@wildo-ai/saas-technical-doc 1.1.1

package/dist/esm/config/wildo-tech-doc-config.schemas.d.ts

@@ -0,0 +1,204 @@
+/**
+ * @wildo_source:part:start engine.saas-technical-doc.config facet:layer:engine facet:family:technical-doc
+ *
+ * Per-service technical-documentation configuration authored as
+ * `wildo.tech-doc.config.ts`. The strict schema owns only settings with live
+ * consumers: publication budgets and public sentinels, API-reference inputs,
+ * presentation metadata, and the docs service CSP. Framework narrative content
+ * comes from the engine topic catalogue, not from application-local recipes.
+ */
+import { CoreResourceType } from '@wildo-ai/saas-models';
+import { z } from 'zod';
+/**
+ * Sentinel for `apiDocResources` meaning "document every core resource that has
+ * API-bearing operations" — the full framework resource catalog. Distinct from
+ * an explicit curated array so an app can opt into everything without listing
+ * (and re-listing, as the engine grows) every `CoreResourceType` by hand.
+ */
+export declare const API_DOC_RESOURCES_ALL: "all";
+/**
+ * One complete category declaration for the resources published by this API
+ * reference.  `resourceNames` uses the generated OpenAPI tag name, which is
+ * the resolved resource identifier, rather than a display label or a
+ * filesystem location.  The companion rejects a duplicate, stale or missing
+ * assignment whenever this feature is configured.
+ */
+export declare const ApiReferenceResourceCategoryAssignmentSchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    resourceNames: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type ApiReferenceResourceCategoryAssignment = z.infer<typeof ApiReferenceResourceCategoryAssignmentSchema>;
+/**
+ * Per-service technical-documentation configuration block.
+ *
+ * Authored as `export default defineTechnicalDocConfig({...})` in
+ * `<tech-doc-service-root>/wildo.tech-doc.config.ts`. The companion
+ * loads this file once at bootstrap via jiti and projects fields
+ * into the OpenAPI generator and Docusaurus/CSP build surfaces.
+ *
+ * @example
+ * ```ts
+ * import { defineTechnicalDocConfig } from '@wildo-ai/saas-technical-doc';
+ *
+ * export default defineTechnicalDocConfig({
+ *   supportedApiVersion: '1.0.0',
+ *   publicMarketingTitle: 'Northstar Tasks — Technical Documentation',
+ *   apiDocResources: 'all', // also document every core engine resource
+ * });
+ * ```
+ */
+export declare const WildoTechnicalDocConfigSchema: z.ZodObject<{
+    /**
+     * Exact public API contract release supported by this documentation
+     * publication. It is required because OpenAPI mandates a version and a
+     * placeholder would make the generated reference look authoritative while
+     * carrying no usable compatibility claim.
+     */
+    supportedApiVersion: z.ZodString;
+    /**
+     * Ceilings on the published documentation tree, applied per field over the engine
+     * defaults (`TECHNICAL_DOCUMENTATION_DEFAULT_OUTPUT_BUDGETS`).
+     *
+     * Omitting this is the normal case and is SAFE: absence yields the engine ceilings, not
+     * an unbounded build. Declare only the field an application genuinely outgrows — a
+     * partial declaration keeps the others tracking the engine, so raising a page count does
+     * not silently freeze a copy of every other limit at today's value.
+     */
+    outputBudgets: z.ZodOptional<z.ZodObject<{
+        maximumPageCount: z.ZodOptional<z.ZodNumber>;
+        maximumTotalBytes: z.ZodOptional<z.ZodNumber>;
+        maximumSearchIndexBytes: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    /**
+     * Additional byte sequences that must never appear in the PUBLIC documentation tree.
+     * Publication fails naming the offending file.
+     *
+     * **Unioned with the engine's mandatory sentinels, never replacing them** — an
+     * application can arm more canaries, and cannot disarm the engine's.
+     *
+     * Choose sequences that cannot legitimately appear in published prose. Generic markers
+     * (`secret`, `token`, `Bearer`) fire on the authentication and webhook guides
+     * themselves, and a canary that cries on correct content is one people learn to remove.
+     */
+    forbiddenPublicSentinels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    /**
+     * Public-facing title for the docs site (browser tab title +
+     * landing page header). Optional — falls back to
+     * `WildoSaasConfig.displayName` when omitted.
+     */
+    publicMarketingTitle: z.ZodOptional<z.ZodString>;
+    /**
+     * Opt-in: include framework (engine) core resources in this app's generated
+     * OpenAPI, in addition to the app's own resources. This setting does not
+     * mutate runtime registration: backend startup already merges the engine core
+     * resource maps, then applies resolved billing/lifecycle exclusions. The dev
+     * companion projects the selected core resources with those same exclusions
+     * and their authored Tier-1/2/3 spec semantics.
+     *
+     * - `'all'` ({@link API_DOC_RESOURCES_ALL}) — document every core resource that
+     *   has API-bearing operations after resolved feature exclusions. Convenient,
+     *   but broad; it is configuration-derived eligibility, not live-route proof.
+     * - `CoreResourceType[]` — a curated subset (e.g. `[CoreResourceType.ORGANIZATIONS,
+     *   CoreResourceType.ORGANIZATION_MEMBERS, CoreResourceType.FILES]`).
+     *
+     * Omitted (default): only the app's own resources are documented. Org-scoped
+     * core resources land in the (auth-gated) Organization API section; any
+     * anonymous ones in the Application API section — the existing section split
+     * by operation access level is unchanged.
+     */
+    apiDocResources: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodEnum<typeof CoreResourceType>>, z.ZodLiteral<"all">]>>;
+    /**
+     * Explicit source-owned grouping for the generated API reference.
+     *
+     * Omit this only when an application deliberately has no API taxonomy yet.
+     * When present, it must classify every published resource exactly once:
+     * categories cannot silently drift as framework or application resources are
+     * added or removed. The category facts become `tags[].x-wildo.category` in
+     * the canonical OpenAPI document and are consumed by the generic renderer.
+     */
+    apiReferenceResourceCategories: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        resourceNames: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>;
+    /**
+     * App-enriched OpenAPI `servers[]` — the base URLs the API is reachable at,
+     * surfaced in the generated docs (and used by the "Try it" console + SDK
+     * generators). **This is the one piece of auth/transport metadata the
+     * framework cannot derive**: the security SCHEMES are framework-universal and
+     * emitted automatically (every Wildo API uses a JWT bearer + a scoped API key
+     * in the standard `Authorization` header),
+     * but deployment URLs are application/environment knowledge — only the app
+     * knows its staging/production domains.
+     *
+     * Each entry is `{ url, description? }` where `url` is the bare ORIGIN
+     * (host[:port]) — do NOT append `/api/v1`: operation paths already carry that
+     * mount, and the effective URL is `server.url` + path, so appending it would
+     * double the prefix. Order is preserved (the first entry is the docs default).
+     *
+     * @example
+     * ```ts
+     * apiServers: [
+     *   { url: 'https://api.example.com', description: 'Production' },
+     *   { url: 'http://localhost:4241', description: 'Local development' },
+     * ],
+     * ```
+     *
+     * Omitted (default): no `servers` block is emitted (the docs still render; the
+     * "Try it" console just has no preset target).
+     */
+    apiServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        url: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    /**
+     * App-authored markdown intro for the generated API reference landing page
+     * (the OpenAPI `info.description`). Use it to frame the API in the app's own
+     * voice — what it's for, key concepts, links to guides.
+     *
+     * This is PREPENDED to a framework-universal "API conventions" section the
+     * generator always emits (Authentication, Base URL, Pagination, Idempotency,
+     * Errors — derived from how every Wildo API behaves), so an app gets a
+     * complete, accurate landing page even with no overview, and a branded one
+     * when it supplies this.
+     *
+     * @example
+     * ```ts
+   * apiOverview: 'The Northstar Tasks API lets you manage projects, work items, and assignments.',
+     * ```
+     */
+    apiOverview: z.ZodOptional<z.ZodString>;
+    /**
+     * Optional Content-Security-Policy override for the per-app nginx
+     * sidecar serving the docs site (and the `<meta http-equiv>` tag
+     * injected into `index.html` as a defense-in-depth fallback when
+     * the bundle is served from a static host that bypasses nginx).
+     *
+     * Typed against `WildoCspConfigSchema` from
+     * `@wildo-ai/platform-config-lib` (auth-hardening.md Slice B B-Step 1).
+     * The parsed value is consumed by the build-time generator at
+     * `platform-config-lib/src/project-config/shared/csp-emit.ts` (Slice B B-Step 3)
+     * which produces the per-app nginx `add_header` line and the
+     * `<meta http-equiv>` tag for the Docusaurus build to inject.
+     *
+     * Default behavior when omitted: NO policy emitted on either channel
+     * (the resolver short-circuits to `null` — same as `enabled: false`).
+     * Opt-in is deliberate per the schema design: frontends that have
+     * not audited their third-party JS / fetch surface should not ship
+     * a half-baked CSP that breaks features without protecting anything.
+     */
+    csp: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        reportOnly: z.ZodDefault<z.ZodBoolean>;
+        mergeStrategy: z.ZodDefault<z.ZodEnum<typeof import("@wildo-ai/platform-config-lib").CspMergeStrategy>>;
+        directives: z.ZodDefault<z.ZodObject<Record<"default-src" | "script-src" | "style-src" | "img-src" | "connect-src" | "font-src" | "frame-src" | "frame-ancestors" | "object-src" | "form-action" | "base-uri" | "manifest-src" | "media-src" | "worker-src", z.ZodOptional<z.ZodArray<z.ZodString>>>, z.core.$strict>>;
+        reportUri: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type WildoTechnicalDocConfig = z.infer<typeof WildoTechnicalDocConfigSchema>;
+export type WildoTechnicalDocConfigInput = z.input<typeof WildoTechnicalDocConfigSchema>;
+/** @wildo_source:part:end engine.saas-technical-doc.config */
+//# sourceMappingURL=wildo-tech-doc-config.schemas.d.ts.map

package/dist/esm/config/wildo-tech-doc-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wildo-tech-doc-config.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/wildo-tech-doc-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAG,KAAc,CAAC;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,4CAA4C;;;;;kBAEvD,CAAC;AACH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC;AAElH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B;IACxC;;;;;OAKG;;IAGH;;;;;;;;OAQG;;;;;;IASH;;;;;;;;;;OAUG;;IAGH;;;;OAIG;;IAGH;;;;;;;;;;;;;;;;;;OAkBG;;IAMH;;;;;;;;OAQG;;;;;;;IAGH;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;;;;;IAGH;;;;;;;;;;;;;;;OAeG;;IAGH;;;;;;;;;;;;;;;;;;OAkBG;;;;;;;;kBAEH,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACzF,8DAA8D"}

package/dist/esm/config/wildo-tech-doc-config.schemas.js

@@ -0,0 +1,192 @@
+/**
+ * @wildo_source:part:start engine.saas-technical-doc.config facet:layer:engine facet:family:technical-doc
+ *
+ * Per-service technical-documentation configuration authored as
+ * `wildo.tech-doc.config.ts`. The strict schema owns only settings with live
+ * consumers: publication budgets and public sentinels, API-reference inputs,
+ * presentation metadata, and the docs service CSP. Framework narrative content
+ * comes from the engine topic catalogue, not from application-local recipes.
+ */
+import { WildoCspConfigSchema } from '@wildo-ai/platform-config-lib';
+import { CoreResourceType } from '@wildo-ai/saas-models';
+import { TechnicalDocumentationSupportedApiVersionSchema } from '@wildo-ai/saas-specifications/technical-documentation';
+import { z } from 'zod';
+import { ApiReferenceResourceCategorySchema, OpenApiServerSchema } from '../companion/operation-projection.schemas.js';
+/**
+ * Sentinel for `apiDocResources` meaning "document every core resource that has
+ * API-bearing operations" — the full framework resource catalog. Distinct from
+ * an explicit curated array so an app can opt into everything without listing
+ * (and re-listing, as the engine grows) every `CoreResourceType` by hand.
+ */
+export const API_DOC_RESOURCES_ALL = 'all';
+/**
+ * One complete category declaration for the resources published by this API
+ * reference.  `resourceNames` uses the generated OpenAPI tag name, which is
+ * the resolved resource identifier, rather than a display label or a
+ * filesystem location.  The companion rejects a duplicate, stale or missing
+ * assignment whenever this feature is configured.
+ */
+export const ApiReferenceResourceCategoryAssignmentSchema = ApiReferenceResourceCategorySchema.extend({
+    resourceNames: z.array(z.string().min(1)).min(1),
+});
+/**
+ * Per-service technical-documentation configuration block.
+ *
+ * Authored as `export default defineTechnicalDocConfig({...})` in
+ * `<tech-doc-service-root>/wildo.tech-doc.config.ts`. The companion
+ * loads this file once at bootstrap via jiti and projects fields
+ * into the OpenAPI generator and Docusaurus/CSP build surfaces.
+ *
+ * @example
+ * ```ts
+ * import { defineTechnicalDocConfig } from '@wildo-ai/saas-technical-doc';
+ *
+ * export default defineTechnicalDocConfig({
+ *   supportedApiVersion: '1.0.0',
+ *   publicMarketingTitle: 'Northstar Tasks — Technical Documentation',
+ *   apiDocResources: 'all', // also document every core engine resource
+ * });
+ * ```
+ */
+export const WildoTechnicalDocConfigSchema = z.strictObject({
+    /**
+     * Exact public API contract release supported by this documentation
+     * publication. It is required because OpenAPI mandates a version and a
+     * placeholder would make the generated reference look authoritative while
+     * carrying no usable compatibility claim.
+     */
+    supportedApiVersion: TechnicalDocumentationSupportedApiVersionSchema,
+    /**
+     * Ceilings on the published documentation tree, applied per field over the engine
+     * defaults (`TECHNICAL_DOCUMENTATION_DEFAULT_OUTPUT_BUDGETS`).
+     *
+     * Omitting this is the normal case and is SAFE: absence yields the engine ceilings, not
+     * an unbounded build. Declare only the field an application genuinely outgrows — a
+     * partial declaration keeps the others tracking the engine, so raising a page count does
+     * not silently freeze a copy of every other limit at today's value.
+     */
+    outputBudgets: z
+        .strictObject({
+        maximumPageCount: z.number().int().positive().optional(),
+        maximumTotalBytes: z.number().int().positive().optional(),
+        maximumSearchIndexBytes: z.number().int().positive().optional(),
+    })
+        .optional(),
+    /**
+     * Additional byte sequences that must never appear in the PUBLIC documentation tree.
+     * Publication fails naming the offending file.
+     *
+     * **Unioned with the engine's mandatory sentinels, never replacing them** — an
+     * application can arm more canaries, and cannot disarm the engine's.
+     *
+     * Choose sequences that cannot legitimately appear in published prose. Generic markers
+     * (`secret`, `token`, `Bearer`) fire on the authentication and webhook guides
+     * themselves, and a canary that cries on correct content is one people learn to remove.
+     */
+    forbiddenPublicSentinels: z.array(z.string().min(1)).optional(),
+    /**
+     * Public-facing title for the docs site (browser tab title +
+     * landing page header). Optional — falls back to
+     * `WildoSaasConfig.displayName` when omitted.
+     */
+    publicMarketingTitle: z.string().min(1).max(200).optional(),
+    /**
+     * Opt-in: include framework (engine) core resources in this app's generated
+     * OpenAPI, in addition to the app's own resources. This setting does not
+     * mutate runtime registration: backend startup already merges the engine core
+     * resource maps, then applies resolved billing/lifecycle exclusions. The dev
+     * companion projects the selected core resources with those same exclusions
+     * and their authored Tier-1/2/3 spec semantics.
+     *
+     * - `'all'` ({@link API_DOC_RESOURCES_ALL}) — document every core resource that
+     *   has API-bearing operations after resolved feature exclusions. Convenient,
+     *   but broad; it is configuration-derived eligibility, not live-route proof.
+     * - `CoreResourceType[]` — a curated subset (e.g. `[CoreResourceType.ORGANIZATIONS,
+     *   CoreResourceType.ORGANIZATION_MEMBERS, CoreResourceType.FILES]`).
+     *
+     * Omitted (default): only the app's own resources are documented. Org-scoped
+     * core resources land in the (auth-gated) Organization API section; any
+     * anonymous ones in the Application API section — the existing section split
+     * by operation access level is unchanged.
+     */
+    apiDocResources: z.union([
+        z.array(z.enum(CoreResourceType)),
+        z.literal(API_DOC_RESOURCES_ALL),
+    ]).optional(),
+    /**
+     * Explicit source-owned grouping for the generated API reference.
+     *
+     * Omit this only when an application deliberately has no API taxonomy yet.
+     * When present, it must classify every published resource exactly once:
+     * categories cannot silently drift as framework or application resources are
+     * added or removed. The category facts become `tags[].x-wildo.category` in
+     * the canonical OpenAPI document and are consumed by the generic renderer.
+     */
+    apiReferenceResourceCategories: z.array(ApiReferenceResourceCategoryAssignmentSchema).min(1).optional(),
+    /**
+     * App-enriched OpenAPI `servers[]` — the base URLs the API is reachable at,
+     * surfaced in the generated docs (and used by the "Try it" console + SDK
+     * generators). **This is the one piece of auth/transport metadata the
+     * framework cannot derive**: the security SCHEMES are framework-universal and
+     * emitted automatically (every Wildo API uses a JWT bearer + a scoped API key
+     * in the standard `Authorization` header),
+     * but deployment URLs are application/environment knowledge — only the app
+     * knows its staging/production domains.
+     *
+     * Each entry is `{ url, description? }` where `url` is the bare ORIGIN
+     * (host[:port]) — do NOT append `/api/v1`: operation paths already carry that
+     * mount, and the effective URL is `server.url` + path, so appending it would
+     * double the prefix. Order is preserved (the first entry is the docs default).
+     *
+     * @example
+     * ```ts
+     * apiServers: [
+     *   { url: 'https://api.example.com', description: 'Production' },
+     *   { url: 'http://localhost:4241', description: 'Local development' },
+     * ],
+     * ```
+     *
+     * Omitted (default): no `servers` block is emitted (the docs still render; the
+     * "Try it" console just has no preset target).
+     */
+    apiServers: z.array(OpenApiServerSchema).optional(),
+    /**
+     * App-authored markdown intro for the generated API reference landing page
+     * (the OpenAPI `info.description`). Use it to frame the API in the app's own
+     * voice — what it's for, key concepts, links to guides.
+     *
+     * This is PREPENDED to a framework-universal "API conventions" section the
+     * generator always emits (Authentication, Base URL, Pagination, Idempotency,
+     * Errors — derived from how every Wildo API behaves), so an app gets a
+     * complete, accurate landing page even with no overview, and a branded one
+     * when it supplies this.
+     *
+     * @example
+     * ```ts
+   * apiOverview: 'The Northstar Tasks API lets you manage projects, work items, and assignments.',
+     * ```
+     */
+    apiOverview: z.string().min(1).max(8000).optional(),
+    /**
+     * Optional Content-Security-Policy override for the per-app nginx
+     * sidecar serving the docs site (and the `<meta http-equiv>` tag
+     * injected into `index.html` as a defense-in-depth fallback when
+     * the bundle is served from a static host that bypasses nginx).
+     *
+     * Typed against `WildoCspConfigSchema` from
+     * `@wildo-ai/platform-config-lib` (auth-hardening.md Slice B B-Step 1).
+     * The parsed value is consumed by the build-time generator at
+     * `platform-config-lib/src/project-config/shared/csp-emit.ts` (Slice B B-Step 3)
+     * which produces the per-app nginx `add_header` line and the
+     * `<meta http-equiv>` tag for the Docusaurus build to inject.
+     *
+     * Default behavior when omitted: NO policy emitted on either channel
+     * (the resolver short-circuits to `null` — same as `enabled: false`).
+     * Opt-in is deliberate per the schema design: frontends that have
+     * not audited their third-party JS / fetch surface should not ship
+     * a half-baked CSP that breaks features without protecting anything.
+     */
+    csp: WildoCspConfigSchema.optional(),
+});
+/** @wildo_source:part:end engine.saas-technical-doc.config */
+//# sourceMappingURL=wildo-tech-doc-config.schemas.js.map

package/dist/esm/config/wildo-tech-doc-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wildo-tech-doc-config.schemas.js","sourceRoot":"","sources":["../../../../src/config/wildo-tech-doc-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,+CAA+C,EAAE,MAAM,uDAAuD,CAAC;AACxH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kCAAkC,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAEpH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAc,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4CAA4C,GAAG,kCAAkC,CAAC,MAAM,CAAC;IACpG,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACjD,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1D;;;;;OAKG;IACH,mBAAmB,EAAE,+CAA+C;IAEpE;;;;;;;;OAQG;IACH,aAAa,EAAE,CAAC;SACb,YAAY,CAAC;QACZ,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACxD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACzD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAChE,CAAC;SACD,QAAQ,EAAE;IAEb;;;;;;;;;;OAUG;IACH,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAE/D;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAE3D;;;;;;;;;;;;;;;;;;OAkBG;IACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC;QACvB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACjC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;KACjC,CAAC,CAAC,QAAQ,EAAE;IAEb;;;;;;;;OAQG;IACH,8BAA8B,EAAE,CAAC,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvG;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;IAEnD;;;;;;;;;;;;;;;OAeG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IAEnD;;;;;;;;;;;;;;;;;;OAkBG;IACH,GAAG,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAGH,8DAA8D","sourcesContent":["/**\n * @wildo_source:part:start engine.saas-technical-doc.config facet:layer:engine facet:family:technical-doc\n *\n * Per-service technical-documentation configuration authored as\n * `wildo.tech-doc.config.ts`. The strict schema owns only settings with live\n * consumers: publication budgets and public sentinels, API-reference inputs,\n * presentation metadata, and the docs service CSP. Framework narrative content\n * comes from the engine topic catalogue, not from application-local recipes.\n */\n\nimport { WildoCspConfigSchema } from '@wildo-ai/platform-config-lib';\nimport { CoreResourceType } from '@wildo-ai/saas-models';\nimport { TechnicalDocumentationSupportedApiVersionSchema } from '@wildo-ai/saas-specifications/technical-documentation';\nimport { z } from 'zod';\nimport { ApiReferenceResourceCategorySchema, OpenApiServerSchema } from '../companion/operation-projection.schemas';\n\n/**\n * Sentinel for `apiDocResources` meaning \"document every core resource that has\n * API-bearing operations\" — the full framework resource catalog. Distinct from\n * an explicit curated array so an app can opt into everything without listing\n * (and re-listing, as the engine grows) every `CoreResourceType` by hand.\n */\nexport const API_DOC_RESOURCES_ALL = 'all' as const;\n\n/**\n * One complete category declaration for the resources published by this API\n * reference.  `resourceNames` uses the generated OpenAPI tag name, which is\n * the resolved resource identifier, rather than a display label or a\n * filesystem location.  The companion rejects a duplicate, stale or missing\n * assignment whenever this feature is configured.\n */\nexport const ApiReferenceResourceCategoryAssignmentSchema = ApiReferenceResourceCategorySchema.extend({\n  resourceNames: z.array(z.string().min(1)).min(1),\n});\nexport type ApiReferenceResourceCategoryAssignment = z.infer<typeof ApiReferenceResourceCategoryAssignmentSchema>;\n\n/**\n * Per-service technical-documentation configuration block.\n *\n * Authored as `export default defineTechnicalDocConfig({...})` in\n * `<tech-doc-service-root>/wildo.tech-doc.config.ts`. The companion\n * loads this file once at bootstrap via jiti and projects fields\n * into the OpenAPI generator and Docusaurus/CSP build surfaces.\n *\n * @example\n * ```ts\n * import { defineTechnicalDocConfig } from '@wildo-ai/saas-technical-doc';\n *\n * export default defineTechnicalDocConfig({\n *   supportedApiVersion: '1.0.0',\n *   publicMarketingTitle: 'Northstar Tasks — Technical Documentation',\n *   apiDocResources: 'all', // also document every core engine resource\n * });\n * ```\n */\nexport const WildoTechnicalDocConfigSchema = z.strictObject({\n  /**\n   * Exact public API contract release supported by this documentation\n   * publication. It is required because OpenAPI mandates a version and a\n   * placeholder would make the generated reference look authoritative while\n   * carrying no usable compatibility claim.\n   */\n  supportedApiVersion: TechnicalDocumentationSupportedApiVersionSchema,\n\n  /**\n   * Ceilings on the published documentation tree, applied per field over the engine\n   * defaults (`TECHNICAL_DOCUMENTATION_DEFAULT_OUTPUT_BUDGETS`).\n   *\n   * Omitting this is the normal case and is SAFE: absence yields the engine ceilings, not\n   * an unbounded build. Declare only the field an application genuinely outgrows — a\n   * partial declaration keeps the others tracking the engine, so raising a page count does\n   * not silently freeze a copy of every other limit at today's value.\n   */\n  outputBudgets: z\n    .strictObject({\n      maximumPageCount: z.number().int().positive().optional(),\n      maximumTotalBytes: z.number().int().positive().optional(),\n      maximumSearchIndexBytes: z.number().int().positive().optional(),\n    })\n    .optional(),\n\n  /**\n   * Additional byte sequences that must never appear in the PUBLIC documentation tree.\n   * Publication fails naming the offending file.\n   *\n   * **Unioned with the engine's mandatory sentinels, never replacing them** — an\n   * application can arm more canaries, and cannot disarm the engine's.\n   *\n   * Choose sequences that cannot legitimately appear in published prose. Generic markers\n   * (`secret`, `token`, `Bearer`) fire on the authentication and webhook guides\n   * themselves, and a canary that cries on correct content is one people learn to remove.\n   */\n  forbiddenPublicSentinels: z.array(z.string().min(1)).optional(),\n\n  /**\n   * Public-facing title for the docs site (browser tab title +\n   * landing page header). Optional — falls back to\n   * `WildoSaasConfig.displayName` when omitted.\n   */\n  publicMarketingTitle: z.string().min(1).max(200).optional(),\n\n  /**\n   * Opt-in: include framework (engine) core resources in this app's generated\n   * OpenAPI, in addition to the app's own resources. This setting does not\n   * mutate runtime registration: backend startup already merges the engine core\n   * resource maps, then applies resolved billing/lifecycle exclusions. The dev\n   * companion projects the selected core resources with those same exclusions\n   * and their authored Tier-1/2/3 spec semantics.\n   *\n   * - `'all'` ({@link API_DOC_RESOURCES_ALL}) — document every core resource that\n   *   has API-bearing operations after resolved feature exclusions. Convenient,\n   *   but broad; it is configuration-derived eligibility, not live-route proof.\n   * - `CoreResourceType[]` — a curated subset (e.g. `[CoreResourceType.ORGANIZATIONS,\n   *   CoreResourceType.ORGANIZATION_MEMBERS, CoreResourceType.FILES]`).\n   *\n   * Omitted (default): only the app's own resources are documented. Org-scoped\n   * core resources land in the (auth-gated) Organization API section; any\n   * anonymous ones in the Application API section — the existing section split\n   * by operation access level is unchanged.\n   */\n  apiDocResources: z.union([\n    z.array(z.enum(CoreResourceType)),\n    z.literal(API_DOC_RESOURCES_ALL),\n  ]).optional(),\n\n  /**\n   * Explicit source-owned grouping for the generated API reference.\n   *\n   * Omit this only when an application deliberately has no API taxonomy yet.\n   * When present, it must classify every published resource exactly once:\n   * categories cannot silently drift as framework or application resources are\n   * added or removed. The category facts become `tags[].x-wildo.category` in\n   * the canonical OpenAPI document and are consumed by the generic renderer.\n   */\n  apiReferenceResourceCategories: z.array(ApiReferenceResourceCategoryAssignmentSchema).min(1).optional(),\n\n  /**\n   * App-enriched OpenAPI `servers[]` — the base URLs the API is reachable at,\n   * surfaced in the generated docs (and used by the \"Try it\" console + SDK\n   * generators). **This is the one piece of auth/transport metadata the\n   * framework cannot derive**: the security SCHEMES are framework-universal and\n   * emitted automatically (every Wildo API uses a JWT bearer + a scoped API key\n   * in the standard `Authorization` header),\n   * but deployment URLs are application/environment knowledge — only the app\n   * knows its staging/production domains.\n   *\n   * Each entry is `{ url, description? }` where `url` is the bare ORIGIN\n   * (host[:port]) — do NOT append `/api/v1`: operation paths already carry that\n   * mount, and the effective URL is `server.url` + path, so appending it would\n   * double the prefix. Order is preserved (the first entry is the docs default).\n   *\n   * @example\n   * ```ts\n   * apiServers: [\n   *   { url: 'https://api.example.com', description: 'Production' },\n   *   { url: 'http://localhost:4241', description: 'Local development' },\n   * ],\n   * ```\n   *\n   * Omitted (default): no `servers` block is emitted (the docs still render; the\n   * \"Try it\" console just has no preset target).\n   */\n  apiServers: z.array(OpenApiServerSchema).optional(),\n\n  /**\n   * App-authored markdown intro for the generated API reference landing page\n   * (the OpenAPI `info.description`). Use it to frame the API in the app's own\n   * voice — what it's for, key concepts, links to guides.\n   *\n   * This is PREPENDED to a framework-universal \"API conventions\" section the\n   * generator always emits (Authentication, Base URL, Pagination, Idempotency,\n   * Errors — derived from how every Wildo API behaves), so an app gets a\n   * complete, accurate landing page even with no overview, and a branded one\n   * when it supplies this.\n   *\n   * @example\n   * ```ts\n * apiOverview: 'The Northstar Tasks API lets you manage projects, work items, and assignments.',\n   * ```\n   */\n  apiOverview: z.string().min(1).max(8000).optional(),\n\n  /**\n   * Optional Content-Security-Policy override for the per-app nginx\n   * sidecar serving the docs site (and the `<meta http-equiv>` tag\n   * injected into `index.html` as a defense-in-depth fallback when\n   * the bundle is served from a static host that bypasses nginx).\n   *\n   * Typed against `WildoCspConfigSchema` from\n   * `@wildo-ai/platform-config-lib` (auth-hardening.md Slice B B-Step 1).\n   * The parsed value is consumed by the build-time generator at\n   * `platform-config-lib/src/project-config/shared/csp-emit.ts` (Slice B B-Step 3)\n   * which produces the per-app nginx `add_header` line and the\n   * `<meta http-equiv>` tag for the Docusaurus build to inject.\n   *\n   * Default behavior when omitted: NO policy emitted on either channel\n   * (the resolver short-circuits to `null` — same as `enabled: false`).\n   * Opt-in is deliberate per the schema design: frontends that have\n   * not audited their third-party JS / fetch surface should not ship\n   * a half-baked CSP that breaks features without protecting anything.\n   */\n  csp: WildoCspConfigSchema.optional(),\n});\nexport type WildoTechnicalDocConfig = z.infer<typeof WildoTechnicalDocConfigSchema>;\nexport type WildoTechnicalDocConfigInput = z.input<typeof WildoTechnicalDocConfigSchema>;\n/** @wildo_source:part:end engine.saas-technical-doc.config */\n"]}

package/dist/esm/content/application-consumer-documentation-content-manifest.schemas.d.ts

@@ -0,0 +1,82 @@
+/** Portable identities for the reusable engine-owned application-consumer content bundle. No filesystem or companion runtime belongs in this module. */
+import { z } from 'zod';
+/** Exact media types accepted by the engine-owned application-consumer content bundle. */
+export declare enum ApplicationConsumerDocumentationContentMediaType {
+    MARKDOWN_UTF8 = "text/markdown; charset=utf-8"
+}
+/** The engine-owned content bundle's stable name. With `contentBundleVersion` it is the bundle's identity. */
+export declare const APPLICATION_CONSUMER_DOCUMENTATION_CONTENT_BUNDLE_REF: "technical-documentation:content-bundle/engine-application-consumer";
+export declare const APPLICATION_CONSUMER_DOCUMENTATION_ENGINE_CONTENT_SOURCE_PREFIX: "saas-technical-doc:engine-content/";
+/**
+ * References to safe, explicitly curated facts projected from framework source.
+ *
+ * Authored Markdown may cite these facts but can never cite an arbitrary model,
+ * resource specification, or source file. The companion projector joins each
+ * reference to the exact catalog entry and fails closed when it is absent.
+ */
+export declare const APPLICATION_CONSUMER_DOCUMENTATION_CONSUMER_FACT_SOURCE_PREFIX: "source:consumer-fact:";
+/**
+ * A narrow, public projection made by the application companion. The current
+ * use is the application's organization-role inventory; it is deliberately
+ * not a general escape hatch for arbitrary application source.
+ */
+export declare const APPLICATION_CONSUMER_DOCUMENTATION_COMPANION_PROJECTION_SOURCE_PREFIX: "source:companion-projection:";
+export declare const ApplicationConsumerDocumentationContentFileIdentityV1Schema: z.ZodObject<{
+    managedPath: z.core.$ZodBranded<z.ZodString, "TechnicalDocumentationNormalizedRelativePath", "out">;
+    mediaType: z.ZodLiteral<ApplicationConsumerDocumentationContentMediaType>;
+    byteLength: z.ZodNumber;
+    /**
+     * sha256 of the file's exact UTF-8 bytes. Kept through the 2026-08-27 digest demolition because
+     * it names opaque emitted content and detects its corruption; the `semanticDigest` and
+     * `contentBundleRootDigest` that sat beside it recorded agreement between two parts of this
+     * repository, which is what went.
+     */
+    fileDigest: z.ZodString;
+    unitRef: z.ZodString;
+}, z.core.$strict>;
+export type ApplicationConsumerDocumentationContentFileIdentityV1 = z.infer<typeof ApplicationConsumerDocumentationContentFileIdentityV1Schema>;
+export declare const ApplicationConsumerDocumentationContentUnitIdentityV1Schema: z.ZodObject<{
+    unitRef: z.ZodString;
+    sourceRefs: z.ZodArray<z.ZodString>;
+    managedPaths: z.ZodArray<z.core.$ZodBranded<z.ZodString, "TechnicalDocumentationNormalizedRelativePath", "out">>;
+}, z.core.$strict>;
+export type ApplicationConsumerDocumentationContentUnitIdentityV1 = z.infer<typeof ApplicationConsumerDocumentationContentUnitIdentityV1Schema>;
+/**
+ * Exact identity of the managed engine content bundle.
+ *
+ * generatedAt is operational provenance only, and is excluded from every comparison so regenerating
+ * identical source bytes stays identity-stable.
+ */
+export declare const ApplicationConsumerDocumentationContentManifestV1Schema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    contentBundleVersion: z.ZodNumber;
+    generatedAt: z.ZodISODateTime;
+    fileCount: z.ZodNumber;
+    unitCount: z.ZodNumber;
+    files: z.ZodArray<z.ZodObject<{
+        managedPath: z.core.$ZodBranded<z.ZodString, "TechnicalDocumentationNormalizedRelativePath", "out">;
+        mediaType: z.ZodLiteral<ApplicationConsumerDocumentationContentMediaType>;
+        byteLength: z.ZodNumber;
+        /**
+         * sha256 of the file's exact UTF-8 bytes. Kept through the 2026-08-27 digest demolition because
+         * it names opaque emitted content and detects its corruption; the `semanticDigest` and
+         * `contentBundleRootDigest` that sat beside it recorded agreement between two parts of this
+         * repository, which is what went.
+         */
+        fileDigest: z.ZodString;
+        unitRef: z.ZodString;
+    }, z.core.$strict>>;
+    units: z.ZodArray<z.ZodObject<{
+        unitRef: z.ZodString;
+        sourceRefs: z.ZodArray<z.ZodString>;
+        managedPaths: z.ZodArray<z.core.$ZodBranded<z.ZodString, "TechnicalDocumentationNormalizedRelativePath", "out">>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ApplicationConsumerDocumentationContentManifestV1 = z.infer<typeof ApplicationConsumerDocumentationContentManifestV1Schema>;
+export interface ApplicationConsumerDocumentationAuthoredContentV1 {
+    readonly managedPath: string;
+    readonly unitRef: string;
+    readonly sourceRefs: readonly string[];
+    readonly markdown: string;
+}
+//# sourceMappingURL=application-consumer-documentation-content-manifest.schemas.d.ts.map

package/dist/esm/content/application-consumer-documentation-content-manifest.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-consumer-documentation-content-manifest.schemas.d.ts","sourceRoot":"","sources":["../../../../src/content/application-consumer-documentation-content-manifest.schemas.ts"],"names":[],"mappings":"AAAA,wJAAwJ;AACxJ,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,0FAA0F;AAC1F,oBAAY,gDAAgD;IAC1D,aAAa,iCAAiC;CAC/C;AAED,8GAA8G;AAC9G,eAAO,MAAM,qDAAqD,EAAG,oEAA6E,CAAC;AAEnJ,eAAO,MAAM,+DAA+D,EAAG,oCAA6C,CAAC;AAC7H;;;;;;GAMG;AACH,eAAO,MAAM,8DAA8D,EAAG,uBAAgC,CAAC;AAC/G;;;;GAIG;AACH,eAAO,MAAM,qEAAqE,EAAG,8BAAuC,CAAC;AAE7H,eAAO,MAAM,2DAA2D;;;;IAItE;;;;;OAKG;;;kBAGH,CAAC;AACH,MAAM,MAAM,qDAAqD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2DAA2D,CAAC,CAAC;AAEhJ,eAAO,MAAM,2DAA2D;;;;kBAoBpE,CAAC;AACL,MAAM,MAAM,qDAAqD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2DAA2D,CAAC,CAAC;AAEhJ;;;;;GAKG;AACH,eAAO,MAAM,uDAAuD;;;;;;;;;;QAxClE;;;;;WAKG;;;;;;;;;kBAqFD,CAAC;AACL,MAAM,MAAM,iDAAiD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uDAAuD,CAAC,CAAC;AAExI,MAAM,WAAW,iDAAiD;IAChE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B"}

package/dist/esm/content/application-consumer-documentation-content-manifest.schemas.js

@@ -0,0 +1,114 @@
+/** Portable identities for the reusable engine-owned application-consumer content bundle. No filesystem or companion runtime belongs in this module. */
+import { z } from 'zod';
+import { TechnicalDocumentationNormalizedRelativePathSchema, TechnicalDocumentationRefSchema, technicalDocumentationValuesAreUniqueAndSorted, } from '@wildo-ai/saas-specifications/technical-documentation';
+/** Exact media types accepted by the engine-owned application-consumer content bundle. */
+export var ApplicationConsumerDocumentationContentMediaType;
+(function (ApplicationConsumerDocumentationContentMediaType) {
+    ApplicationConsumerDocumentationContentMediaType["MARKDOWN_UTF8"] = "text/markdown; charset=utf-8";
+})(ApplicationConsumerDocumentationContentMediaType || (ApplicationConsumerDocumentationContentMediaType = {}));
+/** The engine-owned content bundle's stable name. With `contentBundleVersion` it is the bundle's identity. */
+export const APPLICATION_CONSUMER_DOCUMENTATION_CONTENT_BUNDLE_REF = 'technical-documentation:content-bundle/engine-application-consumer';
+export const APPLICATION_CONSUMER_DOCUMENTATION_ENGINE_CONTENT_SOURCE_PREFIX = 'saas-technical-doc:engine-content/';
+/**
+ * References to safe, explicitly curated facts projected from framework source.
+ *
+ * Authored Markdown may cite these facts but can never cite an arbitrary model,
+ * resource specification, or source file. The companion projector joins each
+ * reference to the exact catalog entry and fails closed when it is absent.
+ */
+export const APPLICATION_CONSUMER_DOCUMENTATION_CONSUMER_FACT_SOURCE_PREFIX = 'source:consumer-fact:';
+/**
+ * A narrow, public projection made by the application companion. The current
+ * use is the application's organization-role inventory; it is deliberately
+ * not a general escape hatch for arbitrary application source.
+ */
+export const APPLICATION_CONSUMER_DOCUMENTATION_COMPANION_PROJECTION_SOURCE_PREFIX = 'source:companion-projection:';
+export const ApplicationConsumerDocumentationContentFileIdentityV1Schema = z.strictObject({
+    managedPath: TechnicalDocumentationNormalizedRelativePathSchema,
+    mediaType: z.literal(ApplicationConsumerDocumentationContentMediaType.MARKDOWN_UTF8),
+    byteLength: z.number().int().nonnegative(),
+    /**
+     * sha256 of the file's exact UTF-8 bytes. Kept through the 2026-08-27 digest demolition because
+     * it names opaque emitted content and detects its corruption; the `semanticDigest` and
+     * `contentBundleRootDigest` that sat beside it recorded agreement between two parts of this
+     * repository, which is what went.
+     */
+    fileDigest: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+    unitRef: TechnicalDocumentationRefSchema,
+});
+export const ApplicationConsumerDocumentationContentUnitIdentityV1Schema = z
+    .strictObject({
+    unitRef: TechnicalDocumentationRefSchema,
+    sourceRefs: z.array(TechnicalDocumentationRefSchema).min(1),
+    managedPaths: z.array(TechnicalDocumentationNormalizedRelativePathSchema).min(1),
+})
+    .superRefine((unit, context) => {
+    if (!technicalDocumentationValuesAreUniqueAndSorted(unit.sourceRefs)) {
+        context.addIssue({ code: 'custom', message: 'content sourceRefs must be unique and sorted', path: ['sourceRefs'] });
+    }
+    if (!technicalDocumentationValuesAreUniqueAndSorted(unit.managedPaths)) {
+        context.addIssue({ code: 'custom', message: 'content managedPaths must be unique and sorted', path: ['managedPaths'] });
+    }
+    for (const [index, sourceRef] of unit.sourceRefs.entries()) {
+        if (!sourceRef.startsWith(APPLICATION_CONSUMER_DOCUMENTATION_ENGINE_CONTENT_SOURCE_PREFIX)
+            && !sourceRef.startsWith(APPLICATION_CONSUMER_DOCUMENTATION_CONSUMER_FACT_SOURCE_PREFIX)
+            && !sourceRef.startsWith(APPLICATION_CONSUMER_DOCUMENTATION_COMPANION_PROJECTION_SOURCE_PREFIX)) {
+            context.addIssue({ code: 'custom', message: 'engine content units can cite only engine-content, curated consumer-fact, or declared companion-projection source refs', path: ['sourceRefs', index] });
+        }
+    }
+});
+/**
+ * Exact identity of the managed engine content bundle.
+ *
+ * generatedAt is operational provenance only, and is excluded from every comparison so regenerating
+ * identical source bytes stays identity-stable.
+ */
+export const ApplicationConsumerDocumentationContentManifestV1Schema = z
+    .strictObject({
+    schemaVersion: z.literal(1),
+    contentBundleVersion: z.number().int().positive(),
+    generatedAt: z.iso.datetime(),
+    fileCount: z.number().int().positive(),
+    unitCount: z.number().int().positive(),
+    files: z.array(ApplicationConsumerDocumentationContentFileIdentityV1Schema).min(1),
+    units: z.array(ApplicationConsumerDocumentationContentUnitIdentityV1Schema).min(1),
+})
+    .superRefine((manifest, context) => {
+    if (manifest.fileCount !== manifest.files.length) {
+        context.addIssue({ code: 'custom', message: 'fileCount must equal the exact managed file inventory', path: ['fileCount'] });
+    }
+    if (manifest.unitCount !== manifest.units.length) {
+        context.addIssue({ code: 'custom', message: 'unitCount must equal the exact unit inventory', path: ['unitCount'] });
+    }
+    const paths = manifest.files.map((file) => file.managedPath);
+    if (!technicalDocumentationValuesAreUniqueAndSorted(paths)) {
+        context.addIssue({ code: 'custom', message: 'managed files must be unique and sorted by path', path: ['files'] });
+    }
+    const caseFoldedPaths = paths.map((path) => path.toLocaleLowerCase('en-US'));
+    if (new Set(caseFoldedPaths).size !== caseFoldedPaths.length) {
+        context.addIssue({ code: 'custom', message: 'managed file paths cannot collide after case folding', path: ['files'] });
+    }
+    const unitRefs = manifest.units.map((unit) => unit.unitRef);
+    if (!technicalDocumentationValuesAreUniqueAndSorted(unitRefs)) {
+        context.addIssue({ code: 'custom', message: 'content units must be unique and sorted by unitRef', path: ['units'] });
+    }
+    const filesByUnitRef = new Map();
+    for (const file of manifest.files) {
+        const managedPaths = filesByUnitRef.get(file.unitRef) ?? [];
+        managedPaths.push(file.managedPath);
+        filesByUnitRef.set(file.unitRef, managedPaths);
+    }
+    for (const [index, unit] of manifest.units.entries()) {
+        const exactPaths = filesByUnitRef.get(unit.unitRef)?.sort() ?? [];
+        if (exactPaths.join('\0') !== unit.managedPaths.join('\0')) {
+            context.addIssue({ code: 'custom', message: 'unit managedPaths must exactly cover files assigned to that unitRef', path: ['units', index, 'managedPaths'] });
+        }
+    }
+    const declaredUnitRefs = new Set(unitRefs);
+    for (const [index, file] of manifest.files.entries()) {
+        if (!declaredUnitRefs.has(file.unitRef)) {
+            context.addIssue({ code: 'custom', message: 'every managed file must belong to a declared unit', path: ['files', index, 'unitRef'] });
+        }
+    }
+});
+//# sourceMappingURL=application-consumer-documentation-content-manifest.schemas.js.map