthorable — an application could not add, remove, reorder or\n * rename a section without the framework agreeing. Splitting destination from\n * placement lets the engine keep owning what a destination MEANS (its target,\n * its roles, its entitlement) while the application owns where it sits.\n */\nexport interface SettingsDestination {\n  /** Destination reference — the `/settings/:sectionRef` URL segment and the id a placement names. */\n  ref: string;\n  /** What the destination renders in its content panel. */\n  target: SettingsSectionTarget;\n  /** Declarative runtime capability gating (same contract as launcher items). */\n  runtimeAvailability?: LauncherRuntimeAvailabilityConfig;\n  /** Feature flags required to surface this destination (plan/subscription gating). */\n  requiredFeatures?: RequiredFeaturesConfig;\n  /** RBAC roles required to surface this destination (OR semantics). */\n  requiredRoles?: string[];\n  /** Optional CoreFeature id this destination's content is ENTITLED by (soft gate — renders an upgrade prompt). */\n  entitlementFeatureId?: string;\n}\n\n/**\n * An application's explicit PLACEMENT of one destination in its settings rail.\n *\n * Authored in the application's own config. Nothing is placed implicitly: a\n * destination the application does not place does not render, which is the whole\n * point — \"we should just place things\", with no automatic inference.\n *\n * `label` is optional and is an OVERRIDE. The resolved label otherwise comes from\n * the `settings_hub.sections.<ref>.label` key, so a placed section is localizable\n * without the application authoring an English string.\n *\n * That namespace and its resolver (`tSettingsHubSection`) EXIST and already fall\n * back to the authored label. What does not exist is anything that generates the\n * units: `LabellingTypes.SETTINGS_HUB` is declared with an empty pattern and the\n * companion plans nothing for it, so today every rail label is the authored\n * English string. R9 is a wiring job, not a new mechanism.\n */\nexport interface SettingsPlacement {\n  /** The {@link SettingsDestination.ref} being placed — an engine destination or one of `destinations`. Refused at DEV startup when unknown. */\n  destinationRef: string;\n  /** Which category (rail group) this destination sits under. */\n  categoryRef: string;\n  /** Sort order within the category (lower = higher). */\n  order?: number;\n  /** Optional icon ref for the rail entry. */\n  icon?: string;\n  /** Rail label override. Omit to take `settings_hub.sections.<ref>.label`. */\n  label?: string;\n}\n/** @wildo_source:part:end saas.frontend.settings-hub.placement */\n\n/**\n * A settings section is one entry in the vertical rail (one `TabsTrigger`) —\n * the RESOLVED union of a {@link SettingsDestination} and the\n * {@link SettingsPlacement} that placed it.\n *\n * Produced by `resolveSettingsHubConfig()`; never authored directly. It\n * belongs to a category, addresses a target, and reuses the existing launcher\n * gating stack:\n * - `runtimeAvailability` — survives the app-shell filtering pass (capabilities).\n * - `requiredFeatures` — plan/subscription gating once resolved.\n * - `requiredRoles` — RBAC gating (e.g. org-admin-only sections).\n *\n * `ref` is the URL-addressable section id (`/settings/:sectionRef`).\n */\nexport interface SettingsSection {\n  /** Section reference — app-defined; the `/settings/:sectionRef` URL segment + Tabs `value`. */\n  ref: string;\n  /** Which category (rail group) this section sits under. */\n  categoryRef: string;\n  /** Rail label (i18n ref). */\n  label: string;\n  /** Optional icon ref for the rail entry. */\n  icon?: string;\n  /** Sort order within the category (lower = higher). */\n  order?: number;\n  /** What the section renders in its content panel. */\n  target: SettingsSectionTarget;\n  /** Declarative runtime capability gating (same contract as launcher items). */\n  runtimeAvailability?: LauncherRuntimeAvailabilityConfig;\n  /**\n   * Feature flags required to surface this section (plan/subscription gating).\n   *\n   * Uses the framework-canonical {@link RequiredFeaturesConfig} contract shared\n   * with views and resource operations — shorthand `string[]` (OR semantics) or\n   * the full `{ features, mode: 'OR' | 'AND' }` form. `limitChecks` are not\n   * evaluated for section visibility (a section is shown or hidden, never\n   * \"over-limit\"); use {@link requiredRoles} / capabilities for hard gating.\n   */\n  requiredFeatures?: RequiredFeaturesConfig;\n  /**\n   * RBAC roles required to surface this section (OR semantics — the user needs\n   * ANY one of these roles). Evaluated against the merged app-level + current-\n   * organization role set, the same effective surface the rest of the frontend\n   * gating layer resolves (see `buildFeaturePolicyRoles`). Org-management\n   * sections gate on `[CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN]`.\n   */\n  requiredRoles?: string[];\n  /**\n   * Optional CoreFeature id this section's content is ENTITLED by. Distinct from\n   * {@link requiredFeatures} (a HARD hide-gate): when set, the section still\n   * SURVIVES (per `runtimeAvailability`/roles) and its body is wrapped in a\n   * `FeatureGate` so an OFFERED-but-not-yet-entitled feature renders the\n   * policy-driven upgrade/add-on prompt (`unavailabilityPolicy`) instead of\n   * vanishing. Pair with a `runtimeAvailability.requiredCapabilities` gate whose\n   * capability is the plan-independent \"app offers X\" signal, so a feature the\n   * app does NOT offer at all is hidden outright while an offered one prompts.\n   */\n  entitlementFeatureId?: string;\n}\n\n// ════════════════════════════════════════════════════════════════\n// Hub Config — the registry root\n// ════════════════════════════════════════════════════════════════\n\n/** @wildo_source:part:start saas.frontend.settings-hub.placement */\n/**\n * The AUTHORED Settings Hub registry — an application's own settings rail.\n *\n * The framework ships destinations (`ENGINE_SETTINGS_DESTINATIONS`), never a\n * placed hub. This is the application's half: which categories exist, which\n * destinations are placed where, and any destinations the application owns.\n * `wildo init` scaffolds the full engine destination list as placements so a new\n * application starts complete and edits down.\n *\n * Resolve it with `resolveSettingsHubConfig()` to get the rendered\n * {@link SettingsSection} list; the render path never reads this shape directly.\n */\nexport interface SettingsHubConfig {\n  /** Rail groups, in render order (also orderable via `SettingsCategory.order`). */\n  categories: SettingsCategory[];\n  /**\n   * Every destination this application places, and where.\n   *\n   * A destination that appears in no placement does not render. That is\n   * deliberate: absence is how an application removes a settings section, and it\n   * must not be second-guessed by a merge against a framework default.\n   */\n  placements: SettingsPlacement[];\n  /**\n   * The application's OWN destinations — settings surfaces the engine does not\n   * ship, such as a list of the application's team members or a component it\n   * registers. Declared here, then placed like any other destination; a\n   * declared destination that no placement names does not render.\n   *\n   * The ref must not be an engine destination's ref. The engine keeps owning\n   * what its destinations mean, so on a clash the ENGINE destination is the one\n   * resolved, and the DEV startup verifier reports the clash.\n   */\n  destinations?: SettingsDestination[];\n  /**\n   * Section opened when the hub is launched without an explicit section\n   * (`/settings` with no `:sectionRef`). Falls back to the first section of the\n   * first category when omitted.\n   */\n  defaultSectionRef?: string;\n}\n\n/**\n * The RESOLVED hub — categories plus fully-resolved sections, ready to render.\n *\n * Distinct from {@link SettingsHubConfig} (what an application AUTHORS) because\n * conflating the two is what let a placed default ship from the engine. A\n * consumer that renders takes this; a consumer that configures takes the other.\n */\nexport interface ResolvedSettingsHubConfig {\n  categories: SettingsCategory[];\n  sections: SettingsSection[];\n  defaultSectionRef?: string;\n}\n/** @wildo_source:part:end saas.frontend.settings-hub.placement */\n"]}

package/dist/esm/core/config/useSettingsHubConfig.d.ts

@@ -1,4 +1,25 @@
-import type { ResolvedSettingsHubConfig, SettingsHubConfig } from './settings-hub.frontend.schemas';
+import type { ResolvedSettingsHubConfig, SettingsDestination, SettingsHubConfig } from './settings-hub.frontend.schemas';
+/**
+ * Every destination an application can place: the engine's, then its own.
+ *
+ * One function, because four readers must agree on it — resolution, the unknown-ref
+ * check, the DEV verifier, and the companion's shell introspection, which reports an
+ * application destination by what it renders. A second copy of the join in any of
+ * them would let a destination render that another reader calls unknown.
+ */
+export interface SettingsDestinationCatalog {
+    readonly byRef: ReadonlyMap<string, SettingsDestination>;
+    /** The refs that resolved to one of the APPLICATION's destinations. */
+    readonly applicationDestinationRefs: ReadonlySet<string>;
+    /**
+     * Application destinations whose ref is an engine destination's. The engine one is
+     * resolved: an application cannot redefine what an engine destination means.
+     */
+    readonly refsShadowingEngineDestinations: readonly string[];
+    /** Application destination refs declared more than once; the first declaration is resolved. */
+    readonly duplicateApplicationDestinationRefs: readonly string[];
+}
+export declare function resolveSettingsDestinationCatalog(authored: SettingsHubConfig | undefined): SettingsDestinationCatalog;
 /**
  * Pure (React-free) resolution — the single source of truth shared by
  * {@link useSettingsHubConfig} (render path) and the DEV-startup
@@ -16,8 +37,8 @@ import type { ResolvedSettingsHubConfig, SettingsHubConfig } from './settings-hu
  */
 export declare function resolveSettingsHubConfig(authored: SettingsHubConfig | undefined): ResolvedSettingsHubConfig;
 /**
- * Every destination ref an authored config places that the catalog does not
- * ship. Reported by `verifySettingsHubContent`; see the note on
+ * Every destination ref an authored config places that neither the engine nor the
+ * application declares. Reported by `verifySettingsHubContent`; see the note on
  * {@link resolveSettingsHubConfig} for why resolution drops rather than throws.
  */
 export declare function findUnknownDestinationRefs(authored: SettingsHubConfig | undefined): string[];

package/dist/esm/core/config/useSettingsHubConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSettingsHubConfig.d.ts","sourceRoot":"","sources":["../../../../src/core/config/useSettingsHubConfig.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACV,yBAAyB,EAEzB,iBAAiB,EAElB,MAAM,iCAAiC,CAAC;AAQzC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GAAG,yBAAyB,CA0C3G;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GAAG,MAAM,EAAE,CAO5F;AAED,wBAAgB,oBAAoB,IAAI,yBAAyB,CAShE"}
+{"version":3,"file":"useSettingsHubConfig.d.ts","sourceRoot":"","sources":["../../../../../src/core/config/useSettingsHubConfig.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EACV,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,EAElB,MAAM,iCAAiC,CAAC;AAQzC;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACzD,uEAAuE;IACvE,QAAQ,CAAC,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzD;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5D,+FAA+F;IAC/F,QAAQ,CAAC,mCAAmC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjE;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GAAG,0BAA0B,CAkBrH;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GAAG,yBAAyB,CA2C3G;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GAAG,MAAM,EAAE,CAQ5F;AAED,wBAAgB,oBAAoB,IAAI,yBAAyB,CAShE"}

package/dist/esm/core/config/useSettingsHubConfig.js

@@ -2,9 +2,9 @@
  * Resolves an application's authored Settings Hub config into the rendered shape.
  *
  * Resolution is the join between the two halves of the placement split: the
- * engine's destination catalog (`ENGINE_SETTINGS_DESTINATIONS` — what a settings
- * surface IS) and the application's placements (where each one sits). Neither
- * half renders alone.
+ * destination catalog (what a settings surface IS — the engine's
+ * `ENGINE_SETTINGS_DESTINATIONS` plus the application's own `destinations`) and
+ * the application's placements (where each one sits). Neither half renders alone.
  *
  * There is deliberately **no framework default and no merge**. An earlier
  * revision returned `DEFAULT_SETTINGS_HUB_CONFIG`, a fully placed hub the engine
@@ -17,8 +17,27 @@
 import { useMemo } from 'react';
 import { ENGINE_SETTINGS_DESTINATIONS } from './engine-settings-destinations.js';
 import { useUI } from '../../core/ui/useUI.js';
-/** Catalog lookup by ref, built once — resolution runs on every hub render. */
-const DESTINATIONS_BY_REF = new Map(ENGINE_SETTINGS_DESTINATIONS.map(destination => [destination.ref, destination]));
+/** Engine catalog lookup by ref, built once — resolution runs on every hub render. */
+const ENGINE_DESTINATIONS_BY_REF = new Map(ENGINE_SETTINGS_DESTINATIONS.map(destination => [destination.ref, destination]));
+export function resolveSettingsDestinationCatalog(authored) {
+    const byRef = new Map(ENGINE_DESTINATIONS_BY_REF);
+    const applicationDestinationRefs = new Set();
+    const refsShadowingEngineDestinations = [];
+    const duplicateApplicationDestinationRefs = [];
+    for (const destination of authored?.destinations ?? []) {
+        if (ENGINE_DESTINATIONS_BY_REF.has(destination.ref)) {
+            refsShadowingEngineDestinations.push(destination.ref);
+            continue;
+        }
+        if (applicationDestinationRefs.has(destination.ref)) {
+            duplicateApplicationDestinationRefs.push(destination.ref);
+            continue;
+        }
+        byRef.set(destination.ref, destination);
+        applicationDestinationRefs.add(destination.ref);
+    }
+    return { byRef, applicationDestinationRefs, refsShadowingEngineDestinations, duplicateApplicationDestinationRefs };
+}
 /**
  * Pure (React-free) resolution — the single source of truth shared by
  * {@link useSettingsHubConfig} (render path) and the DEV-startup
@@ -38,9 +57,10 @@ export function resolveSettingsHubConfig(authored) {
     if (authored === undefined) {
         return { categories: [], sections: [] };
     }
+    const catalog = resolveSettingsDestinationCatalog(authored);
     const sections = [];
     for (const placement of authored.placements) {
-        const destination = DESTINATIONS_BY_REF.get(placement.destinationRef);
+        const destination = catalog.byRef.get(placement.destinationRef);
         if (destination === undefined) {
             continue;
         }
@@ -76,17 +96,18 @@ export function resolveSettingsHubConfig(authored) {
     };
 }
 /**
- * Every destination ref an authored config places that the catalog does not
- * ship. Reported by `verifySettingsHubContent`; see the note on
+ * Every destination ref an authored config places that neither the engine nor the
+ * application declares. Reported by `verifySettingsHubContent`; see the note on
  * {@link resolveSettingsHubConfig} for why resolution drops rather than throws.
  */
 export function findUnknownDestinationRefs(authored) {
     if (authored === undefined) {
         return [];
     }
+    const catalog = resolveSettingsDestinationCatalog(authored);
     return authored.placements
         .map(placement => placement.destinationRef)
-        .filter(ref => !DESTINATIONS_BY_REF.has(ref));
+        .filter(ref => !catalog.byRef.has(ref));
 }
 export function useSettingsHubConfig() {
     const { settingsHub } = useUI();

package/dist/esm/core/config/useSettingsHubConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"useSettingsHubConfig.js","sourceRoot":"","sources":["../../../../src/core/config/useSettingsHubConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAO9E,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAE1D,+EAA+E;AAC/E,MAAM,mBAAmB,GAA6C,IAAI,GAAG,CAC3E,4BAA4B,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAChF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAuC;IAC9E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,4EAA4E;YAC5E,gEAAgE;YAChE,EAAE;YACF,iEAAiE;YACjE,sEAAsE;YACtE,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,mEAAmE;YACnE,oEAAoE;YACpE,iEAAiE;YACjE,iBAAiB;YACjB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,WAAW,CAAC,GAAG;YACzC,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;YACpD,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;SACvD,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ;QACR,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;KAC9C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAuC;IAChF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,QAAQ,CAAC,UAAU;SACvB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC;SAC1C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,CAAC;IAChC,yEAAyE;IACzE,2EAA2E;IAC3E,mEAAmE;IACnE,yEAAyE;IACzE,wEAAwE;IACxE,2DAA2D;IAC3D,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["/**\n * Resolves an application's authored Settings Hub config into the rendered shape.\n *\n * Resolution is the join between the two halves of the placement split: the\n * engine's destination catalog (`ENGINE_SETTINGS_DESTINATIONS` — what a settings\n * surface IS) and the application's placements (where each one sits). Neither\n * half renders alone.\n *\n * There is deliberately **no framework default and no merge**. An earlier\n * revision returned `DEFAULT_SETTINGS_HUB_CONFIG`, a fully placed hub the engine\n * owned, and that is precisely why an application could not remove or reorder a\n * settings section: the render path read the framework's arrangement, so an\n * application's absence of an arrangement was indistinguishable from agreement\n * with it. Here, an unplaced destination does not render — absence is how a\n * section is removed, and nothing reasserts it.\n */\nimport { useMemo } from 'react';\nimport { ENGINE_SETTINGS_DESTINATIONS } from './engine-settings-destinations';\nimport type {\n  ResolvedSettingsHubConfig,\n  SettingsDestination,\n  SettingsHubConfig,\n  SettingsSection,\n} from './settings-hub.frontend.schemas';\nimport { useUI } from '~wildo-frontend-lib/core/ui/useUI';\n\n/** Catalog lookup by ref, built once — resolution runs on every hub render. */\nconst DESTINATIONS_BY_REF: ReadonlyMap<string, SettingsDestination> = new Map(\n  ENGINE_SETTINGS_DESTINATIONS.map(destination => [destination.ref, destination]),\n);\n\n/**\n * Pure (React-free) resolution — the single source of truth shared by\n * {@link useSettingsHubConfig} (render path) and the DEV-startup\n * `verifySettingsHubContent` pass.\n *\n * Keeping resolution here, not inlined in the hook, is what lets the verifier\n * check the EXACT config the hub renders. Do not inline it into either caller:\n * the moment the two derive their config separately, the verifier starts\n * attesting to something nobody renders.\n *\n * A placement naming a ref absent from the catalog is DROPPED here and reported\n * by the verifier rather than throwing. Resolution runs on the render path, and\n * a hard throw there would take down the whole hub over one bad ref; the DEV\n * startup pass is where an author is present to read the diagnostic.\n */\nexport function resolveSettingsHubConfig(authored: SettingsHubConfig | undefined): ResolvedSettingsHubConfig {\n  if (authored === undefined) {\n    return { categories: [], sections: [] };\n  }\n\n  const sections: SettingsSection[] = [];\n  for (const placement of authored.placements) {\n    const destination = DESTINATIONS_BY_REF.get(placement.destinationRef);\n    if (destination === undefined) {\n      continue;\n    }\n    sections.push({\n      ref: destination.ref,\n      categoryRef: placement.categoryRef,\n      // The authored label, falling back to the ref so an unlabelled placement is\n      // visibly wrong in the rail rather than rendering an empty tab.\n      //\n      // It is NOT superseded by label generation, and deleting it is a\n      // regression rather than a tidy-up. `tSettingsHubSection(ref, label)`\n      // takes this as the fallback when no key exists — and, more importantly,\n      // the companion feeds this exact string to the labellize prompt as the\n      // key's `purpose`. Generating without it made the model invent from the\n      // ref: \"User provisioning\" became \"SCIM\", \"Audit streaming\" became\n      // \"SIEM\", and a generated key WINS over the fallback, so the rail's\n      // wording changed. The authored string is the intent; generation\n      // translates it.\n      label: placement.label ?? destination.ref,\n      icon: placement.icon,\n      order: placement.order,\n      target: destination.target,\n      runtimeAvailability: destination.runtimeAvailability,\n      requiredFeatures: destination.requiredFeatures,\n      requiredRoles: destination.requiredRoles,\n      entitlementFeatureId: destination.entitlementFeatureId,\n    });\n  }\n\n  return {\n    categories: authored.categories,\n    sections,\n    defaultSectionRef: authored.defaultSectionRef,\n  };\n}\n\n/**\n * Every destination ref an authored config places that the catalog does not\n * ship. Reported by `verifySettingsHubContent`; see the note on\n * {@link resolveSettingsHubConfig} for why resolution drops rather than throws.\n */\nexport function findUnknownDestinationRefs(authored: SettingsHubConfig | undefined): string[] {\n  if (authored === undefined) {\n    return [];\n  }\n  return authored.placements\n    .map(placement => placement.destinationRef)\n    .filter(ref => !DESTINATIONS_BY_REF.has(ref));\n}\n\nexport function useSettingsHubConfig(): ResolvedSettingsHubConfig {\n  const { settingsHub } = useUI();\n  // Memoised on the authored config, NOT recomputed per render. Resolution\n  // builds a fresh object graph every call, so an unmemoised return made the\n  // hub's config a new identity on every render — and the hub keys a\n  // `useEffect` on that identity to follow URL-driven section changes. The\n  // effect therefore fired after every render and re-asserted the default\n  // section, which silently undid the user's own rail click.\n  return useMemo(() => resolveSettingsHubConfig(settingsHub), [settingsHub]);\n}\n"]}
+{"version":3,"file":"useSettingsHubConfig.js","sourceRoot":"","sources":["../../../../../src/core/config/useSettingsHubConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAO9E,OAAO,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAE1D,sFAAsF;AACtF,MAAM,0BAA0B,GAA6C,IAAI,GAAG,CAClF,4BAA4B,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAChF,CAAC;AAuBF,MAAM,UAAU,iCAAiC,CAAC,QAAuC;IACvF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAClD,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;IACrD,MAAM,+BAA+B,GAAa,EAAE,CAAC;IACrD,MAAM,mCAAmC,GAAa,EAAE,CAAC;IACzD,KAAK,MAAM,WAAW,IAAI,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACvD,IAAI,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,IAAI,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,mCAAmC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC1D,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACxC,0BAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,mCAAmC,EAAE,CAAC;AACrH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAuC;IAC9E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,OAAO,GAAG,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAChE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,4EAA4E;YAC5E,gEAAgE;YAChE,EAAE;YACF,iEAAiE;YACjE,sEAAsE;YACtE,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,mEAAmE;YACnE,oEAAoE;YACpE,iEAAiE;YACjE,iBAAiB;YACjB,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,WAAW,CAAC,GAAG;YACzC,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,mBAAmB,EAAE,WAAW,CAAC,mBAAmB;YACpD,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;YAC9C,aAAa,EAAE,WAAW,CAAC,aAAa;YACxC,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;SACvD,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ;QACR,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;KAC9C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAuC;IAChF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAC5D,OAAO,QAAQ,CAAC,UAAU;SACvB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC;SAC1C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,EAAE,CAAC;IAChC,yEAAyE;IACzE,2EAA2E;IAC3E,mEAAmE;IACnE,yEAAyE;IACzE,wEAAwE;IACxE,2DAA2D;IAC3D,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;AAC7E,CAAC","sourcesContent":["/**\n * Resolves an application's authored Settings Hub config into the rendered shape.\n *\n * Resolution is the join between the two halves of the placement split: the\n * destination catalog (what a settings surface IS — the engine's\n * `ENGINE_SETTINGS_DESTINATIONS` plus the application's own `destinations`) and\n * the application's placements (where each one sits). Neither half renders alone.\n *\n * There is deliberately **no framework default and no merge**. An earlier\n * revision returned `DEFAULT_SETTINGS_HUB_CONFIG`, a fully placed hub the engine\n * owned, and that is precisely why an application could not remove or reorder a\n * settings section: the render path read the framework's arrangement, so an\n * application's absence of an arrangement was indistinguishable from agreement\n * with it. Here, an unplaced destination does not render — absence is how a\n * section is removed, and nothing reasserts it.\n */\nimport { useMemo } from 'react';\nimport { ENGINE_SETTINGS_DESTINATIONS } from './engine-settings-destinations';\nimport type {\n  ResolvedSettingsHubConfig,\n  SettingsDestination,\n  SettingsHubConfig,\n  SettingsSection,\n} from './settings-hub.frontend.schemas';\nimport { useUI } from '~wildo-frontend-lib/core/ui/useUI';\n\n/** Engine catalog lookup by ref, built once — resolution runs on every hub render. */\nconst ENGINE_DESTINATIONS_BY_REF: ReadonlyMap<string, SettingsDestination> = new Map(\n  ENGINE_SETTINGS_DESTINATIONS.map(destination => [destination.ref, destination]),\n);\n\n/**\n * Every destination an application can place: the engine's, then its own.\n *\n * One function, because four readers must agree on it — resolution, the unknown-ref\n * check, the DEV verifier, and the companion's shell introspection, which reports an\n * application destination by what it renders. A second copy of the join in any of\n * them would let a destination render that another reader calls unknown.\n */\nexport interface SettingsDestinationCatalog {\n  readonly byRef: ReadonlyMap<string, SettingsDestination>;\n  /** The refs that resolved to one of the APPLICATION's destinations. */\n  readonly applicationDestinationRefs: ReadonlySet<string>;\n  /**\n   * Application destinations whose ref is an engine destination's. The engine one is\n   * resolved: an application cannot redefine what an engine destination means.\n   */\n  readonly refsShadowingEngineDestinations: readonly string[];\n  /** Application destination refs declared more than once; the first declaration is resolved. */\n  readonly duplicateApplicationDestinationRefs: readonly string[];\n}\n\nexport function resolveSettingsDestinationCatalog(authored: SettingsHubConfig | undefined): SettingsDestinationCatalog {\n  const byRef = new Map(ENGINE_DESTINATIONS_BY_REF);\n  const applicationDestinationRefs = new Set<string>();\n  const refsShadowingEngineDestinations: string[] = [];\n  const duplicateApplicationDestinationRefs: string[] = [];\n  for (const destination of authored?.destinations ?? []) {\n    if (ENGINE_DESTINATIONS_BY_REF.has(destination.ref)) {\n      refsShadowingEngineDestinations.push(destination.ref);\n      continue;\n    }\n    if (applicationDestinationRefs.has(destination.ref)) {\n      duplicateApplicationDestinationRefs.push(destination.ref);\n      continue;\n    }\n    byRef.set(destination.ref, destination);\n    applicationDestinationRefs.add(destination.ref);\n  }\n  return { byRef, applicationDestinationRefs, refsShadowingEngineDestinations, duplicateApplicationDestinationRefs };\n}\n\n/**\n * Pure (React-free) resolution — the single source of truth shared by\n * {@link useSettingsHubConfig} (render path) and the DEV-startup\n * `verifySettingsHubContent` pass.\n *\n * Keeping resolution here, not inlined in the hook, is what lets the verifier\n * check the EXACT config the hub renders. Do not inline it into either caller:\n * the moment the two derive their config separately, the verifier starts\n * attesting to something nobody renders.\n *\n * A placement naming a ref absent from the catalog is DROPPED here and reported\n * by the verifier rather than throwing. Resolution runs on the render path, and\n * a hard throw there would take down the whole hub over one bad ref; the DEV\n * startup pass is where an author is present to read the diagnostic.\n */\nexport function resolveSettingsHubConfig(authored: SettingsHubConfig | undefined): ResolvedSettingsHubConfig {\n  if (authored === undefined) {\n    return { categories: [], sections: [] };\n  }\n\n  const catalog = resolveSettingsDestinationCatalog(authored);\n  const sections: SettingsSection[] = [];\n  for (const placement of authored.placements) {\n    const destination = catalog.byRef.get(placement.destinationRef);\n    if (destination === undefined) {\n      continue;\n    }\n    sections.push({\n      ref: destination.ref,\n      categoryRef: placement.categoryRef,\n      // The authored label, falling back to the ref so an unlabelled placement is\n      // visibly wrong in the rail rather than rendering an empty tab.\n      //\n      // It is NOT superseded by label generation, and deleting it is a\n      // regression rather than a tidy-up. `tSettingsHubSection(ref, label)`\n      // takes this as the fallback when no key exists — and, more importantly,\n      // the companion feeds this exact string to the labellize prompt as the\n      // key's `purpose`. Generating without it made the model invent from the\n      // ref: \"User provisioning\" became \"SCIM\", \"Audit streaming\" became\n      // \"SIEM\", and a generated key WINS over the fallback, so the rail's\n      // wording changed. The authored string is the intent; generation\n      // translates it.\n      label: placement.label ?? destination.ref,\n      icon: placement.icon,\n      order: placement.order,\n      target: destination.target,\n      runtimeAvailability: destination.runtimeAvailability,\n      requiredFeatures: destination.requiredFeatures,\n      requiredRoles: destination.requiredRoles,\n      entitlementFeatureId: destination.entitlementFeatureId,\n    });\n  }\n\n  return {\n    categories: authored.categories,\n    sections,\n    defaultSectionRef: authored.defaultSectionRef,\n  };\n}\n\n/**\n * Every destination ref an authored config places that neither the engine nor the\n * application declares. Reported by `verifySettingsHubContent`; see the note on\n * {@link resolveSettingsHubConfig} for why resolution drops rather than throws.\n */\nexport function findUnknownDestinationRefs(authored: SettingsHubConfig | undefined): string[] {\n  if (authored === undefined) {\n    return [];\n  }\n  const catalog = resolveSettingsDestinationCatalog(authored);\n  return authored.placements\n    .map(placement => placement.destinationRef)\n    .filter(ref => !catalog.byRef.has(ref));\n}\n\nexport function useSettingsHubConfig(): ResolvedSettingsHubConfig {\n  const { settingsHub } = useUI();\n  // Memoised on the authored config, NOT recomputed per render. Resolution\n  // builds a fresh object graph every call, so an unmemoised return made the\n  // hub's config a new identity on every render — and the hub keys a\n  // `useEffect` on that identity to follow URL-driven section changes. The\n  // effect therefore fired after every render and re-asserted the default\n  // section, which silently undid the user's own rail click.\n  return useMemo(() => resolveSettingsHubConfig(settingsHub), [settingsHub]);\n}\n"]}

package/dist/esm/core/config/useVisibleSettingsHubConfig.d.ts

@@ -17,10 +17,37 @@
  * Signals are sourced from the SAME hooks the rest of the frontend gating layer
  * uses, so a settings section appears under exactly the same conditions as the
  * equivalent sidebar/command-menu entry:
- * - scope → `useAppScopeSafe`
+ * - scope → `useAppScopeSafe`, EXCEPT the application id — see below
  * - effective roles → `buildFeaturePolicyRoles(permissions, currentOrganizationId)`
  * - features → `useFeatures().resolvedFeatures`
  * - capabilities → `useLauncherRuntimeAvailabilityContext`
+ *
+ * ## The application id does NOT come from the scope, and a category scoped to
+ * `APPLICATION` was unreachable until it stopped trying to
+ *
+ * `AppScopeContext` derives `currentApplicationId` by decoding the access token, and the access
+ * token's claims carry `userId` and **no** `applicationId` — measured on the running stack in
+ * issue #283 and recorded at `ResourceReadCacheBridge.tsx`. So `appScope.currentApplicationId` is
+ * null everywhere, always.
+ *
+ * That is invisible for every other gate and fatal for this one. `filterSettingsHubConfig` drops a
+ * category whose scope has no value, so an application that authored an `APPLICATION`-scoped
+ * category got a rail that silently omitted it — the exact failure mode the hub's own resolution
+ * comment warns about, where "quietly failed to appear" and "deliberately removed" are
+ * indistinguishable. Nothing threw, no DEV pass reported it, and the category's sections were
+ * well-formed the whole time.
+ *
+ * The id is published on `appIdentity`, which is the one surface that actually has it. Read here
+ * through `useContext` rather than `useApplication()` on purpose: that hook THROWS outside its
+ * provider, and this hook is mounted by the settings hub, which must not crash a tree that happens
+ * to render it a level too high. The scope value is kept as a FALLBACK rather than deleted, so the
+ * day the claim is added to the token this hook keeps working without a second edit.
+ *
+ * **The same correction is owed at ~17 other `currentApplicationId` readers** (navigation, views,
+ * charts, analytics, the command menu) and is deliberately NOT swept here: those feed scope
+ * parameters into queries and URLs that have been null since the field existed, so changing them
+ * is a behavioural change needing its own measurement. This hook is fixed because a null here does
+ * not degrade a surface, it deletes one.
  */
 import type { ResolvedSettingsHubConfig } from './settings-hub.frontend.schemas';
 export declare function useVisibleSettingsHubConfig(): ResolvedSettingsHubConfig;

package/dist/esm/core/config/useVisibleSettingsHubConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useVisibleSettingsHubConfig.d.ts","sourceRoot":"","sources":["../../../../src/core/config/useVisibleSettingsHubConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,wBAAgB,2BAA2B,IAAI,yBAAyB,CAoCvE"}
+{"version":3,"file":"useVisibleSettingsHubConfig.d.ts","sourceRoot":"","sources":["../../../../../src/core/config/useVisibleSettingsHubConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAWH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAEjF,wBAAgB,2BAA2B,IAAI,yBAAyB,CAwCvE"}

package/dist/esm/core/config/useVisibleSettingsHubConfig.js

@@ -17,13 +17,41 @@
  * Signals are sourced from the SAME hooks the rest of the frontend gating layer
  * uses, so a settings section appears under exactly the same conditions as the
  * equivalent sidebar/command-menu entry:
- * - scope → `useAppScopeSafe`
+ * - scope → `useAppScopeSafe`, EXCEPT the application id — see below
  * - effective roles → `buildFeaturePolicyRoles(permissions, currentOrganizationId)`
  * - features → `useFeatures().resolvedFeatures`
  * - capabilities → `useLauncherRuntimeAvailabilityContext`
+ *
+ * ## The application id does NOT come from the scope, and a category scoped to
+ * `APPLICATION` was unreachable until it stopped trying to
+ *
+ * `AppScopeContext` derives `currentApplicationId` by decoding the access token, and the access
+ * token's claims carry `userId` and **no** `applicationId` — measured on the running stack in
+ * issue #283 and recorded at `ResourceReadCacheBridge.tsx`. So `appScope.currentApplicationId` is
+ * null everywhere, always.
+ *
+ * That is invisible for every other gate and fatal for this one. `filterSettingsHubConfig` drops a
+ * category whose scope has no value, so an application that authored an `APPLICATION`-scoped
+ * category got a rail that silently omitted it — the exact failure mode the hub's own resolution
+ * comment warns about, where "quietly failed to appear" and "deliberately removed" are
+ * indistinguishable. Nothing threw, no DEV pass reported it, and the category's sections were
+ * well-formed the whole time.
+ *
+ * The id is published on `appIdentity`, which is the one surface that actually has it. Read here
+ * through `useContext` rather than `useApplication()` on purpose: that hook THROWS outside its
+ * provider, and this hook is mounted by the settings hub, which must not crash a tree that happens
+ * to render it a level too high. The scope value is kept as a FALLBACK rather than deleted, so the
+ * day the claim is added to the token this hook keeps working without a second edit.
+ *
+ * **The same correction is owed at ~17 other `currentApplicationId` readers** (navigation, views,
+ * charts, analytics, the command menu) and is deliberately NOT swept here: those feed scope
+ * parameters into queries and URLs that have been null since the field existed, so changing them
+ * is a behavioural change needing its own measurement. This hook is fixed because a null here does
+ * not degrade a surface, it deletes one.
  */
-import { useMemo } from 'react';
+import { useContext, useMemo } from 'react';
 import { useAppScopeSafe } from '../../core/scope/useAppScope.js';
+import { ApplicationContext } from '../../core/runtime/ApplicationContext.shared.js';
 import { useUserOrgs } from '../../core/security/useUserOrgs.js';
 import { useFeatures } from '../../core/features/useFeatures.js';
 import { useLauncherRuntimeAvailabilityContext } from '../../core/navigation/launcher-runtime-availability.js';
@@ -36,12 +64,16 @@ export function useVisibleSettingsHubConfig() {
     const { permissions } = useUserOrgs();
     const { resolvedFeatures } = useFeatures();
     const runtimeContext = useLauncherRuntimeAvailabilityContext();
+    const applicationContext = useContext(ApplicationContext);
+    const currentApplicationId = applicationContext?.appIdentity?.applicationId
+        ?? appScope?.currentApplicationId
+        ?? null;
     const userRoles = useMemo(() => buildFeaturePolicyRoles(permissions, appScope?.currentOrganizationId), [permissions, appScope?.currentOrganizationId]);
     return useMemo(() => filterSettingsHubConfig(rawConfig, {
         scopeIds: {
             currentUserId: appScope?.currentUserId,
             currentOrganizationId: appScope?.currentOrganizationId,
-            currentApplicationId: appScope?.currentApplicationId,
+            currentApplicationId,
             currentAnonymousUserId: appScope?.currentAnonymousUserId,
         },
         userRoles,
@@ -51,7 +83,7 @@ export function useVisibleSettingsHubConfig() {
         rawConfig,
         appScope?.currentUserId,
         appScope?.currentOrganizationId,
-        appScope?.currentApplicationId,
+        currentApplicationId,
         appScope?.currentAnonymousUserId,
         userRoles,
         resolvedFeatures?.features,

package/dist/esm/core/config/useVisibleSettingsHubConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"useVisibleSettingsHubConfig.js","sourceRoot":"","sources":["../../../../src/core/config/useVisibleSettingsHubConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qCAAqC,EAAE,MAAM,mEAAmE,CAAC;AAC1H,OAAO,EAAE,uBAAuB,EAAE,MAAM,yEAAyE,CAAC;AAClH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAG/E,MAAM,UAAU,2BAA2B;IACzC,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAAC;IACtC,MAAM,EAAE,gBAAgB,EAAE,GAAG,WAAW,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG,qCAAqC,EAAE,CAAC;IAE/D,MAAM,SAAS,GAAG,OAAO,CACvB,GAAG,EAAE,CAAC,uBAAuB,CAAC,WAAW,EAAE,QAAQ,EAAE,qBAAqB,CAAC,EAC3E,CAAC,WAAW,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAC/C,CAAC;IAEF,OAAO,OAAO,CACZ,GAAG,EAAE,CACH,uBAAuB,CAAC,SAAS,EAAE;QACjC,QAAQ,EAAE;YACR,aAAa,EAAE,QAAQ,EAAE,aAAa;YACtC,qBAAqB,EAAE,QAAQ,EAAE,qBAAqB;YACtD,oBAAoB,EAAE,QAAQ,EAAE,oBAAoB;YACpD,sBAAsB,EAAE,QAAQ,EAAE,sBAAsB;SACzD;QACD,SAAS;QACT,eAAe,EAAE,gBAAgB,EAAE,QAAQ,IAAI,EAAE;QACjD,cAAc;KACf,CAAC,EACJ;QACE,SAAS;QACT,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,qBAAqB;QAC/B,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,sBAAsB;QAChC,SAAS;QACT,gBAAgB,EAAE,QAAQ;QAC1B,cAAc;KACf,CACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Resolves the Settings Hub config gated to what the current user may see.\n *\n * Layered on {@link useSettingsHubConfig} (which resolves the application's\n * authored placements against the engine destination catalog): this hook\n * collects the live gating signals — primary scope, effective roles, resolved\n * features, runtime capabilities — and runs the pure\n * {@link filterSettingsHubConfig}. The hub component consumes the already-gated\n * config, so it never has to know about scope/role/feature evaluation.\n *\n * Note the two stages answer different questions and must stay separate. This\n * one asks \"may THIS USER see the section\" and its answer changes as the user's\n * scope and roles change. Resolution asks \"did the APPLICATION place it at all\",\n * and a `no` there is authorship, not gating — it must never be recoverable by a\n * user gaining a role.\n *\n * Signals are sourced from the SAME hooks the rest of the frontend gating layer\n * uses, so a settings section appears under exactly the same conditions as the\n * equivalent sidebar/command-menu entry:\n * - scope → `useAppScopeSafe`\n * - effective roles → `buildFeaturePolicyRoles(permissions, currentOrganizationId)`\n * - features → `useFeatures().resolvedFeatures`\n * - capabilities → `useLauncherRuntimeAvailabilityContext`\n */\n\nimport { useMemo } from 'react';\nimport { useAppScopeSafe } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useFeatures } from '~wildo-frontend-lib/core/features/useFeatures';\nimport { useLauncherRuntimeAvailabilityContext } from '~wildo-frontend-lib/core/navigation/launcher-runtime-availability';\nimport { buildFeaturePolicyRoles } from '~wildo-frontend-lib/core/features/feature-unavailability.frontend.utils';\nimport { useSettingsHubConfig } from './useSettingsHubConfig';\nimport { filterSettingsHubConfig } from './settings-hub-gating.frontend.utils';\nimport type { ResolvedSettingsHubConfig } from './settings-hub.frontend.schemas';\n\nexport function useVisibleSettingsHubConfig(): ResolvedSettingsHubConfig {\n  const rawConfig = useSettingsHubConfig();\n  const appScope = useAppScopeSafe();\n  const { permissions } = useUserOrgs();\n  const { resolvedFeatures } = useFeatures();\n  const runtimeContext = useLauncherRuntimeAvailabilityContext();\n\n  const userRoles = useMemo(\n    () => buildFeaturePolicyRoles(permissions, appScope?.currentOrganizationId),\n    [permissions, appScope?.currentOrganizationId],\n  );\n\n  return useMemo(\n    () =>\n      filterSettingsHubConfig(rawConfig, {\n        scopeIds: {\n          currentUserId: appScope?.currentUserId,\n          currentOrganizationId: appScope?.currentOrganizationId,\n          currentApplicationId: appScope?.currentApplicationId,\n          currentAnonymousUserId: appScope?.currentAnonymousUserId,\n        },\n        userRoles,\n        enabledFeatures: resolvedFeatures?.features ?? [],\n        runtimeContext,\n      }),\n    [\n      rawConfig,\n      appScope?.currentUserId,\n      appScope?.currentOrganizationId,\n      appScope?.currentApplicationId,\n      appScope?.currentAnonymousUserId,\n      userRoles,\n      resolvedFeatures?.features,\n      runtimeContext,\n    ],\n  );\n}\n"]}
+{"version":3,"file":"useVisibleSettingsHubConfig.js","sourceRoot":"","sources":["../../../../../src/core/config/useVisibleSettingsHubConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4DAA4D,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AAC5E,OAAO,EAAE,qCAAqC,EAAE,MAAM,mEAAmE,CAAC;AAC1H,OAAO,EAAE,uBAAuB,EAAE,MAAM,yEAAyE,CAAC;AAClH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAG/E,MAAM,UAAU,2BAA2B;IACzC,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAAC;IACtC,MAAM,EAAE,gBAAgB,EAAE,GAAG,WAAW,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG,qCAAqC,EAAE,CAAC;IAC/D,MAAM,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC1D,MAAM,oBAAoB,GAAG,kBAAkB,EAAE,WAAW,EAAE,aAAa;WACtE,QAAQ,EAAE,oBAAoB;WAC9B,IAAI,CAAC;IAEV,MAAM,SAAS,GAAG,OAAO,CACvB,GAAG,EAAE,CAAC,uBAAuB,CAAC,WAAW,EAAE,QAAQ,EAAE,qBAAqB,CAAC,EAC3E,CAAC,WAAW,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAC/C,CAAC;IAEF,OAAO,OAAO,CACZ,GAAG,EAAE,CACH,uBAAuB,CAAC,SAAS,EAAE;QACjC,QAAQ,EAAE;YACR,aAAa,EAAE,QAAQ,EAAE,aAAa;YACtC,qBAAqB,EAAE,QAAQ,EAAE,qBAAqB;YACtD,oBAAoB;YACpB,sBAAsB,EAAE,QAAQ,EAAE,sBAAsB;SACzD;QACD,SAAS;QACT,eAAe,EAAE,gBAAgB,EAAE,QAAQ,IAAI,EAAE;QACjD,cAAc;KACf,CAAC,EACJ;QACE,SAAS;QACT,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,qBAAqB;QAC/B,oBAAoB;QACpB,QAAQ,EAAE,sBAAsB;QAChC,SAAS;QACT,gBAAgB,EAAE,QAAQ;QAC1B,cAAc;KACf,CACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Resolves the Settings Hub config gated to what the current user may see.\n *\n * Layered on {@link useSettingsHubConfig} (which resolves the application's\n * authored placements against the engine destination catalog): this hook\n * collects the live gating signals — primary scope, effective roles, resolved\n * features, runtime capabilities — and runs the pure\n * {@link filterSettingsHubConfig}. The hub component consumes the already-gated\n * config, so it never has to know about scope/role/feature evaluation.\n *\n * Note the two stages answer different questions and must stay separate. This\n * one asks \"may THIS USER see the section\" and its answer changes as the user's\n * scope and roles change. Resolution asks \"did the APPLICATION place it at all\",\n * and a `no` there is authorship, not gating — it must never be recoverable by a\n * user gaining a role.\n *\n * Signals are sourced from the SAME hooks the rest of the frontend gating layer\n * uses, so a settings section appears under exactly the same conditions as the\n * equivalent sidebar/command-menu entry:\n * - scope → `useAppScopeSafe`, EXCEPT the application id — see below\n * - effective roles → `buildFeaturePolicyRoles(permissions, currentOrganizationId)`\n * - features → `useFeatures().resolvedFeatures`\n * - capabilities → `useLauncherRuntimeAvailabilityContext`\n *\n * ## The application id does NOT come from the scope, and a category scoped to\n * `APPLICATION` was unreachable until it stopped trying to\n *\n * `AppScopeContext` derives `currentApplicationId` by decoding the access token, and the access\n * token's claims carry `userId` and **no** `applicationId` — measured on the running stack in\n * issue #283 and recorded at `ResourceReadCacheBridge.tsx`. So `appScope.currentApplicationId` is\n * null everywhere, always.\n *\n * That is invisible for every other gate and fatal for this one. `filterSettingsHubConfig` drops a\n * category whose scope has no value, so an application that authored an `APPLICATION`-scoped\n * category got a rail that silently omitted it — the exact failure mode the hub's own resolution\n * comment warns about, where \"quietly failed to appear\" and \"deliberately removed\" are\n * indistinguishable. Nothing threw, no DEV pass reported it, and the category's sections were\n * well-formed the whole time.\n *\n * The id is published on `appIdentity`, which is the one surface that actually has it. Read here\n * through `useContext` rather than `useApplication()` on purpose: that hook THROWS outside its\n * provider, and this hook is mounted by the settings hub, which must not crash a tree that happens\n * to render it a level too high. The scope value is kept as a FALLBACK rather than deleted, so the\n * day the claim is added to the token this hook keeps working without a second edit.\n *\n * **The same correction is owed at ~17 other `currentApplicationId` readers** (navigation, views,\n * charts, analytics, the command menu) and is deliberately NOT swept here: those feed scope\n * parameters into queries and URLs that have been null since the field existed, so changing them\n * is a behavioural change needing its own measurement. This hook is fixed because a null here does\n * not degrade a surface, it deletes one.\n */\n\nimport { useContext, useMemo } from 'react';\nimport { useAppScopeSafe } from '~wildo-frontend-lib/core/scope/useAppScope';\nimport { ApplicationContext } from '~wildo-frontend-lib/core/runtime/ApplicationContext.shared';\nimport { useUserOrgs } from '~wildo-frontend-lib/core/security/useUserOrgs';\nimport { useFeatures } from '~wildo-frontend-lib/core/features/useFeatures';\nimport { useLauncherRuntimeAvailabilityContext } from '~wildo-frontend-lib/core/navigation/launcher-runtime-availability';\nimport { buildFeaturePolicyRoles } from '~wildo-frontend-lib/core/features/feature-unavailability.frontend.utils';\nimport { useSettingsHubConfig } from './useSettingsHubConfig';\nimport { filterSettingsHubConfig } from './settings-hub-gating.frontend.utils';\nimport type { ResolvedSettingsHubConfig } from './settings-hub.frontend.schemas';\n\nexport function useVisibleSettingsHubConfig(): ResolvedSettingsHubConfig {\n  const rawConfig = useSettingsHubConfig();\n  const appScope = useAppScopeSafe();\n  const { permissions } = useUserOrgs();\n  const { resolvedFeatures } = useFeatures();\n  const runtimeContext = useLauncherRuntimeAvailabilityContext();\n  const applicationContext = useContext(ApplicationContext);\n  const currentApplicationId = applicationContext?.appIdentity?.applicationId\n    ?? appScope?.currentApplicationId\n    ?? null;\n\n  const userRoles = useMemo(\n    () => buildFeaturePolicyRoles(permissions, appScope?.currentOrganizationId),\n    [permissions, appScope?.currentOrganizationId],\n  );\n\n  return useMemo(\n    () =>\n      filterSettingsHubConfig(rawConfig, {\n        scopeIds: {\n          currentUserId: appScope?.currentUserId,\n          currentOrganizationId: appScope?.currentOrganizationId,\n          currentApplicationId,\n          currentAnonymousUserId: appScope?.currentAnonymousUserId,\n        },\n        userRoles,\n        enabledFeatures: resolvedFeatures?.features ?? [],\n        runtimeContext,\n      }),\n    [\n      rawConfig,\n      appScope?.currentUserId,\n      appScope?.currentOrganizationId,\n      currentApplicationId,\n      appScope?.currentAnonymousUserId,\n      userRoles,\n      resolvedFeatures?.features,\n      runtimeContext,\n    ],\n  );\n}\n"]}

package/dist/esm/core/config/verify-feature-references.frontend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-feature-references.frontend.d.ts","sourceRoot":"","sources":["../../../../src/core/config/verify-feature-references.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,gCAAgC,EAGjC,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,KAAK,EAEV,yBAAyB,EAC1B,MAAM,+DAA+D,CAAC;AAEvE,MAAM,WAAW,0CAA2C,SAAQ,gCAAgC;IAClG,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,iBAAiB,EAAE,yBAAyB,CAAC;IAC7C,SAAS,EAAE,yBAAyB,CAAC;IACrC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3D,GAAG,0CAA0C,CAiC7C"}
+{"version":3,"file":"verify-feature-references.frontend.d.ts","sourceRoot":"","sources":["../../../../../src/core/config/verify-feature-references.frontend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,gCAAgC,EAGjC,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,KAAK,EAEV,yBAAyB,EAC1B,MAAM,+DAA+D,CAAC;AAEvE,MAAM,WAAW,0CAA2C,SAAQ,gCAAgC;IAClG,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,iBAAiB,EAAE,yBAAyB,CAAC;IAC7C,SAAS,EAAE,yBAAyB,CAAC;IACrC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;CAC3D,GAAG,0CAA0C,CAiC7C"}

package/dist/esm/core/config/verify-feature-references.frontend.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-feature-references.frontend.js","sourceRoot":"","sources":["../../../../src/core/config/verify-feature-references.frontend.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,uCAAuC,EACvC,4CAA4C,EAC5C,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAY/B;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAW/C;IACC,MAAM,MAAM,GAA4B;QACtC,GAAG,oCAAoC,CAAC,MAAM,CAAC,SAAS,CAAC;QACzD,GAAG,kDAAkD,CAAC,MAAM,CAAC,iBAAiB,CAAC;KAChF,CAAC;IAEF,MAAM,MAAM,GAAG,uCAAuC,CAAC;QACrD,WAAW,EAAE,MAAM,CAAC,oBAAoB,CAAC,WAAW;QACpD,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG;QACf,GAAG,4CAA4C,CAC7C,MAAM,CAAC,oBAAoB,EAC3B,MAAM,CAAC,qBAAqB,CAC7B;QACD,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACrC,GAAG,KAAK,CAAC,OAAO,mCAAmC,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAC/F,CAAC;QACF,GAAG,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC1C,GAAG,KAAK,CAAC,OAAO,wCAAwC,KAAK,CAAC,UAAU;aACrE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAClB,IAAI,SAAS,CAAC,SAAS,SAAS,SAAS,CAAC,SAAS,YAAY,SAAS,CAAC,iBAAiB,yBAAyB,SAAS,CAAC,eAAe,EAAE,CAC/I,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;KACH,CAAC;IAEF,OAAO;QACL,GAAG,MAAM;QACT,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,4CAA4C,CACnD,oBAA0C,EAC1C,qBAAyD;IAEzD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,UAAU,IAAI,oBAAoB,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QACjD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GAAG,cAAc,CAAC,QAAQ,KAAK,6BAA6B,CAAC,MAAM;eACjF,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;QAC/F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,cAAc,CAAC,kBAAkB,CAAC;QACvD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CACX,YAAY,UAAU,CAAC,UAAU,uIAAuI,CACzK,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,qBAAqB,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,CACX,YAAY,UAAU,CAAC,UAAU,0BAA0B,YAAY,iDAAiD,CACzH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oCAAoC,CAC3C,SAAoC;IAEpC,OAAO;QACL,GAAG,sCAAsC,CACvC,SAAS,CAAC,cAAc,EACxB,CAAC,IAAI,EAAE,EAAE,CAAC,4BAA4B,IAAI,CAAC,GAAG,GAAG,CAClD;QACD,GAAG,sCAAsC,CACvC,SAAS,CAAC,eAAe,EACzB,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,IAAI,CAAC,GAAG,GAAG,CACpD;QACD,GAAG,sCAAsC,CACvC,SAAS,CAAC,gBAAgB,EAC1B,CAAC,IAAI,EAAE,EAAE,CAAC,+BAA+B,IAAI,CAAC,GAAG,GAAG,CACrD;QACD,GAAG,sCAAsC,CACvC,SAAS,CAAC,eAAe,EACzB,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,IAAI,CAAC,GAAG,GAAG,CACnD;QACD,GAAG,iDAAiD,CAAC,SAAS,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,iDAAiD,CACxD,SAAoC;IAEpC,OAAO,CAAC,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACtD,MAAM,UAAU,GAAG,4CAA4C,CAC7D,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAChC,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,CAAC;gBACN,OAAO,EAAE,2BAA2B,IAAI,CAAC,GAAG,YAAY;gBACxD,UAAU;aACX,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sCAAsC,CAC7C,KAAsB,EACtB,cAAkD;IAElD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACnC,MAAM,UAAU,GAAG,4CAA4C,CAC7D,IAAI,CAAC,gBAAyB,CAC/B,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,CAAC;gBACN,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC;gBACpC,UAAU;aACX,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kDAAkD,CACzD,iBAA4C;IAE5C,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,CAAC,OAAO,CACrE,CAAC,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAAE,EAAE,CAAC,CACzC,wDAAwD,CACtD,YAAY,EACZ,qBAAqB,CACtB,CACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,wDAAwD,CAC/D,YAAoB,EACpB,qBAAuD;IAEvD,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,qBAAqB,CAAC;IAE1E,OAAO;QACL,GAAG,CAAC,qBAAqB,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAChE,MAAM,UAAU,GAAG,4CAA4C,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACvF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,CAAC;oBACN,OAAO,EAAE,aAAa,YAAY,qBAAqB,IAAI,CAAC,GAAG,GAAG;oBAClE,UAAU;iBACX,CAAC,CAAC;QACL,CAAC,CAAC;QACF,GAAG,CAAC,qBAAqB,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5D,MAAM,UAAU,GAAG,4CAA4C,CAC7D,IAAI,CAAC,eAAe,CAAC,gBAAgB,CACtC,CAAC;YACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,CAAC;oBACN,OAAO,EAAE,aAAa,YAAY,YAAY,IAAI,CAAC,GAAG,GAAG;oBACzD,UAAU;iBACX,CAAC,CAAC;QACL,CAAC,CAAC;QACF,GAAG,CAAC,qBAAqB,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAChE,MAAM,UAAU,GAAG,4CAA4C,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACvF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,CAAC;oBACN,OAAO,EAAE,aAAa,YAAY,qBAAqB,IAAI,CAAC,GAAG,GAAG;oBAClE,UAAU;iBACX,CAAC,CAAC;QACL,CAAC,CAAC;QACF,GAAG,CAAC,qBAAqB,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC1D,MAAM,UAAU,GAAG,4CAA4C,CAC7D,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAChC,CAAC;YACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,CAAC;oBACN,OAAO,EAAE,aAAa,YAAY,oBAAoB,IAAI,CAAC,GAAG,YAAY;oBAC1E,UAAU;iBACX,CAAC,CAAC;QACL,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAmC;IAClE,OAAO,UAAU;SACd,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,SAAS,SAAS,SAAS,CAAC,SAAS,EAAE,CAAC;SACzE,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC","sourcesContent":["import type {\n  FeatureConfiguration,\n  FeatureReferenceValidationIssues,\n  FeatureReferenceEntry,\n  FeatureReferenceUsage,\n} from '@wildo-ai/saas-models';\nimport {\n  collectFeatureReferenceValidationIssues,\n  extractFeatureReferencesFromRequiredFeatures,\n  FeatureUnavailabilityBehavior,\n} from '@wildo-ai/saas-models';\nimport type { AppConfiguration_Frontend } from './app-configuration-frontend.schemas';\nimport type {\n  AnyFrontendResourceConfiguration,\n  FrontendResourcesRegistry,\n} from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\n\nexport interface FrontendFeatureReferenceVerificationResult extends FeatureReferenceValidationIssues {\n  isValid: boolean;\n  warnings: string[];\n}\n\n/**\n * DEV-time validation for frontend-authored feature refs that never pass\n * through backend startup. This covers app-level views plus resource-owned UI\n * declarations such as inserted charts and resource guidance.\n */\nexport function verifyFrontendFeatureReferences(params: {\n  resourcesRegistry: FrontendResourcesRegistry;\n  appConfig: AppConfiguration_Frontend;\n  featureConfiguration: FeatureConfiguration;\n  /**\n   * Whether a component ref resolves in `ComponentRegistryService`. Optional so a caller that\n   * verifies BEFORE component registration still gets the reference checks; the CUSTOM-behaviour\n   * check simply does not run without it. `start-application.frontend.service.ts` passes it,\n   * deliberately after `componentLoader()`.\n   */\n  isComponentRegistered?: (componentRef: string) => boolean;\n}): FrontendFeatureReferenceVerificationResult {\n  const usages: FeatureReferenceUsage[] = [\n    ...collectAppViewFeatureReferenceUsages(params.appConfig),\n    ...collectResourceConfigurationFeatureReferenceUsages(params.resourcesRegistry),\n  ];\n\n  const issues = collectFeatureReferenceValidationIssues({\n    definitions: params.featureConfiguration.definitions,\n    usages,\n  });\n\n  const warnings = [\n    ...collectCustomUnavailabilityComponentWarnings(\n      params.featureConfiguration,\n      params.isComponentRegistered,\n    ),\n    ...issues.unknownIssues.map((issue) => (\n      `${issue.surface}: unknown feature reference(s): ${formatFeatureReferences(issue.references)}`\n    )),\n    ...issues.incompatibleIssues.map((issue) => (\n      `${issue.surface}: incompatible feature reference(s): ${issue.references\n        .map((reference) => (\n          `'${reference.featureId}' via ${reference.slotLabel} expects ${reference.expectedValueType} but registry defines ${reference.actualValueType}`\n        ))\n        .join(', ')}`\n    )),\n  ];\n\n  return {\n    ...issues,\n    warnings,\n    isValid: warnings.length === 0,\n  };\n}\n\n/**\n * CUSTOM unavailability behaviour, checked at authoring time.\n *\n * The engine resolves `unavailability.customComponentRef` through `ComponentRegistryService` and\n * renders the declared component. A ref naming nothing registered would otherwise reach a user as\n * `ComponentNotInjected` — better than the silence this replaced (#440), but still a runtime\n * surprise for something knowable at startup. Same trade as the launcher's\n * HOSTED_COMPONENT_NOT_CONFIGURED check, and deliberately the same shape.\n *\n * Two shapes are reported, and the second is the one that used to be invisible:\n *   - a ref that resolves to no registered component;\n *   - CUSTOM selected with NO ref at all, which renders the generic prompt and is therefore\n *     indistinguishable from DISABLE — the exact state that made this behaviour look inert.\n *\n * `byRole` overrides are checked too: a role-specific CUSTOM has the same requirement as the\n * feature-level one, and reads from the same single `customComponentRef`.\n */\nfunction collectCustomUnavailabilityComponentWarnings(\n  featureConfiguration: FeatureConfiguration,\n  isComponentRegistered?: (componentRef: string) => boolean,\n): string[] {\n  const warnings: string[] = [];\n\n  for (const definition of featureConfiguration.definitions ?? []) {\n    const unavailability = definition.unavailability;\n    if (!unavailability) {\n      continue;\n    }\n\n    const selectsCustom = unavailability.behavior === FeatureUnavailabilityBehavior.CUSTOM\n      || Object.values(unavailability.byRole ?? {}).includes(FeatureUnavailabilityBehavior.CUSTOM);\n    if (!selectsCustom) {\n      continue;\n    }\n\n    const componentRef = unavailability.customComponentRef;\n    if (!componentRef) {\n      warnings.push(\n        `feature '${definition.identifier}': unavailability behavior CUSTOM declares no customComponentRef, so it renders the generic prompt and behaves identically to DISABLE`,\n      );\n      continue;\n    }\n\n    if (isComponentRegistered && !isComponentRegistered(componentRef)) {\n      warnings.push(\n        `feature '${definition.identifier}': customComponentRef '${componentRef}' is not registered in ComponentRegistryService`,\n      );\n    }\n  }\n\n  return warnings;\n}\n\nfunction collectAppViewFeatureReferenceUsages(\n  appConfig: AppConfiguration_Frontend,\n): FeatureReferenceUsage[] {\n  return [\n    ...collectViewArrayFeatureReferenceUsages(\n      appConfig.compositeViews,\n      (view) => `frontend composite view '${view.ref}'`,\n    ),\n    ...collectViewArrayFeatureReferenceUsages(\n      appConfig.fullCustomViews,\n      (view) => `frontend full custom view '${view.ref}'`,\n    ),\n    ...collectViewArrayFeatureReferenceUsages(\n      appConfig.flowsActorsViews,\n      (view) => `frontend flows/actors view '${view.ref}'`,\n    ),\n    ...collectViewArrayFeatureReferenceUsages(\n      appConfig.onboardingViews,\n      (view) => `frontend onboarding view '${view.ref}'`,\n    ),\n    ...collectFrontendGuidanceFlowFeatureReferenceUsages(appConfig),\n  ];\n}\n\nfunction collectFrontendGuidanceFlowFeatureReferenceUsages(\n  appConfig: AppConfiguration_Frontend,\n): FeatureReferenceUsage[] {\n  return (appConfig.guidanceFlows ?? []).flatMap((flow) => {\n    const references = extractFeatureReferencesFromRequiredFeatures(\n      flow.audience?.requiredFeatures,\n    );\n    if (references.length === 0) {\n      return [];\n    }\n\n    return [{\n      surface: `frontend guidance flow '${flow.ref}' audience`,\n      references,\n    }];\n  });\n}\n\nfunction collectViewArrayFeatureReferenceUsages<T extends { ref?: string; requiredFeatures?: unknown }>(\n  views: T[] | undefined,\n  surfaceBuilder: (view: T, index: number) => string,\n): FeatureReferenceUsage[] {\n  if (!views) {\n    return [];\n  }\n\n  return views.flatMap((view, index) => {\n    const references = extractFeatureReferencesFromRequiredFeatures(\n      view.requiredFeatures as never,\n    );\n    if (references.length === 0) {\n      return [];\n    }\n\n    return [{\n      surface: surfaceBuilder(view, index),\n      references,\n    }];\n  });\n}\n\nfunction collectResourceConfigurationFeatureReferenceUsages(\n  resourcesRegistry: FrontendResourcesRegistry,\n): FeatureReferenceUsage[] {\n  return Object.entries(resourcesRegistry.resourceConfigurations).flatMap(\n    ([resourceType, resourceConfiguration]) => (\n      collectSingleResourceConfigurationFeatureReferenceUsages(\n        resourceType,\n        resourceConfiguration,\n      )\n    ),\n  );\n}\n\nfunction collectSingleResourceConfigurationFeatureReferenceUsages(\n  resourceType: string,\n  resourceConfiguration: AnyFrontendResourceConfiguration,\n): FeatureReferenceUsage[] {\n  const frontendConfiguration = resourceConfiguration.frontendConfiguration;\n\n  return [\n    ...(frontendConfiguration?.compositeViews ?? []).flatMap((view) => {\n      const references = extractFeatureReferencesFromRequiredFeatures(view.requiredFeatures);\n      if (references.length === 0) {\n        return [];\n      }\n\n      return [{\n        surface: `resource '${resourceType}' composite view '${view.ref}'`,\n        references,\n      }];\n    }),\n    ...(frontendConfiguration?.chartViews ?? []).flatMap((view) => {\n      const references = extractFeatureReferencesFromRequiredFeatures(\n        view.chartDefinition.requiredFeatures,\n      );\n      if (references.length === 0) {\n        return [];\n      }\n\n      return [{\n        surface: `resource '${resourceType}' chart '${view.ref}'`,\n        references,\n      }];\n    }),\n    ...(frontendConfiguration?.executionViews ?? []).flatMap((view) => {\n      const references = extractFeatureReferencesFromRequiredFeatures(view.requiredFeatures);\n      if (references.length === 0) {\n        return [];\n      }\n\n      return [{\n        surface: `resource '${resourceType}' execution view '${view.ref}'`,\n        references,\n      }];\n    }),\n    ...(frontendConfiguration?.guidance ?? []).flatMap((flow) => {\n      const references = extractFeatureReferencesFromRequiredFeatures(\n        flow.audience?.requiredFeatures,\n      );\n      if (references.length === 0) {\n        return [];\n      }\n\n      return [{\n        surface: `resource '${resourceType}' guidance flow '${flow.ref}' audience`,\n        references,\n      }];\n    }),\n  ];\n}\n\nfunction formatFeatureReferences(references: FeatureReferenceEntry[]): string {\n  return references\n    .map((reference) => `'${reference.featureId}' via ${reference.slotLabel}`)\n    .join(', ');\n}\n"]}
+{"version":3,"file":"verify-feature-references.frontend.js","sourceRoot":"","sources":["../../../../../src/core/config/verify-feature-references.frontend.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,uCAAuC,EACvC,4CAA4C,EAC5C,6BAA6B,GAC9B,MAAM,uBAAuB,CAAC;AAY/B;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,MAW/C;IACC,MAAM,MAAM,GAA4B;QACtC,GAAG,oCAAoC,CAAC,MAAM,CAAC,SAAS,CAAC;QACzD,GAAG,kDAAkD,CAAC,MAAM,CAAC,iBAAiB,CAAC;KAChF,CAAC;IAEF,MAAM,MAAM,GAAG,uCAAuC,CAAC;QACrD,WAAW,EAAE,MAAM,CAAC,oBAAoB,CAAC,WAAW;QACpD,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG;QACf,GAAG,4CAA4C,CAC7C,MAAM,CAAC,oBAAoB,EAC3B,MAAM,CAAC,qBAAqB,CAC7B;QACD,GAAG,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACrC,GAAG,KAAK,CAAC,OAAO,mCAAmC,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAC/F,CAAC;QACF,GAAG,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC1C,GAAG,KAAK,CAAC,OAAO,wCAAwC,KAAK,CAAC,UAAU;aACrE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAClB,IAAI,SAAS,CAAC,SAAS,SAAS,SAAS,CAAC,SAAS,YAAY,SAAS,CAAC,iBAAiB,yBAAyB,SAAS,CAAC,eAAe,EAAE,CAC/I,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;KACH,CAAC;IAEF,OAAO;QACL,GAAG,MAAM;QACT,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,4CAA4C,CACnD,oBAA0C,EAC1C,qBAAyD;IAEzD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,UAAU,IAAI,oBAAoB,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QACjD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GAAG,cAAc,CAAC,QAAQ,KAAK,6BAA6B,CAAC,MAAM;eACjF,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;QAC/F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,cAAc,CAAC,kBAAkB,CAAC;QACvD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CACX,YAAY,UAAU,CAAC,UAAU,uIAAuI,CACzK,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,qBAAqB,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,CACX,YAAY,UAAU,CAAC,UAAU,0BAA0B,YAAY,iDAAiD,CACzH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oCAAoC,CAC3C,SAAoC;IAEpC,OAAO;QACL,GAAG,sCAAsC,CACvC,SAAS,CAAC,cAAc,EACxB,CAAC,IAAI,EAAE,EAAE,CAAC,4BAA4B,IAAI,CAAC,GAAG,GAAG,CAClD;QACD,GAAG,sCAAsC,CACvC,SAAS,CAAC,eAAe,EACzB,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,IAAI,CAAC,GAAG,GAAG,CACpD;QACD,GAAG,sCAAsC,CACvC,SAAS,CAAC,gBAAgB,EAC1B,CAAC,IAAI,EAAE,EAAE,CAAC,+BAA+B,IAAI,CAAC,GAAG,GAAG,CACrD;QACD,GAAG,sCAAsC,CACvC,SAAS,CAAC,eAAe,EACzB,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,IAAI,CAAC,GAAG,GAAG,CACnD;QACD,GAAG,iDAAiD,CAAC,SAAS,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,iDAAiD,CACxD,SAAoC;IAEpC,OAAO,CAAC,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACtD,MAAM,UAAU,GAAG,4CAA4C,CAC7D,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAChC,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,CAAC;gBACN,OAAO,EAAE,2BAA2B,IAAI,CAAC,GAAG,YAAY;gBACxD,UAAU;aACX,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sCAAsC,CAC7C,KAAsB,EACtB,cAAkD;IAElD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACnC,MAAM,UAAU,GAAG,4CAA4C,CAC7D,IAAI,CAAC,gBAAyB,CAC/B,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,CAAC;gBACN,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC;gBACpC,UAAU;aACX,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kDAAkD,CACzD,iBAA4C;IAE5C,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,CAAC,OAAO,CACrE,CAAC,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAAE,EAAE,CAAC,CACzC,wDAAwD,CACtD,YAAY,EACZ,qBAAqB,CACtB,CACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,wDAAwD,CAC/D,YAAoB,EACpB,qBAAuD;IAEvD,MAAM,qBAAqB,GAAG,qBAAqB,CAAC,qBAAqB,CAAC;IAE1E,OAAO;QACL,GAAG,CAAC,qBAAqB,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAChE,MAAM,UAAU,GAAG,4CAA4C,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACvF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,CAAC;oBACN,OAAO,EAAE,aAAa,YAAY,qBAAqB,IAAI,CAAC,GAAG,GAAG;oBAClE,UAAU;iBACX,CAAC,CAAC;QACL,CAAC,CAAC;QACF,GAAG,CAAC,qBAAqB,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5D,MAAM,UAAU,GAAG,4CAA4C,CAC7D,IAAI,CAAC,eAAe,CAAC,gBAAgB,CACtC,CAAC;YACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,CAAC;oBACN,OAAO,EAAE,aAAa,YAAY,YAAY,IAAI,CAAC,GAAG,GAAG;oBACzD,UAAU;iBACX,CAAC,CAAC;QACL,CAAC,CAAC;QACF,GAAG,CAAC,qBAAqB,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAChE,MAAM,UAAU,GAAG,4CAA4C,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACvF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,CAAC;oBACN,OAAO,EAAE,aAAa,YAAY,qBAAqB,IAAI,CAAC,GAAG,GAAG;oBAClE,UAAU;iBACX,CAAC,CAAC;QACL,CAAC,CAAC;QACF,GAAG,CAAC,qBAAqB,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC1D,MAAM,UAAU,GAAG,4CAA4C,CAC7D,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAChC,CAAC;YACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,OAAO,CAAC;oBACN,OAAO,EAAE,aAAa,YAAY,oBAAoB,IAAI,CAAC,GAAG,YAAY;oBAC1E,UAAU;iBACX,CAAC,CAAC;QACL,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,UAAmC;IAClE,OAAO,UAAU;SACd,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,SAAS,SAAS,SAAS,CAAC,SAAS,EAAE,CAAC;SACzE,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC","sourcesContent":["import type {\n  FeatureConfiguration,\n  FeatureReferenceValidationIssues,\n  FeatureReferenceEntry,\n  FeatureReferenceUsage,\n} from '@wildo-ai/saas-models';\nimport {\n  collectFeatureReferenceValidationIssues,\n  extractFeatureReferencesFromRequiredFeatures,\n  FeatureUnavailabilityBehavior,\n} from '@wildo-ai/saas-models';\nimport type { AppConfiguration_Frontend } from './app-configuration-frontend.schemas';\nimport type {\n  AnyFrontendResourceConfiguration,\n  FrontendResourcesRegistry,\n} from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\n\nexport interface FrontendFeatureReferenceVerificationResult extends FeatureReferenceValidationIssues {\n  isValid: boolean;\n  warnings: string[];\n}\n\n/**\n * DEV-time validation for frontend-authored feature refs that never pass\n * through backend startup. This covers app-level views plus resource-owned UI\n * declarations such as inserted charts and resource guidance.\n */\nexport function verifyFrontendFeatureReferences(params: {\n  resourcesRegistry: FrontendResourcesRegistry;\n  appConfig: AppConfiguration_Frontend;\n  featureConfiguration: FeatureConfiguration;\n  /**\n   * Whether a component ref resolves in `ComponentRegistryService`. Optional so a caller that\n   * verifies BEFORE component registration still gets the reference checks; the CUSTOM-behaviour\n   * check simply does not run without it. `start-application.frontend.service.ts` passes it,\n   * deliberately after `componentLoader()`.\n   */\n  isComponentRegistered?: (componentRef: string) => boolean;\n}): FrontendFeatureReferenceVerificationResult {\n  const usages: FeatureReferenceUsage[] = [\n    ...collectAppViewFeatureReferenceUsages(params.appConfig),\n    ...collectResourceConfigurationFeatureReferenceUsages(params.resourcesRegistry),\n  ];\n\n  const issues = collectFeatureReferenceValidationIssues({\n    definitions: params.featureConfiguration.definitions,\n    usages,\n  });\n\n  const warnings = [\n    ...collectCustomUnavailabilityComponentWarnings(\n      params.featureConfiguration,\n      params.isComponentRegistered,\n    ),\n    ...issues.unknownIssues.map((issue) => (\n      `${issue.surface}: unknown feature reference(s): ${formatFeatureReferences(issue.references)}`\n    )),\n    ...issues.incompatibleIssues.map((issue) => (\n      `${issue.surface}: incompatible feature reference(s): ${issue.references\n        .map((reference) => (\n          `'${reference.featureId}' via ${reference.slotLabel} expects ${reference.expectedValueType} but registry defines ${reference.actualValueType}`\n        ))\n        .join(', ')}`\n    )),\n  ];\n\n  return {\n    ...issues,\n    warnings,\n    isValid: warnings.length === 0,\n  };\n}\n\n/**\n * CUSTOM unavailability behaviour, checked at authoring time.\n *\n * The engine resolves `unavailability.customComponentRef` through `ComponentRegistryService` and\n * renders the declared component. A ref naming nothing registered would otherwise reach a user as\n * `ComponentNotInjected` — better than the silence this replaced (#440), but still a runtime\n * surprise for something knowable at startup. Same trade as the launcher's\n * HOSTED_COMPONENT_NOT_CONFIGURED check, and deliberately the same shape.\n *\n * Two shapes are reported, and the second is the one that used to be invisible:\n *   - a ref that resolves to no registered component;\n *   - CUSTOM selected with NO ref at all, which renders the generic prompt and is therefore\n *     indistinguishable from DISABLE — the exact state that made this behaviour look inert.\n *\n * `byRole` overrides are checked too: a role-specific CUSTOM has the same requirement as the\n * feature-level one, and reads from the same single `customComponentRef`.\n */\nfunction collectCustomUnavailabilityComponentWarnings(\n  featureConfiguration: FeatureConfiguration,\n  isComponentRegistered?: (componentRef: string) => boolean,\n): string[] {\n  const warnings: string[] = [];\n\n  for (const definition of featureConfiguration.definitions ?? []) {\n    const unavailability = definition.unavailability;\n    if (!unavailability) {\n      continue;\n    }\n\n    const selectsCustom = unavailability.behavior === FeatureUnavailabilityBehavior.CUSTOM\n      || Object.values(unavailability.byRole ?? {}).includes(FeatureUnavailabilityBehavior.CUSTOM);\n    if (!selectsCustom) {\n      continue;\n    }\n\n    const componentRef = unavailability.customComponentRef;\n    if (!componentRef) {\n      warnings.push(\n        `feature '${definition.identifier}': unavailability behavior CUSTOM declares no customComponentRef, so it renders the generic prompt and behaves identically to DISABLE`,\n      );\n      continue;\n    }\n\n    if (isComponentRegistered && !isComponentRegistered(componentRef)) {\n      warnings.push(\n        `feature '${definition.identifier}': customComponentRef '${componentRef}' is not registered in ComponentRegistryService`,\n      );\n    }\n  }\n\n  return warnings;\n}\n\nfunction collectAppViewFeatureReferenceUsages(\n  appConfig: AppConfiguration_Frontend,\n): FeatureReferenceUsage[] {\n  return [\n    ...collectViewArrayFeatureReferenceUsages(\n      appConfig.compositeViews,\n      (view) => `frontend composite view '${view.ref}'`,\n    ),\n    ...collectViewArrayFeatureReferenceUsages(\n      appConfig.fullCustomViews,\n      (view) => `frontend full custom view '${view.ref}'`,\n    ),\n    ...collectViewArrayFeatureReferenceUsages(\n      appConfig.flowsActorsViews,\n      (view) => `frontend flows/actors view '${view.ref}'`,\n    ),\n    ...collectViewArrayFeatureReferenceUsages(\n      appConfig.onboardingViews,\n      (view) => `frontend onboarding view '${view.ref}'`,\n    ),\n    ...collectFrontendGuidanceFlowFeatureReferenceUsages(appConfig),\n  ];\n}\n\nfunction collectFrontendGuidanceFlowFeatureReferenceUsages(\n  appConfig: AppConfiguration_Frontend,\n): FeatureReferenceUsage[] {\n  return (appConfig.guidanceFlows ?? []).flatMap((flow) => {\n    const references = extractFeatureReferencesFromRequiredFeatures(\n      flow.audience?.requiredFeatures,\n    );\n    if (references.length === 0) {\n      return [];\n    }\n\n    return [{\n      surface: `frontend guidance flow '${flow.ref}' audience`,\n      references,\n    }];\n  });\n}\n\nfunction collectViewArrayFeatureReferenceUsages<T extends { ref?: string; requiredFeatures?: unknown }>(\n  views: T[] | undefined,\n  surfaceBuilder: (view: T, index: number) => string,\n): FeatureReferenceUsage[] {\n  if (!views) {\n    return [];\n  }\n\n  return views.flatMap((view, index) => {\n    const references = extractFeatureReferencesFromRequiredFeatures(\n      view.requiredFeatures as never,\n    );\n    if (references.length === 0) {\n      return [];\n    }\n\n    return [{\n      surface: surfaceBuilder(view, index),\n      references,\n    }];\n  });\n}\n\nfunction collectResourceConfigurationFeatureReferenceUsages(\n  resourcesRegistry: FrontendResourcesRegistry,\n): FeatureReferenceUsage[] {\n  return Object.entries(resourcesRegistry.resourceConfigurations).flatMap(\n    ([resourceType, resourceConfiguration]) => (\n      collectSingleResourceConfigurationFeatureReferenceUsages(\n        resourceType,\n        resourceConfiguration,\n      )\n    ),\n  );\n}\n\nfunction collectSingleResourceConfigurationFeatureReferenceUsages(\n  resourceType: string,\n  resourceConfiguration: AnyFrontendResourceConfiguration,\n): FeatureReferenceUsage[] {\n  const frontendConfiguration = resourceConfiguration.frontendConfiguration;\n\n  return [\n    ...(frontendConfiguration?.compositeViews ?? []).flatMap((view) => {\n      const references = extractFeatureReferencesFromRequiredFeatures(view.requiredFeatures);\n      if (references.length === 0) {\n        return [];\n      }\n\n      return [{\n        surface: `resource '${resourceType}' composite view '${view.ref}'`,\n        references,\n      }];\n    }),\n    ...(frontendConfiguration?.chartViews ?? []).flatMap((view) => {\n      const references = extractFeatureReferencesFromRequiredFeatures(\n        view.chartDefinition.requiredFeatures,\n      );\n      if (references.length === 0) {\n        return [];\n      }\n\n      return [{\n        surface: `resource '${resourceType}' chart '${view.ref}'`,\n        references,\n      }];\n    }),\n    ...(frontendConfiguration?.executionViews ?? []).flatMap((view) => {\n      const references = extractFeatureReferencesFromRequiredFeatures(view.requiredFeatures);\n      if (references.length === 0) {\n        return [];\n      }\n\n      return [{\n        surface: `resource '${resourceType}' execution view '${view.ref}'`,\n        references,\n      }];\n    }),\n    ...(frontendConfiguration?.guidance ?? []).flatMap((flow) => {\n      const references = extractFeatureReferencesFromRequiredFeatures(\n        flow.audience?.requiredFeatures,\n      );\n      if (references.length === 0) {\n        return [];\n      }\n\n      return [{\n        surface: `resource '${resourceType}' guidance flow '${flow.ref}' audience`,\n        references,\n      }];\n    }),\n  ];\n}\n\nfunction formatFeatureReferences(references: FeatureReferenceEntry[]): string {\n  return references\n    .map((reference) => `'${reference.featureId}' via ${reference.slotLabel}`)\n    .join(', ');\n}\n"]}

package/dist/esm/core/config/verify-launcher-content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-launcher-content.d.ts","sourceRoot":"","sources":["../../../../src/core/config/verify-launcher-content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,KAAK,EAAE,yBAAyB,EAAoC,MAAM,+DAA+D,CAAC;AAoCjJ,oBAAY,4BAA4B;IACtC,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAID,oBAAY,6BAA6B;IACvC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;IAC/C,mCAAmC,wCAAwC;IAC3E,0CAA0C,+CAA+C;IACzF,+CAA+C,oDAAoD;IACnG,qCAAqC,0CAA0C;IAC/E,qCAAqC,0CAA0C;IAC/E,+BAA+B,oCAAoC;IACnE,uBAAuB,4BAA4B;IACnD,gCAAgC,qCAAqC;IACrE,iCAAiC,sCAAsC;IACvE,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAC3C;;;;;;OAMG;IACH,2BAA2B,gCAAgC;CAC5D;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,4BAA4B,CAAC;IACvC,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB;AA0eD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,yBAAyB,EACpC,qBAAqB,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,GACxD,0BAA0B,CAkK5B;AAMD;;;GAGG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,0BAA0B,GAAG,IAAI,CAqB1F"}
+{"version":3,"file":"verify-launcher-content.d.ts","sourceRoot":"","sources":["../../../../../src/core/config/verify-launcher-content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,KAAK,EAAE,yBAAyB,EAAoC,MAAM,+DAA+D,CAAC;AAqCjJ,oBAAY,4BAA4B;IACtC,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAID,oBAAY,6BAA6B;IACvC,kBAAkB,uBAAuB;IACzC,mBAAmB,wBAAwB;IAC3C,cAAc,mBAAmB;IACjC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;IAC/C,mCAAmC,wCAAwC;IAC3E,0CAA0C,+CAA+C;IACzF,+CAA+C,oDAAoD;IACnG,qCAAqC,0CAA0C;IAC/E,qCAAqC,0CAA0C;IAC/E,+BAA+B,oCAAoC;IACnE,uBAAuB,4BAA4B;IACnD,gCAAgC,qCAAqC;IACrE,iCAAiC,sCAAsC;IACvE,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAC3C;;;;;;OAMG;IACH,2BAA2B,gCAAgC;CAC5D;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,4BAA4B,CAAC;IACvC,IAAI,EAAE,6BAA6B,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpC,OAAO,EAAE,OAAO,CAAC;CAClB;AAwfD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,yBAAyB,EACnC,SAAS,EAAE,yBAAyB,EACpC,qBAAqB,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,GACxD,0BAA0B,CAmK5B;AAMD;;;GAGG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,0BAA0B,GAAG,IAAI,CAqB1F"}

package/dist/esm/core/config/verify-launcher-content.js

@@ -310,28 +310,37 @@ placedSettingsSectionRefs, isComponentRegistered) {
         }
     }
 }
+/**
+ * A launcher item's `notificationBadgeRef` must name a registered definition — sidebar and menubar
+ * items alike, since both draw it with `NavigationItemBadge`.
+ *
+ * Matched on the badge KEY (`<scope>:<identifier>`), which is what `NavigationItemBadge` resolves
+ * with and what the badge store indexes by. Matching on the bare `identifier` — the previous
+ * behaviour — accepted a ref that names a definition at a DIFFERENT scope from the one that would
+ * actually render, and reported nothing.
+ */
+function verifyNotificationBadgeRef(item, context, registry, errors) {
+    if (!item.notificationBadgeRef
+        || registry.notificationBadgeDefinitions.some((definition) => notificationBadgeIdentityKey(definition) === item.notificationBadgeRef)) {
+        return;
+    }
+    errors.push({
+        severity: LauncherVerificationSeverity.ERROR,
+        code: LauncherVerificationErrorCode.NOTIFICATION_BADGE_REF_NOT_FOUND,
+        context,
+        message: `notificationBadgeRef "${item.notificationBadgeRef}" does not resolve to a registered notification badge definition. `
+            + `A ref is a badge key ("<scope>:<identifier>"); registered keys are: `
+            + `${registry.notificationBadgeDefinitions.map(notificationBadgeIdentityKey).join(', ') || '(none)'}`,
+        item,
+    });
+}
 /**
  * Recursively verify sidebar items (navigation list children can nest).
  */
 function verifySidebarItems(items, context, registry, viewRegistry, errors, placedSettingsSectionRefs, isComponentRegistered) {
     for (const item of items) {
         verifyItemRef(item, context, registry, viewRegistry, errors, placedSettingsSectionRefs, isComponentRegistered);
-        // Matched on the badge KEY (`<scope>:<identifier>`), which is what `NavigationItemBadge`
-        // resolves with and what the badge store indexes by. Matching on the bare `identifier` — the
-        // previous behaviour — accepted a ref that names a definition at a DIFFERENT scope from the one
-        // that would actually render, and reported nothing.
-        if (item.notificationBadgeRef
-            && !registry.notificationBadgeDefinitions.some((definition) => notificationBadgeIdentityKey(definition) === item.notificationBadgeRef)) {
-            errors.push({
-                severity: LauncherVerificationSeverity.ERROR,
-                code: LauncherVerificationErrorCode.NOTIFICATION_BADGE_REF_NOT_FOUND,
-                context,
-                message: `notificationBadgeRef "${item.notificationBadgeRef}" does not resolve to a registered notification badge definition. `
-                    + `A ref is a badge key ("<scope>:<identifier>"); registered keys are: `
-                    + `${registry.notificationBadgeDefinitions.map(notificationBadgeIdentityKey).join(', ') || '(none)'}`,
-                item,
-            });
-        }
+        verifyNotificationBadgeRef(item, context, registry, errors);
         if (item.children) {
             verifySidebarItems(item.children, `${context}.children`, registry, viewRegistry, errors, placedSettingsSectionRefs, isComponentRegistered);
         }
@@ -412,14 +421,15 @@ function verifySidebarSection(section, registry, viewRegistry, appModeRefs, erro
                     });
                 }
             }
-            // Warn when no label derivation is configured — SidebarResourceBrowser falls
-            // back to instance.name/title/id, but an explicit config is preferred.
+            // Warn when no label derivation is configured — SidebarResourceBrowser names instances through the shared
+            // resolver (`computeFrontendResourceLabel`), which falls back to the record's declared summary fields, then
+            // its id; an explicit config is preferred.
             if (!resourceConfig.frontendConfiguration?.getFrontendResourceLabel) {
                 errors.push({
                     severity: LauncherVerificationSeverity.WARNING,
                     code: LauncherVerificationErrorCode.RESOURCE_BROWSER_MISSING_LABEL_CONFIG,
                     context: ctx,
-                    message: `RESOURCE_BROWSER for "${browserSection.resourceType}" has no getFrontendResourceLabel configured — instance labels will fall back to name/title/id`,
+                    message: `RESOURCE_BROWSER for "${browserSection.resourceType}" has no getFrontendResourceLabel configured — instance labels will fall back to the record's summary fields, then its id`,
                     item: section,
                 });
             }
@@ -560,6 +570,7 @@ export function verifyLauncherContent(registry, appConfig, isComponentRegistered
             if (items) {
                 for (const item of items) {
                     verifyItemRef(item, 'menubar.items', registry, viewRegistry, errors, placedSettingsSectionRefs, isComponentRegistered);
+                    verifyNotificationBadgeRef(item, 'menubar.items', registry, errors);
                 }
             }
         }