@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/core/navigation/ZoneChromeContext.js

@@ -0,0 +1,130 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * ZoneChromeContext — lets the record header an adjacent pane is showing CLAIM that pane's own
+ * controls (expand/restore, close) and place them in its bar.
+ *
+ * ## Why
+ *
+ * A split pane draws its expand and close buttons as a sticky row of their own (`ZoneChrome` in
+ * `NavigationContentAreas`). Above a record's header that row was a whole line holding two icons,
+ * so a todo opened in the pane needed four rows — pane controls, breadcrumb, title, facts — before
+ * its first fact, and three separate ways back sat in three different places. Decided with Paul
+ * (2026-09-30): the header's first line is a BAR carrying back, the breadcrumb, and — when the record
+ * is in a pane — the pane's expand and close.
+ *
+ * ## How
+ *
+ * The pane provides its controls here. A header that qualifies — the page's own header rendering in that
+ * pane: a record's, and equally a collection's or a form's — CLAIMS them: it renders them in its bar, and
+ * the pane's own row steps aside for as long as the claim holds. Nothing claims them when no such header
+ * exists (a custom view with no resource header, an empty pane), and the pane's row is then drawn exactly
+ * as before, so no pane ever loses its controls.
+ *
+ * ## Scrolled past
+ *
+ * The claimant also reports whether its bar is ON SCREEN. Scrolled past, the pane draws its own row again
+ * — the reason that row is sticky is that closing a long record must not need a scroll back up — but OUT
+ * OF THE FLOW (it overlays the content's top edge rather than pushing the content down). An in-flow row
+ * appearing would push the content, which could bring the bar back on screen, take the row away, pull the
+ * content up, and loop; browsers that do not anchor scroll position would show exactly that.
+ *
+ * Only ONE claimant at a time: the first to claim holds the controls until it releases them. And only
+ * a header in the SAME zone may claim: React context crosses portals, so a dialog opened from inside
+ * the pane (navigation zone OVERLAY) would otherwise take the pane's close button with it.
+ */
+import { createContext, useCallback, useContext, useLayoutEffect, useMemo, useRef, useState } from 'react';
+import { cn } from '../../core/ui/cn.js';
+const ZoneChromeContext = createContext(null);
+/** Offer a pane's controls to the header it is showing. Wraps the pane's chrome AND its content. */
+export function ZoneChromeProvider({ zone, controls, children }) {
+    const [claimant, setClaimant] = useState(null);
+    const [claimantOnScreen, setClaimantOnScreen] = useState(true);
+    const claimantRef = useRef(null);
+    // The ref is the source of truth for WHO holds the controls; state only re-renders the pane. So no state
+    // updater carries a side effect (StrictMode runs updaters twice), and the first claimant keeps them.
+    const claim = useCallback((token) => {
+        if (claimantRef.current !== null)
+            return;
+        claimantRef.current = token;
+        setClaimant(token);
+    }, []);
+    const release = useCallback((token) => {
+        if (claimantRef.current !== token)
+            return;
+        claimantRef.current = null;
+        setClaimant(null);
+        setClaimantOnScreen(true);
+    }, []);
+    const reportOnScreen = useCallback((token, onScreen) => {
+        if (claimantRef.current === token)
+            setClaimantOnScreen(onScreen);
+    }, []);
+    const value = useMemo(() => ({ zone, controls, claimant, claimantOnScreen, claim, release, reportOnScreen }), [zone, controls, claimant, claimantOnScreen, claim, release, reportOnScreen]);
+    return _jsx(ZoneChromeContext.Provider, { value: value, children: children });
+}
+/**
+ * Does a pane in `zone` offer its controls to this subtree? A header uses it to keep its bar's line
+ * even while it is not holding the controls (see the scroll hand-off in `ResourceLayout_Header`), so
+ * the claim moving never changes the header's height.
+ */
+export function useZoneChromeOffered(zone) {
+    const host = useContext(ZoneChromeContext);
+    return !!host && host.zone === zone;
+}
+/** How the pane should draw its own row, given who holds its controls. */
+export var ZoneChromeRowPresence;
+(function (ZoneChromeRowPresence) {
+    /** No header holds the controls: the pane's row, in the flow, as it always was. */
+    ZoneChromeRowPresence["OWN_ROW"] = "own_row";
+    /** A header holds them and its bar is on screen: no row — the controls are in the bar. */
+    ZoneChromeRowPresence["IN_HEADER"] = "in_header";
+    /** A header holds them but its bar is scrolled past: the row, OUT of the flow, so it moves nothing. */
+    ZoneChromeRowPresence["OVERLAY"] = "overlay";
+})(ZoneChromeRowPresence || (ZoneChromeRowPresence = {}));
+/** How the pane's own row should be drawn right now. */
+export function useZoneChromeRowPresence() {
+    const host = useContext(ZoneChromeContext);
+    if (!host || host.claimant == null)
+        return ZoneChromeRowPresence.OWN_ROW;
+    return host.claimantOnScreen ? ZoneChromeRowPresence.IN_HEADER : ZoneChromeRowPresence.OVERLAY;
+}
+/**
+ * The pane's own row of controls, drawn as its presence says: in the flow while no header holds them,
+ * not at all while a header's bar shows them, and OUT of the flow while that bar is scrolled past —
+ * `-mb-8`, the controls' own height, so it overlays the content's top edge instead of pushing the
+ * content down (which could bring the bar back on screen, take the row away again, and loop).
+ */
+export function ZoneChromeRow({ children }) {
+    const presence = useZoneChromeRowPresence();
+    if (presence === ZoneChromeRowPresence.IN_HEADER)
+        return null;
+    return (_jsx("div", { className: cn('pointer-events-none sticky top-0 z-10 flex justify-end gap-element', presence === ZoneChromeRowPresence.OVERLAY && '-mb-8'), "data-zone-chrome-presence": presence, children: children }));
+}
+/**
+ * Claim the pane's controls for a header's bar. Returns them to render, or `null` when there is no
+ * pane, the header renders in another zone, it may not claim (`eligible` false), another header holds
+ * them, or the bar is scrolled past (`barOnScreen` false — the pane's overlay row shows them then).
+ *
+ * Claimed in a layout effect, so the pane's row and the header's bar swap in the same frame: the
+ * claim's re-render is flushed before paint, and the controls are never drawn twice or not at all.
+ */
+export function useClaimedZoneChrome(zone, eligible, barOnScreen = true) {
+    const host = useContext(ZoneChromeContext);
+    const token = useRef({}).current;
+    const canClaim = !!host && eligible && zone === host.zone;
+    const claim = host?.claim;
+    const release = host?.release;
+    const reportOnScreen = host?.reportOnScreen;
+    useLayoutEffect(() => {
+        if (!canClaim || !claim || !release)
+            return undefined;
+        claim(token);
+        return () => release(token);
+    }, [canClaim, claim, release, token]);
+    useLayoutEffect(() => {
+        if (canClaim && reportOnScreen)
+            reportOnScreen(token, barOnScreen);
+    }, [canClaim, reportOnScreen, token, barOnScreen, host?.claimant]);
+    return canClaim && host.claimant === token && barOnScreen ? host.controls : null;
+}
+//# sourceMappingURL=ZoneChromeContext.js.map

package/dist/esm/core/navigation/ZoneChromeContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ZoneChromeContext.js","sourceRoot":"","sources":["../../../../../src/core/navigation/ZoneChromeContext.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAc,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGlH,OAAO,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AAgBpD,MAAM,iBAAiB,GAAG,aAAa,CAA6B,IAAI,CAAC,CAAC;AAS1E,oGAAoG;AACpG,MAAM,UAAU,kBAAkB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAA2B;IACtF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IAC9D,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAChD,yGAAyG;IACzG,qGAAqG;IACrG,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,KAAa,EAAE,EAAE;QAC1C,IAAI,WAAW,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO;QACzC,WAAW,CAAC,OAAO,GAAG,KAAK,CAAC;QAC5B,WAAW,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC,EAAE,EAAE,CAAC,CAAC;IACP,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,KAAa,EAAE,EAAE;QAC5C,IAAI,WAAW,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO;QAC1C,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3B,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,EAAE,EAAE,CAAC,CAAC;IACP,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,KAAa,EAAE,QAAiB,EAAE,EAAE;QACtE,IAAI,WAAW,CAAC,OAAO,KAAK,KAAK;YAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnE,CAAC,EAAE,EAAE,CAAC,CAAC;IACP,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EACtF,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC,CAC7E,CAAC;IACF,OAAO,KAAC,iBAAiB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA8B,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAgC;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC;AACtC,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B,mFAAmF;IACnF,4CAAmB,CAAA;IACnB,0FAA0F;IAC1F,gDAAuB,CAAA;IACvB,uGAAuG;IACvG,4CAAmB,CAAA;AACrB,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAED,wDAAwD;AACxD,MAAM,UAAU,wBAAwB;IACtC,MAAM,IAAI,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI;QAAE,OAAO,qBAAqB,CAAC,OAAO,CAAC;IACzE,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,EAAE,QAAQ,EAAiC;IACvE,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,QAAQ,KAAK,qBAAqB,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,CACL,cACE,SAAS,EAAE,EAAE,CAAC,oEAAoE,EAAE,QAAQ,KAAK,qBAAqB,CAAC,OAAO,IAAI,OAAO,CAAC,+BAC/G,QAAQ,YAElC,QAAQ,GACL,CACP,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAgC,EAAE,QAAiB,EAAE,WAAW,GAAG,IAAI;IAC1G,MAAM,IAAI,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;IAC9B,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;IAC5C,eAAe,CAAC,GAAG,EAAE;QACnB,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACtD,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACtC,eAAe,CAAC,GAAG,EAAE;QACnB,IAAI,QAAQ,IAAI,cAAc;YAAE,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACrE,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnE,OAAO,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC","sourcesContent":["/**\n * ZoneChromeContext — lets the record header an adjacent pane is showing CLAIM that pane's own\n * controls (expand/restore, close) and place them in its bar.\n *\n * ## Why\n *\n * A split pane draws its expand and close buttons as a sticky row of their own (`ZoneChrome` in\n * `NavigationContentAreas`). Above a record's header that row was a whole line holding two icons,\n * so a todo opened in the pane needed four rows — pane controls, breadcrumb, title, facts — before\n * its first fact, and three separate ways back sat in three different places. Decided with Paul\n * (2026-09-30): the header's first line is a BAR carrying back, the breadcrumb, and — when the record\n * is in a pane — the pane's expand and close.\n *\n * ## How\n *\n * The pane provides its controls here. A header that qualifies — the page's own header rendering in that\n * pane: a record's, and equally a collection's or a form's — CLAIMS them: it renders them in its bar, and\n * the pane's own row steps aside for as long as the claim holds. Nothing claims them when no such header\n * exists (a custom view with no resource header, an empty pane), and the pane's row is then drawn exactly\n * as before, so no pane ever loses its controls.\n *\n * ## Scrolled past\n *\n * The claimant also reports whether its bar is ON SCREEN. Scrolled past, the pane draws its own row again\n * — the reason that row is sticky is that closing a long record must not need a scroll back up — but OUT\n * OF THE FLOW (it overlays the content's top edge rather than pushing the content down). An in-flow row\n * appearing would push the content, which could bring the bar back on screen, take the row away, pull the\n * content up, and loop; browsers that do not anchor scroll position would show exactly that.\n *\n * Only ONE claimant at a time: the first to claim holds the controls until it releases them. And only\n * a header in the SAME zone may claim: React context crosses portals, so a dialog opened from inside\n * the pane (navigation zone OVERLAY) would otherwise take the pane's close button with it.\n */\nimport React, { createContext, useCallback, useContext, useLayoutEffect, useMemo, useRef, useState } from 'react';\nimport type { NavigationZoneName } from '@wildo-ai/saas-models';\nimport type { NavigationZone } from '~wildo-frontend-lib/core/navigation/navigation.schemas';\nimport { cn } from '~wildo-frontend-lib/core/ui/cn';\n\ninterface ZoneChromeHostValue {\n  /** The zone whose controls these are. Only a header rendering in this zone may claim them. */\n  zone: NavigationZoneName;\n  /** The controls a claimant places in its bar. */\n  controls: React.ReactNode;\n  /** The current claimant, or `null` while the pane draws its own row. */\n  claimant: object | null;\n  /** Whether the claimant's bar is on screen. Off screen, the pane draws its row out of the flow. */\n  claimantOnScreen: boolean;\n  claim: (token: object) => void;\n  release: (token: object) => void;\n  reportOnScreen: (token: object, onScreen: boolean) => void;\n}\n\nconst ZoneChromeContext = createContext<ZoneChromeHostValue | null>(null);\n\nexport interface ZoneChromeProviderProps {\n  zone: NavigationZoneName;\n  /** The controls as a claimant should render them (in a bar, not floating over content). */\n  controls: React.ReactNode;\n  children: React.ReactNode;\n}\n\n/** Offer a pane's controls to the header it is showing. Wraps the pane's chrome AND its content. */\nexport function ZoneChromeProvider({ zone, controls, children }: ZoneChromeProviderProps): React.JSX.Element {\n  const [claimant, setClaimant] = useState<object | null>(null);\n  const [claimantOnScreen, setClaimantOnScreen] = useState(true);\n  const claimantRef = useRef<object | null>(null);\n  // The ref is the source of truth for WHO holds the controls; state only re-renders the pane. So no state\n  // updater carries a side effect (StrictMode runs updaters twice), and the first claimant keeps them.\n  const claim = useCallback((token: object) => {\n    if (claimantRef.current !== null) return;\n    claimantRef.current = token;\n    setClaimant(token);\n  }, []);\n  const release = useCallback((token: object) => {\n    if (claimantRef.current !== token) return;\n    claimantRef.current = null;\n    setClaimant(null);\n    setClaimantOnScreen(true);\n  }, []);\n  const reportOnScreen = useCallback((token: object, onScreen: boolean) => {\n    if (claimantRef.current === token) setClaimantOnScreen(onScreen);\n  }, []);\n  const value = useMemo(\n    () => ({ zone, controls, claimant, claimantOnScreen, claim, release, reportOnScreen }),\n    [zone, controls, claimant, claimantOnScreen, claim, release, reportOnScreen],\n  );\n  return <ZoneChromeContext.Provider value={value}>{children}</ZoneChromeContext.Provider>;\n}\n\n/**\n * Does a pane in `zone` offer its controls to this subtree? A header uses it to keep its bar's line\n * even while it is not holding the controls (see the scroll hand-off in `ResourceLayout_Header`), so\n * the claim moving never changes the header's height.\n */\nexport function useZoneChromeOffered(zone: NavigationZone | undefined): boolean {\n  const host = useContext(ZoneChromeContext);\n  return !!host && host.zone === zone;\n}\n\n/** How the pane should draw its own row, given who holds its controls. */\nexport enum ZoneChromeRowPresence {\n  /** No header holds the controls: the pane's row, in the flow, as it always was. */\n  OWN_ROW = 'own_row',\n  /** A header holds them and its bar is on screen: no row — the controls are in the bar. */\n  IN_HEADER = 'in_header',\n  /** A header holds them but its bar is scrolled past: the row, OUT of the flow, so it moves nothing. */\n  OVERLAY = 'overlay',\n}\n\n/** How the pane's own row should be drawn right now. */\nexport function useZoneChromeRowPresence(): ZoneChromeRowPresence {\n  const host = useContext(ZoneChromeContext);\n  if (!host || host.claimant == null) return ZoneChromeRowPresence.OWN_ROW;\n  return host.claimantOnScreen ? ZoneChromeRowPresence.IN_HEADER : ZoneChromeRowPresence.OVERLAY;\n}\n\n/**\n * The pane's own row of controls, drawn as its presence says: in the flow while no header holds them,\n * not at all while a header's bar shows them, and OUT of the flow while that bar is scrolled past —\n * `-mb-8`, the controls' own height, so it overlays the content's top edge instead of pushing the\n * content down (which could bring the bar back on screen, take the row away again, and loop).\n */\nexport function ZoneChromeRow({ children }: { children: React.ReactNode }): React.JSX.Element | null {\n  const presence = useZoneChromeRowPresence();\n  if (presence === ZoneChromeRowPresence.IN_HEADER) return null;\n  return (\n    <div\n      className={cn('pointer-events-none sticky top-0 z-10 flex justify-end gap-element', presence === ZoneChromeRowPresence.OVERLAY && '-mb-8')}\n      data-zone-chrome-presence={presence}\n    >\n      {children}\n    </div>\n  );\n}\n\n/**\n * Claim the pane's controls for a header's bar. Returns them to render, or `null` when there is no\n * pane, the header renders in another zone, it may not claim (`eligible` false), another header holds\n * them, or the bar is scrolled past (`barOnScreen` false — the pane's overlay row shows them then).\n *\n * Claimed in a layout effect, so the pane's row and the header's bar swap in the same frame: the\n * claim's re-render is flushed before paint, and the controls are never drawn twice or not at all.\n */\nexport function useClaimedZoneChrome(zone: NavigationZone | undefined, eligible: boolean, barOnScreen = true): React.ReactNode | null {\n  const host = useContext(ZoneChromeContext);\n  const token = useRef({}).current;\n  const canClaim = !!host && eligible && zone === host.zone;\n  const claim = host?.claim;\n  const release = host?.release;\n  const reportOnScreen = host?.reportOnScreen;\n  useLayoutEffect(() => {\n    if (!canClaim || !claim || !release) return undefined;\n    claim(token);\n    return () => release(token);\n  }, [canClaim, claim, release, token]);\n  useLayoutEffect(() => {\n    if (canClaim && reportOnScreen) reportOnScreen(token, barOnScreen);\n  }, [canClaim, reportOnScreen, token, barOnScreen, host?.claimant]);\n  return canClaim && host.claimant === token && barOnScreen ? host.controls : null;\n}\n"]}

package/dist/esm/core/navigation/launcher-resolution.d.ts

@@ -19,7 +19,7 @@
  * @see app-shell-implementation-plan.md Step 2
  */
 import type React from 'react';
-import { type RequiredFeaturesConfig } from '@wildo-ai/saas-models';
+import { type ApplicationRoleTables, type RequiredFeaturesConfig, type UserSelfAccessProfile } from '@wildo-ai/saas-models';
 import type { FrontendResourceConfiguration_Operation, FrontendResourcesRegistry, FrontendResourceOperationContext } from '../../core/resources/resources.frontend.schemas';
 import { IconCategory, StandardIconReference } from '../../core/icons/icon-registry.frontend.schemas';
 import type { IconRenderOptions } from '../../core/icons/icon-registry.frontend.schemas';
@@ -47,6 +47,78 @@ type IconRequest = {
  * All external dependencies the resolution functions need.
  * Hooks create this from their own context and pass it in.
  */
+/**
+ * The viewer's roles as a role check needs them: kept apart by scope, because each scope's hierarchy is resolved
+ * against its own role table (`userRolesSatisfyRequiredRoles`). Organization roles are the CURRENT organization's
+ * only. Built by `useViewerEffectiveRoles`, the one place they are derived.
+ *
+ * Roles not known yet (permissions not loaded, an anonymous visitor) are EMPTY, not absent: the viewer holds no role,
+ * so a role-gated entry appears once the roles arrive rather than being offered and then withdrawn. That is the
+ * project's fail-closed rule; an unrestricted entry, or one open to anonymous visitors, is unaffected.
+ */
+export interface LauncherEffectiveRoles {
+    applicationRoles: string[];
+    organizationRoles: string[];
+    /**
+     * The application's role tables these roles are expanded against, and what a role neither table knows does
+     * (`useApplicationRoleTables`). Carried with the roles so no check can expand them against the wrong tables.
+     */
+    roleTables: ApplicationRoleTables;
+    /** The organization `organizationRoles` are held in — the one a decision about an organization's resource is made in. */
+    organizationId: string | null;
+    /**
+     * The backend's own account of this viewer's access (`user-self | access_profile`, #2381), or `null` when not loaded.
+     * It is what lets {@link viewerMayPerformOperation} see a grant the memberships cannot: an organization-unit one.
+     */
+    accessProfile: UserSelfAccessProfile | null;
+}
+/**
+ * The ONE role-visibility decision of the app shell: OR semantics through the role hierarchy, the decision the
+ * backend's operation-role check makes. Shared by launcher items and Settings Hub sections, which used to answer it
+ * differently (the hub compared role names with no hierarchy, so an owner failed a gate naming the administrator role).
+ * The roles are expanded against the application's own tables, so a custom role passes exactly the gates the backend
+ * would let it through, and a role neither table knows passes none. An empty or absent requirement is open.
+ */
+export declare function viewerHoldsOneOfRoles(requiredRoles: readonly string[] | undefined, effectiveRoles: LauncherEffectiveRoles): boolean;
+/**
+ * Whether the shell may offer this viewer an operation on a resource (#2381) — the decision the backend's gate makes,
+ * including its ADDITIVE unit narrowing: an operation is offered when the viewer's roles satisfy it
+ * ({@link viewerHoldsOneOfRoles}), or when the backend's own narrowing decision, `resolveOrganizationUnitNarrowingDecision`
+ * fed with the backend's own role entries and maps (the access profile), admits them through an organization-unit
+ * grant (`UNIT_NARROWED`) or as a unit-scoped representative reading a resource declared organization-wide for representatives.
+ *
+ * Without the profile only the first half can answer, so a unit-granted operation stays hidden — never offered on a
+ * guess. Presentation, never authorization: the backend still decides every request.
+ */
+export declare function viewerMayPerformOperation(operation: {
+    resourceType: string;
+    roles?: readonly string[];
+    operationIdentifier: unknown;
+    resourceOperationLike?: unknown;
+    admitsCrossTenantPlatformAdministration?: boolean;
+    /** The resource's primary scope, when the caller knows it: the crossing rule applies only inside a tenant. */
+    resourcePrimaryScope?: unknown;
+}, viewer: LauncherEffectiveRoles): boolean;
+/**
+ * Whether the viewer has any standing in the organization `viewer.organizationId` names (#2473): an organization-wide
+ * role there, or, per the backend's own access profile, a unit-scoped or relationship entry in it.
+ *
+ * A viewer with none is OUTSIDE that tenant — a platform operator who opened it from the tenant directory — and the
+ * backend admits such a caller only through a variant that declares the crossing
+ * (`admitsCrossTenantPlatformAdministration`, with a usable access grant). Every other variant is an undeclared
+ * crossing: refused, and recorded as an attempted one. `false` when no organization is named.
+ */
+export declare function viewerBelongsToOrganization(viewer: LauncherEffectiveRoles): boolean;
+/**
+ * Whether the viewer is KNOWN to stand outside the organization `viewer.organizationId` names (#2473): they hold roles
+ * we can see (an application role, or the access profile has loaded) and none of them is in that tenant
+ * ({@link viewerBelongsToOrganization}). The platform operator who opened a tenant from the directory is the case.
+ *
+ * A viewer whose roles are not known yet (permissions loading, or the auth context briefly unavailable) is NOT outside:
+ * nothing says so, and treating an unknown as foreign would withdraw an in-place write, and the edit state behind it,
+ * every time the context flickers. Role-gated operations stay hidden for such a viewer anyway, by the role check.
+ */
+export declare function viewerIsKnownOutsideOrganization(viewer: LauncherEffectiveRoles): boolean;
 export interface LauncherResolutionContext {
     registry: FrontendResourcesRegistry;
     contextResourceIdentifiers?: Record<string, string>;
@@ -69,6 +141,19 @@ export interface LauncherResolutionContext {
      */
     t: (key: string) => string;
     renderIcon: (refOrRequest: StandardIconReference | string | IconRequest, options?: IconRenderOptions) => React.ReactElement;
+    /**
+     * The icon the Settings Hub's rail draws for a section (its placement's `icon`), or `undefined` when the placement
+     * names none. A row that opens a settings section draws the same icon as the rail entry it opens, so "Profile" in
+     * the user menu is not a gear beside a gear.
+     */
+    settingsSectionIcon: (sectionRef: string) => string | undefined;
+    /**
+     * The viewer's roles (`useViewerEffectiveRoles`), or `null` when this context does not filter by role at all. A
+     * RESOURCE_OPERATION row is withheld when the viewer may not perform the operation (#2376, #2381): they hold none
+     * of its own `roles`, and no organization-unit grant in their access profile reaches it (`viewerMayPerformOperation`).
+     * An entry the backend would refuse is not offered. Roles not known yet count as none, so such a row appears once they arrive.
+     */
+    viewerRoles: LauncherEffectiveRoles | null;
 }
 /**
  * Core resolved navigation target — the output of `resolveItemRef()`.
@@ -216,12 +301,27 @@ export interface ResolvedMenubarItem extends ResolvedNavigationTarget {
  * @see launcher-operation-binding-analysis.md §3.2
  */
 export declare function resolveItemRef(item: LauncherItemRef, ctx: LauncherResolutionContext): ResolvedNavigationTarget | null;
+/**
+ * The words a SETTINGS_SECTION launcher row reads, and why they are two keys.
+ *
+ * A row naming a section reads that section's own label, `settings_hub.sections.<ref>.label` — the words the hub's
+ * rail shows for it (eager `settings_hub` namespace). A row naming no section opens the hub itself and reads the
+ * hub's title, the label of the `APP_LAYOUTS_SETTINGS_HUB` component; that key is not eager, so the launcher
+ * context requests it (`useLauncherResolutionContext`).
+ *
+ * Both used to be the literal `'Settings'`, so every settings row read "Settings" whatever it opened — a user menu
+ * listing Profile showed a "Settings" heading over a "Settings" row. A missing key renders as its path, like every
+ * other label: visibly missing, never a plausible English word.
+ */
+export declare const SETTINGS_HUB_TITLE_LABEL_KEY = "components.APP_LAYOUTS_SETTINGS_HUB.title";
+export declare function settingsHubSectionLabelKey(sectionRef: string): string;
 /**
  * Resolve sidebar sections from per-launcher config.
  *
  * Dispatches on `contentKind`:
  * - `NAVIGATION_LIST`: resolves each `LauncherItemRef` in `children` via `resolveItemRef`
- * - `RESOURCE_BROWSER`: passes through (component-level rendering, no item resolution)
+ * - `RESOURCE_BROWSER`: passes through (component-level rendering, no item resolution), unless the viewer's roles
+ *   cannot perform its bound operation (#2674): then the section is dropped, as a launcher row for it would be
  * - `GUIDANCE_WIDGET`: passes through
  * - `CUSTOM_COMPONENT`: passes through
  *

package/dist/esm/core/navigation/launcher-resolution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launcher-resolution.d.ts","sourceRoot":"","sources":["../../../../../src/core/navigation/launcher-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAEV,uCAAuC,EACvC,yBAAyB,EACzB,gCAAgC,EACjC,MAAM,+DAA+D,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAY,qBAAqB,EAAE,MAAM,+DAA+D,CAAC;AAC9H,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EACL,sBAAsB,EACtB,aAAa,EAEb,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EAOpB,KAAK,cAAc,EAMnB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EAExB,KAAK,2BAA2B,EACjC,MAAM,iEAAiE,CAAC;AAEzE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,WAAW,EACjB,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EAKL,KAAK,uBAAuB,EAC7B,MAAM,wDAAwD,CAAC;AAMhE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAiB3G,KAAK,WAAW,GACZ;IAAE,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,EAAE,YAAY,CAAC,mBAAmB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAChG;IAAE,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,yBAAyB,CAAC;IACpC,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,KAAK,EAAE;QACL,cAAc,CAAC,EAAE,uBAAuB,EAAE,CAAC;QAC3C,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;QAC7C,gBAAgB,CAAC,EAAE,yBAAyB,EAAE,CAAC;KAChD,CAAC;IACF,eAAe,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/D,kBAAkB,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IACrF;;;;OAIG;IACH,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,qBAAqB,KAAK,MAAM,CAAC;IAC5E;;;OAGG;IACH,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3B,UAAU,EAAE,CAAC,YAAY,EAAE,qBAAqB,GAAG,MAAM,GAAG,WAAW,EAAE,OAAO,CAAC,EAAE,iBAAiB,KAAK,KAAK,CAAC,YAAY,CAAC;CAC7H;AAOD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,sBAAsB,CAAC;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAEvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,uCAAuC,CAAC;IACpD,eAAe,CAAC,EAAE,gCAAgC,CAAC;IAEnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,mBAAoB,SAAQ,wBAAwB;IACnE,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAClC;AAED,+EAA+E;AAC/E,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,yBAAyB,CAAC,eAAe,CAAC;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sFAAsF;IACtF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,YAAY,CAAC,EAAE,0BAA0B,CAAC;IAC1C,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sFAAsF;AACtF,MAAM,WAAW,sCAAsC;IACrD,WAAW,EAAE,yBAAyB,CAAC,gBAAgB,CAAC;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;IAChE,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,IAAI,CAAC;CAClE;AAED,yDAAyD;AACzD,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,yBAAyB,CAAC,eAAe,CAAC;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,0DAA0D;AAC1D,MAAM,WAAW,sCAAsC;IACrD,WAAW,EAAE,yBAAyB,CAAC,gBAAgB,CAAC;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,4DAA4D;AAC5D,MAAM,MAAM,sBAAsB,GAC9B,qCAAqC,GACrC,sCAAsC,GACtC,qCAAqC,GACrC,sCAAsC,CAAC;AAE3C,mCAAmC;AACnC,MAAM,WAAW,uBAAwB,SAAQ,wBAAwB;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,wBAAwB,CAAC;CAC1C;AAED,+BAA+B;AAC/B,MAAM,WAAW,qBAAsB,SAAQ,wBAAwB;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,kCAAkC;AAClC,MAAM,WAAW,uBAAwB,SAAQ,wBAAwB;IACvE,aAAa,CAAC,EAAE,wBAAwB,CAAC;CAC1C;AAED,mCAAmC;AACnC,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6BAA6B;AAC7B,MAAM,WAAW,mBAAoB,SAAQ,wBAAwB;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,sBAAsB,EAAE,CAAC;IAC3C,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,6BAA6B;AAC7B,MAAM,WAAW,mBAAoB,SAAQ,wBAAwB;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAOD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,yBAAyB,GAC7B,wBAAwB,GAAG,IAAI,CAmBjC;AAgZD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EAAE,EAC1B,GAAG,EAAE,yBAAyB,GAC7B,sBAAsB,EAAE,CAa1B;AAmFD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,kBAAkB,EAAE,EAC9B,GAAG,EAAE,yBAAyB,GAC7B,uBAAuB,EAAE,CAiB3B;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,aAAa,EAAE,EACzB,GAAG,EAAE,yBAAyB,GAC7B,qBAAqB,EAAE,CAsBzB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,eAAe,EAAE,EAC1B,GAAG,EAAE,yBAAyB,GAC7B,uBAAuB,EAAE,CAc3B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,gBAAgB,EAAE,EACzB,GAAG,EAAE,yBAAyB,GAC7B,wBAAwB,EAAE,CAc5B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,EAAE,EACpB,GAAG,EAAE,yBAAyB,GAC7B,mBAAmB,EAAE,CAevB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,sBAAsB,EAAE,GAAG,SAAS,EACtD,KAAK,EAAE,mBAAmB,EAAE,GAAG,SAAS,EACxC,GAAG,EAAE,yBAAyB,GAC7B,sBAAsB,CAoBxB"}
+{"version":3,"file":"launcher-resolution.d.ts","sourceRoot":"","sources":["../../../../../src/core/navigation/launcher-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EASL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAEV,uCAAuC,EACvC,yBAAyB,EACzB,gCAAgC,EACjC,MAAM,+DAA+D,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAY,qBAAqB,EAAE,MAAM,+DAA+D,CAAC;AAC9H,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,OAAO,EACL,sBAAsB,EACtB,aAAa,EAEb,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EAOpB,KAAK,cAAc,EAMnB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EAExB,KAAK,2BAA2B,EACjC,MAAM,iEAAiE,CAAC;AAEzE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,WAAW,EACjB,MAAM,uEAAuE,CAAC;AAC/E,OAAO,EAKL,KAAK,uBAAuB,EAC7B,MAAM,wDAAwD,CAAC;AAMhE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAiB3G,KAAK,WAAW,GACZ;IAAE,QAAQ,EAAE,YAAY,CAAC,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,EAAE,YAAY,CAAC,mBAAmB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAChG;IAAE,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D;;;GAGG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B;;;OAGG;IACH,UAAU,EAAE,qBAAqB,CAAC;IAClC,yHAAyH;IACzH,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;OAGG;IACH,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,sBAAsB,GAAG,OAAO,CAUnI;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE;IACT,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,uCAAuC,CAAC,EAAE,OAAO,CAAC;IAClD,8GAA8G;IAC9G,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,EACD,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAyBT;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAKnF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAGxF;AAyDD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,yBAAyB,CAAC;IACpC,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,KAAK,EAAE;QACL,cAAc,CAAC,EAAE,uBAAuB,EAAE,CAAC;QAC3C,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;QAC7C,gBAAgB,CAAC,EAAE,yBAAyB,EAAE,CAAC;KAChD,CAAC;IACF,eAAe,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/D,kBAAkB,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IACrF;;;;OAIG;IACH,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,qBAAqB,KAAK,MAAM,CAAC;IAC5E;;;OAGG;IACH,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3B,UAAU,EAAE,CAAC,YAAY,EAAE,qBAAqB,GAAG,MAAM,GAAG,WAAW,EAAE,OAAO,CAAC,EAAE,iBAAiB,KAAK,KAAK,CAAC,YAAY,CAAC;IAC5H;;;;OAIG;IACH,mBAAmB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAChE;;;;;OAKG;IACH,WAAW,EAAE,sBAAsB,GAAG,IAAI,CAAC;CAC5C;AAOD;;;;;;GAMG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,sBAAsB,CAAC;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAEvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,uCAAuC,CAAC;IACpD,eAAe,CAAC,EAAE,gCAAgC,CAAC;IAEnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,qBAAqB,CAAC;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAExC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,mBAAoB,SAAQ,wBAAwB;IACnE,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,6EAA6E;IAC7E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;CAClC;AAED,+EAA+E;AAC/E,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,yBAAyB,CAAC,eAAe,CAAC;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,sFAAsF;IACtF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,YAAY,CAAC,EAAE,0BAA0B,CAAC;IAC1C,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sFAAsF;AACtF,MAAM,WAAW,sCAAsC;IACrD,WAAW,EAAE,yBAAyB,CAAC,gBAAgB,CAAC;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;IAChE,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,IAAI,CAAC;CAClE;AAED,yDAAyD;AACzD,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,yBAAyB,CAAC,eAAe,CAAC;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,0DAA0D;AAC1D,MAAM,WAAW,sCAAsC;IACrD,WAAW,EAAE,yBAAyB,CAAC,gBAAgB,CAAC;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,4DAA4D;AAC5D,MAAM,MAAM,sBAAsB,GAC9B,qCAAqC,GACrC,sCAAsC,GACtC,qCAAqC,GACrC,sCAAsC,CAAC;AAE3C,mCAAmC;AACnC,MAAM,WAAW,uBAAwB,SAAQ,wBAAwB;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,wBAAwB,CAAC;CAC1C;AAED,+BAA+B;AAC/B,MAAM,WAAW,qBAAsB,SAAQ,wBAAwB;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,kCAAkC;AAClC,MAAM,WAAW,uBAAwB,SAAQ,wBAAwB;IACvE,aAAa,CAAC,EAAE,wBAAwB,CAAC;CAC1C;AAED,mCAAmC;AACnC,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6BAA6B;AAC7B,MAAM,WAAW,mBAAoB,SAAQ,wBAAwB;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,sBAAsB,EAAE,CAAC;IAC3C,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,6BAA6B;AAC7B,MAAM,WAAW,mBAAoB,SAAQ,wBAAwB;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAOD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,yBAAyB,GAC7B,wBAAwB,GAAG,IAAI,CAmBjC;AAuVD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,8CAAyF,CAAC;AAEnI,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAErE;AAuED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EAAE,EAC1B,GAAG,EAAE,yBAAyB,GAC7B,sBAAsB,EAAE,CAa1B;AAkGD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,kBAAkB,EAAE,EAC9B,GAAG,EAAE,yBAAyB,GAC7B,uBAAuB,EAAE,CAiB3B;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,aAAa,EAAE,EACzB,GAAG,EAAE,yBAAyB,GAC7B,qBAAqB,EAAE,CAsBzB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,eAAe,EAAE,EAC1B,GAAG,EAAE,yBAAyB,GAC7B,uBAAuB,EAAE,CAc3B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,gBAAgB,EAAE,EACzB,GAAG,EAAE,yBAAyB,GAC7B,wBAAwB,EAAE,CAc5B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,EAAE,EACpB,GAAG,EAAE,yBAAyB,GAC7B,mBAAmB,EAAE,CAevB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,gBAAgB,EAAE,sBAAsB,EAAE,GAAG,SAAS,EACtD,KAAK,EAAE,mBAAmB,EAAE,GAAG,SAAS,EACxC,GAAG,EAAE,yBAAyB,GAC7B,sBAAsB,CAoBxB"}

package/dist/esm/core/navigation/launcher-resolution.js

@@ -18,10 +18,13 @@
  * @see launcher-operation-binding-analysis.md §4.3, §7.1
  * @see app-shell-implementation-plan.md Step 2
  */
+import { computeRoleHierarchy, CoreResourceOperation, isReadShapedOperation, OrganizationUnitNarrowingDecisionKind, PlatformAccessGrants_Operations, resolveOrganizationUnitNarrowingDecision, ResourcePrimaryScope, userRolesSatisfyRequiredRoles, } from '@wildo-ai/saas-models';
+import { FrontendComponentType, LabellingTypes } from '@wildo-ai/presets-components-models';
 import { frontendResourceUtils } from '../../core/resources/frontend-resource.utils.js';
 import { IconCategory, IconSize, StandardIconReference } from '../../core/icons/icon-registry.frontend.schemas.js';
 import { NavigationContentType } from './navigation.schemas.js';
 import { NavigationUtils } from './navigation.utils.js';
+import { resolveSidebarResourceBrowserOperation } from './sidebar-resource-browser-operation.js';
 import { LauncherItemTargetKind, ENGINE_PAGE_METADATA, SidebarSectionContentKind, } from '../../core/config/launcher-items.frontend.schemas.js';
 import { CommonRoutePaths } from '../../core/runtime/routes.frontend.definitions.js';
 import { buildCompositeRouteUrlPath, buildResourceInsertedCompositeIdentity, isStandaloneRoutableCompositeView, isStandaloneRoutableInsertedCompositeView, } from '../../core/config/composite-view.schemas.js';
@@ -33,6 +36,143 @@ import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.ser
 const logger = LoggerFrontendService.getLogger();
 const logDebug = logger.debugByType('launcher-resolution');
 logger.setDebugTypeLogging('launcher-resolution', false);
+/**
+ * The ONE role-visibility decision of the app shell: OR semantics through the role hierarchy, the decision the
+ * backend's operation-role check makes. Shared by launcher items and Settings Hub sections, which used to answer it
+ * differently (the hub compared role names with no hierarchy, so an owner failed a gate naming the administrator role).
+ * The roles are expanded against the application's own tables, so a custom role passes exactly the gates the backend
+ * would let it through, and a role neither table knows passes none. An empty or absent requirement is open.
+ */
+export function viewerHoldsOneOfRoles(requiredRoles, effectiveRoles) {
+    if (!requiredRoles?.length)
+        return true;
+    return userRolesSatisfyRequiredRoles({
+        requiredRoles,
+        userAppRoles: effectiveRoles.applicationRoles,
+        userOrgRoles: effectiveRoles.organizationRoles,
+        appRolesConfig: effectiveRoles.roleTables.appRolesConfig,
+        orgRolesConfig: effectiveRoles.roleTables.orgRolesConfig,
+        unresolvableRoles: effectiveRoles.roleTables.unresolvableRoles,
+    });
+}
+/**
+ * Whether the shell may offer this viewer an operation on a resource (#2381) — the decision the backend's gate makes,
+ * including its ADDITIVE unit narrowing: an operation is offered when the viewer's roles satisfy it
+ * ({@link viewerHoldsOneOfRoles}), or when the backend's own narrowing decision, `resolveOrganizationUnitNarrowingDecision`
+ * fed with the backend's own role entries and maps (the access profile), admits them through an organization-unit
+ * grant (`UNIT_NARROWED`) or as a unit-scoped representative reading a resource declared organization-wide for representatives.
+ *
+ * Without the profile only the first half can answer, so a unit-granted operation stays hidden — never offered on a
+ * guess. Presentation, never authorization: the backend still decides every request.
+ */
+export function viewerMayPerformOperation(operation, viewer) {
+    if (crossingVariantIsNotTheViewers(operation, viewer))
+        return false;
+    // A viewer KNOWN to stand outside the addressed organization reaches it only through a variant that declares the
+    // crossing (#2473, #2600): the backend refuses every other variant as an undeclared crossing, whatever role the viewer
+    // holds, and records the attempt. `requestAccess` is the backend's own exemption, so it is exempt here too. Inert for
+    // a question about the viewer's current organization, which they belong to.
+    if (viewerIsKnownOutsideOrganization(viewer)
+        && operation.admitsCrossTenantPlatformAdministration !== true
+        && String(operation.operationIdentifier) !== PlatformAccessGrants_Operations.REQUEST_ACCESS)
+        return false;
+    if (viewerHoldsOneOfRoles(operation.roles, viewer))
+        return true;
+    if (!viewer.accessProfile || !viewer.organizationId)
+        return false;
+    const tables = viewer.roleTables;
+    const decision = resolveOrganizationUnitNarrowingDecision({
+        resourceType: operation.resourceType,
+        requiredRoles: operation.roles ?? [],
+        initiatorRoles: viewer.accessProfile.roleEntries,
+        organizationId: viewer.organizationId,
+        narrowingRegistry: viewer.accessProfile.organizationUnitNarrowing,
+        relationshipOrganizationWideAccess: viewer.accessProfile.relationshipOrganizationWideAccess,
+        operationIsReadOnly: isReadShapedOperation(operation),
+        roleHierarchyResolver: (role, scope) => computeRoleHierarchy(role, scope === ResourcePrimaryScope.APPLICATION ? tables.appRolesConfig : tables.orgRolesConfig),
+    });
+    return decision.kind === OrganizationUnitNarrowingDecisionKind.UNIT_NARROWED
+        || decision.kind === OrganizationUnitNarrowingDecisionKind.RELATIONSHIP_ORGANIZATION_WIDE;
+}
+/**
+ * Whether the viewer has any standing in the organization `viewer.organizationId` names (#2473): an organization-wide
+ * role there, or, per the backend's own access profile, a unit-scoped or relationship entry in it.
+ *
+ * A viewer with none is OUTSIDE that tenant — a platform operator who opened it from the tenant directory — and the
+ * backend admits such a caller only through a variant that declares the crossing
+ * (`admitsCrossTenantPlatformAdministration`, with a usable access grant). Every other variant is an undeclared
+ * crossing: refused, and recorded as an attempted one. `false` when no organization is named.
+ */
+export function viewerBelongsToOrganization(viewer) {
+    if (!viewer.organizationId)
+        return false;
+    if (viewer.organizationRoles.length > 0)
+        return true;
+    return (viewer.accessProfile?.roleEntries ?? []).some((entry) => String(entry.relatedPrimaryScope) === ResourcePrimaryScope.ORGANIZATIONS && String(entry.relatedResourceId) === viewer.organizationId);
+}
+/**
+ * Whether the viewer is KNOWN to stand outside the organization `viewer.organizationId` names (#2473): they hold roles
+ * we can see (an application role, or the access profile has loaded) and none of them is in that tenant
+ * ({@link viewerBelongsToOrganization}). The platform operator who opened a tenant from the directory is the case.
+ *
+ * A viewer whose roles are not known yet (permissions loading, or the auth context briefly unavailable) is NOT outside:
+ * nothing says so, and treating an unknown as foreign would withdraw an in-place write, and the edit state behind it,
+ * every time the context flickers. Role-gated operations stay hidden for such a viewer anyway, by the role check.
+ */
+export function viewerIsKnownOutsideOrganization(viewer) {
+    if (!viewer.organizationId || viewerBelongsToOrganization(viewer))
+        return false;
+    return viewer.applicationRoles.length > 0 || viewer.accessProfile !== null;
+}
+/**
+ * A COLLECTION-shaped variant that crosses into a tenant (`admitsCrossTenantPlatformAdministration`: a LIST, SEARCH,
+ * COUNT, CREATE-like or `*_MANY` verb) is the platform operator's door into an organization they do NOT belong to (#2315). For a
+ * viewer who holds a role in the addressed organization it is not their door, because taking it acts AS THE PLATFORM:
+ * the operator's "Place hold" places a PLATFORM-tier hold, which the tenant can then never release. A super-administrator
+ * who also owns their organization was offered it on their own legal holds, ranked above the owner's.
+ *
+ * The backend no longer refuses such a member: since #2482 the collection gate resolves a member's application roles as
+ * the per-instance gate does, so the super-administrator role satisfies the crossed variant. Hiding it is therefore a
+ * decision about which door is the viewer's, not a mirror of a refusal; the backend stays the authority on what is
+ * admitted. Before #2482 this comment said the gate refused, which was then true.
+ *
+ * Two kinds of crossing variant stay with the ordinary role check, because the backend admits a member through them:
+ * - a per-instance verb (READ, UPDATE, DELETE-like, a row action): the row gate passes a member, and the role check
+ *   keeps the viewer's application entries, so a super-administrator member performs it without a grant. The
+ *   tenant's own Revoke on an operator access grant is one of these and must stay offered;
+ * - a collection verb whose roles the viewer's ORGANIZATION roles satisfy, which the organization role table admits.
+ *
+ * `requestAccess` is the one exemption the backend makes (an elevation cannot require one), so it is exempt here too.
+ */
+// Every verb whose call names no row and so reaches the collection gate: the reads of a collection, a create, and the
+// `*_MANY` verbs (an entitlement's enable and disable are UPDATE_MANY-shaped, #2316).
+const COLLECTION_SHAPED_OPERATIONS = new Set([
+    CoreResourceOperation.CREATE,
+    CoreResourceOperation.LIST,
+    CoreResourceOperation.SEARCH,
+    CoreResourceOperation.COUNT,
+    CoreResourceOperation.CREATE_MANY,
+    CoreResourceOperation.UPDATE_MANY,
+    CoreResourceOperation.DELETE_MANY,
+]);
+function crossingVariantIsNotTheViewers(operation, viewer) {
+    if (operation.admitsCrossTenantPlatformAdministration !== true)
+        return false;
+    // Only a resource INSIDE a tenant has an organization gate to refuse a member. An application-scoped crossing (the
+    // application audit log) is refused by no organization role table, and a caller that does not say the scope leaves
+    // the decision to the ordinary role check.
+    if (String(operation.resourcePrimaryScope ?? '') !== ResourcePrimaryScope.ORGANIZATIONS)
+        return false;
+    if (String(operation.operationIdentifier) === PlatformAccessGrants_Operations.REQUEST_ACCESS)
+        return false;
+    if (!viewer.organizationId || viewer.organizationRoles.length === 0)
+        return false;
+    const shape = String(operation.resourceOperationLike ?? operation.operationIdentifier);
+    if (!COLLECTION_SHAPED_OPERATIONS.has(shape))
+        return false;
+    // The organization role table is what the collection gate falls back to for a member.
+    return !viewerHoldsOneOfRoles(operation.roles, { ...viewer, applicationRoles: [] });
+}
 // ════════════════════════════════════════════════════════════════
 // Core Resolution: resolveItemRef
 // ════════════════════════════════════════════════════════════════
@@ -88,6 +228,18 @@ function resolveResourceOperation(item, ctx) {
         });
         return null;
     }
+    // The operation's own roles decide who is offered it, by the same rule a launcher item's `requiredRoles` uses —
+    // so an author never restates on the row what the operation already says (#2376). The SELECTED variant is judged,
+    // because it is the one whose route the entry opens. The action bar instead keeps the highest-rights variant a viewer
+    // qualifies for; a restrictive default beside a broader non-default variant would differ, and none of the engine's
+    // resources declares that shape (defaults are the less-privileged variants).
+    if (ctx.viewerRoles && !viewerMayPerformOperation({ ...operation, resourceType: item.resourceType }, ctx.viewerRoles)) {
+        logDebug('Launcher resource operation withheld: the viewer may not perform it (no role, no reaching unit grant)', {
+            resourceType: item.resourceType,
+            operation: item.operation,
+        });
+        return null;
+    }
     // Resolve the operation's URL against the current AppScope. A launcher item is
     // surfaced whenever the resource's REQUIRED route parameters are satisfiable
     // from the ambient scope (primary scope + custom/optional context), filling both
@@ -306,6 +458,22 @@ function resolveEnginePage(item, ctx) {
         contentType: NavigationContentType.ENGINE_PAGE,
     };
 }
+/**
+ * The words a SETTINGS_SECTION launcher row reads, and why they are two keys.
+ *
+ * A row naming a section reads that section's own label, `settings_hub.sections.<ref>.label` — the words the hub's
+ * rail shows for it (eager `settings_hub` namespace). A row naming no section opens the hub itself and reads the
+ * hub's title, the label of the `APP_LAYOUTS_SETTINGS_HUB` component; that key is not eager, so the launcher
+ * context requests it (`useLauncherResolutionContext`).
+ *
+ * Both used to be the literal `'Settings'`, so every settings row read "Settings" whatever it opened — a user menu
+ * listing Profile showed a "Settings" heading over a "Settings" row. A missing key renders as its path, like every
+ * other label: visibly missing, never a plausible English word.
+ */
+export const SETTINGS_HUB_TITLE_LABEL_KEY = `${LabellingTypes.COMPONENTS}.${FrontendComponentType.APP_LAYOUTS_SETTINGS_HUB}.title`;
+export function settingsHubSectionLabelKey(sectionRef) {
+    return `${LabellingTypes.SETTINGS_HUB}.sections.${sectionRef}.label`;
+}
 function resolveSettingsSection(item, ctx) {
     const urlPath = item.sectionRef
         ? CommonRoutePaths.settingsSection.replace(':sectionRef', item.sectionRef)
@@ -314,10 +482,10 @@ function resolveSettingsSection(item, ctx) {
         targetKind: LauncherItemTargetKind.SETTINGS_SECTION,
         id: `resolved-settings-${item.sectionRef ?? 'default'}`,
         ref: `settings:${item.sectionRef ?? 'default'}`,
-        // TODO(settings-hub:i18n): resolve the hub label via i18n once wired.
-        label: 'Settings',
+        label: ctx.t(item.sectionRef ? settingsHubSectionLabelKey(item.sectionRef) : SETTINGS_HUB_TITLE_LABEL_KEY),
         urlPath,
-        icon: ctx.renderIcon(StandardIconReference.SETTINGS, { size: IconSize.SM }),
+        // The section's own rail icon when its placement names one; the hub itself, and a section without one, take the gear.
+        icon: ctx.renderIcon((item.sectionRef && ctx.settingsSectionIcon(item.sectionRef)) || StandardIconReference.SETTINGS, { size: IconSize.SM }),
         contentType: NavigationContentType.SETTINGS_HUB,
         sectionRef: item.sectionRef,
     };
@@ -364,7 +532,8 @@ function resolveSidebarItem(item, ctx) {
  *
  * Dispatches on `contentKind`:
  * - `NAVIGATION_LIST`: resolves each `LauncherItemRef` in `children` via `resolveItemRef`
- * - `RESOURCE_BROWSER`: passes through (component-level rendering, no item resolution)
+ * - `RESOURCE_BROWSER`: passes through (component-level rendering, no item resolution), unless the viewer's roles
+ *   cannot perform its bound operation (#2674): then the section is dropped, as a launcher row for it would be
  * - `GUIDANCE_WIDGET`: passes through
  * - `CUSTOM_COMPONENT`: passes through
  *
@@ -374,19 +543,35 @@ function resolveSidebarItem(item, ctx) {
  * @see launcher-operation-binding-analysis.md §3.3.1
  */
 export function resolveSidebarSections(sections, ctx) {
-    return sections.map(section => {
+    return sections.flatMap((section) => {
         switch (section.contentKind) {
             case SidebarSectionContentKind.NAVIGATION_LIST:
-                return resolveNavigationListSection(section, ctx);
+                return [resolveNavigationListSection(section, ctx)];
             case SidebarSectionContentKind.RESOURCE_BROWSER:
-                return resolveResourceBrowserSection(section);
+                return viewerCanBrowse(section, ctx) ? [resolveResourceBrowserSection(section)] : [];
             case SidebarSectionContentKind.GUIDANCE_WIDGET:
-                return resolveGuidanceWidgetSection(section);
+                return [resolveGuidanceWidgetSection(section)];
             case SidebarSectionContentKind.CUSTOM_COMPONENT:
-                return resolveCustomComponentSection(section);
+                return [resolveCustomComponentSection(section)];
         }
     });
 }
+/**
+ * Whether the viewer may perform the operation a RESOURCE_BROWSER section fetches with (#2674). A browser the viewer
+ * cannot list renders the backend's refusal as its content; dropping the section is what the launcher does for a row,
+ * and it is judged by the same `viewerMayPerformOperation` (roles through the application's tables, and an
+ * organization-unit grant, #2376, #2381). An operation that does not resolve keeps the section, so the browser can
+ * report its own configuration problem; a context that does not filter by role (`viewerRoles: null`) keeps it too.
+ */
+function viewerCanBrowse(section, ctx) {
+    if (!ctx.viewerRoles)
+        return true;
+    const config = ctx.registry.resourceConfigurations[section.resourceType];
+    if (!config)
+        return true;
+    const operation = resolveSidebarResourceBrowserOperation(config, section.operation ?? CoreResourceOperation.LIST, section.operationVariant);
+    return operation === undefined || viewerMayPerformOperation({ ...operation, resourceType: section.resourceType }, ctx.viewerRoles);
+}
 function resolveNavigationListSection(section, ctx) {
     const items = section.children
         .map(child => resolveSidebarItem(child, ctx))