@wildo-ai/saas-technical-doc 1.1.1

package/dist/esm/companion/application-documentation/technical-documentation-engine-content-bundle.js

@@ -0,0 +1,1865 @@
+import { canonicalizeTechnicalDocumentationJson, TechnicalDocumentationAccessClass, TechnicalDocumentationApiReferenceSection, TechnicalDocumentationApiReferenceTargetKind, TechnicalDocumentationApplicabilityEvidenceAxis, TechnicalDocumentationApplicabilityEvidenceStatus, TechnicalDocumentationEditorialStatus, TechnicalDocumentationEvidenceSubjectRef, TechnicalDocumentationLinkKind, TechnicalDocumentationReaderAudience, TechnicalDocumentationSourceClassification, TechnicalDocumentationSourceOwnership, TechnicalDocumentationUnitKind, createTechnicalDocumentationUnitV1, } from '@wildo-ai/saas-specifications/technical-documentation';
+import { EngineDocumentationSpecificationFamilyRef, } from '@wildo-ai/saas-specifications/companion';
+import { APPLICATION_CONSUMER_DOCUMENTATION_CONSUMER_FACT_SOURCE_PREFIX, APPLICATION_CONSUMER_DOCUMENTATION_ENGINE_CONTENT_SOURCE_PREFIX, } from '../../content/application-consumer-documentation-content-manifest.schemas.js';
+import { APPLICATION_ORGANIZATION_ROLES_DOCUMENTATION_SOURCE_REF } from './application-organization-role-documentation.js';
+import { APPLICATION_ORGANIZATION_UNIT_RESOURCES_DOCUMENTATION_SOURCE_REF, } from './application-organization-unit-resource-documentation.js';
+const PROVEN = [TechnicalDocumentationApplicabilityEvidenceStatus.PROVEN];
+/**
+ * Every page in the webhook journey describes the same conditional product
+ * surface. Keep that condition at the journey boundary so a child task can
+ * never be published after its landing has correctly failed applicability.
+ */
+const OUTBOUND_WEBHOOK_APPLICABILITY_REQUIREMENTS = [
+    {
+        axis: TechnicalDocumentationApplicabilityEvidenceAxis.EXPOSED_API_SURFACE,
+        subjectRef: TechnicalDocumentationEvidenceSubjectRef.OUTBOUND_M2M_DELIVERY,
+        acceptableStatuses: [...PROVEN],
+    },
+    {
+        axis: TechnicalDocumentationApplicabilityEvidenceAxis.ENGINE_SUPPORT,
+        subjectRef: TechnicalDocumentationEvidenceSubjectRef.OUTBOUND_M2M_SIGNATURE,
+        acceptableStatuses: [...PROVEN],
+    },
+];
+const ORGANIZATION_SIEM_EXPORT_APPLICABILITY_REQUIREMENTS = [{
+        axis: TechnicalDocumentationApplicabilityEvidenceAxis.EXPOSED_API_SURFACE,
+        subjectRef: TechnicalDocumentationEvidenceSubjectRef.ORGANIZATION_SIEM_EXPORT,
+        acceptableStatuses: [...PROVEN],
+    }];
+const ORGANIZATION_SIEM_RECOVERY_APPLICABILITY_REQUIREMENTS = [{
+        axis: TechnicalDocumentationApplicabilityEvidenceAxis.EXPOSED_API_SURFACE,
+        subjectRef: TechnicalDocumentationEvidenceSubjectRef.ORGANIZATION_SIEM_DELIVERY_RECOVERY,
+        acceptableStatuses: [...PROVEN],
+    }];
+/** Billing is one operational journey; every page requires the admitted account and subscription surfaces. */
+const ORGANIZATION_BILLING_APPLICABILITY_REQUIREMENTS = [{
+        axis: TechnicalDocumentationApplicabilityEvidenceAxis.EXPOSED_API_SURFACE,
+        subjectRef: TechnicalDocumentationEvidenceSubjectRef.ORGANIZATION_BILLING_ADMINISTRATION,
+        acceptableStatuses: [...PROVEN],
+    }];
+const MCP_INTEGRATION_APPLICABILITY_REQUIREMENTS = [{
+        axis: TechnicalDocumentationApplicabilityEvidenceAxis.CONFIGURED_ACTIVATION,
+        subjectRef: TechnicalDocumentationEvidenceSubjectRef.APPLICATION_MCP_TOOL_SURFACE,
+        acceptableStatuses: [...PROVEN],
+    }];
+const A2A_INTEGRATION_APPLICABILITY_REQUIREMENTS = [{
+        axis: TechnicalDocumentationApplicabilityEvidenceAxis.CONFIGURED_ACTIVATION,
+        subjectRef: TechnicalDocumentationEvidenceSubjectRef.APPLICATION_A2A_AGENT_SURFACE,
+        acceptableStatuses: [...PROVEN],
+    }];
+const CONSUMER_FACT_TOKEN_PATTERN = /\{\{CONSUMER_FACT:([^#}]+)#([^}]+)\}\}/g;
+const APPLICATION_ORGANIZATION_ROLES_TOKEN = '{{APPLICATION_ORGANIZATION_ROLES}}';
+const APPLICATION_ORGANIZATION_UNIT_RESOURCES_TOKEN = '{{APPLICATION_ORGANIZATION_UNIT_RESOURCES}}';
+/**
+ * Build one semantic guide-to-reference link without embedding a Docusaurus
+ * route. The verified OpenAPI link index resolves the resource only when the
+ * application actually publishes it, so a task page cannot drift into a
+ * second, hand-maintained endpoint catalogue.
+ */
+function resourceApiReferenceTarget(label, resourceIdentifier) {
+    const target = {
+        section: TechnicalDocumentationApiReferenceSection.API_REFERENCE,
+        kind: TechnicalDocumentationApiReferenceTargetKind.RESOURCE,
+        resourceRef: `technical-documentation:resource/${resourceIdentifier}`,
+    };
+    return Object.freeze({
+        label,
+        target,
+    });
+}
+function applicationAdministrationResourceApiReferenceTarget(label, resourceIdentifier) {
+    const target = {
+        section: TechnicalDocumentationApiReferenceSection.APPLICATION_ADMINISTRATION_API_REFERENCE,
+        kind: TechnicalDocumentationApiReferenceTargetKind.RESOURCE,
+        resourceRef: `technical-documentation:resource/${resourceIdentifier}`,
+    };
+    return Object.freeze({
+        label,
+        target,
+    });
+}
+function operationFamilyApiReferenceTarget(label, resourceIdentifier, operationFamilyIdentifier) {
+    const target = {
+        section: TechnicalDocumentationApiReferenceSection.API_REFERENCE,
+        kind: TechnicalDocumentationApiReferenceTargetKind.OPERATION_FAMILY,
+        operationFamilyRef: `technical-documentation:resource/${resourceIdentifier}/operation-family/${operationFamilyIdentifier}`,
+    };
+    return Object.freeze({ label, target });
+}
+const organizationMembersApiReferenceTarget = () => resourceApiReferenceTarget('Organization members API reference', 'organizationMembers');
+const organizationUnitsApiReferenceTarget = () => resourceApiReferenceTarget('Organization units API reference', 'organizationUnits');
+const organizationUnitMembersApiReferenceTarget = () => resourceApiReferenceTarget('Organization-unit members API reference', 'organizationUnitMembers');
+const scimProvisioningConfigApiReferenceTarget = () => resourceApiReferenceTarget('SCIM provisioning configuration API reference', 'organizationScimProvisioningConfig');
+const auditLogsApiReferenceTarget = () => resourceApiReferenceTarget('Audit records API reference', 'auditLogs');
+const organizationSiemExportConfigApiReferenceTarget = () => resourceApiReferenceTarget('Organization SIEM export configuration API reference', 'organizationSiemExportConfig');
+const organizationSiemDeliveryDlqApiReferenceTarget = () => resourceApiReferenceTarget('Organization SIEM delivery recovery API reference', 'organizationSiemDeliveryDlq');
+const organizationBillingAccountApiReferenceTarget = () => resourceApiReferenceTarget('Organization billing account API reference', 'organizationBillingAccounts');
+const organizationSubscriptionsApiReferenceTarget = () => resourceApiReferenceTarget('Organization subscriptions API reference', 'organizationSubscriptions');
+const organizationInvoiceRefsApiReferenceTarget = () => resourceApiReferenceTarget('Organization invoice summaries API reference', 'organizationInvoiceRefs');
+const organizationUsageRecordsApiReferenceTarget = () => resourceApiReferenceTarget('Organization usage records API reference', 'organizationUsageRecords');
+/**
+ * The engine-owned editorial topology: each verified authored unit has one
+ * consumer-documentation role and an explicit set of reader destinations.
+ *
+ * This is deliberately separate from Markdown. Markdown owns the narrative
+ * and title; this map owns type, audience, publication posture and navigation
+ * relationships, allowing the projector to reject a mismatched content set.
+ */
+export const ENGINE_CONTENT_UNIT_DEFINITIONS = Object.freeze({
+    'technical-documentation:unit/application-orientation': {
+        kind: TechnicalDocumentationUnitKind.ORIENTATION,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/authentication',
+            'technical-documentation:unit/api-keys',
+            'technical-documentation:unit/first-request',
+        ],
+    },
+    'technical-documentation:unit/authentication': {
+        kind: TechnicalDocumentationUnitKind.ORIENTATION,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        // D14: engine-generic API guidance is applicable because the application
+        // declares an API, not because a live process was observed serving one.
+        // The former RUNTIME_AUTHORIZATION requirement on APPLICATION_API could only ever be
+        // satisfied by a runtime receipt, which no longer exists.
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/sign-in-and-mfa',
+            'technical-documentation:unit/single-sign-on',
+            'technical-documentation:unit/api-keys',
+            'technical-documentation:unit/oauth-provider',
+            'technical-documentation:unit/first-request',
+        ],
+    },
+    'technical-documentation:unit/sign-in-and-mfa': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/complete-sign-in',
+            'technical-documentation:unit/mfa-enrollment-and-recovery',
+            'technical-documentation:unit/sign-in-troubleshoot',
+        ],
+    },
+    'technical-documentation:unit/complete-sign-in': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/sign-in-and-mfa',
+            'technical-documentation:unit/mfa-enrollment-and-recovery',
+            'technical-documentation:unit/sign-in-troubleshoot',
+        ],
+    },
+    'technical-documentation:unit/mfa-enrollment-and-recovery': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/sign-in-and-mfa',
+            'technical-documentation:unit/complete-sign-in',
+            'technical-documentation:unit/sign-in-troubleshoot',
+        ],
+    },
+    'technical-documentation:unit/sign-in-troubleshoot': {
+        kind: TechnicalDocumentationUnitKind.TROUBLESHOOTING,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/sign-in-and-mfa',
+            'technical-documentation:unit/complete-sign-in',
+            'technical-documentation:unit/mfa-enrollment-and-recovery',
+            'technical-documentation:unit/troubleshoot-user-access',
+        ],
+    },
+    'technical-documentation:unit/single-sign-on': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/sso-configure',
+            'technical-documentation:unit/sso-rollout-and-recovery',
+            'technical-documentation:unit/sso-troubleshoot',
+        ],
+    },
+    'technical-documentation:unit/sso-configure': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/single-sign-on',
+            'technical-documentation:unit/sso-rollout-and-recovery',
+            'technical-documentation:unit/sso-troubleshoot',
+        ],
+    },
+    'technical-documentation:unit/sso-rollout-and-recovery': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/single-sign-on',
+            'technical-documentation:unit/sso-configure',
+            'technical-documentation:unit/sso-troubleshoot',
+        ],
+    },
+    'technical-documentation:unit/sso-troubleshoot': {
+        kind: TechnicalDocumentationUnitKind.TROUBLESHOOTING,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/single-sign-on',
+            'technical-documentation:unit/sso-configure',
+            'technical-documentation:unit/sso-rollout-and-recovery',
+            'technical-documentation:unit/troubleshoot-user-access',
+        ],
+    },
+    'technical-documentation:unit/api-keys': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/api-keys-create-and-store',
+            'technical-documentation:unit/api-keys-lifecycle',
+            'technical-documentation:unit/api-keys-troubleshoot',
+        ],
+        apiReferenceTargets: [{
+                label: 'Organization API keys API reference',
+                target: {
+                    section: TechnicalDocumentationApiReferenceSection.API_REFERENCE,
+                    kind: TechnicalDocumentationApiReferenceTargetKind.RESOURCE,
+                    resourceRef: 'technical-documentation:resource/organizationApiKeys',
+                },
+            }],
+    },
+    'technical-documentation:unit/api-keys-create-and-store': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/api-keys',
+            'technical-documentation:unit/api-keys-lifecycle',
+            'technical-documentation:unit/first-request',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Create an organization API key', 'organizationApiKeys', 'create'),
+        ],
+    },
+    'technical-documentation:unit/api-keys-lifecycle': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/api-keys',
+            'technical-documentation:unit/api-keys-create-and-store',
+            'technical-documentation:unit/api-keys-troubleshoot',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Rotate an organization API key', 'organizationApiKeys', 'rotate'),
+            operationFamilyApiReferenceTarget('Deactivate an organization API key', 'organizationApiKeys', 'deactivate'),
+            operationFamilyApiReferenceTarget('Reactivate an organization API key', 'organizationApiKeys', 'reactivate'),
+            operationFamilyApiReferenceTarget('Extend an organization API key expiry', 'organizationApiKeys', 'extend_expiry'),
+        ],
+    },
+    'technical-documentation:unit/api-keys-troubleshoot': {
+        kind: TechnicalDocumentationUnitKind.TROUBLESHOOTING,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/api-keys',
+            'technical-documentation:unit/api-keys-create-and-store',
+            'technical-documentation:unit/common-rest-api',
+        ],
+        apiReferenceTargets: [resourceApiReferenceTarget('Organization API keys API reference', 'organizationApiKeys')],
+    },
+    'technical-documentation:unit/oauth-provider': {
+        kind: TechnicalDocumentationUnitKind.CONCEPT,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/oauth-register-client',
+            'technical-documentation:unit/oauth-authorize-delegated-access',
+            'technical-documentation:unit/oauth-operate-and-revoke',
+        ],
+    },
+    'technical-documentation:unit/oauth-register-client': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/oauth-provider',
+            'technical-documentation:unit/oauth-authorize-delegated-access',
+            'technical-documentation:unit/oauth-operate-and-revoke',
+        ],
+        apiReferenceTargets: [
+            applicationAdministrationResourceApiReferenceTarget('Organization OAuth clients API reference', 'organizationOAuthClients'),
+        ],
+    },
+    'technical-documentation:unit/oauth-authorize-delegated-access': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/oauth-provider',
+            'technical-documentation:unit/oauth-register-client',
+            'technical-documentation:unit/oauth-operate-and-revoke',
+        ],
+    },
+    'technical-documentation:unit/oauth-operate-and-revoke': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/oauth-provider',
+            'technical-documentation:unit/oauth-register-client',
+            'technical-documentation:unit/oauth-authorize-delegated-access',
+            'technical-documentation:unit/api-keys-lifecycle',
+        ],
+        apiReferenceTargets: [
+            applicationAdministrationResourceApiReferenceTarget('Organization OAuth clients API reference', 'organizationOAuthClients'),
+        ],
+    },
+    'technical-documentation:unit/user-administration': {
+        kind: TechnicalDocumentationUnitKind.ORIENTATION,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/manage-users-manually',
+            'technical-documentation:unit/authentication',
+            'technical-documentation:unit/scim',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+    },
+    'technical-documentation:unit/manage-users-manually': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/invite-and-onboard-user',
+            'technical-documentation:unit/change-user-access',
+            'technical-documentation:unit/suspend-or-remove-user',
+            'technical-documentation:unit/scim',
+        ],
+    },
+    'technical-documentation:unit/invite-and-onboard-user': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/manage-users-manually',
+            'technical-documentation:unit/organization-roles',
+            'technical-documentation:unit/suspend-or-remove-user',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Invite a member', 'organizationMembers', 'create'),
+            operationFamilyApiReferenceTarget('Resend a pending invitation', 'organizationMembers', 'resend'),
+            operationFamilyApiReferenceTarget('Revoke a pending invitation', 'organizationMembers', 'revoke'),
+        ],
+    },
+    'technical-documentation:unit/organization-roles': {
+        kind: TechnicalDocumentationUnitKind.CONCEPT,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/change-user-access',
+            'technical-documentation:unit/manage-organization-units',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+        apiReferenceTargets: [{
+                label: 'Organization members API reference',
+                target: {
+                    section: TechnicalDocumentationApiReferenceSection.API_REFERENCE,
+                    kind: TechnicalDocumentationApiReferenceTargetKind.RESOURCE,
+                    resourceRef: 'technical-documentation:resource/organizationMembers',
+                },
+            }],
+    },
+    'technical-documentation:unit/change-user-access': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/organization-roles',
+            'technical-documentation:unit/suspend-or-remove-user',
+            'technical-documentation:unit/manage-organization-units',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Update an organization membership', 'organizationMembers', 'update'),
+            organizationUnitMembersApiReferenceTarget(),
+        ],
+    },
+    'technical-documentation:unit/manage-organization-units': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/user-administration',
+            'technical-documentation:unit/design-organization-unit-hierarchy',
+            'technical-documentation:unit/assign-organization-unit-access',
+            'technical-documentation:unit/operate-organization-units',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Create an organization unit', 'organizationUnits', 'create'),
+            organizationUnitsApiReferenceTarget(),
+        ],
+    },
+    'technical-documentation:unit/design-organization-unit-hierarchy': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/manage-organization-units',
+            'technical-documentation:unit/assign-organization-unit-access',
+            'technical-documentation:unit/operate-organization-units',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Create an organization unit', 'organizationUnits', 'create'),
+            operationFamilyApiReferenceTarget('Move an organization unit', 'organizationUnits', 'move'),
+        ],
+    },
+    'technical-documentation:unit/assign-organization-unit-access': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/manage-organization-units',
+            'technical-documentation:unit/design-organization-unit-hierarchy',
+            'technical-documentation:unit/organization-roles',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('List organization-unit members', 'organizationUnitMembers', 'list'),
+            operationFamilyApiReferenceTarget('Assign an organization-unit member', 'organizationUnitMembers', 'create'),
+            operationFamilyApiReferenceTarget('Change an organization-unit assignment', 'organizationUnitMembers', 'update'),
+            operationFamilyApiReferenceTarget('Remove an organization-unit assignment', 'organizationUnitMembers', 'delete'),
+        ],
+    },
+    'technical-documentation:unit/operate-organization-units': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/manage-organization-units',
+            'technical-documentation:unit/assign-organization-unit-access',
+            'technical-documentation:unit/scim-map-profile-and-units',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Move an organization unit', 'organizationUnits', 'move'),
+            operationFamilyApiReferenceTarget('Archive an organization unit', 'organizationUnits', 'archive'),
+            operationFamilyApiReferenceTarget('Restore an organization unit', 'organizationUnits', 'restore'),
+            operationFamilyApiReferenceTarget('Delete an organization unit', 'organizationUnits', 'delete'),
+        ],
+    },
+    'technical-documentation:unit/suspend-or-remove-user': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/manage-users-manually',
+            'technical-documentation:unit/scim',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Revoke a pending invitation', 'organizationMembers', 'revoke'),
+            operationFamilyApiReferenceTarget('Suspend an organization membership', 'organizationMembers', 'suspend'),
+            operationFamilyApiReferenceTarget('Reactivate an organization membership', 'organizationMembers', 'reactivate'),
+            operationFamilyApiReferenceTarget('Remove an organization membership', 'organizationMembers', 'delete'),
+        ],
+    },
+    'technical-documentation:unit/review-users-and-access': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/user-administration',
+            'technical-documentation:unit/organization-roles',
+            'technical-documentation:unit/manage-organization-units',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('List organization members', 'organizationMembers', 'list'),
+            operationFamilyApiReferenceTarget('List organization-unit members', 'organizationUnitMembers', 'list'),
+        ],
+    },
+    'technical-documentation:unit/troubleshoot-user-access': {
+        kind: TechnicalDocumentationUnitKind.TROUBLESHOOTING,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/user-administration',
+            'technical-documentation:unit/sign-in-and-mfa',
+            'technical-documentation:unit/organization-roles',
+            'technical-documentation:unit/scim-operate-and-troubleshoot',
+        ],
+    },
+    'technical-documentation:unit/scim': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/user-administration',
+            'technical-documentation:unit/scim-protocol-and-payloads',
+            'technical-documentation:unit/scim-configure',
+            'technical-documentation:unit/scim-microsoft-entra',
+            'technical-documentation:unit/scim-okta',
+            'technical-documentation:unit/scim-ldap-and-active-directory',
+            'technical-documentation:unit/scim-map-profile-and-units',
+            'technical-documentation:unit/scim-validate-and-roll-out',
+            'technical-documentation:unit/scim-operate-and-troubleshoot',
+        ],
+        apiReferenceTargets: [
+            scimProvisioningConfigApiReferenceTarget(),
+            operationFamilyApiReferenceTarget('List SCIM tokens', 'organizationScimTokens', 'list'),
+            operationFamilyApiReferenceTarget('Generate a SCIM token', 'organizationScimTokens', 'generateToken'),
+        ],
+    },
+    'technical-documentation:unit/scim-protocol-and-payloads': {
+        kind: TechnicalDocumentationUnitKind.CONCEPT,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/scim',
+            'technical-documentation:unit/scim-configure',
+            'technical-documentation:unit/scim-microsoft-entra',
+            'technical-documentation:unit/scim-okta',
+            'technical-documentation:unit/scim-ldap-and-active-directory',
+            'technical-documentation:unit/scim-operate-and-troubleshoot',
+        ],
+        apiReferenceTargets: [
+            scimProvisioningConfigApiReferenceTarget(),
+            operationFamilyApiReferenceTarget('List SCIM tokens', 'organizationScimTokens', 'list'),
+        ],
+    },
+    'technical-documentation:unit/scim-configure': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/scim',
+            'technical-documentation:unit/single-sign-on',
+            'technical-documentation:unit/scim-protocol-and-payloads',
+            'technical-documentation:unit/scim-microsoft-entra',
+            'technical-documentation:unit/scim-okta',
+            'technical-documentation:unit/scim-ldap-and-active-directory',
+            'technical-documentation:unit/scim-map-profile-and-units',
+            'technical-documentation:unit/scim-validate-and-roll-out',
+        ],
+        apiReferenceTargets: [
+            scimProvisioningConfigApiReferenceTarget(),
+            operationFamilyApiReferenceTarget('Generate a SCIM token', 'organizationScimTokens', 'generateToken'),
+        ],
+    },
+    'technical-documentation:unit/scim-microsoft-entra': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/scim',
+            'technical-documentation:unit/scim-configure',
+            'technical-documentation:unit/scim-protocol-and-payloads',
+            'technical-documentation:unit/scim-map-profile-and-units',
+            'technical-documentation:unit/scim-validate-and-roll-out',
+        ],
+        apiReferenceTargets: [
+            scimProvisioningConfigApiReferenceTarget(),
+            operationFamilyApiReferenceTarget('Generate a SCIM token', 'organizationScimTokens', 'generateToken'),
+            organizationMembersApiReferenceTarget(),
+        ],
+    },
+    'technical-documentation:unit/scim-okta': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/scim',
+            'technical-documentation:unit/scim-configure',
+            'technical-documentation:unit/scim-protocol-and-payloads',
+            'technical-documentation:unit/scim-map-profile-and-units',
+            'technical-documentation:unit/scim-validate-and-roll-out',
+        ],
+        apiReferenceTargets: [
+            scimProvisioningConfigApiReferenceTarget(),
+            operationFamilyApiReferenceTarget('Generate a SCIM token', 'organizationScimTokens', 'generateToken'),
+            organizationMembersApiReferenceTarget(),
+        ],
+    },
+    'technical-documentation:unit/scim-ldap-and-active-directory': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/scim',
+            'technical-documentation:unit/scim-configure',
+            'technical-documentation:unit/scim-protocol-and-payloads',
+            'technical-documentation:unit/scim-map-profile-and-units',
+            'technical-documentation:unit/scim-validate-and-roll-out',
+        ],
+        apiReferenceTargets: [
+            scimProvisioningConfigApiReferenceTarget(),
+            operationFamilyApiReferenceTarget('Generate a SCIM token', 'organizationScimTokens', 'generateToken'),
+            organizationMembersApiReferenceTarget(),
+        ],
+    },
+    'technical-documentation:unit/scim-map-profile-and-units': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/scim',
+            'technical-documentation:unit/manage-organization-units',
+            'technical-documentation:unit/scim-validate-and-roll-out',
+        ],
+        apiReferenceTargets: [
+            scimProvisioningConfigApiReferenceTarget(),
+            organizationUnitsApiReferenceTarget(),
+        ],
+    },
+    'technical-documentation:unit/scim-validate-and-roll-out': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/scim',
+            'technical-documentation:unit/scim-configure',
+            'technical-documentation:unit/scim-map-profile-and-units',
+            'technical-documentation:unit/scim-operate-and-troubleshoot',
+        ],
+        apiReferenceTargets: [
+            scimProvisioningConfigApiReferenceTarget(),
+            organizationMembersApiReferenceTarget(),
+        ],
+    },
+    'technical-documentation:unit/scim-operate-and-troubleshoot': {
+        kind: TechnicalDocumentationUnitKind.TROUBLESHOOTING,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/scim',
+            'technical-documentation:unit/scim-configure',
+            'technical-documentation:unit/scim-validate-and-roll-out',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+        apiReferenceTargets: [
+            scimProvisioningConfigApiReferenceTarget(),
+            operationFamilyApiReferenceTarget('List SCIM tokens', 'organizationScimTokens', 'list'),
+            operationFamilyApiReferenceTarget('Generate a SCIM token', 'organizationScimTokens', 'generateToken'),
+            operationFamilyApiReferenceTarget('Revoke a SCIM token', 'organizationScimTokens', 'revokeToken'),
+            operationFamilyApiReferenceTarget('Rotate a SCIM token', 'organizationScimTokens', 'rotateToken'),
+        ],
+    },
+    'technical-documentation:unit/audit-and-siem': {
+        kind: TechnicalDocumentationUnitKind.ORIENTATION,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/investigate-audit-event',
+            'technical-documentation:unit/review-privileged-and-access-changes',
+            'technical-documentation:unit/export-audit-records',
+            'technical-documentation:unit/configure-siem-export',
+            'technical-documentation:unit/siem-splunk',
+            'technical-documentation:unit/siem-microsoft-sentinel',
+            'technical-documentation:unit/siem-elastic',
+            'technical-documentation:unit/operate-and-troubleshoot-siem-delivery',
+            'technical-documentation:unit/protect-and-retain-audit-evidence',
+            'technical-documentation:unit/user-administration',
+            'technical-documentation:unit/scim',
+        ],
+        apiReferenceTargets: [auditLogsApiReferenceTarget()],
+    },
+    'technical-documentation:unit/investigate-audit-event': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/audit-and-siem',
+            'technical-documentation:unit/review-privileged-and-access-changes',
+            'technical-documentation:unit/export-audit-records',
+        ],
+        apiReferenceTargets: [auditLogsApiReferenceTarget()],
+    },
+    'technical-documentation:unit/review-privileged-and-access-changes': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/audit-and-siem',
+            'technical-documentation:unit/investigate-audit-event',
+            'technical-documentation:unit/review-users-and-access',
+        ],
+        apiReferenceTargets: [auditLogsApiReferenceTarget()],
+    },
+    'technical-documentation:unit/export-audit-records': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/audit-and-siem',
+            'technical-documentation:unit/investigate-audit-event',
+            'technical-documentation:unit/protect-and-retain-audit-evidence',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Export audit records', 'auditLogs', 'exportAuditLogs'),
+        ],
+    },
+    'technical-documentation:unit/configure-siem-export': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_SIEM_EXPORT_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/audit-and-siem',
+            'technical-documentation:unit/siem-splunk',
+            'technical-documentation:unit/siem-microsoft-sentinel',
+            'technical-documentation:unit/siem-elastic',
+            'technical-documentation:unit/operate-and-troubleshoot-siem-delivery',
+            'technical-documentation:unit/protect-and-retain-audit-evidence',
+        ],
+        apiReferenceTargets: [organizationSiemExportConfigApiReferenceTarget()],
+    },
+    'technical-documentation:unit/siem-splunk': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_SIEM_EXPORT_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/configure-siem-export',
+            'technical-documentation:unit/operate-and-troubleshoot-siem-delivery',
+            'technical-documentation:unit/protect-and-retain-audit-evidence',
+        ],
+        apiReferenceTargets: [organizationSiemExportConfigApiReferenceTarget()],
+    },
+    'technical-documentation:unit/siem-microsoft-sentinel': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_SIEM_EXPORT_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/configure-siem-export',
+            'technical-documentation:unit/operate-and-troubleshoot-siem-delivery',
+            'technical-documentation:unit/protect-and-retain-audit-evidence',
+        ],
+        apiReferenceTargets: [organizationSiemExportConfigApiReferenceTarget()],
+    },
+    'technical-documentation:unit/siem-elastic': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_SIEM_EXPORT_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/configure-siem-export',
+            'technical-documentation:unit/operate-and-troubleshoot-siem-delivery',
+            'technical-documentation:unit/protect-and-retain-audit-evidence',
+        ],
+        apiReferenceTargets: [organizationSiemExportConfigApiReferenceTarget()],
+    },
+    'technical-documentation:unit/operate-and-troubleshoot-siem-delivery': {
+        kind: TechnicalDocumentationUnitKind.TROUBLESHOOTING,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_SIEM_RECOVERY_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/audit-and-siem',
+            'technical-documentation:unit/configure-siem-export',
+            'technical-documentation:unit/investigate-audit-event',
+        ],
+        apiReferenceTargets: [organizationSiemDeliveryDlqApiReferenceTarget()],
+    },
+    'technical-documentation:unit/protect-and-retain-audit-evidence': {
+        kind: TechnicalDocumentationUnitKind.CONCEPT,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/audit-and-siem',
+            'technical-documentation:unit/export-audit-records',
+            'technical-documentation:unit/operate-and-troubleshoot-siem-delivery',
+        ],
+        apiReferenceTargets: [auditLogsApiReferenceTarget()],
+    },
+    'technical-documentation:unit/billing': {
+        kind: TechnicalDocumentationUnitKind.ORIENTATION,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_BILLING_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/understand-billing-plans-and-access',
+            'technical-documentation:unit/start-billing-subscription',
+            'technical-documentation:unit/change-or-end-billing-subscription',
+            'technical-documentation:unit/billing-records-and-usage',
+            'technical-documentation:unit/reconcile-billing-and-access',
+            'technical-documentation:unit/troubleshoot-billing-change',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+        apiReferenceTargets: [
+            organizationBillingAccountApiReferenceTarget(),
+            organizationSubscriptionsApiReferenceTarget(),
+        ],
+    },
+    'technical-documentation:unit/understand-billing-plans-and-access': {
+        kind: TechnicalDocumentationUnitKind.CONCEPT,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_BILLING_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/billing',
+            'technical-documentation:unit/start-billing-subscription',
+            'technical-documentation:unit/reconcile-billing-and-access',
+        ],
+        apiReferenceTargets: [organizationBillingAccountApiReferenceTarget()],
+    },
+    'technical-documentation:unit/start-billing-subscription': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_BILLING_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/billing',
+            'technical-documentation:unit/understand-billing-plans-and-access',
+            'technical-documentation:unit/reconcile-billing-and-access',
+            'technical-documentation:unit/troubleshoot-billing-change',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Open an organization checkout', 'organizationBillingAccounts', 'open_checkout'),
+        ],
+    },
+    'technical-documentation:unit/change-or-end-billing-subscription': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_BILLING_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/billing',
+            'technical-documentation:unit/understand-billing-plans-and-access',
+            'technical-documentation:unit/reconcile-billing-and-access',
+            'technical-documentation:unit/troubleshoot-billing-change',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Change an organization subscription plan', 'organizationSubscriptions', 'change_plan'),
+            operationFamilyApiReferenceTarget('Cancel an organization subscription', 'organizationSubscriptions', 'cancel'),
+            operationFamilyApiReferenceTarget('Resume an organization subscription', 'organizationSubscriptions', 'resume'),
+        ],
+    },
+    'technical-documentation:unit/manage-invoices-and-payments': {
+        kind: TechnicalDocumentationUnitKind.CONCEPT,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_BILLING_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/billing',
+            'technical-documentation:unit/billing-records-and-usage',
+            'technical-documentation:unit/reconcile-billing-and-access',
+            'technical-documentation:unit/understand-metered-usage',
+            'technical-documentation:unit/protect-and-retain-audit-evidence',
+        ],
+        apiReferenceTargets: [
+            organizationInvoiceRefsApiReferenceTarget(),
+            operationFamilyApiReferenceTarget('Open the authenticated billing portal', 'organizationBillingAccounts', 'open_portal'),
+        ],
+    },
+    'technical-documentation:unit/billing-records-and-usage': {
+        kind: TechnicalDocumentationUnitKind.ORIENTATION,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_BILLING_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/billing',
+            'technical-documentation:unit/manage-invoices-and-payments',
+            'technical-documentation:unit/understand-metered-usage',
+            'technical-documentation:unit/reconcile-billing-and-access',
+            'technical-documentation:unit/troubleshoot-billing-change',
+        ],
+        apiReferenceTargets: [
+            organizationInvoiceRefsApiReferenceTarget(),
+            organizationUsageRecordsApiReferenceTarget(),
+        ],
+    },
+    'technical-documentation:unit/understand-metered-usage': {
+        kind: TechnicalDocumentationUnitKind.CONCEPT,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_BILLING_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/billing',
+            'technical-documentation:unit/billing-records-and-usage',
+            'technical-documentation:unit/manage-invoices-and-payments',
+            'technical-documentation:unit/reconcile-billing-and-access',
+            'technical-documentation:unit/troubleshoot-billing-change',
+        ],
+        apiReferenceTargets: [organizationUsageRecordsApiReferenceTarget()],
+    },
+    'technical-documentation:unit/reconcile-billing-and-access': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_BILLING_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/billing',
+            'technical-documentation:unit/manage-invoices-and-payments',
+            'technical-documentation:unit/understand-metered-usage',
+            'technical-documentation:unit/troubleshoot-billing-change',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+        apiReferenceTargets: [
+            operationFamilyApiReferenceTarget('Read aggregated organization billing state', 'organizationBillingAccounts', 'get_state'),
+            organizationSubscriptionsApiReferenceTarget(),
+        ],
+    },
+    'technical-documentation:unit/troubleshoot-billing-change': {
+        kind: TechnicalDocumentationUnitKind.TROUBLESHOOTING,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_ADMINISTRATOR,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: ORGANIZATION_BILLING_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/billing',
+            'technical-documentation:unit/reconcile-billing-and-access',
+            'technical-documentation:unit/manage-invoices-and-payments',
+            'technical-documentation:unit/understand-metered-usage',
+        ],
+        apiReferenceTargets: [
+            organizationBillingAccountApiReferenceTarget(),
+            organizationSubscriptionsApiReferenceTarget(),
+        ],
+    },
+    'technical-documentation:unit/integrations': {
+        kind: TechnicalDocumentationUnitKind.ORIENTATION,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/automation-platforms',
+            'technical-documentation:unit/ai-coding-tools',
+            'technical-documentation:unit/first-request',
+            'technical-documentation:unit/common-rest-api',
+            'technical-documentation:unit/webhooks',
+            'technical-documentation:unit/agent-interoperability',
+        ],
+    },
+    'technical-documentation:unit/automation-platforms': {
+        kind: TechnicalDocumentationUnitKind.ORIENTATION,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/connect-n8n',
+            'technical-documentation:unit/connect-zapier',
+            'technical-documentation:unit/connect-make',
+            'technical-documentation:unit/first-request',
+        ],
+    },
+    'technical-documentation:unit/connect-n8n': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/automation-platforms',
+            'technical-documentation:unit/common-rest-api',
+            'technical-documentation:unit/webhooks',
+            'technical-documentation:unit/api-keys',
+        ],
+    },
+    'technical-documentation:unit/connect-zapier': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/automation-platforms',
+            'technical-documentation:unit/common-rest-api',
+            'technical-documentation:unit/webhooks',
+            'technical-documentation:unit/api-keys',
+        ],
+    },
+    'technical-documentation:unit/connect-make': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/automation-platforms',
+            'technical-documentation:unit/common-rest-api',
+            'technical-documentation:unit/webhooks',
+            'technical-documentation:unit/api-keys',
+        ],
+    },
+    'technical-documentation:unit/ai-coding-tools': {
+        kind: TechnicalDocumentationUnitKind.ORIENTATION,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: MCP_INTEGRATION_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/connect-cursor',
+            'technical-documentation:unit/connect-codex',
+            'technical-documentation:unit/connect-claude-code',
+            'technical-documentation:unit/mcp-integrations',
+        ],
+    },
+    'technical-documentation:unit/connect-cursor': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: MCP_INTEGRATION_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/ai-coding-tools',
+            'technical-documentation:unit/mcp-integrations',
+            'technical-documentation:unit/oauth-provider',
+        ],
+    },
+    'technical-documentation:unit/connect-codex': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: MCP_INTEGRATION_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/ai-coding-tools',
+            'technical-documentation:unit/mcp-integrations',
+            'technical-documentation:unit/oauth-provider',
+        ],
+    },
+    'technical-documentation:unit/connect-claude-code': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: MCP_INTEGRATION_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/ai-coding-tools',
+            'technical-documentation:unit/mcp-integrations',
+            'technical-documentation:unit/oauth-provider',
+        ],
+    },
+    'technical-documentation:unit/agent-interoperability': {
+        kind: TechnicalDocumentationUnitKind.CONCEPT,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/mcp-integrations',
+            'technical-documentation:unit/a2a-integrations',
+            'technical-documentation:unit/ai-coding-tools',
+            'technical-documentation:unit/oauth-provider',
+        ],
+    },
+    'technical-documentation:unit/mcp-integrations': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: MCP_INTEGRATION_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/agent-interoperability',
+            'technical-documentation:unit/oauth-provider',
+            'technical-documentation:unit/troubleshoot-api-request',
+        ],
+    },
+    'technical-documentation:unit/a2a-integrations': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: A2A_INTEGRATION_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/agent-interoperability',
+            'technical-documentation:unit/oauth-provider',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+    },
+    'technical-documentation:unit/first-request': {
+        kind: TechnicalDocumentationUnitKind.QUICKSTART,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        // D14: engine-generic API guidance is applicable because the application
+        // declares an API, not because a live process was observed serving one.
+        // The former runtime-exposure requirement on APPLICATION_API (then named
+        // `RUNTIME_EXPOSURE`, now `EXPOSED_API_SURFACE`) could only ever be satisfied
+        // by a runtime receipt, which no longer exists. The webhook page retains
+        // its own source-derived exposure gate because its contract is conditional.
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/integrations',
+            'technical-documentation:unit/api-keys',
+            'technical-documentation:unit/common-rest-api',
+        ],
+    },
+    'technical-documentation:unit/common-rest-api': {
+        kind: TechnicalDocumentationUnitKind.CONCEPT,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/send-api-request',
+            'technical-documentation:unit/work-with-api-collections',
+            'technical-documentation:unit/write-and-reconcile-api-changes',
+            'technical-documentation:unit/troubleshoot-api-request',
+        ],
+        apiReferenceTargets: [{
+                label: 'API reference',
+                target: {
+                    section: TechnicalDocumentationApiReferenceSection.API_REFERENCE,
+                    kind: TechnicalDocumentationApiReferenceTargetKind.ROOT,
+                },
+            }],
+    },
+    'technical-documentation:unit/send-api-request': {
+        kind: TechnicalDocumentationUnitKind.QUICKSTART,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/api-keys',
+            'technical-documentation:unit/work-with-api-collections',
+            'technical-documentation:unit/write-and-reconcile-api-changes',
+        ],
+        apiReferenceTargets: [{
+                label: 'API reference',
+                target: {
+                    section: TechnicalDocumentationApiReferenceSection.API_REFERENCE,
+                    kind: TechnicalDocumentationApiReferenceTargetKind.ROOT,
+                },
+            }],
+    },
+    'technical-documentation:unit/work-with-api-collections': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/send-api-request',
+            'technical-documentation:unit/write-and-reconcile-api-changes',
+            'technical-documentation:unit/troubleshoot-api-request',
+        ],
+        apiReferenceTargets: [{
+                label: 'API reference',
+                target: {
+                    section: TechnicalDocumentationApiReferenceSection.API_REFERENCE,
+                    kind: TechnicalDocumentationApiReferenceTargetKind.ROOT,
+                },
+            }],
+    },
+    'technical-documentation:unit/write-and-reconcile-api-changes': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/send-api-request',
+            'technical-documentation:unit/troubleshoot-api-request',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+        apiReferenceTargets: [{
+                label: 'API reference',
+                target: {
+                    section: TechnicalDocumentationApiReferenceSection.API_REFERENCE,
+                    kind: TechnicalDocumentationApiReferenceTargetKind.ROOT,
+                },
+            }],
+    },
+    'technical-documentation:unit/troubleshoot-api-request': {
+        kind: TechnicalDocumentationUnitKind.TROUBLESHOOTING,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: [],
+        relatedUnitRefs: [
+            'technical-documentation:unit/authentication',
+            'technical-documentation:unit/api-keys-troubleshoot',
+            'technical-documentation:unit/write-and-reconcile-api-changes',
+        ],
+        apiReferenceTargets: [{
+                label: 'API reference',
+                target: {
+                    section: TechnicalDocumentationApiReferenceSection.API_REFERENCE,
+                    kind: TechnicalDocumentationApiReferenceTargetKind.ROOT,
+                },
+            }],
+    },
+    'technical-documentation:unit/webhooks': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        // D14 gap RESOLVED 2026-08-08 — and the resolution was to STOP ASKING THE
+        // TENANT QUESTION, not to find a build-time way to answer it.
+        //
+        // The deleted runtime collector reported `featureReady` for
+        // `CoreFeature.M2M_WEBHOOK_DELIVERY`, which is `scopeBoundary: true` over
+        // [APPLICATION, ORGANIZATIONS] — every organization opts in independently, so
+        // that boolean was TENANT STATE gating whether a documentation PAGE exists.
+        // That is a category error: the signature algorithm, payload envelope and
+        // retry policy are code, identical for every tenant. Whether a given
+        // organization has delivery switched on is an entitlement, and entitlements
+        // belong in the prose (see the per-organization note in the unit body), not
+        // in an applicability gate.
+        //
+        // What the gate asks instead is the question documentation can actually
+        // answer: does THIS application expose the outbound-webhook surface at all?
+        // That is source-derived — the resources must be registered and admitted by
+        // the application's declared `apiDocResources` opt-in — and it fails closed
+        // for an application that documents no webhook surface.
+        applicabilityRequirements: OUTBOUND_WEBHOOK_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/configure-and-test-webhook-endpoint',
+            'technical-documentation:unit/verify-webhook-delivery',
+            'technical-documentation:unit/operate-webhook-deliveries',
+            'technical-documentation:unit/troubleshoot-webhook-deliveries',
+        ],
+    },
+    'technical-documentation:unit/configure-and-test-webhook-endpoint': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: OUTBOUND_WEBHOOK_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/verify-webhook-delivery',
+            'technical-documentation:unit/operate-webhook-deliveries',
+            'technical-documentation:unit/troubleshoot-webhook-deliveries',
+        ],
+    },
+    'technical-documentation:unit/verify-webhook-delivery': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: OUTBOUND_WEBHOOK_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/configure-and-test-webhook-endpoint',
+            'technical-documentation:unit/operate-webhook-deliveries',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+    },
+    'technical-documentation:unit/operate-webhook-deliveries': {
+        kind: TechnicalDocumentationUnitKind.HOW_TO,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: OUTBOUND_WEBHOOK_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/verify-webhook-delivery',
+            'technical-documentation:unit/troubleshoot-webhook-deliveries',
+            'technical-documentation:unit/audit-and-siem',
+        ],
+    },
+    'technical-documentation:unit/troubleshoot-webhook-deliveries': {
+        kind: TechnicalDocumentationUnitKind.TROUBLESHOOTING,
+        readerAudiences: [
+            TechnicalDocumentationReaderAudience.APPLICATION_OPERATIONS_STAFF,
+            TechnicalDocumentationReaderAudience.CONSUMING_INTERNAL_SERVICE,
+            TechnicalDocumentationReaderAudience.EXTERNAL_INTEGRATION_DEVELOPER,
+            TechnicalDocumentationReaderAudience.ORGANIZATION_INTEGRATION_DEVELOPER,
+        ],
+        accessClass: TechnicalDocumentationAccessClass.PUBLIC,
+        applicabilityRequirements: OUTBOUND_WEBHOOK_APPLICABILITY_REQUIREMENTS,
+        relatedUnitRefs: [
+            'technical-documentation:unit/configure-and-test-webhook-endpoint',
+            'technical-documentation:unit/verify-webhook-delivery',
+            'technical-documentation:unit/operate-webhook-deliveries',
+        ],
+    },
+});
+function parseEngineMarkdown(markdown, unitRef) {
+    const lines = markdown.trim().split('\n');
+    const titleLine = lines.shift();
+    if (titleLine === undefined || !titleLine.startsWith('# '))
+        throw new Error(`engine content ${unitRef} must begin with exactly one H1 title`);
+    const title = titleLine.slice(2).trim();
+    const sections = [];
+    let heading = 'Overview';
+    let body = [];
+    const flush = () => {
+        const bodyMarkdown = body.join('\n').trim();
+        if (bodyMarkdown.length > 0)
+            sections.push({ heading, bodyMarkdown });
+        body = [];
+    };
+    for (const line of lines) {
+        if (line.startsWith('## ')) {
+            flush();
+            heading = line.slice(3).trim();
+        }
+        else {
+            body.push(line);
+        }
+    }
+    flush();
+    if (sections.length === 0)
+        throw new Error(`engine content ${unitRef} must contain a non-empty Markdown body`);
+    const firstParagraph = sections[0].bodyMarkdown.split(/\n\s*\n/, 1)[0].replace(/\s+/g, ' ').trim();
+    // The first prose paragraph is deliberately the card/search summary. It is
+    // rendered above the guide body by both output families, so retaining that
+    // paragraph in the implicit `Overview` section would visibly say it twice.
+    // An explicit H2 is not rewritten: its author chose a real section and may
+    // intentionally need the opening paragraph in its body.
+    const [firstSection, ...remainingSections] = sections;
+    if (firstSection !== undefined && firstSection.heading === 'Overview') {
+        const overviewRemainder = firstSection.bodyMarkdown.replace(/^.*?(?:\n\s*\n|$)/s, '').trim();
+        return {
+            title,
+            summary: firstParagraph,
+            sections: overviewRemainder.length === 0
+                ? remainingSections
+                : [{ heading: firstSection.heading, bodyMarkdown: overviewRemainder }, ...remainingSections],
+        };
+    }
+    return { title, summary: firstParagraph, sections };
+}
+/**
+ * A related-link label names the reader's destination, not the relationship.
+ *
+ * The renderer supplies the `Related` heading. Repeating a generic phrase in
+ * every list item makes several different navigation choices visually
+ * indistinguishable, while resolving the target's authored title preserves
+ * the exact customer-facing vocabulary in one place.
+ */
+/**
+ * Resolves related destinations before output links or provenance are built.
+ *
+ * A related link projects the target's authored title into the source unit.
+ * The title's engine-content identity is therefore an input to both the
+ * source unit's output bytes and its digest; it must travel with the link
+ * instead of being silently treated as presentation-only metadata.
+ */
+function resolveRelatedUnitLinkTargets(unitRef, relatedUnitRefs, targetByUnitRef) {
+    return relatedUnitRefs.map((targetUnitRef) => {
+        const target = targetByUnitRef.get(targetUnitRef);
+        if (target === undefined)
+            throw new Error(`engine content ${unitRef} links to an unknown target ${targetUnitRef}`);
+        return target;
+    });
+}
+function relatedLinks(unitRef, relatedTargets) {
+    const sourceSlug = unitRef.slice(unitRef.lastIndexOf('/') + 1);
+    return relatedTargets.map((target) => {
+        const targetSlug = target.targetUnitRef.slice(target.targetUnitRef.lastIndexOf('/') + 1);
+        return {
+            linkRef: `technical-documentation:link/${sourceSlug}-to-${targetSlug}`,
+            kind: TechnicalDocumentationLinkKind.UNIT,
+            label: target.title,
+            targetUnitRef: target.targetUnitRef,
+            targetRef: null,
+            externalUrl: null,
+            apiReferenceTarget: null,
+        };
+    });
+}
+function apiReferenceLinks(unitRef, targets) {
+    const sourceSlug = unitRef.slice(unitRef.lastIndexOf('/') + 1);
+    return targets.map((target, index) => ({
+        linkRef: `technical-documentation:link/${sourceSlug}-api-reference-${index + 1}`,
+        kind: TechnicalDocumentationLinkKind.API_REFERENCE,
+        label: target.label,
+        targetUnitRef: null,
+        targetRef: null,
+        externalUrl: null,
+        apiReferenceTarget: target.target,
+    }));
+}
+/**
+ * Merges source provenance with the exact title authorities imported through
+ * related links. A source reference has one semantic identity in a rendered
+ * unit: accepting the same ref with divergent digests would make its output
+ * digest ambiguous, so the projector rejects it before the unit schema's
+ * canonicalization hides the conflict.
+ */
+function mergeProvenance(ownProvenance, relatedTargets) {
+    /*
+     * Compares the WHOLE row, not one field, matching `canonicalizeTechnicalDocumentationRows` — the
+     * idiom this subsystem uses everywhere else for "two rows claim one key and disagree".
+     *
+     * Measured, because the narrower version this replaced could not fail: it compared only
+     * `sourceVersion`, and the two producers feeding this function cannot disagree on that. A
+     * related target's `titleProvenance` is always an `ENGINE_CONTENT`-prefixed ref carrying
+     * `contentBundleVersion`, and own-provenance for that same prefix carries `contentBundleVersion`
+     * too — the curated-fact and companion-projection branches, which carry other versions, use
+     * disjoint ref prefixes and can never collide with a title source. Widening to the full row does
+     * not make today's two producers trip it either; it makes the check meaningful the day a third
+     * producer is added, which is when a silent disagreement would actually cost something.
+     *
+     * The digest form that preceded both was reachable for the wrong reason: it compared
+     * `identity.semanticDigest`, which is the CITING UNIT's identity rather than the source's, so two
+     * units legitimately citing one shared engine-content source disagreed and it threw on a correct
+     * input.
+     */
+    const provenanceBySourceRef = new Map();
+    for (const provenance of [...ownProvenance, ...relatedTargets.map((target) => target.titleProvenance)]) {
+        const existing = provenanceBySourceRef.get(provenance.sourceRef);
+        if (existing !== undefined && canonicalizeTechnicalDocumentationJson(existing) !== canonicalizeTechnicalDocumentationJson(provenance)) {
+            throw new Error(`engine content provenance source ${provenance.sourceRef} is cited with conflicting rows`);
+        }
+        provenanceBySourceRef.set(provenance.sourceRef, provenance);
+    }
+    return [...provenanceBySourceRef.values()].sort((left, right) => left.sourceRef.localeCompare(right.sourceRef, 'en-US'));
+}
+function consumerFactPresentation(entry, selector) {
+    if (entry.specificationFamilyRef !== EngineDocumentationSpecificationFamilyRef.CONSUMER_FACT) {
+        throw new Error(`documentation source ${entry.sourceRef} is not a curated consumer fact`);
+    }
+    if (entry.semanticDto === null || typeof entry.semanticDto !== 'object' || Array.isArray(entry.semanticDto)) {
+        throw new Error(`consumer fact ${entry.sourceRef} has no object semantic DTO`);
+    }
+    const presentation = entry.semanticDto[selector];
+    if (typeof presentation !== 'string' || presentation.trim().length === 0) {
+        throw new Error(`consumer fact ${entry.sourceRef} has no ${selector} presentation`);
+    }
+    return presentation;
+}
+/**
+ * Resolves only declared, explicitly curated consumer facts into an authored
+ * engine-content unit. Arbitrary catalog entries are not eligible: that is the
+ * safety boundary preventing raw specification fields from entering prose.
+ */
+function resolveConsumerFactMarkdown(markdown, declaredSourceRefs, catalog) {
+    const declaredFactRefs = declaredSourceRefs.filter((sourceRef) => sourceRef.startsWith(APPLICATION_CONSUMER_DOCUMENTATION_CONSUMER_FACT_SOURCE_PREFIX));
+    const catalogEntriesBySourceRef = new Map(catalog.entries.map((entry) => [entry.sourceRef, entry]));
+    const resolvedFactRefs = new Set();
+    const renderedMarkdown = markdown.replace(CONSUMER_FACT_TOKEN_PATTERN, (_token, sourceRef, selector) => {
+        if (!declaredFactRefs.includes(sourceRef)) {
+            throw new Error(`engine content references undeclared consumer fact ${sourceRef}`);
+        }
+        const entry = catalogEntriesBySourceRef.get(sourceRef);
+        if (entry === undefined)
+            throw new Error(`engine content references unavailable consumer fact ${sourceRef}`);
+        resolvedFactRefs.add(sourceRef);
+        return consumerFactPresentation(entry, selector);
+    });
+    if (renderedMarkdown.includes('{{CONSUMER_FACT:'))
+        throw new Error('engine content contains an invalid consumer-fact token');
+    if (resolvedFactRefs.size !== declaredFactRefs.length) {
+        const missing = declaredFactRefs.filter((sourceRef) => !resolvedFactRefs.has(sourceRef));
+        throw new Error(`engine content declares an unused consumer fact: ${missing.join(', ')}`);
+    }
+    return {
+        markdown: renderedMarkdown,
+        entriesBySourceRef: new Map([...resolvedFactRefs].map((sourceRef) => [sourceRef, catalogEntriesBySourceRef.get(sourceRef)])),
+    };
+}
+function resolveApplicationOrganizationRolesMarkdown(markdown, declaredSourceRefs, fact) {
+    const declaredRefs = declaredSourceRefs.filter((sourceRef) => sourceRef === APPLICATION_ORGANIZATION_ROLES_DOCUMENTATION_SOURCE_REF);
+    const tokenCount = markdown.split(APPLICATION_ORGANIZATION_ROLES_TOKEN).length - 1;
+    if (tokenCount === 0) {
+        if (declaredRefs.length > 0)
+            throw new Error(`engine content declares an unused companion projection: ${declaredRefs.join(', ')}`);
+        return { markdown, fact: undefined };
+    }
+    if (tokenCount !== 1 || declaredRefs.length !== 1 || fact === undefined || declaredRefs[0] !== fact.sourceRef) {
+        throw new Error('engine content organization-role projection must declare and resolve exactly one matching companion source');
+    }
+    if (fact.markdown.trim().length === 0)
+        throw new Error('application organization-role projection has no Markdown presentation');
+    return { markdown: markdown.replace(APPLICATION_ORGANIZATION_ROLES_TOKEN, fact.markdown), fact };
+}
+function resolveApplicationOrganizationUnitResourcesMarkdown(markdown, declaredSourceRefs, fact) {
+    const declaredRefs = declaredSourceRefs.filter((sourceRef) => sourceRef === APPLICATION_ORGANIZATION_UNIT_RESOURCES_DOCUMENTATION_SOURCE_REF);
+    const tokenCount = markdown.split(APPLICATION_ORGANIZATION_UNIT_RESOURCES_TOKEN).length - 1;
+    if (tokenCount === 0) {
+        if (declaredRefs.length > 0)
+            throw new Error(`engine content declares an unused organization-unit resource projection: ${declaredRefs.join(', ')}`);
+        return { markdown, fact: undefined };
+    }
+    if (tokenCount !== 1 || declaredRefs.length !== 1 || fact === undefined || declaredRefs[0] !== fact.sourceRef) {
+        throw new Error('engine content organization-unit resource projection must declare and resolve exactly one matching companion source');
+    }
+    if (fact.markdown.trim().length === 0)
+        throw new Error('application organization-unit resource projection has no Markdown presentation');
+    return { markdown: markdown.replace(APPLICATION_ORGANIZATION_UNIT_RESOURCES_TOKEN, fact.markdown), fact };
+}
+/**
+ * Compiles verified engine content and the two explicit application facts
+ * (organization roles and unit-aware resources) into private documentation.
+ */
+export function projectEngineApplicationConsumerContentBundle(bundle, engineSpecificationCatalog, unitDefinitions = ENGINE_CONTENT_UNIT_DEFINITIONS, applicationOrganizationRolesFact, applicationOrganizationUnitResourcesFact) {
+    const manifestRefs = bundle.manifest.units.map((unit) => unit.unitRef).sort();
+    const definitionRefs = Object.keys(unitDefinitions).sort();
+    if (manifestRefs.join('\0') !== definitionRefs.join('\0')) {
+        throw new Error('engine content unit definitions do not exactly cover the verified application-consumer content bundle');
+    }
+    const parsedContentByUnitRef = new Map(bundle.manifest.units.map((identity) => {
+        if (identity.managedPaths.length !== 1)
+            throw new Error(`engine content unit ${identity.unitRef} must resolve to exactly one Markdown source`);
+        const authoredMarkdown = new TextDecoder('utf-8', { fatal: true }).decode(bundle.readManagedBytes(identity.managedPaths[0]));
+        const resolvedConsumerFacts = resolveConsumerFactMarkdown(authoredMarkdown, identity.sourceRefs, engineSpecificationCatalog);
+        const resolvedApplicationOrganizationRoles = resolveApplicationOrganizationRolesMarkdown(resolvedConsumerFacts.markdown, identity.sourceRefs, applicationOrganizationRolesFact);
+        const resolvedApplicationOrganizationUnitResources = resolveApplicationOrganizationUnitResourcesMarkdown(resolvedApplicationOrganizationRoles.markdown, identity.sourceRefs, applicationOrganizationUnitResourcesFact);
+        return [identity.unitRef, {
+                parsed: parseEngineMarkdown(resolvedApplicationOrganizationUnitResources.markdown, identity.unitRef),
+                resolvedConsumerFacts,
+                resolvedApplicationOrganizationRoles,
+                resolvedApplicationOrganizationUnitResources,
+            }];
+    }));
+    const relatedTargetByUnitRef = new Map(bundle.manifest.units.map((identity) => {
+        const content = parsedContentByUnitRef.get(identity.unitRef);
+        if (content === undefined)
+            throw new Error(`engine content ${identity.unitRef} has no parsed content`);
+        const titleSourceRef = identity.sourceRefs.find((sourceRef) => sourceRef.startsWith(APPLICATION_CONSUMER_DOCUMENTATION_ENGINE_CONTENT_SOURCE_PREFIX));
+        if (titleSourceRef === undefined)
+            throw new Error(`engine content ${identity.unitRef} has no authored title source`);
+        return [identity.unitRef, {
+                targetUnitRef: identity.unitRef,
+                title: content.parsed.title,
+                titleProvenance: {
+                    sourceRef: titleSourceRef,
+                    ownership: TechnicalDocumentationSourceOwnership.ENGINE_GENERIC_CONTENT,
+                    classification: TechnicalDocumentationSourceClassification.PUBLIC,
+                    sourceVersion: bundle.identity.contentBundleVersion,
+                    sourceAnchorRef: null,
+                },
+            }];
+    }));
+    return bundle.manifest.units.map((identity) => {
+        const definition = unitDefinitions[identity.unitRef];
+        if (definition === undefined)
+            throw new Error(`unsupported engine application-consumer content unit ${identity.unitRef}`);
+        const content = parsedContentByUnitRef.get(identity.unitRef);
+        if (content === undefined)
+            throw new Error(`engine content ${identity.unitRef} has no parsed content`);
+        const { parsed, resolvedConsumerFacts, resolvedApplicationOrganizationRoles, resolvedApplicationOrganizationUnitResources } = content;
+        const unitSlug = identity.unitRef.slice(identity.unitRef.lastIndexOf('/') + 1);
+        const relatedTargets = resolveRelatedUnitLinkTargets(identity.unitRef, definition.relatedUnitRefs, relatedTargetByUnitRef);
+        const ownProvenance = identity.sourceRefs.map((sourceRef) => {
+            const fact = resolvedConsumerFacts.entriesBySourceRef.get(sourceRef);
+            const applicationProjection = resolvedApplicationOrganizationRoles.fact?.sourceRef === sourceRef
+                ? resolvedApplicationOrganizationRoles.fact
+                : resolvedApplicationOrganizationUnitResources.fact?.sourceRef === sourceRef
+                    ? resolvedApplicationOrganizationUnitResources.fact
+                    : undefined;
+            return {
+                sourceRef,
+                ownership: applicationProjection === undefined
+                    ? TechnicalDocumentationSourceOwnership.ENGINE_GENERIC_CONTENT
+                    : TechnicalDocumentationSourceOwnership.APPLICATION_COMPANION_PROJECTION,
+                classification: TechnicalDocumentationSourceClassification.PUBLIC,
+                /*
+                 * A companion projection carries its own version; a curated engine fact takes the
+                 * catalog projector's; authored engine content takes the content bundle's. All three
+                 * were sha256 values until 2026-08-27 and none of them was ever compared to anything
+                 * except another copy of itself.
+                 */
+                sourceVersion: applicationProjection?.sourceVersion
+                    ?? (fact === undefined ? bundle.identity.contentBundleVersion : engineSpecificationCatalog.identity.projectorVersion),
+                sourceAnchorRef: null,
+            };
+        });
+        return createTechnicalDocumentationUnitV1({
+            schemaVersion: 1,
+            unitRef: identity.unitRef,
+            unitVersion: 1,
+            kind: definition.kind,
+            readerAudiences: [...definition.readerAudiences],
+            title: parsed.title,
+            summary: parsed.summary,
+            sections: parsed.sections.map((section, index) => ({
+                sectionRef: `technical-documentation:section/${unitSlug}-${index + 1}`,
+                heading: section.heading,
+                bodyMarkdown: section.bodyMarkdown,
+            })),
+            links: [...relatedLinks(identity.unitRef, relatedTargets), ...apiReferenceLinks(identity.unitRef, definition.apiReferenceTargets ?? [])],
+            provenance: mergeProvenance(ownProvenance, relatedTargets),
+            applicabilityRequirements: [...definition.applicabilityRequirements],
+            accessClass: definition.accessClass,
+            editorialStatus: TechnicalDocumentationEditorialStatus.APPROVED,
+            assetRequests: [],
+        });
+    }).sort((left, right) => left.unitRef.localeCompare(right.unitRef, 'en-US'));
+}
+//# sourceMappingURL=technical-documentation-engine-content-bundle.js.map