@wildo-ai/saas-frontend-lib 1.1.5 → 1.1.7

package/dist/esm/core/config/engine-settings-destinations.js

@@ -238,6 +238,18 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
             operation: CoreResourceOperation.LIST,
         },
     },
+    {
+        // Beside API keys: the other credential type for the same machine principal, and where an administrator binds
+        // an autonomous agent to a client (#1812). Management roles, although LIST admits any member, because every
+        // other verb on the page — create, rotate, bind — is the administrator's.
+        ref: EngineSettingsDestinationRef.ORGANIZATION_OAUTH_CLIENTS,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
     {
         // Where a tenant connects its OWN third-party accounts. Until this existed the resource had
         // backend doors, an encrypted store, migrations and audit events, and no way for the
@@ -394,6 +406,97 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
             ],
         },
     },
+    {
+        // Inbound deliveries (#1596). No capability gate: the store exists in every application, and an
+        // application with no inbound handler simply shows an empty log. Not under WEBHOOKS, whose
+        // entitlement is the OUTBOUND feature.
+        ref: EngineSettingsDestinationRef.INBOUND_DELIVERIES,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.ORGANIZATION_INBOUND_DELIVERIES,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // Service-provider relationships (#1597), the CLIENT's side. No capability gate: placement is the
+        // gate — an application places it only when one of its organization types declares
+        // `servesAsProvider`, and an organization no firm serves simply shows an empty list.
+        ref: EngineSettingsDestinationRef.SERVICE_PROVIDERS,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.SUB_TABS,
+            subTabs: [
+                {
+                    ref: 'service-providers-relationships',
+                    label: 'Firms',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.SERVICE_PROVIDER_RELATIONSHIPS,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+                {
+                    // #1631: the administrative capabilities this organization lends its firms — grant, revoke, and when each ends.
+                    ref: 'service-providers-delegated-capabilities',
+                    label: 'Delegated capabilities',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+            ],
+        },
+    },
+    {
+        // The FIRM's side (#1597): its mirror of each relationship, and who serves each client.
+        ref: EngineSettingsDestinationRef.SERVICE_CLIENTS,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.SUB_TABS,
+            subTabs: [
+                {
+                    ref: 'service-clients-engagements',
+                    label: 'Clients',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.SERVICE_ENGAGEMENTS,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+                {
+                    ref: 'service-clients-assignments',
+                    label: 'Assignments',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.SERVICE_ENGAGEMENT_ASSIGNMENTS,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+                {
+                    // #1632: what the firm's own experts did in its clients — metadata only, and only when the firm switched it on.
+                    ref: 'service-clients-activity-feed',
+                    label: 'Expert activity',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+                {
+                    // #1632: the firm owner's decision to collect it, with who, when, and the consultation-notice acknowledgement.
+                    ref: 'service-clients-activity-feed-settings',
+                    label: 'Expert activity feed',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS,
+                        operation: CoreResourceOperation.READ,
+                    },
+                },
+            ],
+        },
+    },
     {
         ref: EngineSettingsDestinationRef.AUDIT_LOGS,
         requiredRoles: ORG_MANAGEMENT_ROLES,
@@ -441,6 +544,84 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
             operation: CoreResourceOperation.LIST,
         },
     },
+    {
+        // The organization's preservation duties (#1634). ORG_OWNER, as the resource's READ / LIST: a hold stops the
+        // tenant's retention schedule and its data subjects' erasures, and the owner is who places and releases it.
+        ref: EngineSettingsDestinationRef.ORGANIZATION_LEGAL_HOLDS,
+        requiredRoles: [CORE_ORG_ROLES.ORG_OWNER],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.LEGAL_HOLDS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // Receiving email (#1600): the organization's own domains. No capability gate: the store exists in every
+        // application, and one without an inbound email provider shows a claim that cannot reach the provider stage.
+        ref: EngineSettingsDestinationRef.EMAIL_DOMAINS,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.ORGANIZATION_EMAIL_DOMAINS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // Receiving email (#1600), the FIRM's side: the mailboxes it keeps on its own domain for the clients it serves.
+        // Placement is the gate, as for `service-clients`.
+        ref: EngineSettingsDestinationRef.CLIENT_MAILBOXES,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.CLIENT_MAILBOXES,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // Experts' corrections to agent work (#1599). The rate first: it is what an administrator comes to read, and it
+        // needs neither setting. Then the two organization singletons (each page is its READ, created in its default state
+        // on first access), then the ledger the export authorisation governs. No capability gate: the records exist in
+        // every application with agents, and one without them shows an empty rate.
+        ref: EngineSettingsDestinationRef.AGENT_WORK_REVIEW,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.SUB_TABS,
+            subTabs: [
+                {
+                    ref: 'agent-work-override-rate',
+                    label: 'Override rate',
+                    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.AGENT_WORK_OVERRIDE_RATE },
+                },
+                {
+                    ref: 'agent-work-content-capture',
+                    label: 'Content capture',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS,
+                        operation: CoreResourceOperation.READ,
+                    },
+                },
+                {
+                    ref: 'agent-work-export-authorization',
+                    label: 'Export authorisation',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS,
+                        operation: CoreResourceOperation.READ,
+                    },
+                },
+                {
+                    ref: 'agent-work-exports',
+                    label: 'Exports',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.EVALUATION_DATASET_EXPORTS,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+            ],
+        },
+    },
     // ── Application administration ─────────────────────────────────
     //
     // The operator's own surfaces. An application places these in a category scoped to
@@ -673,6 +854,25 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
             operation: CoreResourceOperation.LIST,
         },
     },
+    {
+        ref: EngineSettingsDestinationRef.APPLICATION_INBOUND_DELIVERIES,
+        requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.APPLICATION_INBOUND_DELIVERIES,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // Both roles the records accept, like the audit trail below: the evidence reader is who this record is for.
+        ref: EngineSettingsDestinationRef.APPLICATION_RETENTION_ENFORCEMENT,
+        requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN, CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.RETENTION_ENFORCEMENT_RECORDS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
     {
         /**
          * The application-wide trail.
@@ -761,12 +961,25 @@ export const SCAFFOLD_SETTINGS_HUB_CONFIG = {
         { destinationRef: EngineSettingsDestinationRef.BILLING, categoryRef: 'organization', label: 'Billing', order: 4 },
         { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_REFERRALS, categoryRef: 'organization', label: 'Referrals', order: 5 },
         { destinationRef: EngineSettingsDestinationRef.API_KEYS, categoryRef: 'organization', label: 'API keys', order: 6 },
-        { destinationRef: EngineSettingsDestinationRef.PROVIDER_CREDENTIALS, categoryRef: 'organization', label: 'Integrations', order: 7 },
-        { destinationRef: EngineSettingsDestinationRef.SSO, categoryRef: 'organization', label: 'SSO — OIDC / SAML', order: 8 },
-        { destinationRef: EngineSettingsDestinationRef.SCIM, categoryRef: 'organization', label: 'SCIM provisioning', order: 9 },
-        { destinationRef: EngineSettingsDestinationRef.SIEM, categoryRef: 'organization', label: 'SIEM export', order: 10 },
-        { destinationRef: EngineSettingsDestinationRef.WEBHOOKS, categoryRef: 'organization', label: 'Webhooks', order: 11 },
-        { destinationRef: EngineSettingsDestinationRef.AUDIT_LOGS, categoryRef: 'organization', label: 'Audit log', order: 12 },
+        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_OAUTH_CLIENTS, categoryRef: 'organization', label: 'OAuth clients', order: 7 },
+        { destinationRef: EngineSettingsDestinationRef.PROVIDER_CREDENTIALS, categoryRef: 'organization', label: 'Integrations', order: 8 },
+        { destinationRef: EngineSettingsDestinationRef.SSO, categoryRef: 'organization', label: 'SSO — OIDC / SAML', order: 9 },
+        { destinationRef: EngineSettingsDestinationRef.SCIM, categoryRef: 'organization', label: 'SCIM provisioning', order: 10 },
+        { destinationRef: EngineSettingsDestinationRef.SIEM, categoryRef: 'organization', label: 'SIEM export', order: 11 },
+        { destinationRef: EngineSettingsDestinationRef.WEBHOOKS, categoryRef: 'organization', label: 'Webhooks', order: 12 },
+        { destinationRef: EngineSettingsDestinationRef.AUDIT_LOGS, categoryRef: 'organization', label: 'Audit log', order: 13 },
+        { destinationRef: EngineSettingsDestinationRef.INBOUND_DELIVERIES, categoryRef: 'organization', label: 'Inbound deliveries', order: 14 },
+        // Scaffolded like everything else so a new application starts complete: an application with no
+        // organization type declaring `servesAsProvider` deletes these two lines.
+        { destinationRef: EngineSettingsDestinationRef.SERVICE_PROVIDERS, categoryRef: 'organization', label: 'Service providers', order: 15 },
+        { destinationRef: EngineSettingsDestinationRef.SERVICE_CLIENTS, categoryRef: 'organization', label: 'Clients', order: 16 },
+        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_LEGAL_HOLDS, categoryRef: 'organization', label: 'Legal holds', order: 17 },
+        // Receiving email (#1600). An application with no inbound email provider deletes these; one whose organization
+        // types declare no `servesAsProvider` deletes `client-mailboxes`.
+        { destinationRef: EngineSettingsDestinationRef.EMAIL_DOMAINS, categoryRef: 'organization', label: 'Email domains', order: 18 },
+        { destinationRef: EngineSettingsDestinationRef.CLIENT_MAILBOXES, categoryRef: 'organization', label: 'Client mailboxes', order: 19 },
+        // Experts' corrections to agent work (#1599). An application with no agents deletes it.
+        { destinationRef: EngineSettingsDestinationRef.AGENT_WORK_REVIEW, categoryRef: 'organization', label: 'Agent work review', order: 20 },
         // Administration mirrors the organization order — General, the population, entitlements and
         // commerce, then the integration surfaces in the same sequence — so an operator who has learned
         // one rail has learned the other, and the scope distinction reads as a scope distinction rather
@@ -783,6 +996,8 @@ export const SCAFFOLD_SETTINGS_HUB_CONFIG = {
         { destinationRef: EngineSettingsDestinationRef.APPLICATION_AUDIT_LOGS, categoryRef: 'administration', label: 'Audit log', order: 9 },
         { destinationRef: EngineSettingsDestinationRef.APPLICATION_ACCESS_GRANTS, categoryRef: 'administration', label: 'Access grants', order: 10 },
         { destinationRef: EngineSettingsDestinationRef.APPLICATION_VERSIONS, categoryRef: 'administration', label: 'Versions', order: 11 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_INBOUND_DELIVERIES, categoryRef: 'administration', label: 'Inbound deliveries', order: 12 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_RETENTION_ENFORCEMENT, categoryRef: 'administration', label: 'Retention enforcement', order: 13 },
     ],
     defaultSectionRef: 'profile',
 };

package/dist/esm/core/config/engine-settings-destinations.js.map

@@ -1 +1 @@
-{"version":3,"file":"engine-settings-destinations.js","sourceRoot":"","sources":["../../../../../src/core/config/engine-settings-destinations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACjL,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAG9F,iFAAiF;AACjF,MAAM,oBAAoB,GAAa,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;AAE5F;;;;;;;;GAQG;AACH,MAAM,gCAAgC,GAAa,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAC5C,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAC9C,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAC9C,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAmC;IAC1E,kEAAkE;IAClE;QACE,GAAG,EAAE,4BAA4B,CAAC,OAAO;QACzC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,kBAAkB;YACjD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,QAAQ;QAC1C,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE;KAC9F;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,UAAU;QAC5C,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,UAAU,EAAE;KAChG;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,WAAW;QAC7C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,qBAAqB;YACpD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,oFAAoF;QACpF,kFAAkF;QAClF,iFAAiF;QACjF,kFAAkF;QAClF,yFAAyF;QACzF,GAAG,EAAE,4BAA4B,CAAC,cAAc;QAChD,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,WAAW,EAAE;KACjG;IACD;QACE,0DAA0D;QAC1D,EAAE;QACF,2FAA2F;QAC3F,6FAA6F;QAC7F,8FAA8F;QAC9F,2FAA2F;QAC3F,kBAAkB;QAClB,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,gFAAgF;QAChF,GAAG,EAAE,4BAA4B,CAAC,uBAAuB;QACzD,gGAAgG;QAChG,EAAE;QACF,gGAAgG;QAChG,gGAAgG;QAChG,iGAAiG;QACjG,mBAAmB;QACnB,EAAE;QACF,iGAAiG;QACjG,kGAAkG;QAClG,0FAA0F;QAC1F,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,SAAS;oBACd,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,kBAAkB,EAAE;iBACxG;gBACD;oBACE,GAAG,EAAE,aAAa;oBAClB,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,yBAAyB;wBACxD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD,kEAAkE;IAClE;QACE,GAAG,EAAE,4BAA4B,CAAC,oBAAoB;QACtD,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,aAAa;YAC5C,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,8EAA8E;QAC9E,gFAAgF;QAChF,0EAA0E;QAC1E,wEAAwE;QACxE,GAAG,EAAE,4BAA4B,CAAC,OAAO;QACzC,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,wFAAwF;QACxF,iGAAiG;QACjG,iGAAiG;QACjG,0FAA0F;QAC1F,GAAG,EAAE,4BAA4B,CAAC,kBAAkB;QACpD,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,kBAAkB;YACjD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,OAAO;QACzC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,0BAA0B,CAAC,EAAE;QAC3E,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,gDAAgD;QAChD,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,OAAO,EAAE;KAC7F;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,QAAQ;QAC1C,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,YAAY;YAC3C,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,4FAA4F;QAC5F,qFAAqF;QACrF,gGAAgG;QAChG,mFAAmF;QACnF,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,qBAAqB;QACrB,GAAG,EAAE,4BAA4B,CAAC,oBAAoB;QACtD,aAAa,EAAE,oBAAoB;QACnC,+FAA+F;QAC/F,8FAA8F;QAC9F,gGAAgG;QAChG,oBAAoB;QACpB,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,SAAS;oBACd,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,+BAA+B,EAAE;iBACrH;gBACD;oBACE,GAAG,EAAE,aAAa;oBAClB,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,wBAAwB;wBACvD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD,kEAAkE;IAClE,kEAAkE;IAClE,sEAAsE;IACtE,2EAA2E;IAC3E;QACE,GAAG,EAAE,4BAA4B,CAAC,GAAG;QACrC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,sBAAsB,CAAC,EAAE;QACvE,oBAAoB,EAAE,WAAW,CAAC,cAAc;QAChD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,mBAAmB;oBACxB,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,uBAAuB;wBACtD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,4BAA4B;wBAC3D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,IAAI;QACtC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,uBAAuB,CAAC,EAAE;QACxE,oBAAoB,EAAE,WAAW,CAAC,sBAAsB;QACxD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,mBAAmB;oBACxB,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,qCAAqC;wBACpE,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,aAAa;oBAClB,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,wBAAwB;wBACvD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,IAAI;QACtC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,uBAAuB,CAAC,EAAE;QACxE,oBAAoB,EAAE,WAAW,CAAC,qBAAqB;QACvD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,aAAa;oBAClB,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,+BAA+B;wBAC9D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,wBAAwB;oBAC7B,KAAK,EAAE,mBAAmB;oBAC1B,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,8BAA8B;wBAC7D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,QAAQ;QAC1C,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,2BAA2B,CAAC,EAAE;QAC5E,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;QACtD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,oBAAoB;oBACzB,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,2BAA2B;wBAC1D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,qCAAqC;wBACpE,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,UAAU;QAC5C,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,UAAU;YACzC,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE;;;;;;;;;;;;;;;;WAgBG;QACH,GAAG,EAAE,4BAA4B,CAAC,yBAAyB;QAC3D,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,qBAAqB;YACpD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,6FAA6F;QAC7F,kGAAkG;QAClG,4FAA4F;QAC5F,mFAAmF;QACnF,GAAG,EAAE,4BAA4B,CAAC,sBAAsB;QACxD,aAAa,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;QACzC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,SAAS;YACxC,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IAED,kEAAkE;IAClE,EAAE;IACF,mFAAmF;IACnF,kGAAkG;IAClG,EAAE;IACF,+FAA+F;IAC/F,qFAAqF;IACrF,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,8FAA8F;IAC9F,0EAA0E;IAC1E;QACE,GAAG,EAAE,4BAA4B,CAAC,mBAAmB;QACrD,aAAa,EAAE,gCAAgC;QAC/C,qEAAqE;QACrE,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,oBAAoB;QACtD,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,8FAA8F;QAC9F,+FAA+F;QAC/F,8FAA8F;QAC9F,uCAAuC;QACvC,GAAG,EAAE,4BAA4B,CAAC,wBAAwB;QAC1D,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,oBAAoB;QACtD,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,eAAe;QACjD,aAAa,EAAE,gCAAgC;QAC/C,gGAAgG;QAChG,8FAA8F;QAC9F,yEAAyE;QACzE,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,+BAA+B;oBACpC,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,sBAAsB;wBACrD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,6BAA6B;oBAClC,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,2BAA2B;wBAC1D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,gGAAgG;QAChG,+FAA+F;QAC/F,cAAc;QACd,GAAG,EAAE,4BAA4B,CAAC,gBAAgB;QAClD,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oCAAoC;YACnE,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,gBAAgB;QAClD,aAAa,EAAE,gCAAgC;QAC/C,+FAA+F;QAC/F,+BAA+B;QAC/B,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,yBAAyB;oBAC9B,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,8BAA8B;wBAC7D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,oCAAoC;oBACzC,KAAK,EAAE,mBAAmB;oBAC1B,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,6BAA6B;wBAC5D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,oBAAoB;QACtD,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,gCAAgC;oBACrC,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;wBACzD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,mCAAmC;oBACxC,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,oCAAoC;wBACnE,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8BG;QACH,GAAG,EAAE,4BAA4B,CAAC,eAAe;QACjD,aAAa,EAAE,gCAAgC;QAC/C,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,0BAA0B,CAAC,EAAE;QAC3E,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,0BAA0B;oBAC/B,KAAK,EAAE,UAAU;oBACjB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,QAAQ;wBACvC,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,4BAA4B;oBACjC,KAAK,EAAE,YAAY;oBACnB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,UAAU;wBACzC,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,yBAAyB;QAC3D,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,yBAAyB;YACxD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,2FAA2F;QAC3F,+FAA+F;QAC/F,+FAA+F;QAC/F,gFAAgF;QAChF,GAAG,EAAE,4BAA4B,CAAC,yBAAyB;QAC3D,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,yBAAyB;YACxD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE;;;;;;;;;WASG;QACH,GAAG,EAAE,4BAA4B,CAAC,sBAAsB;QACxD,aAAa,EAAE,CAAC,cAAc,CAAC,qBAAqB,EAAE,cAAc,CAAC,yBAAyB,CAAC;QAC/F,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,sBAAsB;YACrD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,+CAA+C;CAChD,CAAC;AAGF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,UAAU,EAAE;QACV,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QACrF,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;QACnG,wFAAwF;QACxF,2FAA2F;QAC3F,6FAA6F;QAC7F,0FAA0F;QAC1F,+EAA+E;QAC/E,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE;KACtG;IACD,UAAU,EAAE;QACV;;;;;;;;;;;;;;;WAeG;QACH,EAAE,cAAc,EAAE,4BAA4B,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QAC5G,EAAE,cAAc,EAAE,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QAC9G,EAAE,cAAc,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE;QAClH,EAAE,cAAc,EAAE,4BAA4B,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;QACpH,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;QACvH,gGAAgG;QAChG,sDAAsD;QACtD,EAAE,cAAc,EAAE,4BAA4B,CAAC,uBAAuB,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE;QACjI,EAAE,cAAc,EAAE,4BAA4B,CAAC,oBAAoB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QAC9H,EAAE,cAAc,EAAE,4BAA4B,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QACjH,gGAAgG;QAChG,kFAAkF;QAClF,EAAE,cAAc,EAAE,4BAA4B,CAAC,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE;QACvI,EAAE,cAAc,EAAE,4BAA4B,CAAC,yBAAyB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE;QACxI,EAAE,cAAc,EAAE,4BAA4B,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QACjH,EAAE,cAAc,EAAE,4BAA4B,CAAC,sBAAsB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE;QAClI,EAAE,cAAc,EAAE,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QACnH,EAAE,cAAc,EAAE,4BAA4B,CAAC,oBAAoB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE;QACnI,EAAE,cAAc,EAAE,4BAA4B,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE;QACvH,EAAE,cAAc,EAAE,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE;QACxH,EAAE,cAAc,EAAE,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;QACnH,EAAE,cAAc,EAAE,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE;QACpH,EAAE,cAAc,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE;QACvH,4FAA4F;QAC5F,gGAAgG;QAChG,gGAAgG;QAChG,+BAA+B;QAC/B,EAAE,cAAc,EAAE,4BAA4B,CAAC,mBAAmB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QAC/H,EAAE,cAAc,EAAE,4BAA4B,CAAC,wBAAwB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE;QACzI,EAAE,cAAc,EAAE,4BAA4B,CAAC,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE;QACnI,EAAE,cAAc,EAAE,4BAA4B,CAAC,oBAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QACjI,EAAE,cAAc,EAAE,4BAA4B,CAAC,yBAAyB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE;QAC3I,EAAE,cAAc,EAAE,4BAA4B,CAAC,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE;QACrI,EAAE,cAAc,EAAE,4BAA4B,CAAC,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE;QACtI,EAAE,cAAc,EAAE,4BAA4B,CAAC,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;QAChI,EAAE,cAAc,EAAE,4BAA4B,CAAC,oBAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QACjI,EAAE,cAAc,EAAE,4BAA4B,CAAC,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE;QACpI,EAAE,cAAc,EAAE,4BAA4B,CAAC,yBAAyB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,EAAE;QAC5I,EAAE,cAAc,EAAE,4BAA4B,CAAC,oBAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE;KACnI;IACD,iBAAiB,EAAE,SAAS;CAC7B,CAAC","sourcesContent":["/**\n * The engine's settings DESTINATION catalog — addressable, and deliberately unplaced.\n *\n * Each entry says what a settings surface IS: its target, and the gating that\n * decides whether the current principal may see it at all. **No entry carries a\n * `categoryRef`, an `order` or a `label`**, because those are placement, and\n * placement belongs to the application (`SettingsPlacement`).\n *\n * This file replaced `settings-hub.frontend.defaults.ts`, which shipped a fully\n * PLACED hub as a framework default. That default was the reason an application\n * could not add, remove, reorder or rename a settings section: the render path\n * read the framework's arrangement, so an application had no arrangement of its\n * own to read. Splitting destination from placement keeps the engine owning what\n * a destination MEANS while the application owns where it sits — and makes\n * \"remove this section\" expressible, which under a merged default it was not.\n *\n * Gating notes carried over from the previous default, because they are\n * destination facts rather than placement facts:\n *\n * - Account destinations are `USER_SELF`-shaped and always available to an\n *   authenticated user; the category's scope does the hiding.\n * - Organization destinations gate on org owner/admin roles, and several\n *   additionally on a runtime capability, so an application that excludes the\n *   backing resource surfaces nothing. This is the \"face to right management of\n *   the user\" gating — a member who cannot manage the org sees no such section.\n *\n * Sub-tab labels stay on the target: they describe the destination's internal\n * structure, not its position in the rail.\n *\n * ## The refs themselves live in `@wildo-ai/saas-models`\n *\n * `EngineSettingsDestinationRef` and `ENGINE_SETTINGS_DESTINATION_REFS` are declared in\n * `saas-models` (`frontend-definitions/settings-destination-ref.definitions.ts`); this file\n * declares only what each ref MEANS. The split exists because the ref vocabulary has a\n * backend-side consumer this package can never serve: `validatePlacementPlan`'s `UNKNOWN_SUBJECT`\n * hard floor is held by the app-creation semantic authority, which must not depend on\n * `saas-frontend-lib`. Everything that names a component, a panel or a sub-tab stayed here; the\n * sixteen ids did not.\n *\n * The enum is deliberately NOT re-exported from this module, from the package root, or from\n * `companion-exports`: a symbol reachable through two public doors is a symbol whose two doors\n * drift. Every consumer — including this package's own — imports it from `@wildo-ai/saas-models`.\n */\nimport { CoreFeature, CoreResourceOperation, CoreResourceType, CORE_APP_ROLES, CORE_ORG_ROLES, EngineSettingsDestinationRef, ResourcePrimaryScope } from '@wildo-ai/saas-models';\nimport { SettingsPanelRef, SettingsSectionTargetKind } from './settings-hub.frontend.schemas';\nimport type { SettingsDestination, SettingsHubConfig } from './settings-hub.frontend.schemas';\n\n/** Org-management destinations are visible to organization owners and admins. */\nconst ORG_MANAGEMENT_ROLES: string[] = [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN];\n\n/**\n * Application-administration destinations are visible to the application's own super-administrator.\n *\n * ONE role, deliberately, and not the wider `APP_ADMIN_*` family: every destination gated with this\n * is a surface whose resource ALSO requires `APP_ADMIN_SUPER_ADMIN` server-side, so admitting\n * `APP_ADMIN_VIEWER` or `APP_ADMIN_BILLING_MANAGER` here would render a rail entry that answers 403\n * on open — worse than absent, because it reads as a permission the operator has and a bug they hit.\n * Widen this only alongside the operation roles it would then have to match.\n */\nconst APPLICATION_ADMINISTRATION_ROLES: string[] = [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN];\n\n/**\n * Runtime capability key for \"billing is enabled for this app\". Wired in\n * `useLauncherRuntimeAvailabilityContext` (`runtimeCapabilities.billingEnabled`);\n * there is no enum for capability keys yet, so the launcher-config string is the\n * single source of truth.\n */\nconst BILLING_ENABLED_CAPABILITY = 'billingEnabled';\n\n/**\n * Runtime capability keys for the enterprise-config features. Unlike billing\n * (which reads `appConfig.billing.enabled`), these have no app-config toggle.\n *\n * **They are ENTITLEMENT keys, not registration keys**, and the difference decides whether these\n * sections appear at all. `useLauncherRuntimeAvailabilityContext` computes each one as\n * `isFeatureOffered(CoreFeature.X)` — \"does this application OFFER the feature\", meaning the\n * organization is entitled to it OR an upgrade/add-on in the billing catalogue grants it. Keep\n * these string literals in sync with the keys emitted there.\n *\n * This docblock said the opposite until 2026-09-17: that they were \"wired from resource-registration\n * presence (`hasResource(ORGANIZATION_*_CONFIG)`), so a destination auto-hides when its app excludes\n * the resource and otherwise degrades to org-admin role gating.\" No `hasResource` call has ever\n * produced these keys. The correction matters because the two readings differ exactly where it hurts:\n * under the old one, an application that REGISTERS the resource always sees the section, so the\n * sections are effectively always on; under the truth, an application that registers the resource,\n * migrates its tables and places the destination still shows NOTHING unless some product grants the\n * feature or the feature defaults on.\n *\n * That is not hypothetical — it is how Wonder Todos, which has every one of these tables, offered\n * none of the four to any account on any plan until the gap was measured.\n *\n * **A false capability REMOVES the destination; it does not lock it.** `requiredCapabilities` is a\n * survival filter (`isLauncherRuntimeAvailabilitySatisfied`), so an unoffered feature produces an\n * absent rail entry rather than an upgrade prompt. `isFeatureOffered` is deliberately the OFFERED\n * axis rather than the ENTITLED one so that a billing-on organization whose plan lacks the feature\n * still survives the filter and can render an upgrade prompt via `FeatureGate`; an application whose\n * catalogue grants the feature nowhere offers it to nobody, and the section vanishes.\n */\nconst SSO_ENABLED_CAPABILITY = 'ssoEnabled';\nconst SCIM_ENABLED_CAPABILITY = 'scimEnabled';\nconst SIEM_ENABLED_CAPABILITY = 'siemEnabled';\nconst WEBHOOKS_ENABLED_CAPABILITY = 'webhooksEnabled';\n\n/**\n * Every settings destination the engine ships, keyed by `ref`.\n *\n * An application places these by ref. A placement naming a ref absent from this\n * catalog is refused at DEV startup rather than silently dropped — a settings\n * section that quietly fails to appear is indistinguishable from one an author\n * meant to remove.\n */\nexport const ENGINE_SETTINGS_DESTINATIONS: readonly SettingsDestination[] = [\n  // ── Account ────────────────────────────────────────────────────\n  {\n    ref: EngineSettingsDestinationRef.PROFILE,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.USER_SELF_PROFILES,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.SECURITY,\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.SECURITY },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPEARANCE,\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.APPEARANCE },\n  },\n  {\n    ref: EngineSettingsDestinationRef.PREFERENCES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.USER_SELF_PREFERENCES,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    // The caller's OWN received invitations (Approach P) — their own INVITED membership\n    // rows across orgs they haven't joined yet. Distinct from the org-admin's view of\n    // sent invites, which are now just INVITED-status rows in the 'members' list (no\n    // separate org 'invitations' section). No `requiredRoles`: any authenticated user\n    // can act on invitations addressed to them (authorized server-side by userId-ownership).\n    ref: EngineSettingsDestinationRef.MY_INVITATIONS,\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.INVITATIONS },\n  },\n  {\n    // Where a PERSON connects their own third-party accounts.\n    //\n    // No `requiredRoles`, and that is the substantive difference from the organization sibling\n    // rather than an omission. Every authenticated user owns their own connections; the resource\n    // declares `APP_USER` on every variant and no administrative variant at all, so authorization\n    // is by OWNERSHIP and adding a role gate here could only ever hide the screen from someone\n    // entitled to it.\n    //\n    // No `runtimeAvailability` gate either, for the organization destination's reason: gating on\n    // \"the application declared a provider\" would hide the screen exactly when somebody is looking\n    // for it, since providers are declared whether or not anyone has connected one.\n    ref: EngineSettingsDestinationRef.MY_PROVIDER_CREDENTIALS,\n    // TWO tabs, because the screen answers two questions and one of them has no resource behind it.\n    //\n    // \"Connect\" is the catalogue — what this person MAY connect — and it is a bespoke panel because\n    // connecting is a flow out to a vendor rather than a row somebody creates. \"Credentials\" is the\n    // ordinary resource list: what they HAVE connected, plus the pasted keys that never went through\n    // a vendor at all.\n    //\n    // Connect comes FIRST deliberately. On the day somebody opens this screen for the first time the\n    // list is empty, and an empty table is the least informative thing to greet them with; it is also\n    // the tab the connection callback returns them to, carrying the outcome it has to render.\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'connect',\n          label: 'Connect',\n          target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.CONNECTED_ACCOUNTS },\n        },\n        {\n          ref: 'credentials',\n          label: 'Credentials',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.USER_PROVIDER_CREDENTIALS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  // ── Organization ───────────────────────────────────────────────\n  {\n    ref: EngineSettingsDestinationRef.ORGANIZATION_GENERAL,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATIONS,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    // NOTE: no separate org-level \"invitations\" destination — invitations are now\n    // INVITED-status rows inside the ORGANIZATION_MEMBERS junction, so they surface\n    // in this list (filter by status) rather than a parallel destination. The\n    // invitee's own pending invitations live in the 'my-invitations' panel.\n    ref: EngineSettingsDestinationRef.MEMBERS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATION_MEMBERS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // The tenant's internal structure, on the rail rather than as a tab inside General. Two\n    // different kinds of surface: General is a RECORD — a column of decisions about the tenant — and\n    // a unit hierarchy is a POPULATION you navigate. Nested, it was also reachable only by opening a\n    // pane a reader had no other reason to open, which is a poor place to keep the org chart.\n    ref: EngineSettingsDestinationRef.ORGANIZATION_UNITS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATION_UNITS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.BILLING,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [BILLING_ENABLED_CAPABILITY] },\n    // THE billing home — a bespoke panel over the aggregated BillingContext\n    // state (subscription, plans + checkout, usage, invoices, portal link).\n    // Deliberately NOT per-resource LIST sub-tabs: the billing child resources\n    // are routed under the billing account (`REQUIRES_CONTEXT`), so org-scoped\n    // generic panels cannot address them, while the aggregated state endpoint is\n    // org-addressable and auto-creates the account.\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.BILLING },\n  },\n  {\n    ref: EngineSettingsDestinationRef.API_KEYS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORG_API_KEYS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // Where a tenant connects its OWN third-party accounts. Until this existed the resource had\n    // backend doors, an encrypted store, migrations and audit events, and no way for the\n    // administrator it is FOR to reach any of it — so every tenant kept acting as the application's\n    // own third-party principal, which is the defect the resource was built to remove.\n    //\n    // No `runtimeAvailability` gate: unlike SSO or SIEM this needs no capability to be switched on,\n    // and gating it on \"the application declared a provider\" would hide the screen exactly when an\n    // operator is looking for it, since an application declares providers whether or not any tenant\n    // has connected one.\n    ref: EngineSettingsDestinationRef.PROVIDER_CREDENTIALS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    // TWO tabs, for the person-scope destination's reason: \"Connect\" is a flow out to a vendor and\n    // has no resource behind it, while \"Credentials\" is the ordinary list of what the tenant HAS.\n    // Connect comes first because it is where the connection callback returns, carrying the outcome\n    // it has to render.\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'connect',\n          label: 'Connect',\n          target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.ORGANIZATION_CONNECTED_ACCOUNTS },\n        },\n        {\n          ref: 'credentials',\n          label: 'Credentials',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORG_PROVIDER_CREDENTIALS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  // ── Organization · enterprise credentials & compliance ─────────\n  // Each gates on org-admin role + a per-feature runtime capability\n  // (resource-registration presence). Multi-resource domains split into\n  // sub-tabs pairing the singleton config (READ) with its collection (LIST).\n  {\n    ref: EngineSettingsDestinationRef.SSO,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [SSO_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.SINGLE_SIGN_ON,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'sso-configuration',\n          label: 'Configuration',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'sso-connections',\n          label: 'Connections',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SSO_CONNECTIONS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.SCIM,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [SCIM_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.DIRECTORY_PROVISIONING,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'scim-provisioning',\n          label: 'Provisioning',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'scim-tokens',\n          label: 'Tokens',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SCIM_TOKENS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.SIEM,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [SIEM_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.SECURITY_EVENT_EXPORT,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'siem-export',\n          label: 'Export',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'siem-failed-deliveries',\n          label: 'Failed deliveries',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SIEM_DELIVERY_DLQ,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.WEBHOOKS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [WEBHOOKS_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.M2M_WEBHOOK_DELIVERY,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'webhooks-endpoints',\n          label: 'Endpoints',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_WEBHOOK_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'webhooks-delivery-log',\n          label: 'Delivery log',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.AUDIT_LOGS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.AUDIT_LOGS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    /**\n     * What this organization is entitled to, and — for a platform administrator — the console that\n     * changes it.\n     *\n     * **No `requiredRoles`, and that is the substantive decision.** `organizationFeatures` READ is\n     * `ORG_MEMBER`, so any member may see what their organization actually has; the three operations\n     * that MUTATE it (`enable_feature`, `disable_feature`, `reset_features`) plus UPDATE are\n     * `APP_ADMIN_SUPER_ADMIN` on the resource itself. One screen therefore serves both readers\n     * honestly — a read-only summary for a member, a grant/withdraw console for an operator — without\n     * this destination having to know which one is looking.\n     *\n     * Gating it on org management instead would hide from members the exact page that explains why a\n     * feature they were just told to upgrade for is unavailable, which is the moment it is worth most.\n     *\n     * READ rather than LIST, because the resource is 1:1 with its organization: the URL builder drops\n     * the `{id}` segment for a one-to-one parent, and the factory declares no LIST at all.\n     */\n    ref: EngineSettingsDestinationRef.ORGANIZATION_ENTITLEMENTS,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATION_FEATURES,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    // Referral codes belong to the billing DOMAIN and to the ORGANIZATION scope — the resource's\n    // primary scope really is `ORGANIZATIONS`, unlike products/prices/promotions beside it, which are\n    // application-scoped. So it is placed with the tenant's settings rather than the operator's\n    // catalogue, and gated on `ORG_OWNER` to match the resource's own READ/LIST roles.\n    ref: EngineSettingsDestinationRef.ORGANIZATION_REFERRALS,\n    requiredRoles: [CORE_ORG_ROLES.ORG_OWNER],\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.REFERRALS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n\n  // ── Application administration ─────────────────────────────────\n  //\n  // The operator's own surfaces. An application places these in a category scoped to\n  // `ResourcePrimaryScope.APPLICATION`, and that scope is what hides the whole group from a tenant.\n  //\n  // None of them carries a `runtimeAvailability` capability gate, and the omission is a decision\n  // rather than an oversight. The org-scope SSO/SCIM/SIEM/webhook destinations gate on\n  // `isFeatureOffered(CoreFeature.X)` because those are features a TENANT buys, and a tenant that\n  // cannot buy one should not see its configuration screen. An APPLICATION does not buy anything\n  // from itself: it either ships the capability or it does not, and if it does not, the destination\n  // is simply not placed. Gating the operator's own screens on the tenant entitlement catalogue\n  // would make an application's configuration depend on its own price list.\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_GENERAL,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    // 1:1 with the application, so READ addresses it with no id segment.\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_METADATA,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_VERSIONS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_VERSIONS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // The application-scope twin of ORGANIZATION_ENTITLEMENTS, and the pair is not a duplication:\n    // `M2M_WEBHOOK_DELIVERY` is declared `scopeBoundary: true`, so enabling it for the application\n    // does NOT enable it for any organization. An operator who cannot see both states cannot tell\n    // which of the two refused a delivery.\n    ref: EngineSettingsDestinationRef.APPLICATION_ENTITLEMENTS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_FEATURES,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_API_KEYS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_API_KEYS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_SSO,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    // Two tabs mirroring the organization sibling: the singleton configuration, then the collection\n    // of connections. LIST rather than READ for the connections because the application variant's\n    // READ is an `INTERNAL_CALL` and has no route — only LIST is `API_CALL`.\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'application-sso-configuration',\n          label: 'Configuration',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_SSO_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'application-sso-connections',\n          label: 'Connections',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_SSO_CONNECTIONS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    // ONE target where the organization sibling has two, because `APPLICATION_SCIM_TOKENS` does not\n    // exist — the token resource is organization-scoped only. A second tab here would have nothing\n    // to address.\n    ref: EngineSettingsDestinationRef.APPLICATION_SCIM,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_SCIM_PROVISIONING_CONFIG,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_SIEM,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    // LIST for the dead-letter queue: its READ is `REPOSITORY_ONLY` and therefore route-less, same\n    // as the organization sibling.\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'application-siem-export',\n          label: 'Export',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_SIEM_EXPORT_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'application-siem-failed-deliveries',\n          label: 'Failed deliveries',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_SIEM_DELIVERY_DLQ,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_WEBHOOKS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'application-webhooks-endpoints',\n          label: 'Endpoints',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_WEBHOOK_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'application-webhooks-delivery-log',\n          label: 'Delivery log',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_M2M_WEBHOOK_DELIVERY_LOG,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    /**\n     * What the application SELLS. Not to be merged with the organization `BILLING` destination,\n     * which is what one tenant BOUGHT — same domain, opposite side of the transaction, and only one\n     * of them is editable by the person looking at it.\n     *\n     * Tabs rather than separate destinations because a promotion is meaningless without the product\n     * it discounts: an operator pricing a plan moves between them continuously, and splitting them\n     * across the rail would make that a navigation task.\n     *\n     * ## There is no PRICES tab, and its removal is the point of this note\n     *\n     * One was placed here until 2026-09-18, targeting `PRICES.LIST`, and it could never load: a\n     * price is a COMPOSITION child of a product, so the only LIST route the engine generates for it\n     * is `/api/v1/products/{productId}/prices`. Measured against the running backend that day —\n     * `/api/v1/products` 200, `/api/v1/promotions` 200, `/api/v1/prices` **404** — and the pane\n     * rendered \"We couldn't load the list\" because the frontend could not build a URL for a tab\n     * the engine itself was placing at rail level.\n     *\n     * Making a bare `/prices` exist was tried and REJECTED on measurement, which is worth recording\n     * so it is not retried. Declaring the product edge `OPTIONAL_CONTEXT` changes nothing on its\n     * own, because `generateParentCombinations` drops the empty parent combination whenever any URL\n     * parent exists. Removing that guard DOES produce `/api/v1/prices` — and, in the same pass, 16\n     * tenant-free `organizationMembers` routes (`/api/v1/organization-members`,\n     * `/api/v1/organization-members/{id}`, …), because that resource's organization parent is also\n     * optional in its built configuration. The guard is load-bearing tenancy, not an oversight.\n     *\n     * So prices are reached where they live: the Products tab lists products, and a product's own\n     * record surfaces its prices as the composition child it is. That is one navigation step, and\n     * it is the step the domain already describes — this destination's original note said it\n     * itself, that \"a price is meaningless without its product\".\n     */\n    ref: EngineSettingsDestinationRef.BILLING_CATALOG,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    runtimeAvailability: { requiredCapabilities: [BILLING_ENABLED_CAPABILITY] },\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'billing-catalog-products',\n          label: 'Products',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.PRODUCTS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n        {\n          ref: 'billing-catalog-promotions',\n          label: 'Promotions',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.PROMOTIONS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_OAUTH_CLIENTS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // The review queue for application-wide elevations. Role-gated like its neighbours and NOT\n    // additionally grant-gated, deliberately: reading which elevations exist is how the two-person\n    // rule is supervised, and putting the supervision behind the thing it supervises would mean an\n    // administrator needs an elevation to discover that elevations are being taken.\n    ref: EngineSettingsDestinationRef.APPLICATION_ACCESS_GRANTS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_ACCESS_GRANTS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    /**\n     * The application-wide trail.\n     *\n     * `requiredRoles` names BOTH roles the resource accepts, not just the super-administrator:\n     * `APP_AUDIT_EVIDENCE_READER` exists precisely so that reading the trail can be granted without\n     * granting anything else, and a rail that hid the section from that role would make the role\n     * unusable through the product — the holder would have the permission and no way to exercise it.\n     * This is the one Administration destination whose gate is deliberately wider than\n     * `APPLICATION_ADMINISTRATION_ROLES`.\n     */\n    ref: EngineSettingsDestinationRef.APPLICATION_AUDIT_LOGS,\n    requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN, CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER],\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_AUDIT_LOGS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  // NO tenant-directory and NO user-directory destination here, deliberately — see the note under\n  // `EngineSettingsDestinationRef` for why neither is a placement problem. Both reads that look like\n  // they would serve one are confined or grant-gated ON PURPOSE, and placing them would advertise a\n  // population the section cannot actually show.\n];\n\n\n/**\n * The full placement set `wildo init` scaffolds into a new application's config.\n *\n * **This is GENERATION INPUT, not a runtime fallback.** Nothing in the render\n * path may read it — `resolveSettingsHubConfig()` resolves the application's own\n * authored config and nothing else. The distinction is the entire point of the\n * split: a scaffold is a starting arrangement an author edits and owns, whereas\n * a default is an arrangement that reasserts itself and cannot be edited away.\n *\n * It places every engine destination so a new application starts complete and\n * edits DOWN, which is the direction that surfaces what exists. Starting empty\n * would hide the catalog behind documentation.\n *\n * The `label`s here are the English strings the previous framework default\n * carried, and they are NOT a temporary convenience to be removed once label\n * generation runs. The companion feeds each authored label to the labellize\n * prompt as that key's `purpose`, so it is the wording INTENT generation\n * translates — delete it and the model falls back to inventing from the ref.\n */\nexport const SCAFFOLD_SETTINGS_HUB_CONFIG: SettingsHubConfig = {\n  categories: [\n    { ref: 'account', label: 'Account', scope: ResourcePrimaryScope.USER_SELF, order: 0 },\n    { ref: 'organization', label: 'Organization', scope: ResourcePrimaryScope.ORGANIZATIONS, order: 1 },\n    // The operator's own scope. Scaffolded like everything else so a new application starts\n    // complete: `APPLICATION` scope plus `APP_ADMIN_SUPER_ADMIN` on every destination means an\n    // ordinary member never sees the heading, and a category whose sections are all gated out is\n    // dropped rather than rendered empty — so placing it costs an application nothing and NOT\n    // placing it would hide the whole administration surface behind documentation.\n    { ref: 'administration', label: 'Administration', scope: ResourcePrimaryScope.APPLICATION, order: 2 },\n  ],\n  placements: [\n    /*\n     * A rail label NAMES the thing. It is not a friendlier word for it.\n     *\n     * Five of these were a gloss and every one of them cost a reader: \"User provisioning\" is SCIM,\n     * \"Audit streaming\" is SIEM, \"Connected accounts\" is integrations, \"Single sign-on\" is a choice\n     * between OIDC and SAML, and \"Teams\" is the organization-unit hierarchy. An administrator\n     * arrives at this rail having been told to \"set up SCIM\" or \"point the SIEM at us\", and none of\n     * those words was on the screen — so the item that answers the question is the one they scroll\n     * past. The gloss is also ambiguous in the direction that matters: \"user provisioning\" is what\n     * SSO just-in-time creation does as well, and \"connected accounts\" reads as the user's own\n     * social logins, which is a different pane in a different category.\n     *\n     * The protocol name is not jargon here. It is the term the vendor documentation, the IdP's own\n     * setup page and the person's ticket all use, and it is what they will search this rail for.\n     * Where a plain word IS the precise one — Members, Billing, Webhooks, API keys — it stays.\n     */\n    { destinationRef: EngineSettingsDestinationRef.PROFILE, categoryRef: 'account', label: 'Profile', order: 0 },\n    { destinationRef: EngineSettingsDestinationRef.SECURITY, categoryRef: 'account', label: 'Security', order: 1 },\n    { destinationRef: EngineSettingsDestinationRef.APPEARANCE, categoryRef: 'account', label: 'Appearance', order: 2 },\n    { destinationRef: EngineSettingsDestinationRef.PREFERENCES, categoryRef: 'account', label: 'Preferences', order: 3 },\n    { destinationRef: EngineSettingsDestinationRef.MY_INVITATIONS, categoryRef: 'account', label: 'Invitations', order: 4 },\n    // Same label as the organization placement below, deliberately: it is the same feature, and the\n    // CATEGORY is what says whose integrations these are.\n    { destinationRef: EngineSettingsDestinationRef.MY_PROVIDER_CREDENTIALS, categoryRef: 'account', label: 'Integrations', order: 5 },\n    { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_GENERAL, categoryRef: 'organization', label: 'General', order: 0 },\n    { destinationRef: EngineSettingsDestinationRef.MEMBERS, categoryRef: 'organization', label: 'Members', order: 1 },\n    // Beside Members, because the two are the same KIND of surface — who is in this tenant, and how\n    // it is arranged — and a reader looking for one is usually looking for the other.\n    { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_UNITS, categoryRef: 'organization', label: 'Organization units', order: 2 },\n    { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_ENTITLEMENTS, categoryRef: 'organization', label: 'Entitlements', order: 3 },\n    { destinationRef: EngineSettingsDestinationRef.BILLING, categoryRef: 'organization', label: 'Billing', order: 4 },\n    { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_REFERRALS, categoryRef: 'organization', label: 'Referrals', order: 5 },\n    { destinationRef: EngineSettingsDestinationRef.API_KEYS, categoryRef: 'organization', label: 'API keys', order: 6 },\n    { destinationRef: EngineSettingsDestinationRef.PROVIDER_CREDENTIALS, categoryRef: 'organization', label: 'Integrations', order: 7 },\n    { destinationRef: EngineSettingsDestinationRef.SSO, categoryRef: 'organization', label: 'SSO — OIDC / SAML', order: 8 },\n    { destinationRef: EngineSettingsDestinationRef.SCIM, categoryRef: 'organization', label: 'SCIM provisioning', order: 9 },\n    { destinationRef: EngineSettingsDestinationRef.SIEM, categoryRef: 'organization', label: 'SIEM export', order: 10 },\n    { destinationRef: EngineSettingsDestinationRef.WEBHOOKS, categoryRef: 'organization', label: 'Webhooks', order: 11 },\n    { destinationRef: EngineSettingsDestinationRef.AUDIT_LOGS, categoryRef: 'organization', label: 'Audit log', order: 12 },\n    // Administration mirrors the organization order — General, the population, entitlements and\n    // commerce, then the integration surfaces in the same sequence — so an operator who has learned\n    // one rail has learned the other, and the scope distinction reads as a scope distinction rather\n    // than as two unrelated menus.\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_GENERAL, categoryRef: 'administration', label: 'General', order: 0 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_ENTITLEMENTS, categoryRef: 'administration', label: 'Entitlements', order: 1 },\n    { destinationRef: EngineSettingsDestinationRef.BILLING_CATALOG, categoryRef: 'administration', label: 'Plans & pricing', order: 2 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_API_KEYS, categoryRef: 'administration', label: 'API keys', order: 3 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_OAUTH_CLIENTS, categoryRef: 'administration', label: 'OAuth clients', order: 4 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_SSO, categoryRef: 'administration', label: 'SSO — OIDC / SAML', order: 5 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_SCIM, categoryRef: 'administration', label: 'SCIM provisioning', order: 6 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_SIEM, categoryRef: 'administration', label: 'SIEM export', order: 7 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_WEBHOOKS, categoryRef: 'administration', label: 'Webhooks', order: 8 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_AUDIT_LOGS, categoryRef: 'administration', label: 'Audit log', order: 9 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_ACCESS_GRANTS, categoryRef: 'administration', label: 'Access grants', order: 10 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_VERSIONS, categoryRef: 'administration', label: 'Versions', order: 11 },\n  ],\n  defaultSectionRef: 'profile',\n};\n"]}
+{"version":3,"file":"engine-settings-destinations.js","sourceRoot":"","sources":["../../../../src/core/config/engine-settings-destinations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACjL,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAG9F,iFAAiF;AACjF,MAAM,oBAAoB,GAAa,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;AAE5F;;;;;;;;GAQG;AACH,MAAM,gCAAgC,GAAa,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAE1F;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAC5C,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAC9C,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAC9C,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAmC;IAC1E,kEAAkE;IAClE;QACE,GAAG,EAAE,4BAA4B,CAAC,OAAO;QACzC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,kBAAkB;YACjD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,QAAQ;QAC1C,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE;KAC9F;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,UAAU;QAC5C,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,UAAU,EAAE;KAChG;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,WAAW;QAC7C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,qBAAqB;YACpD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,oFAAoF;QACpF,kFAAkF;QAClF,iFAAiF;QACjF,kFAAkF;QAClF,yFAAyF;QACzF,GAAG,EAAE,4BAA4B,CAAC,cAAc;QAChD,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,WAAW,EAAE;KACjG;IACD;QACE,0DAA0D;QAC1D,EAAE;QACF,2FAA2F;QAC3F,6FAA6F;QAC7F,8FAA8F;QAC9F,2FAA2F;QAC3F,kBAAkB;QAClB,EAAE;QACF,6FAA6F;QAC7F,+FAA+F;QAC/F,gFAAgF;QAChF,GAAG,EAAE,4BAA4B,CAAC,uBAAuB;QACzD,gGAAgG;QAChG,EAAE;QACF,gGAAgG;QAChG,gGAAgG;QAChG,iGAAiG;QACjG,mBAAmB;QACnB,EAAE;QACF,iGAAiG;QACjG,kGAAkG;QAClG,0FAA0F;QAC1F,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,SAAS;oBACd,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,kBAAkB,EAAE;iBACxG;gBACD;oBACE,GAAG,EAAE,aAAa;oBAClB,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,yBAAyB;wBACxD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD,kEAAkE;IAClE;QACE,GAAG,EAAE,4BAA4B,CAAC,oBAAoB;QACtD,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,aAAa;YAC5C,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,8EAA8E;QAC9E,gFAAgF;QAChF,0EAA0E;QAC1E,wEAAwE;QACxE,GAAG,EAAE,4BAA4B,CAAC,OAAO;QACzC,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,wFAAwF;QACxF,iGAAiG;QACjG,iGAAiG;QACjG,0FAA0F;QAC1F,GAAG,EAAE,4BAA4B,CAAC,kBAAkB;QACpD,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,kBAAkB;YACjD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,OAAO;QACzC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,0BAA0B,CAAC,EAAE;QAC3E,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,6EAA6E;QAC7E,gDAAgD;QAChD,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,OAAO,EAAE;KAC7F;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,QAAQ;QAC1C,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,YAAY;YAC3C,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,8GAA8G;QAC9G,4GAA4G;QAC5G,0EAA0E;QAC1E,GAAG,EAAE,4BAA4B,CAAC,0BAA0B;QAC5D,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;YACzD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,4FAA4F;QAC5F,qFAAqF;QACrF,gGAAgG;QAChG,mFAAmF;QACnF,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,qBAAqB;QACrB,GAAG,EAAE,4BAA4B,CAAC,oBAAoB;QACtD,aAAa,EAAE,oBAAoB;QACnC,+FAA+F;QAC/F,8FAA8F;QAC9F,gGAAgG;QAChG,oBAAoB;QACpB,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,SAAS;oBACd,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,+BAA+B,EAAE;iBACrH;gBACD;oBACE,GAAG,EAAE,aAAa;oBAClB,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,wBAAwB;wBACvD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD,kEAAkE;IAClE,kEAAkE;IAClE,sEAAsE;IACtE,2EAA2E;IAC3E;QACE,GAAG,EAAE,4BAA4B,CAAC,GAAG;QACrC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,sBAAsB,CAAC,EAAE;QACvE,oBAAoB,EAAE,WAAW,CAAC,cAAc;QAChD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,mBAAmB;oBACxB,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,uBAAuB;wBACtD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,4BAA4B;wBAC3D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,IAAI;QACtC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,uBAAuB,CAAC,EAAE;QACxE,oBAAoB,EAAE,WAAW,CAAC,sBAAsB;QACxD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,mBAAmB;oBACxB,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,qCAAqC;wBACpE,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,aAAa;oBAClB,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,wBAAwB;wBACvD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,IAAI;QACtC,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,uBAAuB,CAAC,EAAE;QACxE,oBAAoB,EAAE,WAAW,CAAC,qBAAqB;QACvD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,aAAa;oBAClB,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,+BAA+B;wBAC9D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,wBAAwB;oBAC7B,KAAK,EAAE,mBAAmB;oBAC1B,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,8BAA8B;wBAC7D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,QAAQ;QAC1C,aAAa,EAAE,oBAAoB;QACnC,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,2BAA2B,CAAC,EAAE;QAC5E,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;QACtD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,oBAAoB;oBACzB,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,2BAA2B;wBAC1D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,qCAAqC;wBACpE,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,gGAAgG;QAChG,2FAA2F;QAC3F,uCAAuC;QACvC,GAAG,EAAE,4BAA4B,CAAC,kBAAkB;QACpD,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,+BAA+B;YAC9D,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,kGAAkG;QAClG,mFAAmF;QACnF,qFAAqF;QACrF,GAAG,EAAE,4BAA4B,CAAC,iBAAiB;QACnD,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,iCAAiC;oBACtC,KAAK,EAAE,OAAO;oBACd,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,8BAA8B;wBAC7D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,gHAAgH;oBAChH,GAAG,EAAE,0CAA0C;oBAC/C,KAAK,EAAE,wBAAwB;oBAC/B,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,kCAAkC;wBACjE,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,wFAAwF;QACxF,GAAG,EAAE,4BAA4B,CAAC,eAAe;QACjD,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,6BAA6B;oBAClC,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,mBAAmB;wBAClD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,6BAA6B;oBAClC,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,8BAA8B;wBAC7D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,gHAAgH;oBAChH,GAAG,EAAE,+BAA+B;oBACpC,KAAK,EAAE,iBAAiB;oBACxB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,8BAA8B;wBAC7D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,+GAA+G;oBAC/G,GAAG,EAAE,wCAAwC;oBAC7C,KAAK,EAAE,sBAAsB;oBAC7B,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,uCAAuC;wBACtE,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,UAAU;QAC5C,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,UAAU;YACzC,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE;;;;;;;;;;;;;;;;WAgBG;QACH,GAAG,EAAE,4BAA4B,CAAC,yBAAyB;QAC3D,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,qBAAqB;YACpD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,6FAA6F;QAC7F,kGAAkG;QAClG,4FAA4F;QAC5F,mFAAmF;QACnF,GAAG,EAAE,4BAA4B,CAAC,sBAAsB;QACxD,aAAa,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;QACzC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,SAAS;YACxC,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,6GAA6G;QAC7G,4GAA4G;QAC5G,GAAG,EAAE,4BAA4B,CAAC,wBAAwB;QAC1D,aAAa,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;QACzC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,WAAW;YAC1C,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,yGAAyG;QACzG,6GAA6G;QAC7G,GAAG,EAAE,4BAA4B,CAAC,aAAa;QAC/C,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;YACzD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,gHAAgH;QAChH,mDAAmD;QACnD,GAAG,EAAE,4BAA4B,CAAC,gBAAgB;QAClD,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,gBAAgB;YAC/C,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,gHAAgH;QAChH,mHAAmH;QACnH,+GAA+G;QAC/G,2EAA2E;QAC3E,GAAG,EAAE,4BAA4B,CAAC,iBAAiB;QACnD,aAAa,EAAE,oBAAoB;QACnC,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,0BAA0B;oBAC/B,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE,EAAE,IAAI,EAAE,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,gBAAgB,CAAC,wBAAwB,EAAE;iBAC9G;gBACD;oBACE,GAAG,EAAE,4BAA4B;oBACjC,KAAK,EAAE,iBAAiB;oBACxB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,2BAA2B;wBAC1D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,iCAAiC;oBACtC,KAAK,EAAE,sBAAsB;oBAC7B,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,gCAAgC;wBAC/D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,oBAAoB;oBACzB,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;wBACzD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IAED,kEAAkE;IAClE,EAAE;IACF,mFAAmF;IACnF,kGAAkG;IAClG,EAAE;IACF,+FAA+F;IAC/F,qFAAqF;IACrF,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,8FAA8F;IAC9F,0EAA0E;IAC1E;QACE,GAAG,EAAE,4BAA4B,CAAC,mBAAmB;QACrD,aAAa,EAAE,gCAAgC;QAC/C,qEAAqE;QACrE,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,oBAAoB;QACtD,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,8FAA8F;QAC9F,+FAA+F;QAC/F,8FAA8F;QAC9F,uCAAuC;QACvC,GAAG,EAAE,4BAA4B,CAAC,wBAAwB;QAC1D,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,oBAAoB;QACtD,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oBAAoB;YACnD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,eAAe;QACjD,aAAa,EAAE,gCAAgC;QAC/C,gGAAgG;QAChG,8FAA8F;QAC9F,yEAAyE;QACzE,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,+BAA+B;oBACpC,KAAK,EAAE,eAAe;oBACtB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,sBAAsB;wBACrD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,6BAA6B;oBAClC,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,2BAA2B;wBAC1D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,gGAAgG;QAChG,+FAA+F;QAC/F,cAAc;QACd,GAAG,EAAE,4BAA4B,CAAC,gBAAgB;QAClD,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,oCAAoC;YACnE,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,gBAAgB;QAClD,aAAa,EAAE,gCAAgC;QAC/C,+FAA+F;QAC/F,+BAA+B;QAC/B,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,yBAAyB;oBAC9B,KAAK,EAAE,QAAQ;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,8BAA8B;wBAC7D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,oCAAoC;oBACzC,KAAK,EAAE,mBAAmB;oBAC1B,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,6BAA6B;wBAC5D,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,oBAAoB;QACtD,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,gCAAgC;oBACrC,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;wBACzD,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,mCAAmC;oBACxC,KAAK,EAAE,cAAc;oBACrB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,oCAAoC;wBACnE,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA8BG;QACH,GAAG,EAAE,4BAA4B,CAAC,eAAe;QACjD,aAAa,EAAE,gCAAgC;QAC/C,mBAAmB,EAAE,EAAE,oBAAoB,EAAE,CAAC,0BAA0B,CAAC,EAAE;QAC3E,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,QAAQ;YACxC,OAAO,EAAE;gBACP;oBACE,GAAG,EAAE,0BAA0B;oBAC/B,KAAK,EAAE,UAAU;oBACjB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,QAAQ;wBACvC,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;gBACD;oBACE,GAAG,EAAE,4BAA4B;oBACjC,KAAK,EAAE,YAAY;oBACnB,MAAM,EAAE;wBACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;wBAClD,YAAY,EAAE,gBAAgB,CAAC,UAAU;wBACzC,SAAS,EAAE,qBAAqB,CAAC,IAAI;qBACtC;iBACF;aACF;SACF;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,yBAAyB;QAC3D,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,yBAAyB;YACxD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,2FAA2F;QAC3F,+FAA+F;QAC/F,+FAA+F;QAC/F,gFAAgF;QAChF,GAAG,EAAE,4BAA4B,CAAC,yBAAyB;QAC3D,aAAa,EAAE,gCAAgC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,yBAAyB;YACxD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,GAAG,EAAE,4BAA4B,CAAC,8BAA8B;QAChE,aAAa,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;QACrD,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,8BAA8B;YAC7D,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE,4GAA4G;QAC5G,GAAG,EAAE,4BAA4B,CAAC,iCAAiC;QACnE,aAAa,EAAE,CAAC,cAAc,CAAC,qBAAqB,EAAE,cAAc,CAAC,yBAAyB,CAAC;QAC/F,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,6BAA6B;YAC5D,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD;QACE;;;;;;;;;WASG;QACH,GAAG,EAAE,4BAA4B,CAAC,sBAAsB;QACxD,aAAa,EAAE,CAAC,cAAc,CAAC,qBAAqB,EAAE,cAAc,CAAC,yBAAyB,CAAC;QAC/F,MAAM,EAAE;YACN,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;YAClD,YAAY,EAAE,gBAAgB,CAAC,sBAAsB;YACrD,SAAS,EAAE,qBAAqB,CAAC,IAAI;SACtC;KACF;IACD,gGAAgG;IAChG,mGAAmG;IACnG,kGAAkG;IAClG,+CAA+C;CAChD,CAAC;AAGF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,UAAU,EAAE;QACV,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QACrF,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;QACnG,wFAAwF;QACxF,2FAA2F;QAC3F,6FAA6F;QAC7F,0FAA0F;QAC1F,+EAA+E;QAC/E,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE;KACtG;IACD,UAAU,EAAE;QACV;;;;;;;;;;;;;;;WAeG;QACH,EAAE,cAAc,EAAE,4BAA4B,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QAC5G,EAAE,cAAc,EAAE,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QAC9G,EAAE,cAAc,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE;QAClH,EAAE,cAAc,EAAE,4BAA4B,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;QACpH,EAAE,cAAc,EAAE,4BAA4B,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;QACvH,gGAAgG;QAChG,sDAAsD;QACtD,EAAE,cAAc,EAAE,4BAA4B,CAAC,uBAAuB,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE;QACjI,EAAE,cAAc,EAAE,4BAA4B,CAAC,oBAAoB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QAC9H,EAAE,cAAc,EAAE,4BAA4B,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QACjH,gGAAgG;QAChG,kFAAkF;QAClF,EAAE,cAAc,EAAE,4BAA4B,CAAC,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE;QACvI,EAAE,cAAc,EAAE,4BAA4B,CAAC,yBAAyB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE;QACxI,EAAE,cAAc,EAAE,4BAA4B,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QACjH,EAAE,cAAc,EAAE,4BAA4B,CAAC,sBAAsB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE;QAClI,EAAE,cAAc,EAAE,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QACnH,EAAE,cAAc,EAAE,4BAA4B,CAAC,0BAA0B,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE;QAC1I,EAAE,cAAc,EAAE,4BAA4B,CAAC,oBAAoB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE;QACnI,EAAE,cAAc,EAAE,4BAA4B,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE;QACvH,EAAE,cAAc,EAAE,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,EAAE;QACzH,EAAE,cAAc,EAAE,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;QACnH,EAAE,cAAc,EAAE,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE;QACpH,EAAE,cAAc,EAAE,4BAA4B,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE;QACvH,EAAE,cAAc,EAAE,4BAA4B,CAAC,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE;QACxI,+FAA+F;QAC/F,0EAA0E;QAC1E,EAAE,cAAc,EAAE,4BAA4B,CAAC,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,EAAE;QACtI,EAAE,cAAc,EAAE,4BAA4B,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE;QAC1H,EAAE,cAAc,EAAE,4BAA4B,CAAC,wBAAwB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;QACvI,+GAA+G;QAC/G,kEAAkE;QAClE,EAAE,cAAc,EAAE,4BAA4B,CAAC,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9H,EAAE,cAAc,EAAE,4BAA4B,CAAC,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,EAAE;QACpI,wFAAwF;QACxF,EAAE,cAAc,EAAE,4BAA4B,CAAC,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,EAAE;QACtI,4FAA4F;QAC5F,gGAAgG;QAChG,gGAAgG;QAChG,+BAA+B;QAC/B,EAAE,cAAc,EAAE,4BAA4B,CAAC,mBAAmB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;QAC/H,EAAE,cAAc,EAAE,4BAA4B,CAAC,wBAAwB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE;QACzI,EAAE,cAAc,EAAE,4BAA4B,CAAC,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE;QACnI,EAAE,cAAc,EAAE,4BAA4B,CAAC,oBAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QACjI,EAAE,cAAc,EAAE,4BAA4B,CAAC,yBAAyB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE;QAC3I,EAAE,cAAc,EAAE,4BAA4B,CAAC,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE;QACrI,EAAE,cAAc,EAAE,4BAA4B,CAAC,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE;QACtI,EAAE,cAAc,EAAE,4BAA4B,CAAC,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE;QAChI,EAAE,cAAc,EAAE,4BAA4B,CAAC,oBAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE;QACjI,EAAE,cAAc,EAAE,4BAA4B,CAAC,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE;QACpI,EAAE,cAAc,EAAE,4BAA4B,CAAC,yBAAyB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,EAAE;QAC5I,EAAE,cAAc,EAAE,4BAA4B,CAAC,oBAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE;QAClI,EAAE,cAAc,EAAE,4BAA4B,CAAC,8BAA8B,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,EAAE;QACtJ,EAAE,cAAc,EAAE,4BAA4B,CAAC,iCAAiC,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,EAAE,EAAE;KAC7J;IACD,iBAAiB,EAAE,SAAS;CAC7B,CAAC","sourcesContent":["/**\n * The engine's settings DESTINATION catalog — addressable, and deliberately unplaced.\n *\n * Each entry says what a settings surface IS: its target, and the gating that\n * decides whether the current principal may see it at all. **No entry carries a\n * `categoryRef`, an `order` or a `label`**, because those are placement, and\n * placement belongs to the application (`SettingsPlacement`).\n *\n * This file replaced `settings-hub.frontend.defaults.ts`, which shipped a fully\n * PLACED hub as a framework default. That default was the reason an application\n * could not add, remove, reorder or rename a settings section: the render path\n * read the framework's arrangement, so an application had no arrangement of its\n * own to read. Splitting destination from placement keeps the engine owning what\n * a destination MEANS while the application owns where it sits — and makes\n * \"remove this section\" expressible, which under a merged default it was not.\n *\n * Gating notes carried over from the previous default, because they are\n * destination facts rather than placement facts:\n *\n * - Account destinations are `USER_SELF`-shaped and always available to an\n *   authenticated user; the category's scope does the hiding.\n * - Organization destinations gate on org owner/admin roles, and several\n *   additionally on a runtime capability, so an application that excludes the\n *   backing resource surfaces nothing. This is the \"face to right management of\n *   the user\" gating — a member who cannot manage the org sees no such section.\n *\n * Sub-tab labels stay on the target: they describe the destination's internal\n * structure, not its position in the rail.\n *\n * ## The refs themselves live in `@wildo-ai/saas-models`\n *\n * `EngineSettingsDestinationRef` and `ENGINE_SETTINGS_DESTINATION_REFS` are declared in\n * `saas-models` (`frontend-definitions/settings-destination-ref.definitions.ts`); this file\n * declares only what each ref MEANS. The split exists because the ref vocabulary has a\n * backend-side consumer this package can never serve: `validatePlacementPlan`'s `UNKNOWN_SUBJECT`\n * hard floor is held by the app-creation semantic authority, which must not depend on\n * `saas-frontend-lib`. Everything that names a component, a panel or a sub-tab stayed here; the\n * sixteen ids did not.\n *\n * The enum is deliberately NOT re-exported from this module, from the package root, or from\n * `companion-exports`: a symbol reachable through two public doors is a symbol whose two doors\n * drift. Every consumer — including this package's own — imports it from `@wildo-ai/saas-models`.\n */\nimport { CoreFeature, CoreResourceOperation, CoreResourceType, CORE_APP_ROLES, CORE_ORG_ROLES, EngineSettingsDestinationRef, ResourcePrimaryScope } from '@wildo-ai/saas-models';\nimport { SettingsPanelRef, SettingsSectionTargetKind } from './settings-hub.frontend.schemas';\nimport type { SettingsDestination, SettingsHubConfig } from './settings-hub.frontend.schemas';\n\n/** Org-management destinations are visible to organization owners and admins. */\nconst ORG_MANAGEMENT_ROLES: string[] = [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN];\n\n/**\n * Application-administration destinations are visible to the application's own super-administrator.\n *\n * ONE role, deliberately, and not the wider `APP_ADMIN_*` family: every destination gated with this\n * is a surface whose resource ALSO requires `APP_ADMIN_SUPER_ADMIN` server-side, so admitting\n * `APP_ADMIN_VIEWER` or `APP_ADMIN_BILLING_MANAGER` here would render a rail entry that answers 403\n * on open — worse than absent, because it reads as a permission the operator has and a bug they hit.\n * Widen this only alongside the operation roles it would then have to match.\n */\nconst APPLICATION_ADMINISTRATION_ROLES: string[] = [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN];\n\n/**\n * Runtime capability key for \"billing is enabled for this app\". Wired in\n * `useLauncherRuntimeAvailabilityContext` (`runtimeCapabilities.billingEnabled`);\n * there is no enum for capability keys yet, so the launcher-config string is the\n * single source of truth.\n */\nconst BILLING_ENABLED_CAPABILITY = 'billingEnabled';\n\n/**\n * Runtime capability keys for the enterprise-config features. Unlike billing\n * (which reads `appConfig.billing.enabled`), these have no app-config toggle.\n *\n * **They are ENTITLEMENT keys, not registration keys**, and the difference decides whether these\n * sections appear at all. `useLauncherRuntimeAvailabilityContext` computes each one as\n * `isFeatureOffered(CoreFeature.X)` — \"does this application OFFER the feature\", meaning the\n * organization is entitled to it OR an upgrade/add-on in the billing catalogue grants it. Keep\n * these string literals in sync with the keys emitted there.\n *\n * This docblock said the opposite until 2026-09-17: that they were \"wired from resource-registration\n * presence (`hasResource(ORGANIZATION_*_CONFIG)`), so a destination auto-hides when its app excludes\n * the resource and otherwise degrades to org-admin role gating.\" No `hasResource` call has ever\n * produced these keys. The correction matters because the two readings differ exactly where it hurts:\n * under the old one, an application that REGISTERS the resource always sees the section, so the\n * sections are effectively always on; under the truth, an application that registers the resource,\n * migrates its tables and places the destination still shows NOTHING unless some product grants the\n * feature or the feature defaults on.\n *\n * That is not hypothetical — it is how Wonder Todos, which has every one of these tables, offered\n * none of the four to any account on any plan until the gap was measured.\n *\n * **A false capability REMOVES the destination; it does not lock it.** `requiredCapabilities` is a\n * survival filter (`isLauncherRuntimeAvailabilitySatisfied`), so an unoffered feature produces an\n * absent rail entry rather than an upgrade prompt. `isFeatureOffered` is deliberately the OFFERED\n * axis rather than the ENTITLED one so that a billing-on organization whose plan lacks the feature\n * still survives the filter and can render an upgrade prompt via `FeatureGate`; an application whose\n * catalogue grants the feature nowhere offers it to nobody, and the section vanishes.\n */\nconst SSO_ENABLED_CAPABILITY = 'ssoEnabled';\nconst SCIM_ENABLED_CAPABILITY = 'scimEnabled';\nconst SIEM_ENABLED_CAPABILITY = 'siemEnabled';\nconst WEBHOOKS_ENABLED_CAPABILITY = 'webhooksEnabled';\n\n/**\n * Every settings destination the engine ships, keyed by `ref`.\n *\n * An application places these by ref. A placement naming a ref absent from this\n * catalog is refused at DEV startup rather than silently dropped — a settings\n * section that quietly fails to appear is indistinguishable from one an author\n * meant to remove.\n */\nexport const ENGINE_SETTINGS_DESTINATIONS: readonly SettingsDestination[] = [\n  // ── Account ────────────────────────────────────────────────────\n  {\n    ref: EngineSettingsDestinationRef.PROFILE,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.USER_SELF_PROFILES,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.SECURITY,\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.SECURITY },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPEARANCE,\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.APPEARANCE },\n  },\n  {\n    ref: EngineSettingsDestinationRef.PREFERENCES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.USER_SELF_PREFERENCES,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    // The caller's OWN received invitations (Approach P) — their own INVITED membership\n    // rows across orgs they haven't joined yet. Distinct from the org-admin's view of\n    // sent invites, which are now just INVITED-status rows in the 'members' list (no\n    // separate org 'invitations' section). No `requiredRoles`: any authenticated user\n    // can act on invitations addressed to them (authorized server-side by userId-ownership).\n    ref: EngineSettingsDestinationRef.MY_INVITATIONS,\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.INVITATIONS },\n  },\n  {\n    // Where a PERSON connects their own third-party accounts.\n    //\n    // No `requiredRoles`, and that is the substantive difference from the organization sibling\n    // rather than an omission. Every authenticated user owns their own connections; the resource\n    // declares `APP_USER` on every variant and no administrative variant at all, so authorization\n    // is by OWNERSHIP and adding a role gate here could only ever hide the screen from someone\n    // entitled to it.\n    //\n    // No `runtimeAvailability` gate either, for the organization destination's reason: gating on\n    // \"the application declared a provider\" would hide the screen exactly when somebody is looking\n    // for it, since providers are declared whether or not anyone has connected one.\n    ref: EngineSettingsDestinationRef.MY_PROVIDER_CREDENTIALS,\n    // TWO tabs, because the screen answers two questions and one of them has no resource behind it.\n    //\n    // \"Connect\" is the catalogue — what this person MAY connect — and it is a bespoke panel because\n    // connecting is a flow out to a vendor rather than a row somebody creates. \"Credentials\" is the\n    // ordinary resource list: what they HAVE connected, plus the pasted keys that never went through\n    // a vendor at all.\n    //\n    // Connect comes FIRST deliberately. On the day somebody opens this screen for the first time the\n    // list is empty, and an empty table is the least informative thing to greet them with; it is also\n    // the tab the connection callback returns them to, carrying the outcome it has to render.\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'connect',\n          label: 'Connect',\n          target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.CONNECTED_ACCOUNTS },\n        },\n        {\n          ref: 'credentials',\n          label: 'Credentials',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.USER_PROVIDER_CREDENTIALS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  // ── Organization ───────────────────────────────────────────────\n  {\n    ref: EngineSettingsDestinationRef.ORGANIZATION_GENERAL,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATIONS,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    // NOTE: no separate org-level \"invitations\" destination — invitations are now\n    // INVITED-status rows inside the ORGANIZATION_MEMBERS junction, so they surface\n    // in this list (filter by status) rather than a parallel destination. The\n    // invitee's own pending invitations live in the 'my-invitations' panel.\n    ref: EngineSettingsDestinationRef.MEMBERS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATION_MEMBERS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // The tenant's internal structure, on the rail rather than as a tab inside General. Two\n    // different kinds of surface: General is a RECORD — a column of decisions about the tenant — and\n    // a unit hierarchy is a POPULATION you navigate. Nested, it was also reachable only by opening a\n    // pane a reader had no other reason to open, which is a poor place to keep the org chart.\n    ref: EngineSettingsDestinationRef.ORGANIZATION_UNITS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATION_UNITS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.BILLING,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [BILLING_ENABLED_CAPABILITY] },\n    // THE billing home — a bespoke panel over the aggregated BillingContext\n    // state (subscription, plans + checkout, usage, invoices, portal link).\n    // Deliberately NOT per-resource LIST sub-tabs: the billing child resources\n    // are routed under the billing account (`REQUIRES_CONTEXT`), so org-scoped\n    // generic panels cannot address them, while the aggregated state endpoint is\n    // org-addressable and auto-creates the account.\n    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.BILLING },\n  },\n  {\n    ref: EngineSettingsDestinationRef.API_KEYS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORG_API_KEYS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // Beside API keys: the other credential type for the same machine principal, and where an administrator binds\n    // an autonomous agent to a client (#1812). Management roles, although LIST admits any member, because every\n    // other verb on the page — create, rotate, bind — is the administrator's.\n    ref: EngineSettingsDestinationRef.ORGANIZATION_OAUTH_CLIENTS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // Where a tenant connects its OWN third-party accounts. Until this existed the resource had\n    // backend doors, an encrypted store, migrations and audit events, and no way for the\n    // administrator it is FOR to reach any of it — so every tenant kept acting as the application's\n    // own third-party principal, which is the defect the resource was built to remove.\n    //\n    // No `runtimeAvailability` gate: unlike SSO or SIEM this needs no capability to be switched on,\n    // and gating it on \"the application declared a provider\" would hide the screen exactly when an\n    // operator is looking for it, since an application declares providers whether or not any tenant\n    // has connected one.\n    ref: EngineSettingsDestinationRef.PROVIDER_CREDENTIALS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    // TWO tabs, for the person-scope destination's reason: \"Connect\" is a flow out to a vendor and\n    // has no resource behind it, while \"Credentials\" is the ordinary list of what the tenant HAS.\n    // Connect comes first because it is where the connection callback returns, carrying the outcome\n    // it has to render.\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'connect',\n          label: 'Connect',\n          target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.ORGANIZATION_CONNECTED_ACCOUNTS },\n        },\n        {\n          ref: 'credentials',\n          label: 'Credentials',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORG_PROVIDER_CREDENTIALS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  // ── Organization · enterprise credentials & compliance ─────────\n  // Each gates on org-admin role + a per-feature runtime capability\n  // (resource-registration presence). Multi-resource domains split into\n  // sub-tabs pairing the singleton config (READ) with its collection (LIST).\n  {\n    ref: EngineSettingsDestinationRef.SSO,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [SSO_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.SINGLE_SIGN_ON,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'sso-configuration',\n          label: 'Configuration',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'sso-connections',\n          label: 'Connections',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SSO_CONNECTIONS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.SCIM,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [SCIM_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.DIRECTORY_PROVISIONING,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'scim-provisioning',\n          label: 'Provisioning',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'scim-tokens',\n          label: 'Tokens',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SCIM_TOKENS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.SIEM,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [SIEM_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.SECURITY_EVENT_EXPORT,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'siem-export',\n          label: 'Export',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'siem-failed-deliveries',\n          label: 'Failed deliveries',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_SIEM_DELIVERY_DLQ,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.WEBHOOKS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    runtimeAvailability: { requiredCapabilities: [WEBHOOKS_ENABLED_CAPABILITY] },\n    entitlementFeatureId: CoreFeature.M2M_WEBHOOK_DELIVERY,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'webhooks-endpoints',\n          label: 'Endpoints',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_WEBHOOK_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'webhooks-delivery-log',\n          label: 'Delivery log',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.ORGANIZATION_M2M_WEBHOOK_DELIVERY_LOG,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    // Inbound deliveries (#1596). No capability gate: the store exists in every application, and an\n    // application with no inbound handler simply shows an empty log. Not under WEBHOOKS, whose\n    // entitlement is the OUTBOUND feature.\n    ref: EngineSettingsDestinationRef.INBOUND_DELIVERIES,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATION_INBOUND_DELIVERIES,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // Service-provider relationships (#1597), the CLIENT's side. No capability gate: placement is the\n    // gate — an application places it only when one of its organization types declares\n    // `servesAsProvider`, and an organization no firm serves simply shows an empty list.\n    ref: EngineSettingsDestinationRef.SERVICE_PROVIDERS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'service-providers-relationships',\n          label: 'Firms',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.SERVICE_PROVIDER_RELATIONSHIPS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n        {\n          // #1631: the administrative capabilities this organization lends its firms — grant, revoke, and when each ends.\n          ref: 'service-providers-delegated-capabilities',\n          label: 'Delegated capabilities',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    // The FIRM's side (#1597): its mirror of each relationship, and who serves each client.\n    ref: EngineSettingsDestinationRef.SERVICE_CLIENTS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'service-clients-engagements',\n          label: 'Clients',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.SERVICE_ENGAGEMENTS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n        {\n          ref: 'service-clients-assignments',\n          label: 'Assignments',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.SERVICE_ENGAGEMENT_ASSIGNMENTS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n        {\n          // #1632: what the firm's own experts did in its clients — metadata only, and only when the firm switched it on.\n          ref: 'service-clients-activity-feed',\n          label: 'Expert activity',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n        {\n          // #1632: the firm owner's decision to collect it, with who, when, and the consultation-notice acknowledgement.\n          ref: 'service-clients-activity-feed-settings',\n          label: 'Expert activity feed',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.AUDIT_LOGS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.AUDIT_LOGS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    /**\n     * What this organization is entitled to, and — for a platform administrator — the console that\n     * changes it.\n     *\n     * **No `requiredRoles`, and that is the substantive decision.** `organizationFeatures` READ is\n     * `ORG_MEMBER`, so any member may see what their organization actually has; the three operations\n     * that MUTATE it (`enable_feature`, `disable_feature`, `reset_features`) plus UPDATE are\n     * `APP_ADMIN_SUPER_ADMIN` on the resource itself. One screen therefore serves both readers\n     * honestly — a read-only summary for a member, a grant/withdraw console for an operator — without\n     * this destination having to know which one is looking.\n     *\n     * Gating it on org management instead would hide from members the exact page that explains why a\n     * feature they were just told to upgrade for is unavailable, which is the moment it is worth most.\n     *\n     * READ rather than LIST, because the resource is 1:1 with its organization: the URL builder drops\n     * the `{id}` segment for a one-to-one parent, and the factory declares no LIST at all.\n     */\n    ref: EngineSettingsDestinationRef.ORGANIZATION_ENTITLEMENTS,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATION_FEATURES,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    // Referral codes belong to the billing DOMAIN and to the ORGANIZATION scope — the resource's\n    // primary scope really is `ORGANIZATIONS`, unlike products/prices/promotions beside it, which are\n    // application-scoped. So it is placed with the tenant's settings rather than the operator's\n    // catalogue, and gated on `ORG_OWNER` to match the resource's own READ/LIST roles.\n    ref: EngineSettingsDestinationRef.ORGANIZATION_REFERRALS,\n    requiredRoles: [CORE_ORG_ROLES.ORG_OWNER],\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.REFERRALS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // The organization's preservation duties (#1634). ORG_OWNER, as the resource's READ / LIST: a hold stops the\n    // tenant's retention schedule and its data subjects' erasures, and the owner is who places and releases it.\n    ref: EngineSettingsDestinationRef.ORGANIZATION_LEGAL_HOLDS,\n    requiredRoles: [CORE_ORG_ROLES.ORG_OWNER],\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.LEGAL_HOLDS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // Receiving email (#1600): the organization's own domains. No capability gate: the store exists in every\n    // application, and one without an inbound email provider shows a claim that cannot reach the provider stage.\n    ref: EngineSettingsDestinationRef.EMAIL_DOMAINS,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.ORGANIZATION_EMAIL_DOMAINS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // Receiving email (#1600), the FIRM's side: the mailboxes it keeps on its own domain for the clients it serves.\n    // Placement is the gate, as for `service-clients`.\n    ref: EngineSettingsDestinationRef.CLIENT_MAILBOXES,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.CLIENT_MAILBOXES,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // Experts' corrections to agent work (#1599). The rate first: it is what an administrator comes to read, and it\n    // needs neither setting. Then the two organization singletons (each page is its READ, created in its default state\n    // on first access), then the ledger the export authorisation governs. No capability gate: the records exist in\n    // every application with agents, and one without them shows an empty rate.\n    ref: EngineSettingsDestinationRef.AGENT_WORK_REVIEW,\n    requiredRoles: ORG_MANAGEMENT_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'agent-work-override-rate',\n          label: 'Override rate',\n          target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.AGENT_WORK_OVERRIDE_RATE },\n        },\n        {\n          ref: 'agent-work-content-capture',\n          label: 'Content capture',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.AGENT_WORK_CAPTURE_SETTINGS,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'agent-work-export-authorization',\n          label: 'Export authorisation',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.EVALUATION_EXPORT_AUTHORIZATIONS,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'agent-work-exports',\n          label: 'Exports',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.EVALUATION_DATASET_EXPORTS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n\n  // ── Application administration ─────────────────────────────────\n  //\n  // The operator's own surfaces. An application places these in a category scoped to\n  // `ResourcePrimaryScope.APPLICATION`, and that scope is what hides the whole group from a tenant.\n  //\n  // None of them carries a `runtimeAvailability` capability gate, and the omission is a decision\n  // rather than an oversight. The org-scope SSO/SCIM/SIEM/webhook destinations gate on\n  // `isFeatureOffered(CoreFeature.X)` because those are features a TENANT buys, and a tenant that\n  // cannot buy one should not see its configuration screen. An APPLICATION does not buy anything\n  // from itself: it either ships the capability or it does not, and if it does not, the destination\n  // is simply not placed. Gating the operator's own screens on the tenant entitlement catalogue\n  // would make an application's configuration depend on its own price list.\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_GENERAL,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    // 1:1 with the application, so READ addresses it with no id segment.\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_METADATA,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_VERSIONS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_VERSIONS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // The application-scope twin of ORGANIZATION_ENTITLEMENTS, and the pair is not a duplication:\n    // `M2M_WEBHOOK_DELIVERY` is declared `scopeBoundary: true`, so enabling it for the application\n    // does NOT enable it for any organization. An operator who cannot see both states cannot tell\n    // which of the two refused a delivery.\n    ref: EngineSettingsDestinationRef.APPLICATION_ENTITLEMENTS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_FEATURES,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_API_KEYS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_API_KEYS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_SSO,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    // Two tabs mirroring the organization sibling: the singleton configuration, then the collection\n    // of connections. LIST rather than READ for the connections because the application variant's\n    // READ is an `INTERNAL_CALL` and has no route — only LIST is `API_CALL`.\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'application-sso-configuration',\n          label: 'Configuration',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_SSO_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'application-sso-connections',\n          label: 'Connections',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_SSO_CONNECTIONS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    // ONE target where the organization sibling has two, because `APPLICATION_SCIM_TOKENS` does not\n    // exist — the token resource is organization-scoped only. A second tab here would have nothing\n    // to address.\n    ref: EngineSettingsDestinationRef.APPLICATION_SCIM,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_SCIM_PROVISIONING_CONFIG,\n      operation: CoreResourceOperation.READ,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_SIEM,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    // LIST for the dead-letter queue: its READ is `REPOSITORY_ONLY` and therefore route-less, same\n    // as the organization sibling.\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'application-siem-export',\n          label: 'Export',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_SIEM_EXPORT_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'application-siem-failed-deliveries',\n          label: 'Failed deliveries',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_SIEM_DELIVERY_DLQ,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_WEBHOOKS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'application-webhooks-endpoints',\n          label: 'Endpoints',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_WEBHOOK_CONFIG,\n            operation: CoreResourceOperation.READ,\n          },\n        },\n        {\n          ref: 'application-webhooks-delivery-log',\n          label: 'Delivery log',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.APPLICATION_M2M_WEBHOOK_DELIVERY_LOG,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    /**\n     * What the application SELLS. Not to be merged with the organization `BILLING` destination,\n     * which is what one tenant BOUGHT — same domain, opposite side of the transaction, and only one\n     * of them is editable by the person looking at it.\n     *\n     * Tabs rather than separate destinations because a promotion is meaningless without the product\n     * it discounts: an operator pricing a plan moves between them continuously, and splitting them\n     * across the rail would make that a navigation task.\n     *\n     * ## There is no PRICES tab, and its removal is the point of this note\n     *\n     * One was placed here until 2026-09-18, targeting `PRICES.LIST`, and it could never load: a\n     * price is a COMPOSITION child of a product, so the only LIST route the engine generates for it\n     * is `/api/v1/products/{productId}/prices`. Measured against the running backend that day —\n     * `/api/v1/products` 200, `/api/v1/promotions` 200, `/api/v1/prices` **404** — and the pane\n     * rendered \"We couldn't load the list\" because the frontend could not build a URL for a tab\n     * the engine itself was placing at rail level.\n     *\n     * Making a bare `/prices` exist was tried and REJECTED on measurement, which is worth recording\n     * so it is not retried. Declaring the product edge `OPTIONAL_CONTEXT` changes nothing on its\n     * own, because `generateParentCombinations` drops the empty parent combination whenever any URL\n     * parent exists. Removing that guard DOES produce `/api/v1/prices` — and, in the same pass, 16\n     * tenant-free `organizationMembers` routes (`/api/v1/organization-members`,\n     * `/api/v1/organization-members/{id}`, …), because that resource's organization parent is also\n     * optional in its built configuration. The guard is load-bearing tenancy, not an oversight.\n     *\n     * So prices are reached where they live: the Products tab lists products, and a product's own\n     * record surfaces its prices as the composition child it is. That is one navigation step, and\n     * it is the step the domain already describes — this destination's original note said it\n     * itself, that \"a price is meaningless without its product\".\n     */\n    ref: EngineSettingsDestinationRef.BILLING_CATALOG,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    runtimeAvailability: { requiredCapabilities: [BILLING_ENABLED_CAPABILITY] },\n    target: {\n      kind: SettingsSectionTargetKind.SUB_TABS,\n      subTabs: [\n        {\n          ref: 'billing-catalog-products',\n          label: 'Products',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.PRODUCTS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n        {\n          ref: 'billing-catalog-promotions',\n          label: 'Promotions',\n          target: {\n            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n            resourceType: CoreResourceType.PROMOTIONS,\n            operation: CoreResourceOperation.LIST,\n          },\n        },\n      ],\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_OAUTH_CLIENTS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // The review queue for application-wide elevations. Role-gated like its neighbours and NOT\n    // additionally grant-gated, deliberately: reading which elevations exist is how the two-person\n    // rule is supervised, and putting the supervision behind the thing it supervises would mean an\n    // administrator needs an elevation to discover that elevations are being taken.\n    ref: EngineSettingsDestinationRef.APPLICATION_ACCESS_GRANTS,\n    requiredRoles: APPLICATION_ADMINISTRATION_ROLES,\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_ACCESS_GRANTS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    ref: EngineSettingsDestinationRef.APPLICATION_INBOUND_DELIVERIES,\n    requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_INBOUND_DELIVERIES,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    // Both roles the records accept, like the audit trail below: the evidence reader is who this record is for.\n    ref: EngineSettingsDestinationRef.APPLICATION_RETENTION_ENFORCEMENT,\n    requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN, CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER],\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.RETENTION_ENFORCEMENT_RECORDS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  {\n    /**\n     * The application-wide trail.\n     *\n     * `requiredRoles` names BOTH roles the resource accepts, not just the super-administrator:\n     * `APP_AUDIT_EVIDENCE_READER` exists precisely so that reading the trail can be granted without\n     * granting anything else, and a rail that hid the section from that role would make the role\n     * unusable through the product — the holder would have the permission and no way to exercise it.\n     * This is the one Administration destination whose gate is deliberately wider than\n     * `APPLICATION_ADMINISTRATION_ROLES`.\n     */\n    ref: EngineSettingsDestinationRef.APPLICATION_AUDIT_LOGS,\n    requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN, CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER],\n    target: {\n      kind: SettingsSectionTargetKind.RESOURCE_OPERATION,\n      resourceType: CoreResourceType.APPLICATION_AUDIT_LOGS,\n      operation: CoreResourceOperation.LIST,\n    },\n  },\n  // NO tenant-directory and NO user-directory destination here, deliberately — see the note under\n  // `EngineSettingsDestinationRef` for why neither is a placement problem. Both reads that look like\n  // they would serve one are confined or grant-gated ON PURPOSE, and placing them would advertise a\n  // population the section cannot actually show.\n];\n\n\n/**\n * The full placement set `wildo init` scaffolds into a new application's config.\n *\n * **This is GENERATION INPUT, not a runtime fallback.** Nothing in the render\n * path may read it — `resolveSettingsHubConfig()` resolves the application's own\n * authored config and nothing else. The distinction is the entire point of the\n * split: a scaffold is a starting arrangement an author edits and owns, whereas\n * a default is an arrangement that reasserts itself and cannot be edited away.\n *\n * It places every engine destination so a new application starts complete and\n * edits DOWN, which is the direction that surfaces what exists. Starting empty\n * would hide the catalog behind documentation.\n *\n * The `label`s here are the English strings the previous framework default\n * carried, and they are NOT a temporary convenience to be removed once label\n * generation runs. The companion feeds each authored label to the labellize\n * prompt as that key's `purpose`, so it is the wording INTENT generation\n * translates — delete it and the model falls back to inventing from the ref.\n */\nexport const SCAFFOLD_SETTINGS_HUB_CONFIG: SettingsHubConfig = {\n  categories: [\n    { ref: 'account', label: 'Account', scope: ResourcePrimaryScope.USER_SELF, order: 0 },\n    { ref: 'organization', label: 'Organization', scope: ResourcePrimaryScope.ORGANIZATIONS, order: 1 },\n    // The operator's own scope. Scaffolded like everything else so a new application starts\n    // complete: `APPLICATION` scope plus `APP_ADMIN_SUPER_ADMIN` on every destination means an\n    // ordinary member never sees the heading, and a category whose sections are all gated out is\n    // dropped rather than rendered empty — so placing it costs an application nothing and NOT\n    // placing it would hide the whole administration surface behind documentation.\n    { ref: 'administration', label: 'Administration', scope: ResourcePrimaryScope.APPLICATION, order: 2 },\n  ],\n  placements: [\n    /*\n     * A rail label NAMES the thing. It is not a friendlier word for it.\n     *\n     * Five of these were a gloss and every one of them cost a reader: \"User provisioning\" is SCIM,\n     * \"Audit streaming\" is SIEM, \"Connected accounts\" is integrations, \"Single sign-on\" is a choice\n     * between OIDC and SAML, and \"Teams\" is the organization-unit hierarchy. An administrator\n     * arrives at this rail having been told to \"set up SCIM\" or \"point the SIEM at us\", and none of\n     * those words was on the screen — so the item that answers the question is the one they scroll\n     * past. The gloss is also ambiguous in the direction that matters: \"user provisioning\" is what\n     * SSO just-in-time creation does as well, and \"connected accounts\" reads as the user's own\n     * social logins, which is a different pane in a different category.\n     *\n     * The protocol name is not jargon here. It is the term the vendor documentation, the IdP's own\n     * setup page and the person's ticket all use, and it is what they will search this rail for.\n     * Where a plain word IS the precise one — Members, Billing, Webhooks, API keys — it stays.\n     */\n    { destinationRef: EngineSettingsDestinationRef.PROFILE, categoryRef: 'account', label: 'Profile', order: 0 },\n    { destinationRef: EngineSettingsDestinationRef.SECURITY, categoryRef: 'account', label: 'Security', order: 1 },\n    { destinationRef: EngineSettingsDestinationRef.APPEARANCE, categoryRef: 'account', label: 'Appearance', order: 2 },\n    { destinationRef: EngineSettingsDestinationRef.PREFERENCES, categoryRef: 'account', label: 'Preferences', order: 3 },\n    { destinationRef: EngineSettingsDestinationRef.MY_INVITATIONS, categoryRef: 'account', label: 'Invitations', order: 4 },\n    // Same label as the organization placement below, deliberately: it is the same feature, and the\n    // CATEGORY is what says whose integrations these are.\n    { destinationRef: EngineSettingsDestinationRef.MY_PROVIDER_CREDENTIALS, categoryRef: 'account', label: 'Integrations', order: 5 },\n    { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_GENERAL, categoryRef: 'organization', label: 'General', order: 0 },\n    { destinationRef: EngineSettingsDestinationRef.MEMBERS, categoryRef: 'organization', label: 'Members', order: 1 },\n    // Beside Members, because the two are the same KIND of surface — who is in this tenant, and how\n    // it is arranged — and a reader looking for one is usually looking for the other.\n    { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_UNITS, categoryRef: 'organization', label: 'Organization units', order: 2 },\n    { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_ENTITLEMENTS, categoryRef: 'organization', label: 'Entitlements', order: 3 },\n    { destinationRef: EngineSettingsDestinationRef.BILLING, categoryRef: 'organization', label: 'Billing', order: 4 },\n    { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_REFERRALS, categoryRef: 'organization', label: 'Referrals', order: 5 },\n    { destinationRef: EngineSettingsDestinationRef.API_KEYS, categoryRef: 'organization', label: 'API keys', order: 6 },\n    { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_OAUTH_CLIENTS, categoryRef: 'organization', label: 'OAuth clients', order: 7 },\n    { destinationRef: EngineSettingsDestinationRef.PROVIDER_CREDENTIALS, categoryRef: 'organization', label: 'Integrations', order: 8 },\n    { destinationRef: EngineSettingsDestinationRef.SSO, categoryRef: 'organization', label: 'SSO — OIDC / SAML', order: 9 },\n    { destinationRef: EngineSettingsDestinationRef.SCIM, categoryRef: 'organization', label: 'SCIM provisioning', order: 10 },\n    { destinationRef: EngineSettingsDestinationRef.SIEM, categoryRef: 'organization', label: 'SIEM export', order: 11 },\n    { destinationRef: EngineSettingsDestinationRef.WEBHOOKS, categoryRef: 'organization', label: 'Webhooks', order: 12 },\n    { destinationRef: EngineSettingsDestinationRef.AUDIT_LOGS, categoryRef: 'organization', label: 'Audit log', order: 13 },\n    { destinationRef: EngineSettingsDestinationRef.INBOUND_DELIVERIES, categoryRef: 'organization', label: 'Inbound deliveries', order: 14 },\n    // Scaffolded like everything else so a new application starts complete: an application with no\n    // organization type declaring `servesAsProvider` deletes these two lines.\n    { destinationRef: EngineSettingsDestinationRef.SERVICE_PROVIDERS, categoryRef: 'organization', label: 'Service providers', order: 15 },\n    { destinationRef: EngineSettingsDestinationRef.SERVICE_CLIENTS, categoryRef: 'organization', label: 'Clients', order: 16 },\n    { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_LEGAL_HOLDS, categoryRef: 'organization', label: 'Legal holds', order: 17 },\n    // Receiving email (#1600). An application with no inbound email provider deletes these; one whose organization\n    // types declare no `servesAsProvider` deletes `client-mailboxes`.\n    { destinationRef: EngineSettingsDestinationRef.EMAIL_DOMAINS, categoryRef: 'organization', label: 'Email domains', order: 18 },\n    { destinationRef: EngineSettingsDestinationRef.CLIENT_MAILBOXES, categoryRef: 'organization', label: 'Client mailboxes', order: 19 },\n    // Experts' corrections to agent work (#1599). An application with no agents deletes it.\n    { destinationRef: EngineSettingsDestinationRef.AGENT_WORK_REVIEW, categoryRef: 'organization', label: 'Agent work review', order: 20 },\n    // Administration mirrors the organization order — General, the population, entitlements and\n    // commerce, then the integration surfaces in the same sequence — so an operator who has learned\n    // one rail has learned the other, and the scope distinction reads as a scope distinction rather\n    // than as two unrelated menus.\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_GENERAL, categoryRef: 'administration', label: 'General', order: 0 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_ENTITLEMENTS, categoryRef: 'administration', label: 'Entitlements', order: 1 },\n    { destinationRef: EngineSettingsDestinationRef.BILLING_CATALOG, categoryRef: 'administration', label: 'Plans & pricing', order: 2 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_API_KEYS, categoryRef: 'administration', label: 'API keys', order: 3 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_OAUTH_CLIENTS, categoryRef: 'administration', label: 'OAuth clients', order: 4 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_SSO, categoryRef: 'administration', label: 'SSO — OIDC / SAML', order: 5 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_SCIM, categoryRef: 'administration', label: 'SCIM provisioning', order: 6 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_SIEM, categoryRef: 'administration', label: 'SIEM export', order: 7 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_WEBHOOKS, categoryRef: 'administration', label: 'Webhooks', order: 8 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_AUDIT_LOGS, categoryRef: 'administration', label: 'Audit log', order: 9 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_ACCESS_GRANTS, categoryRef: 'administration', label: 'Access grants', order: 10 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_VERSIONS, categoryRef: 'administration', label: 'Versions', order: 11 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_INBOUND_DELIVERIES, categoryRef: 'administration', label: 'Inbound deliveries', order: 12 },\n    { destinationRef: EngineSettingsDestinationRef.APPLICATION_RETENTION_ENFORCEMENT, categoryRef: 'administration', label: 'Retention enforcement', order: 13 },\n  ],\n  defaultSectionRef: 'profile',\n};\n"]}

package/dist/esm/core/config/execution-view.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-view.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/core/config/execution-view.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,gEAAgE,CAAC;AAExE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EAGrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,sBAAsB,EACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,KAAK,4BAA4B,EAClC,MAAM,kCAAkC,CAAC;AAI1C,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,mEAAmE,CAAC;AACpI,OAAO,KAAK,EACV,uCAAuC,EACvC,yBAAyB,EACzB,YAAY,EACb,MAAM,+DAA+D,CAAC;AAUvE;;;;GAIG;AACH,oBAAY,gCAAgC;IAC1C,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;CACpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC;;;iBAG9C,CAAC;AAEH,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gCAAgC,CAAC;CAC1C;AAED,oBAAY,4BAA4B;IACtC,MAAM,WAAW;IACjB,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IACnE,uBAAuB,4BAA4B;CACpD;AAuBD;;;;;;;GAOG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;6BAKjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AACtG,mFAAmF;AAEnF,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,uBAAuB,CAAC;IACxC,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,oBAAY,+BAA+B;IACzC,sEAAsE;IACtE,aAAa,kBAAkB;IAC/B,+EAA+E;IAC/E,kBAAkB,uBAAuB;CAC1C;AAED,eAAO,MAAM,wCAAwC,kFAGnD,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,sCAAsC;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,YAAY,CAAC;IACxB,YAAY,EAAE,+BAA+B,CAAC;CAC/C;AAED,eAAO,MAAM,4CAA4C;;;;iBAIvD,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,WAAW,mCAAmC;IAClD,mBAAmB,EAAE,+BAA+B,CAAC;IACrD,2BAA2B,CAAC,EAAE,sCAAsC,EAAE,CAAC;CACxE;AAED,eAAO,MAAM,yCAAyC;;;;;;;iBAIpD,CAAC;AACH,4FAA4F;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,kFAA2C,CAAC;AAC1F,MAAM,MAAM,2BAA2B,GAAG,YAAY,CAAC;AAEvD,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwExC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,sBAAsB,CAAC,QAAQ,CAAC;IACvC,2BAA2B,CAAC,EAAE,0CAA0C,EAAE,CAAC;IAC3E,8BAA8B,CAAC,EAAE,0CAA0C,EAAE,CAAC;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,oBAAoB,CAAC;IACnC,MAAM,CAAC,EAAE,6BAA6B,CAAC;IACvC,gBAAgB,CAAC,EAAE,mCAAmC,CAAC;IACvD,mBAAmB,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;IAClE,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;IAChE,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,oGAAoG;IACpG,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED,eAAO,MAAM,0CAA0C,mBAAmB,CAAC;AAE3E,MAAM,WAAW,oCAAoC;IACnD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,MAAM,CAAC,EAAE,6BAA6B,CAAC;IACvC,gBAAgB,CAAC,EAAE,mCAAmC,CAAC;IACvD,mBAAmB,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACpD,2BAA2B,CAAC,EAAE,0CAA0C,EAAE,CAAC;IAC3E,8BAA8B,CAAC,EAAE,0CAA0C,EAAE,CAAC;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;IAClE,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;IAChE,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IACtC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,oGAAoG;IACpG,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED,MAAM,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;AAChG,MAAM,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAEnE;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,EAC/D,MAAM,GAAE,IAAI,CAAC,oCAAoC,EAAE,eAAe,CAAM,GACvE,oCAAoC,CAKtC;AACD,qEAAqE;AAErE,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,2BAA2B,GACrC,MAAM,CAMR;AAED;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB,CAAC,EAAE,2BAA2B,EAAE,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0CAA0C,CACxD,KAAK,SAAS,2BAA2B,EAEzC,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,SAAS,GACjD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAuBvB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,qBAAqB,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,SAAS,wBAAwB,EACjF,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,SAAS,EAClD,iBAAiB,EAAE,qBAAqB,GACvC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAqBvB;AAED,wBAAgB,iCAAiC,CAC/C,aAAa,EAAE,uBAAuB,GAAG,SAAS,GACjD,OAAO,CAKT;AAED,wBAAgB,sCAAsC,CACpD,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,GAClD,4BAA4B,CAO9B;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,CAAC,EAAE,yBAAyB,CAAC;CACtC,GAAG,uBAAuB,GAAG,SAAS,CAmBtC;AAED,wBAAgB,uCAAuC,CACrD,SAAS,EAAE,IAAI,CACb,uCAAuC,EACvC,qBAAqB,GAAG,YAAY,GAAG,oBAAoB,CAC5D,GACA,YAAY,CAMd;AAED,wBAAgB,yCAAyC,CACvD,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,YAAY,GACnB,OAAO,CAMT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sCAAsC,CAAC,MAAM,EAAE;IAC7D,cAAc,EAAE,IAAI,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,CAAC;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CACb,uCAAuC,EACvC,qBAAqB,GAAG,YAAY,GAAG,oBAAoB,CAC5D,CAAC;CACH,GAAG,+BAA+B,CAYlC;AACD,uGAAuG;AAEvG,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClD,MAAM,CAWR;AAED,wBAAgB,+CAA+C,CAC7D,YAAY,EAAE,eAAe,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAWpC"}
+{"version":3,"file":"execution-view.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/config/execution-view.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,gEAAgE,CAAC;AAExE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EAGrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EACL,sBAAsB,EACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,KAAK,4BAA4B,EAClC,MAAM,kCAAkC,CAAC;AAI1C,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,mEAAmE,CAAC;AACpI,OAAO,KAAK,EACV,uCAAuC,EACvC,yBAAyB,EACzB,YAAY,EACb,MAAM,+DAA+D,CAAC;AAUvE;;;;GAIG;AACH,oBAAY,gCAAgC;IAC1C,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;CACpE;AAED;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC;;;iBAG9C,CAAC;AAEH,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,gCAAgC,CAAC;CAC1C;AAED,oBAAY,4BAA4B;IACtC,MAAM,WAAW;IACjB,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IACnE,uBAAuB,4BAA4B;CACpD;AAuBD;;;;;;;GAOG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;6BAKjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AACtG,mFAAmF;AAEnF,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,uBAAuB,CAAC;IACxC,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,oBAAY,+BAA+B;IACzC,sEAAsE;IACtE,aAAa,kBAAkB;IAC/B,+EAA+E;IAC/E,kBAAkB,uBAAuB;CAC1C;AAED,eAAO,MAAM,wCAAwC,kFAGnD,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,sCAAsC;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,YAAY,CAAC;IACxB,YAAY,EAAE,+BAA+B,CAAC;CAC/C;AAED,eAAO,MAAM,4CAA4C;;;;iBAIvD,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,WAAW,mCAAmC;IAClD,mBAAmB,EAAE,+BAA+B,CAAC;IACrD,2BAA2B,CAAC,EAAE,sCAAsC,EAAE,CAAC;CACxE;AAED,eAAO,MAAM,yCAAyC;;;;;;;iBAIpD,CAAC;AACH,4FAA4F;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,kFAA2C,CAAC;AAC1F,MAAM,MAAM,2BAA2B,GAAG,YAAY,CAAC;AAEvD,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwExC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,sBAAsB,CAAC,QAAQ,CAAC;IACvC,2BAA2B,CAAC,EAAE,0CAA0C,EAAE,CAAC;IAC3E,8BAA8B,CAAC,EAAE,0CAA0C,EAAE,CAAC;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,YAAY,EAAE,oBAAoB,CAAC;IACnC,MAAM,CAAC,EAAE,6BAA6B,CAAC;IACvC,gBAAgB,CAAC,EAAE,mCAAmC,CAAC;IACvD,mBAAmB,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;IAClE,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;IAChE,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,oGAAoG;IACpG,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED,eAAO,MAAM,0CAA0C,mBAAmB,CAAC;AAE3E,MAAM,WAAW,oCAAoC;IACnD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,MAAM,CAAC,EAAE,6BAA6B,CAAC;IACvC,gBAAgB,CAAC,EAAE,mCAAmC,CAAC;IACvD,mBAAmB,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACpD,2BAA2B,CAAC,EAAE,0CAA0C,EAAE,CAAC;IAC3E,8BAA8B,CAAC,EAAE,0CAA0C,EAAE,CAAC;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;IAClE,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAAC;IAChE,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,0BAA0B,CAAC;IACtC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC7B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,oGAAoG;IACpG,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED,MAAM,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;AAChG,MAAM,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAEnE;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,2BAA2B,CAAC,EAC/D,MAAM,GAAE,IAAI,CAAC,oCAAoC,EAAE,eAAe,CAAM,GACvE,oCAAoC,CAKtC;AACD,qEAAqE;AAErE,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,2BAA2B,GACrC,MAAM,CAMR;AAED;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB,CAAC,EAAE,2BAA2B,EAAE,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,0CAA0C,CACxD,KAAK,SAAS,2BAA2B,EAEzC,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,SAAS,GACjD,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAuBvB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,qBAAqB,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,SAAS,wBAAwB,EACjF,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,SAAS,EAClD,iBAAiB,EAAE,qBAAqB,GACvC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAqBvB;AAED,wBAAgB,iCAAiC,CAC/C,aAAa,EAAE,uBAAuB,GAAG,SAAS,GACjD,OAAO,CAKT;AAED,wBAAgB,sCAAsC,CACpD,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,GAClD,4BAA4B,CAO9B;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,CAAC,EAAE,yBAAyB,CAAC;CACtC,GAAG,uBAAuB,GAAG,SAAS,CAmBtC;AAED,wBAAgB,uCAAuC,CACrD,SAAS,EAAE,IAAI,CACb,uCAAuC,EACvC,qBAAqB,GAAG,YAAY,GAAG,oBAAoB,CAC5D,GACA,YAAY,CAMd;AAED,wBAAgB,yCAAyC,CACvD,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,YAAY,GACnB,OAAO,CAMT;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sCAAsC,CAAC,MAAM,EAAE;IAC7D,cAAc,EAAE,IAAI,CAAC,uBAAuB,EAAE,kBAAkB,CAAC,CAAC;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,IAAI,CACb,uCAAuC,EACvC,qBAAqB,GAAG,YAAY,GAAG,oBAAoB,CAC5D,CAAC;CACH,GAAG,+BAA+B,CAYlC;AACD,uGAAuG;AAEvG,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,MAAM,EACf,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClD,MAAM,CAWR;AAED,wBAAgB,+CAA+C,CAC7D,YAAY,EAAE,eAAe,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAWpC"}