npm - @wildo-ai/saas-technical-doc - Versions diffs - 1.1.2 → 1.1.3 - Mend

@wildo-ai/saas-technical-doc 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (96) hide show

package/dist/esm/companion/application-documentation/application-integration-documentation.js CHANGED Viewed

@@ -43,13 +43,36 @@ function webhookEventsMarkdown(source) {
  * application produce identical bytes.
  */
 export function projectApplicationIntegrationDocumentation(source) {
+    /*
+     * Both inventories are ADDRESSES: a tool name is what an agent types, and a (resource, operation,
+     * channel) triple is one fact about one delivery. Neither can legitimately appear twice, so a
+     * repeat is a producer walking something twice — which is exactly what the companion's collector
+     * did, visiting every selected core resource once from the prepared list and once from the core
+     * factory sweep. It survived because the collector used to answer a boolean, where duplicates are
+     * unobservable.
+     *
+     * The refusal lives HERE rather than only in that collector because this is the one place every
+     * producer passes through, and a duplicated row is worse than a loud failure: it reads as two
+     * separate things a reader must tell apart.
+     */
+    const seenToolNames = new Set();
     for (const tool of source.mcpTools) {
         if (tool.toolName.trim().length === 0)
             throw new Error('application integration projection received an MCP tool with no name');
+        if (seenToolNames.has(tool.toolName)) {
+            throw new Error(`application integration projection received the MCP tool '${tool.toolName}' twice — a tool name addresses one operation`);
+        }
+        seenToolNames.add(tool.toolName);
     }
+    const seenEvents = new Set();
     for (const event of source.webhookEvents) {
         if (event.channel.trim().length === 0)
             throw new Error('application integration projection received a webhook event with no channel');
+        const identity = `${event.resourceIdentifier}.${event.operationIdentifier}.${event.channel}`;
+        if (seenEvents.has(identity)) {
+            throw new Error(`application integration projection received the webhook event '${identity}' twice — one operation on one channel is one event`);
+        }
+        seenEvents.add(identity);
     }
     return {
         sourceRef: APPLICATION_INTEGRATION_DOCUMENTATION_SOURCE_REF,

package/dist/esm/companion/application-documentation/application-integration-documentation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-integration-documentation.js","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/application-integration-documentation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,qDAA8D,CAAC;AAC/H,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC;AAqBtE,4FAA4F;AAC5F,MAAM,CAAN,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAC5C,4DAA4D;IAC5D,4DAAsB,CAAA;IACtB,2EAA2E;IAC3E,sEAAgC,CAAA;AAClC,CAAC,EALW,kCAAkC,KAAlC,kCAAkC,QAK7C;AAQD,SAAS,gBAAgB,CAAC,MAAiD;IACzE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,8FAA8F,CAAC;IACxG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ;SACzB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,kBAAkB,MAAM,IAAI,CAAC,mBAAmB,IAAI,CAAC;SACpG,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,yDAAyD,IAAI,+PAA+P,CAAC;AACtU,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAiD;IAC9E,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,qIAAqI,CAAC;IAC/I,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa;SAC9B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,kBAAkB,MAAM,KAAK,CAAC,mBAAmB,QAAQ,KAAK,CAAC,OAAO,MAAM,CAAC;SACvG,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,0EAA0E,IAAI,0SAA0S,CAAC;AAClY,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0CAA0C,CACxD,MAAiD;IAEjD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;~~IACjI~~,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;~~IACxI~~,CAAC;IACD,OAAO;QACL,SAAS,EAAE,gDAAgD;QAC3D,aAAa,EAAE,oDAAoD;QACnE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;YAC3B,CAAC,kCAAkC,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,MAAM,CAAC;YACxE,CAAC,kCAAkC,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC;SACnF,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["/*\n The tools an MCP client will find, and the events a webhook receiver will be sent.\n \n Five webhook pages explained delivery, verification, retries and reconciliation without ever\n * naming an event, and the MCP page described a catalogue without naming a tool in it. Both\n * inventories were already being computed — as booleans, to decide whether those pages publish at\n * all — so the reader was one projection away from the list the whole time.\n \n Names are the application's own: a tool is `<resource>__<operation>` exactly as an agent must\n * type it, and an event names the resource and operation that produce it. Nothing here is\n * humanized, because every one of these strings is a value someone matches on in code.\n /\nexport const APPLICATION_INTEGRATION_DOCUMENTATION_SOURCE_REF = 'source:companion-projection:application-integration' as const;\nexport const APPLICATION_INTEGRATION_DOCUMENTATION_SOURCE_VERSION = 1;\n\nexport interface ApplicationMcpToolSource {\n /* The exact name an agent calls, `<resource>__<operation>`. /\n readonly toolName: string;\n readonly resourceIdentifier: string;\n readonly operationIdentifier: string;\n}\n\nexport interface ApplicationWebhookEventSource {\n readonly resourceIdentifier: string;\n readonly operationIdentifier: string;\n /* The notification channel that carries it, which is also its delivery scope. /\n readonly channel: string;\n}\n\nexport interface ApplicationIntegrationDocumentationSource {\n readonly mcpTools: readonly ApplicationMcpToolSource[];\n readonly webhookEvents: readonly ApplicationWebhookEventSource[];\n}\n\n/* Named presentations a page may request with `{{APPLICATION_INTEGRATION:<selector>}}`. /\nexport enum ApplicationIntegrationPresentation {\n /* Every tool this application publishes to MCP clients. /\n MCP_TOOLS = 'mcpTools',\n /* Every resource operation that produces an outbound webhook delivery. /\n WEBHOOK_EVENTS = 'webhookEvents',\n}\n\nexport interface ApplicationIntegrationDocumentationFact {\n readonly sourceRef: string;\n readonly sourceVersion: number;\n readonly presentations: Readonly<Record<ApplicationIntegrationPresentation, string>>;\n}\n\nfunction mcpToolsMarkdown(source: ApplicationIntegrationDocumentationSource): string {\n if (source.mcpTools.length === 0) {\n return 'This application publishes no MCP tools, so a connected client will find an empty catalogue.';\n }\n const rows = source.mcpTools\n .map((tool) => `\| \\`${tool.toolName}\\` \| ${tool.resourceIdentifier} \| ${tool.operationIdentifier} \|`)\n .join('\\n');\n return `\| Tool \| Resource \| Operation \|\\n\| --- \| --- \| --- \|\\n${rows}\\n\\nThese are the tools the application publishes. What YOU see is the subset your credential is allowed to call, so a shorter catalogue is an authorization result and not a fault. The API reference carries each operation's exact arguments and response.`;\n}\n\nfunction webhookEventsMarkdown(source: ApplicationIntegrationDocumentationSource): string {\n if (source.webhookEvents.length === 0) {\n return 'This application declares no outbound webhook events, so an endpoint would receive nothing even when one is configured and enabled.';\n }\n const rows = source.webhookEvents\n .map((event) => `\| ${event.resourceIdentifier} \| ${event.operationIdentifier} \| \\`${event.channel}\\` \|`)\n .join('\\n');\n return `\| Resource \| Operation that fires it \| Channel \|\\n\| --- \| --- \| --- \|\\n${rows}\\n\\nEvery enabled endpoint on the matching channel receives every event on that channel: an endpoint is not subscribed to a subset. Route on the signed \\`resourceIdentifier\\` and \\`operationIdentifier\\` claims rather than on the destination URL, and ignore an event your receiver does not handle.`;\n}\n\n/\n Projects both integration inventories. A pure function of the source, so two runs over the same\n * application produce identical bytes.\n */\nexport function projectApplicationIntegrationDocumentation(\n source: ApplicationIntegrationDocumentationSource,\n): ApplicationIntegrationDocumentationFact {\n for (const tool of source.mcpTools) {\n if (tool.toolName.trim().length === 0) throw new Error('application integration projection received an MCP tool with no name');\n }\n for (const event of source.webhookEvents) {\n if (event.channel.trim().length === 0) throw new Error('application integration projection received a webhook event with no channel');\n }\n return {\n sourceRef: APPLICATION_INTEGRATION_DOCUMENTATION_SOURCE_REF,\n sourceVersion: APPLICATION_INTEGRATION_DOCUMENTATION_SOURCE_VERSION,\n presentations: Object.freeze({\n [ApplicationIntegrationPresentation.MCP_TOOLS]: mcpToolsMarkdown(source),\n [ApplicationIntegrationPresentation.WEBHOOK_EVENTS]: webhookEventsMarkdown(source),\n }),\n };\n}\n"]}
1	+ {"version":3,"file":"application-integration-documentation.js","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/application-integration-documentation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gDAAgD,GAAG,qDAA8D,CAAC;AAC/H,MAAM,CAAC,MAAM,oDAAoD,GAAG,CAAC,CAAC;AAqBtE,4FAA4F;AAC5F,MAAM,CAAN,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAC5C,4DAA4D;IAC5D,4DAAsB,CAAA;IACtB,2EAA2E;IAC3E,sEAAgC,CAAA;AAClC,CAAC,EALW,kCAAkC,KAAlC,kCAAkC,QAK7C;AAQD,SAAS,gBAAgB,CAAC,MAAiD;IACzE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,8FAA8F,CAAC;IACxG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ;SACzB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,kBAAkB,MAAM,IAAI,CAAC,mBAAmB,IAAI,CAAC;SACpG,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,yDAAyD,IAAI,+PAA+P,CAAC;AACtU,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAiD;IAC9E,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,qIAAqI,CAAC;IAC/I,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa;SAC9B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,kBAAkB,MAAM,KAAK,CAAC,mBAAmB,QAAQ,KAAK,CAAC,OAAO,MAAM,CAAC;SACvG,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,0EAA0E,IAAI,0SAA0S,CAAC;AAClY,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0CAA0C,CACxD,MAAiD;IAEjD;;;;;;;;;;;OAWG;IACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC/H,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,6DAA6D,IAAI,CAAC,QAAQ,+CAA+C,CAAC,CAAC;QAC7I,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACtI,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC7F,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,kEAAkE,QAAQ,qDAAqD,CAAC,CAAC;QACnJ,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO;QACL,SAAS,EAAE,gDAAgD;QAC3D,aAAa,EAAE,oDAAoD;QACnE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;YAC3B,CAAC,kCAAkC,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,MAAM,CAAC;YACxE,CAAC,kCAAkC,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC,MAAM,CAAC;SACnF,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["/*\n The tools an MCP client will find, and the events a webhook receiver will be sent.\n \n Five webhook pages explained delivery, verification, retries and reconciliation without ever\n * naming an event, and the MCP page described a catalogue without naming a tool in it. Both\n * inventories were already being computed — as booleans, to decide whether those pages publish at\n * all — so the reader was one projection away from the list the whole time.\n \n Names are the application's own: a tool is `<resource>__<operation>` exactly as an agent must\n * type it, and an event names the resource and operation that produce it. Nothing here is\n * humanized, because every one of these strings is a value someone matches on in code.\n /\nexport const APPLICATION_INTEGRATION_DOCUMENTATION_SOURCE_REF = 'source:companion-projection:application-integration' as const;\nexport const APPLICATION_INTEGRATION_DOCUMENTATION_SOURCE_VERSION = 1;\n\nexport interface ApplicationMcpToolSource {\n /* The exact name an agent calls, `<resource>__<operation>`. /\n readonly toolName: string;\n readonly resourceIdentifier: string;\n readonly operationIdentifier: string;\n}\n\nexport interface ApplicationWebhookEventSource {\n readonly resourceIdentifier: string;\n readonly operationIdentifier: string;\n /* The notification channel that carries it, which is also its delivery scope. /\n readonly channel: string;\n}\n\nexport interface ApplicationIntegrationDocumentationSource {\n readonly mcpTools: readonly ApplicationMcpToolSource[];\n readonly webhookEvents: readonly ApplicationWebhookEventSource[];\n}\n\n/* Named presentations a page may request with `{{APPLICATION_INTEGRATION:<selector>}}`. /\nexport enum ApplicationIntegrationPresentation {\n /* Every tool this application publishes to MCP clients. /\n MCP_TOOLS = 'mcpTools',\n /* Every resource operation that produces an outbound webhook delivery. /\n WEBHOOK_EVENTS = 'webhookEvents',\n}\n\nexport interface ApplicationIntegrationDocumentationFact {\n readonly sourceRef: string;\n readonly sourceVersion: number;\n readonly presentations: Readonly<Record<ApplicationIntegrationPresentation, string>>;\n}\n\nfunction mcpToolsMarkdown(source: ApplicationIntegrationDocumentationSource): string {\n if (source.mcpTools.length === 0) {\n return 'This application publishes no MCP tools, so a connected client will find an empty catalogue.';\n }\n const rows = source.mcpTools\n .map((tool) => `\| \\`${tool.toolName}\\` \| ${tool.resourceIdentifier} \| ${tool.operationIdentifier} \|`)\n .join('\\n');\n return `\| Tool \| Resource \| Operation \|\\n\| --- \| --- \| --- \|\\n${rows}\\n\\nThese are the tools the application publishes. What YOU see is the subset your credential is allowed to call, so a shorter catalogue is an authorization result and not a fault. The API reference carries each operation's exact arguments and response.`;\n}\n\nfunction webhookEventsMarkdown(source: ApplicationIntegrationDocumentationSource): string {\n if (source.webhookEvents.length === 0) {\n return 'This application declares no outbound webhook events, so an endpoint would receive nothing even when one is configured and enabled.';\n }\n const rows = source.webhookEvents\n .map((event) => `\| ${event.resourceIdentifier} \| ${event.operationIdentifier} \| \\`${event.channel}\\` \|`)\n .join('\\n');\n return `\| Resource \| Operation that fires it \| Channel \|\\n\| --- \| --- \| --- \|\\n${rows}\\n\\nEvery enabled endpoint on the matching channel receives every event on that channel: an endpoint is not subscribed to a subset. Route on the signed \\`resourceIdentifier\\` and \\`operationIdentifier\\` claims rather than on the destination URL, and ignore an event your receiver does not handle.`;\n}\n\n/\n Projects both integration inventories. A pure function of the source, so two runs over the same\n * application produce identical bytes.\n /\nexport function projectApplicationIntegrationDocumentation(\n source: ApplicationIntegrationDocumentationSource,\n): ApplicationIntegrationDocumentationFact {\n /\n * Both inventories are ADDRESSES: a tool name is what an agent types, and a (resource, operation,\n * channel) triple is one fact about one delivery. Neither can legitimately appear twice, so a\n * repeat is a producer walking something twice — which is exactly what the companion's collector\n * did, visiting every selected core resource once from the prepared list and once from the core\n * factory sweep. It survived because the collector used to answer a boolean, where duplicates are\n * unobservable.\n \n The refusal lives HERE rather than only in that collector because this is the one place every\n * producer passes through, and a duplicated row is worse than a loud failure: it reads as two\n * separate things a reader must tell apart.\n */\n const seenToolNames = new Set<string>();\n for (const tool of source.mcpTools) {\n if (tool.toolName.trim().length === 0) throw new Error('application integration projection received an MCP tool with no name');\n if (seenToolNames.has(tool.toolName)) {\n throw new Error(`application integration projection received the MCP tool '${tool.toolName}' twice — a tool name addresses one operation`);\n }\n seenToolNames.add(tool.toolName);\n }\n const seenEvents = new Set<string>();\n for (const event of source.webhookEvents) {\n if (event.channel.trim().length === 0) throw new Error('application integration projection received a webhook event with no channel');\n const identity = `${event.resourceIdentifier}.${event.operationIdentifier}.${event.channel}`;\n if (seenEvents.has(identity)) {\n throw new Error(`application integration projection received the webhook event '${identity}' twice — one operation on one channel is one event`);\n }\n seenEvents.add(identity);\n }\n return {\n sourceRef: APPLICATION_INTEGRATION_DOCUMENTATION_SOURCE_REF,\n sourceVersion: APPLICATION_INTEGRATION_DOCUMENTATION_SOURCE_VERSION,\n presentations: Object.freeze({\n [ApplicationIntegrationPresentation.MCP_TOOLS]: mcpToolsMarkdown(source),\n [ApplicationIntegrationPresentation.WEBHOOK_EVENTS]: webhookEventsMarkdown(source),\n }),\n };\n}\n"]}

package/dist/esm/companion/application-documentation/application-organization-role-documentation.d.ts CHANGED Viewed

@@ -56,6 +56,36 @@ export declare function projectApplicationOrganizationRoleDocumentationSources(c
  * make the guide disagree with member-management and role-picker UI.
  */
 export declare function resolveApplicationOrganizationRoleDocumentation(roles: readonly ApplicationOrganizationRoleDocumentationSource[], primaryLocaleLabels: Readonly<Record<string, string>>): readonly ApplicationOrganizationRoleDocumentation[];
+/**
+ * Give every operation's access documentation the role names the APPLICATION authored.
+ *
+ * ## The defect this closes
+ *
+ * `roleRequirements[].label` was derived from the role TOKEN in the projector subprocess —
+ * `ORG_MANAGER` became "Organization Manager" and `APP_ADMIN_SUPER_ADMIN` became "Application Admin
+ * Super Admin". That is invented display text (`.claude/rules/display-text-comes-from-i18n.md`), and
+ * it appeared on EVERY documented operation, which is the largest surface the defect had. Meanwhile
+ * the same roles carry authored labels resolved from the application's own i18n unit, and
+ * publication already refuses to proceed without them — but those labels reached only the roles
+ * page. Two names for one role, and the invented one was the one beside every endpoint (#382).
+ *
+ * ## Why a token is the fallback, and not a prettier guess
+ *
+ * A label this map does not carry stays the raw token. `ORG_MANAGER` is honest, searchable, and
+ * visibly not a product's word — an invented English phrase is none of those, and once printed it is
+ * indistinguishable from an authored one. The refusal belongs at the door that PUBLISHES, which
+ * already has it; a read that merely generates a document must not fail closed on an authoring gap.
+ *
+ * Returns new objects; the input projections are left untouched.
+ */
+export declare function applyAuthoredRoleLabelsToOperationAccess<T extends {
+    readonly access?: {
+        readonly roleRequirements: readonly {
+            readonly role: string;
+            readonly label: string;
+        }[];
+    };
+}>(operations: readonly T[], labelByRole: Readonly<Record<string, string>>): readonly T[];
 /**
  * Materialize the reusable Markdown fact consumed by the Roles and permissions
  * topic. This function knows no application identity: different applications

package/dist/esm/companion/application-documentation/application-organization-role-documentation.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-organization-role-documentation.d.ts","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/application-organization-role-documentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,6CAA6C,EAAE,MAAM,iDAAiD,CAAC;AAErH,eAAO,MAAM,uDAAuD,EAAG,gDAAyD,CAAC;AACjI,4GAA4G;AAC5G,eAAO,MAAM,2DAA2D,IAAI,CAAC;AAE7E,sFAAsF;AACtF,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CACxD;AAED;;;;GAIG;AACH,MAAM,WAAW,8CAA8C;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED,qFAAqF;AACrF,MAAM,WAAW,wCAAyC,SAAQ,8CAA8C;IAC9G,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,UAAU,2CAA2C;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACtD,WAAW,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAkBzD;AAED;;;;;GAKG;AACH,wBAAgB,sDAAsD,CACpE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,CAAC,GAAG,SAAS,EAC9F,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,kCAAkC,CAAC,GACtE,SAAS,8CAA8C,EAAE,CA8C3D;AAED;;;;GAIG;AACH,wBAAgB,+CAA+C,CAC7D,KAAK,EAAE,SAAS,8CAA8C,EAAE,EAChE,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACpD,SAAS,wCAAwC,EAAE,CAMrD;AAED;;;;GAIG;AACH,wBAAgB,mDAAmD,CACjE,KAAK,EAAE,SAAS,wCAAwC,EAAE,GACzD,6CAA6C,CAgC/C"}
1	+ {"version":3,"file":"application-organization-role-documentation.d.ts","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/application-organization-role-documentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,6CAA6C,EAAE,MAAM,iDAAiD,CAAC;AAErH,eAAO,MAAM,uDAAuD,EAAG,gDAAyD,CAAC;AACjI,4GAA4G;AAC5G,eAAO,MAAM,2DAA2D,IAAI,CAAC;AAE7E,sFAAsF;AACtF,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CACxD;AAED;;;;GAIG;AACH,MAAM,WAAW,8CAA8C;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED,qFAAqF;AACrF,MAAM,WAAW,wCAAyC,SAAQ,8CAA8C;IAC9G,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,UAAU,2CAA2C;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,wCAAwC,CACtD,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACtD,WAAW,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAkBzD;AAED;;;;;GAKG;AACH,wBAAgB,sDAAsD,CACpE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2CAA2C,CAAC,CAAC,GAAG,SAAS,EAC9F,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,kCAAkC,CAAC,GACtE,SAAS,8CAA8C,EAAE,CA8C3D;AAED;;;;GAIG;AACH,wBAAgB,+CAA+C,CAC7D,KAAK,EAAE,SAAS,8CAA8C,EAAE,EAChE,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACpD,SAAS,wCAAwC,EAAE,CAMrD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,wCAAwC,CACtD,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,gBAAgB,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAA;CAAE,EAC3H,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,EAAE,CAavF;AAED;;;;GAIG;AACH,wBAAgB,mDAAmD,CACjE,KAAK,EAAE,SAAS,wCAAwC,EAAE,GACzD,6CAA6C,CAgC/C"}

package/dist/esm/companion/application-documentation/application-organization-role-documentation.js CHANGED Viewed

@@ -86,6 +86,44 @@ export function resolveApplicationOrganizationRoleDocumentation(roles, primaryLo
         description: requiredRoleLabel(primaryLocaleLabels, role.role, 'description'),
     })));
 }
+/**
+ * Give every operation's access documentation the role names the APPLICATION authored.
+ *
+ * ## The defect this closes
+ *
+ * `roleRequirements[].label` was derived from the role TOKEN in the projector subprocess —
+ * `ORG_MANAGER` became "Organization Manager" and `APP_ADMIN_SUPER_ADMIN` became "Application Admin
+ * Super Admin". That is invented display text (`.claude/rules/display-text-comes-from-i18n.md`), and
+ * it appeared on EVERY documented operation, which is the largest surface the defect had. Meanwhile
+ * the same roles carry authored labels resolved from the application's own i18n unit, and
+ * publication already refuses to proceed without them — but those labels reached only the roles
+ * page. Two names for one role, and the invented one was the one beside every endpoint (#382).
+ *
+ * ## Why a token is the fallback, and not a prettier guess
+ *
+ * A label this map does not carry stays the raw token. `ORG_MANAGER` is honest, searchable, and
+ * visibly not a product's word — an invented English phrase is none of those, and once printed it is
+ * indistinguishable from an authored one. The refusal belongs at the door that PUBLISHES, which
+ * already has it; a read that merely generates a document must not fail closed on an authoring gap.
+ *
+ * Returns new objects; the input projections are left untouched.
+ */
+export function applyAuthoredRoleLabelsToOperationAccess(operations, labelByRole) {
+    return operations.map((operation) => {
+        const access = operation.access;
+        if (access === undefined || access.roleRequirements.length === 0)
+            return operation;
+        let changed = false;
+        const roleRequirements = access.roleRequirements.map((requirement) => {
+            const authored = labelByRole[requirement.role];
+            if (authored === undefined || authored === requirement.label)
+                return requirement;
+            changed = true;
+            return { ...requirement, label: authored };
+        });
+        return changed ? { ...operation, access: { ...access, roleRequirements } } : operation;
+    });
+}
 /**
  * Materialize the reusable Markdown fact consumed by the Roles and permissions
  * topic. This function knows no application identity: different applications

package/dist/esm/companion/application-documentation/application-organization-role-documentation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"application-organization-role-documentation.js","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/application-organization-role-documentation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAM/B,MAAM,CAAC,MAAM,uDAAuD,GAAG,gDAAyD,CAAC;AACjI,4GAA4G;AAC5G,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC;AAyC7E;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,kBAAuD;IAEvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8C,CAAC;IACrE,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3G,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,8EAA8E,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACxB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC;YAChD,YAAY,EAAE,oBAAoB,CAAC,SAAS,CAAC,YAAY,CAAC;YAC1D,iBAAiB,EAAE,oBAAoB,CAAC,SAAS,CAAC,iBAAiB,CAAC;YACpE,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC;YAChD,SAAS,EAAE,oBAAoB,CAAC,SAAS,CAAC,SAAS,CAAC;YACpD,mBAAmB,EAAE,yBAAyB,CAAC,SAAS,CAAC,mBAAmB,CAAC;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sDAAsD,CACpE,WAA8F,EAC9F,cAAuE;IAEvE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmF,CAAC;IAC9G,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC/D,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAC;QAC1H,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;QAC5H,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,8DAA8D,MAAM,CAAC,IAAI,+CAA+C,CAAC,CAAC;QAC5I,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;SAC1C,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa,CAAC;SACrF,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,IACE,aAAa,KAAK,SAAS;eACxB,aAAa,CAAC,OAAO,KAAK,IAAI;eAC9B,aAAa,CAAC,iBAAiB,KAAK,IAAI;eACxC,aAAa,CAAC,OAAO,KAAK,IAAI;eAC9B,aAAa,CAAC,SAAS,KAAK,IAAI;eAChC,aAAa,CAAC,mBAAmB,KAAK,IAAI,EAC7C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+DAA+D,MAAM,CAAC,IAAI,gFAAgF,CAC3J,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YACvC,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;YAClD,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;SACvD,CAAC,CAAC;IACL,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+CAA+C,CAC7D,KAAgE,EAChE,mBAAqD;IAErD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACrD,GAAG,IAAI;QACP,KAAK,EAAE,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACjE,WAAW,EAAE,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;KAC9E,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mDAAmD,CACjE,KAA0D;IAE1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACpH,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,0EAA0E;IAC1E,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrD,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAE;WACzE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;WAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAEnD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrG,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI;YAC3C,CAAC,CAAC,uDAAuD;YACzD,CAAC,CAAC,2CAA2C,YAAY,CAAC,aAAa,EAAE,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAC7I,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC;aACzD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;aACrD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,+BAA+B,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,6BAA6B,WAAW,iCAAiC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,MAAM,0BAA0B,sBAAsB,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;IAC5a,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,uDAAuD;QAClE,QAAQ,EAAE,8RAA8R,YAAY,0NAA0N;QAC9gB,aAAa,EAAE,2DAA2D;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,IAA8C,EAC9C,gBAA+E,EAC/E,YAAY,IAAI,GAAG,EAAU;IAE7B,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2EAA2E,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,IAAI,yBAAyB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,gBAAgB,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAC7B,IAA8C,EAC9C,gBAA+E;IAE/E,MAAM,cAAc,GAA+C,EAAE,CAAC;IACtE,IAAI,OAAO,GAAyD,IAAI,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO,OAAO,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,2EAA2E,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,GAAG,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACrF,OAAO,qLAAqL,CAAC;IAC/L,CAAC;IAED,MAAM,eAAe,GAAG,cAAc;SACnC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;SAC1F,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,uFAAuF,eAAe,+IAA+I,CAAC;AAC/P,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAwC,EACxC,IAAY,EACZ,KAA8B;IAE9B,MAAM,GAAG,GAAG,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,8EAA8E,GAAG,2EAA2E,CAC7J,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;QACjE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAC7G,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC;AACjD,CAAC","sourcesContent":["import {\n CORE_ORG_ROLES,\n DEFAULT_ORGANIZATION_ROLES,\n ResourcePrimaryScope,\n} from '@wildo-ai/saas-models';\nimport {\n} from '@wildo-ai/saas-specifications/technical-documentation';\n\nimport type { ApplicationOrganizationRolesDocumentationFact } from './technical-documentation-engine-content-bundle';\n\nexport const APPLICATION_ORGANIZATION_ROLES_DOCUMENTATION_SOURCE_REF = 'source:companion-projection:organization-roles' as const;\n/** Advances when this projection's shape changes; it is the fact's version wherever provenance cites it. /\nexport const APPLICATION_ORGANIZATION_ROLES_DOCUMENTATION_SOURCE_VERSION = 1;\n\n/* Minimal application/engine role specification needed by consumer documentation. /\nexport interface ApplicationRoleDocumentationSource {\n readonly ref: string;\n readonly purpose: string \| null;\n readonly businessRole: string \| null;\n readonly authorityBoundary: string \| null;\n readonly useWhen: string \| null;\n readonly avoidWhen: string \| null;\n readonly businessConstraints: readonly string[] \| null;\n}\n\n/\n Application-independent organization-role projection before UI labels are\n * joined. The introspection subprocess can safely emit this JSON-only shape;\n * the parent companion later joins the application's primary-locale labels.\n /\nexport interface ApplicationOrganizationRoleDocumentationSource {\n readonly role: string;\n readonly inheritFrom: string \| null;\n readonly purpose: string;\n readonly businessRole: string \| null;\n readonly authorityBoundary: string;\n readonly useWhen: string;\n readonly avoidWhen: string;\n readonly businessConstraints: readonly string[];\n}\n\n/* Complete consumer-visible role documentation after the application label join. /\nexport interface ApplicationOrganizationRoleDocumentation extends ApplicationOrganizationRoleDocumentationSource {\n readonly label: string;\n readonly description: string;\n}\n\ninterface ApplicationRoleConfigurationProjectionInput {\n readonly role?: string;\n readonly inheritFrom?: string;\n readonly relatedPrimaryScope: ResourcePrimaryScope;\n}\n\n/\n Index companion-exported role specifications by their runtime role token.\n * Engine and application-defined roles intentionally share this namespace.\n /\nexport function indexApplicationRoleDocumentationSources(\n roleSpecifications: Record<string, unknown> \| undefined,\n): ReadonlyMap<string, ApplicationRoleDocumentationSource> {\n const result = new Map<string, ApplicationRoleDocumentationSource>();\n for (const candidate of Object.values(roleSpecifications ?? {})) {\n if (!isPlainObject(candidate) \|\| typeof candidate.ref !== 'string' \|\| candidate.ref.length === 0) continue;\n if (result.has(candidate.ref)) {\n throw new Error(`application organization-role projector: duplicate role specification for '${candidate.ref}'`);\n }\n result.set(candidate.ref, {\n ref: candidate.ref,\n purpose: nonEmptyStringOrNull(candidate.purpose),\n businessRole: nonEmptyStringOrNull(candidate.businessRole),\n authorityBoundary: nonEmptyStringOrNull(candidate.authorityBoundary),\n useWhen: nonEmptyStringOrNull(candidate.useWhen),\n avoidWhen: nonEmptyStringOrNull(candidate.avoidWhen),\n businessConstraints: nonEmptyStringArrayOrNull(candidate.businessConstraints),\n });\n }\n return result;\n}\n\n/\n Resolve every framework and application-defined organization role from the\n * application's merged runtime registry and authored role specifications.\n * Application-scoped roles are deliberately excluded from this organization\n * administration reference.\n /\nexport function projectApplicationOrganizationRoleDocumentationSources(\n customRoles: Readonly<Record<string, ApplicationRoleConfigurationProjectionInput>> \| undefined,\n roleSpecsByRef: ReadonlyMap<string, ApplicationRoleDocumentationSource>,\n): readonly ApplicationOrganizationRoleDocumentationSource[] {\n const configured = new Map<string, ApplicationRoleConfigurationProjectionInput & { readonly role: string }>();\n for (const config of Object.values(DEFAULT_ORGANIZATION_ROLES)) {\n if (typeof config.role !== 'string' \|\| config.role.length === 0) {\n throw new Error('application organization-role projector: framework organization role configuration has no role token');\n }\n configured.set(config.role, { ...config, role: config.role });\n }\n for (const config of Object.values(customRoles ?? {})) {\n if (typeof config.role !== 'string' \|\| config.role.length === 0) {\n throw new Error('application organization-role projector: application organization role configuration has no role token');\n }\n if (configured.has(config.role)) {\n throw new Error(`application organization-role projector: application role '${config.role}' collides with a framework organization role`);\n }\n configured.set(config.role, { ...config, role: config.role });\n }\n\n return Object.freeze([...configured.values()]\n .filter((config) => config.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS)\n .map((config) => {\n const specification = roleSpecsByRef.get(config.role);\n if (\n specification === undefined\n \|\| specification.purpose === null\n \|\| specification.authorityBoundary === null\n \|\| specification.useWhen === null\n \|\| specification.avoidWhen === null\n \|\| specification.businessConstraints === null\n ) {\n throw new Error(\n `application organization-role projector: organization role '${config.role}' has no companion-exported role specification with complete consumer guidance`,\n );\n }\n return Object.freeze({\n role: config.role,\n inheritFrom: config.inheritFrom ?? null,\n purpose: specification.purpose,\n businessRole: specification.businessRole,\n authorityBoundary: specification.authorityBoundary,\n useWhen: specification.useWhen,\n avoidWhen: specification.avoidWhen,\n businessConstraints: specification.businessConstraints,\n });\n })\n .sort((left, right) => left.role.localeCompare(right.role, 'en-US')));\n}\n\n/\n Join role semantics to the exact primary-locale labels shown by the\n * application. Missing values fail closed: publishing a guessed label would\n * make the guide disagree with member-management and role-picker UI.\n /\nexport function resolveApplicationOrganizationRoleDocumentation(\n roles: readonly ApplicationOrganizationRoleDocumentationSource[],\n primaryLocaleLabels: Readonly<Record<string, string>>,\n): readonly ApplicationOrganizationRoleDocumentation[] {\n return Object.freeze(roles.map((role) => Object.freeze({\n ...role,\n label: requiredRoleLabel(primaryLocaleLabels, role.role, 'label'),\n description: requiredRoleLabel(primaryLocaleLabels, role.role, 'description'),\n })));\n}\n\n/\n Materialize the reusable Markdown fact consumed by the Roles and permissions\n * topic. This function knows no application identity: different applications\n * receive different role inputs and therefore different facts.\n /\nexport function createApplicationOrganizationRolesDocumentationFact(\n roles: readonly ApplicationOrganizationRoleDocumentation[],\n): ApplicationOrganizationRolesDocumentationFact {\n if (roles.length === 0) throw new Error('technical documentation requires at least one resolved organization role');\n if (new Set(roles.map((role) => role.role)).size !== roles.length) {\n throw new Error('technical documentation received duplicate resolved organization roles');\n }\n\n const roleByIdentifier = new Map(roles.map((role) => [role.role, role]));\n const hierarchyDepthByRole = new Map(roles.map((role) => [role.role, hierarchyDepth(role, roleByIdentifier)]));\n // Readers compare authority from broadest to narrowest. Derive that order\n // from the actual inheritance chain; sibling branches use visible labels and\n // stable role tokens only as deterministic tie-breakers.\n const canonicalRoles = [...roles].sort((left, right) =>\n hierarchyDepthByRole.get(right.role)! - hierarchyDepthByRole.get(left.role)!\n \|\| left.label.localeCompare(right.label, 'en-US')\n \|\| left.role.localeCompare(right.role, 'en-US'));\n\n const roleSections = canonicalRoles.map((role) => {\n const inheritedRole = role.inheritFrom === null ? undefined : roleByIdentifier.get(role.inheritFrom);\n const inheritance = role.inheritFrom === null\n ? 'This role does not inherit another organization role.'\n : `This role includes the permissions of ${markdownText(inheritedRole?.label ?? role.inheritFrom)}* (${inlineCode(role.inheritFrom)}).`;\n const limits = [role.avoidWhen, ...role.businessConstraints]\n .map((constraint) => `- ${markdownProse(constraint)}`)\n .join('\\n');\n return `### ${markdownText(role.label)}\\n\\n${markdownText(role.description)}\\n\\n- Where it applies: ${markdownProse(role.authorityBoundary)}\\n- Inherited access: ${inheritance}\\n- Technical identifier: ${inlineCode(role.role)}\\n\\n#### Can do\\n\\n${markdownProse(role.purpose)}\\n\\n${markdownProse(role.useWhen)}\\n\\n#### Cannot do\\n\\n${limits}\\n\\n#### Can assign\\n\\n${roleAssignmentMarkdown(role, roleByIdentifier)}`;\n }).join('\\n\\n');\n\n return Object.freeze({\n sourceRef: APPLICATION_ORGANIZATION_ROLES_DOCUMENTATION_SOURCE_REF,\n markdown: `These are all the organization roles available in this application. Their names and short descriptions match the application's primary-language interface; the technical identifier is included so you can recognize the same role in an access request, audit record, or API response.\\n\\n${roleSections}\\n\\n> How inherited access works: when one role includes another, it receives the included role’s permissions as well as its own. The reverse is not true: assigning the included role never grants the higher role.`,\n sourceVersion: APPLICATION_ORGANIZATION_ROLES_DOCUMENTATION_SOURCE_VERSION,\n });\n}\n\nfunction hierarchyDepth(\n role: ApplicationOrganizationRoleDocumentation,\n roleByIdentifier: ReadonlyMap<string, ApplicationOrganizationRoleDocumentation>,\n ancestors = new Set<string>(),\n): number {\n if (role.inheritFrom === null) return 0;\n if (ancestors.has(role.role)) {\n throw new Error(`technical documentation organization-role hierarchy contains a cycle at ${role.role}`);\n }\n const inheritedRole = roleByIdentifier.get(role.inheritFrom);\n if (inheritedRole === undefined) {\n throw new Error(`technical documentation organization role ${role.role} inherits absent role ${role.inheritFrom}`);\n }\n return 1 + hierarchyDepth(inheritedRole, roleByIdentifier, new Set([...ancestors, role.role]));\n}\n\n/*\n Explain the standard organization-role assignment ceiling from the exact\n * application role graph. This deliberately does not flatten custom roles into\n * a total order: sibling custom branches are outside one another's ceiling.\n * A role must also inherit the administrator gate before it can use the\n * standard membership and unit-assignment controls at all.\n /\nfunction roleAssignmentMarkdown(\n role: ApplicationOrganizationRoleDocumentation,\n roleByIdentifier: ReadonlyMap<string, ApplicationOrganizationRoleDocumentation>,\n): string {\n const effectiveRoles: ApplicationOrganizationRoleDocumentation[] = [];\n let current: ApplicationOrganizationRoleDocumentation \| undefined = role;\n const visited = new Set<string>();\n while (current !== undefined) {\n if (visited.has(current.role)) {\n throw new Error(`technical documentation organization-role hierarchy contains a cycle at ${current.role}`);\n }\n visited.add(current.role);\n effectiveRoles.push(current);\n current = current.inheritFrom === null ? undefined : roleByIdentifier.get(current.inheritFrom);\n }\n\n if (!effectiveRoles.some((candidate) => candidate.role === CORE_ORG_ROLES.ORG_ADMIN)) {\n return 'This role cannot use the standard organization-membership or organization-unit assignment controls. It therefore cannot assign an organization or unit role through those controls.';\n }\n\n const assignableRoles = effectiveRoles\n .map((candidate) => `${markdownText(candidate.label)}* (${inlineCode(candidate.role)})`)\n .join(', ');\n return `Through the standard membership and unit-assignment controls, this role can assign: ${assignableRoles}. It cannot assign a role outside this inheritance chain unless the person also holds another organization-wide role whose chain includes it.`;\n}\n\nfunction requiredRoleLabel(\n labels: Readonly<Record<string, string>>,\n role: string,\n field: 'label' \| 'description',\n): string {\n const key = `roles.${role}.${field}`;\n const value = labels[key];\n if (typeof value !== 'string' \|\| value.trim().length === 0) {\n throw new Error(\n `application organization-role documentation requires primary-locale label '${key}'; generate the application's role labels before publishing documentation`,\n );\n }\n return value.trim();\n}\n\nfunction nonEmptyStringOrNull(value: unknown): string \| null {\n return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null;\n}\n\nfunction nonEmptyStringArrayOrNull(value: unknown): readonly string[] \| null {\n if (!Array.isArray(value) \|\| value.length === 0) return null;\n const normalized = value.map(nonEmptyStringOrNull);\n return normalized.every((entry): entry is string => entry !== null)\n ? Object.freeze(normalized)\n : null;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction markdownText(value: string): string {\n return value.replaceAll(/\\s+/g, ' ').trim().replaceAll('\\\\', '\\\\\\\\').replaceAll(/([`_[\\]<>#\|])/g, '\\\\$1');\n}\n\n/* Role specifications intentionally author small inline-Markdown semantics. */\nfunction markdownProse(value: string): string {\n return value.replaceAll(/\\s+/g, ' ').trim();\n}\n\nfunction inlineCode(value: string): string {\n return `\\`${value.replaceAll('`', '`')}\\``;\n}\n"]}
1	+ {"version":3,"file":"application-organization-role-documentation.js","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/application-organization-role-documentation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAM/B,MAAM,CAAC,MAAM,uDAAuD,GAAG,gDAAyD,CAAC;AACjI,4GAA4G;AAC5G,MAAM,CAAC,MAAM,2DAA2D,GAAG,CAAC,CAAC;AAyC7E;;;GAGG;AACH,MAAM,UAAU,wCAAwC,CACtD,kBAAuD;IAEvD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8C,CAAC;IACrE,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3G,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,8EAA8E,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACxB,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC;YAChD,YAAY,EAAE,oBAAoB,CAAC,SAAS,CAAC,YAAY,CAAC;YAC1D,iBAAiB,EAAE,oBAAoB,CAAC,SAAS,CAAC,iBAAiB,CAAC;YACpE,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC;YAChD,SAAS,EAAE,oBAAoB,CAAC,SAAS,CAAC,SAAS,CAAC;YACpD,mBAAmB,EAAE,yBAAyB,CAAC,SAAS,CAAC,mBAAmB,CAAC;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sDAAsD,CACpE,WAA8F,EAC9F,cAAuE;IAEvE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmF,CAAC;IAC9G,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC/D,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAC;QAC1H,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;QAC5H,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,8DAA8D,MAAM,CAAC,IAAI,+CAA+C,CAAC,CAAC;QAC5I,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;SAC1C,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,KAAK,oBAAoB,CAAC,aAAa,CAAC;SACrF,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,IACE,aAAa,KAAK,SAAS;eACxB,aAAa,CAAC,OAAO,KAAK,IAAI;eAC9B,aAAa,CAAC,iBAAiB,KAAK,IAAI;eACxC,aAAa,CAAC,OAAO,KAAK,IAAI;eAC9B,aAAa,CAAC,SAAS,KAAK,IAAI;eAChC,aAAa,CAAC,mBAAmB,KAAK,IAAI,EAC7C,CAAC;YACD,MAAM,IAAI,KAAK,CACb,+DAA+D,MAAM,CAAC,IAAI,gFAAgF,CAC3J,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;YACvC,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;YAClD,OAAO,EAAE,aAAa,CAAC,OAAO;YAC9B,SAAS,EAAE,aAAa,CAAC,SAAS;YAClC,mBAAmB,EAAE,aAAa,CAAC,mBAAmB;SACvD,CAAC,CAAC;IACL,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+CAA+C,CAC7D,KAAgE,EAChE,mBAAqD;IAErD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACrD,GAAG,IAAI;QACP,KAAK,EAAE,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACjE,WAAW,EAAE,iBAAiB,CAAC,mBAAmB,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;KAC9E,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,wCAAwC,CAEtD,UAAwB,EAAE,WAA6C;IACvE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAChC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACnF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;YACnE,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,WAAW,CAAC,KAAK;gBAAE,OAAO,WAAW,CAAC;YACjF,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,GAAG,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mDAAmD,CACjE,KAA0D;IAE1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACpH,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,0EAA0E;IAC1E,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrD,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAE,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAE;WACzE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;WAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAEnD,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrG,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,IAAI;YAC3C,CAAC,CAAC,uDAAuD;YACzD,CAAC,CAAC,2CAA2C,YAAY,CAAC,aAAa,EAAE,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAC7I,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC;aACzD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;aACrD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,+BAA+B,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,6BAA6B,WAAW,iCAAiC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,MAAM,0BAA0B,sBAAsB,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;IAC5a,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,uDAAuD;QAClE,QAAQ,EAAE,8RAA8R,YAAY,0NAA0N;QAC9gB,aAAa,EAAE,2DAA2D;KAC3E,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,IAA8C,EAC9C,gBAA+E,EAC/E,YAAY,IAAI,GAAG,EAAU;IAE7B,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACxC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2EAA2E,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,IAAI,yBAAyB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,gBAAgB,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAC7B,IAA8C,EAC9C,gBAA+E;IAE/E,MAAM,cAAc,GAA+C,EAAE,CAAC;IACtE,IAAI,OAAO,GAAyD,IAAI,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO,OAAO,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,2EAA2E,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,GAAG,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QACrF,OAAO,qLAAqL,CAAC;IAC/L,CAAC;IAED,MAAM,eAAe,GAAG,cAAc;SACnC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;SAC1F,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,uFAAuF,eAAe,+IAA+I,CAAC;AAC/P,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAwC,EACxC,IAAY,EACZ,KAA8B;IAE9B,MAAM,GAAG,GAAG,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,8EAA8E,GAAG,2EAA2E,CAC7J,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;QACjE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;QAC3B,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAC7G,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC;AACjD,CAAC","sourcesContent":["import {\n CORE_ORG_ROLES,\n DEFAULT_ORGANIZATION_ROLES,\n ResourcePrimaryScope,\n} from '@wildo-ai/saas-models';\nimport {\n} from '@wildo-ai/saas-specifications/technical-documentation';\n\nimport type { ApplicationOrganizationRolesDocumentationFact } from './technical-documentation-engine-content-bundle';\n\nexport const APPLICATION_ORGANIZATION_ROLES_DOCUMENTATION_SOURCE_REF = 'source:companion-projection:organization-roles' as const;\n/** Advances when this projection's shape changes; it is the fact's version wherever provenance cites it. /\nexport const APPLICATION_ORGANIZATION_ROLES_DOCUMENTATION_SOURCE_VERSION = 1;\n\n/* Minimal application/engine role specification needed by consumer documentation. /\nexport interface ApplicationRoleDocumentationSource {\n readonly ref: string;\n readonly purpose: string \| null;\n readonly businessRole: string \| null;\n readonly authorityBoundary: string \| null;\n readonly useWhen: string \| null;\n readonly avoidWhen: string \| null;\n readonly businessConstraints: readonly string[] \| null;\n}\n\n/\n Application-independent organization-role projection before UI labels are\n * joined. The introspection subprocess can safely emit this JSON-only shape;\n * the parent companion later joins the application's primary-locale labels.\n /\nexport interface ApplicationOrganizationRoleDocumentationSource {\n readonly role: string;\n readonly inheritFrom: string \| null;\n readonly purpose: string;\n readonly businessRole: string \| null;\n readonly authorityBoundary: string;\n readonly useWhen: string;\n readonly avoidWhen: string;\n readonly businessConstraints: readonly string[];\n}\n\n/* Complete consumer-visible role documentation after the application label join. /\nexport interface ApplicationOrganizationRoleDocumentation extends ApplicationOrganizationRoleDocumentationSource {\n readonly label: string;\n readonly description: string;\n}\n\ninterface ApplicationRoleConfigurationProjectionInput {\n readonly role?: string;\n readonly inheritFrom?: string;\n readonly relatedPrimaryScope: ResourcePrimaryScope;\n}\n\n/\n Index companion-exported role specifications by their runtime role token.\n * Engine and application-defined roles intentionally share this namespace.\n /\nexport function indexApplicationRoleDocumentationSources(\n roleSpecifications: Record<string, unknown> \| undefined,\n): ReadonlyMap<string, ApplicationRoleDocumentationSource> {\n const result = new Map<string, ApplicationRoleDocumentationSource>();\n for (const candidate of Object.values(roleSpecifications ?? {})) {\n if (!isPlainObject(candidate) \|\| typeof candidate.ref !== 'string' \|\| candidate.ref.length === 0) continue;\n if (result.has(candidate.ref)) {\n throw new Error(`application organization-role projector: duplicate role specification for '${candidate.ref}'`);\n }\n result.set(candidate.ref, {\n ref: candidate.ref,\n purpose: nonEmptyStringOrNull(candidate.purpose),\n businessRole: nonEmptyStringOrNull(candidate.businessRole),\n authorityBoundary: nonEmptyStringOrNull(candidate.authorityBoundary),\n useWhen: nonEmptyStringOrNull(candidate.useWhen),\n avoidWhen: nonEmptyStringOrNull(candidate.avoidWhen),\n businessConstraints: nonEmptyStringArrayOrNull(candidate.businessConstraints),\n });\n }\n return result;\n}\n\n/\n Resolve every framework and application-defined organization role from the\n * application's merged runtime registry and authored role specifications.\n * Application-scoped roles are deliberately excluded from this organization\n * administration reference.\n /\nexport function projectApplicationOrganizationRoleDocumentationSources(\n customRoles: Readonly<Record<string, ApplicationRoleConfigurationProjectionInput>> \| undefined,\n roleSpecsByRef: ReadonlyMap<string, ApplicationRoleDocumentationSource>,\n): readonly ApplicationOrganizationRoleDocumentationSource[] {\n const configured = new Map<string, ApplicationRoleConfigurationProjectionInput & { readonly role: string }>();\n for (const config of Object.values(DEFAULT_ORGANIZATION_ROLES)) {\n if (typeof config.role !== 'string' \|\| config.role.length === 0) {\n throw new Error('application organization-role projector: framework organization role configuration has no role token');\n }\n configured.set(config.role, { ...config, role: config.role });\n }\n for (const config of Object.values(customRoles ?? {})) {\n if (typeof config.role !== 'string' \|\| config.role.length === 0) {\n throw new Error('application organization-role projector: application organization role configuration has no role token');\n }\n if (configured.has(config.role)) {\n throw new Error(`application organization-role projector: application role '${config.role}' collides with a framework organization role`);\n }\n configured.set(config.role, { ...config, role: config.role });\n }\n\n return Object.freeze([...configured.values()]\n .filter((config) => config.relatedPrimaryScope === ResourcePrimaryScope.ORGANIZATIONS)\n .map((config) => {\n const specification = roleSpecsByRef.get(config.role);\n if (\n specification === undefined\n \|\| specification.purpose === null\n \|\| specification.authorityBoundary === null\n \|\| specification.useWhen === null\n \|\| specification.avoidWhen === null\n \|\| specification.businessConstraints === null\n ) {\n throw new Error(\n `application organization-role projector: organization role '${config.role}' has no companion-exported role specification with complete consumer guidance`,\n );\n }\n return Object.freeze({\n role: config.role,\n inheritFrom: config.inheritFrom ?? null,\n purpose: specification.purpose,\n businessRole: specification.businessRole,\n authorityBoundary: specification.authorityBoundary,\n useWhen: specification.useWhen,\n avoidWhen: specification.avoidWhen,\n businessConstraints: specification.businessConstraints,\n });\n })\n .sort((left, right) => left.role.localeCompare(right.role, 'en-US')));\n}\n\n/\n Join role semantics to the exact primary-locale labels shown by the\n * application. Missing values fail closed: publishing a guessed label would\n * make the guide disagree with member-management and role-picker UI.\n /\nexport function resolveApplicationOrganizationRoleDocumentation(\n roles: readonly ApplicationOrganizationRoleDocumentationSource[],\n primaryLocaleLabels: Readonly<Record<string, string>>,\n): readonly ApplicationOrganizationRoleDocumentation[] {\n return Object.freeze(roles.map((role) => Object.freeze({\n ...role,\n label: requiredRoleLabel(primaryLocaleLabels, role.role, 'label'),\n description: requiredRoleLabel(primaryLocaleLabels, role.role, 'description'),\n })));\n}\n\n/\n Give every operation's access documentation the role names the APPLICATION authored.\n \n ## The defect this closes\n \n `roleRequirements[].label` was derived from the role TOKEN in the projector subprocess —\n * `ORG_MANAGER` became \"Organization Manager\" and `APP_ADMIN_SUPER_ADMIN` became \"Application Admin\n * Super Admin\". That is invented display text (`.claude/rules/display-text-comes-from-i18n.md`), and\n * it appeared on EVERY documented operation, which is the largest surface the defect had. Meanwhile\n * the same roles carry authored labels resolved from the application's own i18n unit, and\n * publication already refuses to proceed without them — but those labels reached only the roles\n * page. Two names for one role, and the invented one was the one beside every endpoint (#382).\n \n ## Why a token is the fallback, and not a prettier guess\n \n A label this map does not carry stays the raw token. `ORG_MANAGER` is honest, searchable, and\n * visibly not a product's word — an invented English phrase is none of those, and once printed it is\n * indistinguishable from an authored one. The refusal belongs at the door that PUBLISHES, which\n * already has it; a read that merely generates a document must not fail closed on an authoring gap.\n \n Returns new objects; the input projections are left untouched.\n /\nexport function applyAuthoredRoleLabelsToOperationAccess<\n T extends { readonly access?: { readonly roleRequirements: readonly { readonly role: string; readonly label: string }[] } },\n>(operations: readonly T[], labelByRole: Readonly<Record<string, string>>): readonly T[] {\n return operations.map((operation) => {\n const access = operation.access;\n if (access === undefined \|\| access.roleRequirements.length === 0) return operation;\n let changed = false;\n const roleRequirements = access.roleRequirements.map((requirement) => {\n const authored = labelByRole[requirement.role];\n if (authored === undefined \|\| authored === requirement.label) return requirement;\n changed = true;\n return { ...requirement, label: authored };\n });\n return changed ? { ...operation, access: { ...access, roleRequirements } } : operation;\n });\n}\n\n/\n Materialize the reusable Markdown fact consumed by the Roles and permissions\n * topic. This function knows no application identity: different applications\n * receive different role inputs and therefore different facts.\n /\nexport function createApplicationOrganizationRolesDocumentationFact(\n roles: readonly ApplicationOrganizationRoleDocumentation[],\n): ApplicationOrganizationRolesDocumentationFact {\n if (roles.length === 0) throw new Error('technical documentation requires at least one resolved organization role');\n if (new Set(roles.map((role) => role.role)).size !== roles.length) {\n throw new Error('technical documentation received duplicate resolved organization roles');\n }\n\n const roleByIdentifier = new Map(roles.map((role) => [role.role, role]));\n const hierarchyDepthByRole = new Map(roles.map((role) => [role.role, hierarchyDepth(role, roleByIdentifier)]));\n // Readers compare authority from broadest to narrowest. Derive that order\n // from the actual inheritance chain; sibling branches use visible labels and\n // stable role tokens only as deterministic tie-breakers.\n const canonicalRoles = [...roles].sort((left, right) =>\n hierarchyDepthByRole.get(right.role)! - hierarchyDepthByRole.get(left.role)!\n \|\| left.label.localeCompare(right.label, 'en-US')\n \|\| left.role.localeCompare(right.role, 'en-US'));\n\n const roleSections = canonicalRoles.map((role) => {\n const inheritedRole = role.inheritFrom === null ? undefined : roleByIdentifier.get(role.inheritFrom);\n const inheritance = role.inheritFrom === null\n ? 'This role does not inherit another organization role.'\n : `This role includes the permissions of ${markdownText(inheritedRole?.label ?? role.inheritFrom)}* (${inlineCode(role.inheritFrom)}).`;\n const limits = [role.avoidWhen, ...role.businessConstraints]\n .map((constraint) => `- ${markdownProse(constraint)}`)\n .join('\\n');\n return `### ${markdownText(role.label)}\\n\\n${markdownText(role.description)}\\n\\n- Where it applies: ${markdownProse(role.authorityBoundary)}\\n- Inherited access: ${inheritance}\\n- Technical identifier: ${inlineCode(role.role)}\\n\\n#### Can do\\n\\n${markdownProse(role.purpose)}\\n\\n${markdownProse(role.useWhen)}\\n\\n#### Cannot do\\n\\n${limits}\\n\\n#### Can assign\\n\\n${roleAssignmentMarkdown(role, roleByIdentifier)}`;\n }).join('\\n\\n');\n\n return Object.freeze({\n sourceRef: APPLICATION_ORGANIZATION_ROLES_DOCUMENTATION_SOURCE_REF,\n markdown: `These are all the organization roles available in this application. Their names and short descriptions match the application's primary-language interface; the technical identifier is included so you can recognize the same role in an access request, audit record, or API response.\\n\\n${roleSections}\\n\\n> How inherited access works: when one role includes another, it receives the included role’s permissions as well as its own. The reverse is not true: assigning the included role never grants the higher role.`,\n sourceVersion: APPLICATION_ORGANIZATION_ROLES_DOCUMENTATION_SOURCE_VERSION,\n });\n}\n\nfunction hierarchyDepth(\n role: ApplicationOrganizationRoleDocumentation,\n roleByIdentifier: ReadonlyMap<string, ApplicationOrganizationRoleDocumentation>,\n ancestors = new Set<string>(),\n): number {\n if (role.inheritFrom === null) return 0;\n if (ancestors.has(role.role)) {\n throw new Error(`technical documentation organization-role hierarchy contains a cycle at ${role.role}`);\n }\n const inheritedRole = roleByIdentifier.get(role.inheritFrom);\n if (inheritedRole === undefined) {\n throw new Error(`technical documentation organization role ${role.role} inherits absent role ${role.inheritFrom}`);\n }\n return 1 + hierarchyDepth(inheritedRole, roleByIdentifier, new Set([...ancestors, role.role]));\n}\n\n/*\n Explain the standard organization-role assignment ceiling from the exact\n * application role graph. This deliberately does not flatten custom roles into\n * a total order: sibling custom branches are outside one another's ceiling.\n * A role must also inherit the administrator gate before it can use the\n * standard membership and unit-assignment controls at all.\n /\nfunction roleAssignmentMarkdown(\n role: ApplicationOrganizationRoleDocumentation,\n roleByIdentifier: ReadonlyMap<string, ApplicationOrganizationRoleDocumentation>,\n): string {\n const effectiveRoles: ApplicationOrganizationRoleDocumentation[] = [];\n let current: ApplicationOrganizationRoleDocumentation \| undefined = role;\n const visited = new Set<string>();\n while (current !== undefined) {\n if (visited.has(current.role)) {\n throw new Error(`technical documentation organization-role hierarchy contains a cycle at ${current.role}`);\n }\n visited.add(current.role);\n effectiveRoles.push(current);\n current = current.inheritFrom === null ? undefined : roleByIdentifier.get(current.inheritFrom);\n }\n\n if (!effectiveRoles.some((candidate) => candidate.role === CORE_ORG_ROLES.ORG_ADMIN)) {\n return 'This role cannot use the standard organization-membership or organization-unit assignment controls. It therefore cannot assign an organization or unit role through those controls.';\n }\n\n const assignableRoles = effectiveRoles\n .map((candidate) => `${markdownText(candidate.label)}* (${inlineCode(candidate.role)})`)\n .join(', ');\n return `Through the standard membership and unit-assignment controls, this role can assign: ${assignableRoles}. It cannot assign a role outside this inheritance chain unless the person also holds another organization-wide role whose chain includes it.`;\n}\n\nfunction requiredRoleLabel(\n labels: Readonly<Record<string, string>>,\n role: string,\n field: 'label' \| 'description',\n): string {\n const key = `roles.${role}.${field}`;\n const value = labels[key];\n if (typeof value !== 'string' \|\| value.trim().length === 0) {\n throw new Error(\n `application organization-role documentation requires primary-locale label '${key}'; generate the application's role labels before publishing documentation`,\n );\n }\n return value.trim();\n}\n\nfunction nonEmptyStringOrNull(value: unknown): string \| null {\n return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null;\n}\n\nfunction nonEmptyStringArrayOrNull(value: unknown): readonly string[] \| null {\n if (!Array.isArray(value) \|\| value.length === 0) return null;\n const normalized = value.map(nonEmptyStringOrNull);\n return normalized.every((entry): entry is string => entry !== null)\n ? Object.freeze(normalized)\n : null;\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction markdownText(value: string): string {\n return value.replaceAll(/\\s+/g, ' ').trim().replaceAll('\\\\', '\\\\\\\\').replaceAll(/([`_[\\]<>#\|])/g, '\\\\$1');\n}\n\n/* Role specifications intentionally author small inline-Markdown semantics. */\nfunction markdownProse(value: string): string {\n return value.replaceAll(/\\s+/g, ' ').trim();\n}\n\nfunction inlineCode(value: string): string {\n return `\\`${value.replaceAll('`', '`')}\\``;\n}\n"]}

package/dist/esm/companion/application-documentation/technical-documentation-engine-content-bundle.d.ts CHANGED Viewed

@@ -1,8 +1,9 @@
 import { type ApplicationConnectionDocumentationFact } from './application-connection-documentation';
 import { type ApplicationAuthenticationDocumentationFact } from './application-authentication-documentation';
 import { type ApplicationIntegrationDocumentationFact } from './application-integration-documentation';
+import { type ApplicationDomainDocumentationFact } from './application-domain-documentation';
 import { type ApplicationAdministrationDocumentationFact } from './application-administration-documentation';
-import { TechnicalDocumentationAccessClass, TechnicalDocumentationReaderAudience, TechnicalDocumentationUnitKind, type TechnicalDocumentationApplicabilityRequirementV1, type TechnicalDocumentationApiReferenceTargetV1, type TechnicalDocumentationUnitV1 } from '@wildo-ai/saas-specifications/technical-documentation';
+import { TechnicalDocumentationAccessClass, TechnicalDocumentationEditorialStatus, TechnicalDocumentationReaderAudience, type TechnicalDocumentationAssetRequestV1, TechnicalDocumentationUnitKind, type TechnicalDocumentationApplicabilityRequirementV1, type TechnicalDocumentationApiReferenceTargetV1, type TechnicalDocumentationUnitV1 } from '@wildo-ai/saas-specifications/technical-documentation';
 import { type EngineDocumentationSpecificationCatalogV1 } from '@wildo-ai/saas-specifications/companion';
 import type { LoadedApplicationConsumerDocumentationContentBundleV1 } from '../content/application-consumer-documentation-content-loader';
 import { APPLICATION_CONSUMER_DOCUMENTATION_COMPANION_PROJECTION_SOURCE_PREFIX } from '../../content/application-consumer-documentation-content-manifest.schemas';
@@ -17,6 +18,34 @@ export interface EngineContentUnitDefinition {
         readonly label: string;
         readonly target: TechnicalDocumentationApiReferenceTargetV1;
     }[];
+    /**
+     * Editorial state of this page. **Omitted means `APPROVED`**, which is what every page authored
+     * before 2026-09-08 relied on — the two unit-creation sites hardcoded `APPROVED` and the policy's
+     * editorial suppression path therefore had no producer at all (#474).
+     *
+     * Declare `DRAFT` or `REVIEW_REQUIRED` for a page that exists in the content module and is not
+     * ready for a reader. It stays in the private derivation — so it is still built, still linked
+     * from the manifest, still visible to whoever is writing it — and the publication policy keeps it
+     * out of the portal with `EDITORIAL_NOT_APPROVED`. That is the difference between a page in
+     * progress and a page deleted, and until now the framework could only express the second.
+     */
+    readonly editorialStatus?: TechnicalDocumentationEditorialStatus;
+    /**
+     * Assets this page asks for — a deterministic diagram, or a product screenshot.
+     *
+     * Omitted means none, which is what every page meant until 2026-09-08: both unit-creation sites
+     * hardcoded `assetRequests: []`, so the screenshot placeholder branch, the deterministic diagram
+     * renderer and the whole asset-resolution path were unreachable from shipped content (#474). The
+     * pipeline was complete and had no producer.
+     *
+     * A request is a DECLARATION that the page needs a picture, never a promise that one exists. The
+     * resolver decides what arrives: a `DETERMINISTIC_RENDER` diagram is materialized offline and
+     * arrives RESOLVED, while a `PLAYWRIGHT_CAPTURE` screenshot with no capture available ships a
+     * PLACEHOLDER and the page still publishes — skip the generation, never block the tree on a
+     * browser and a live stack. Whether provisional imagery may actually SHIP is an environment
+     * decision enforced at publication (`--refuse-provisional-assets`), not an authoring one.
+     */
+    readonly assetRequests?: readonly TechnicalDocumentationAssetRequestV1[];
 }
 /** Public, semantic role inventory supplied by the resolved application companion. */
 export interface ApplicationOrganizationRolesDocumentationFact {
@@ -32,6 +61,36 @@ export interface ApplicationOrganizationRolesDocumentationFact {
  * and title; this map owns type, audience, publication posture and navigation
  * relationships, allowing the projector to reject a mismatched content set.
  */
+/**
+ * The unit-ref namespace generated resource pages live in, and the only place its shape is written.
+ *
+ * `technical-documentation:unit/manages/<resource>` — an ENGINE ref with a reserved segment, not an
+ * application-owned one. The distinction is load-bearing: `pathForUnit` still refuses a unit an
+ * application named, and these are engine units whose subject happens to come from the application.
+ */
+export declare function applicationDomainResourcePageUnitRef(resourceIdentifier: string): string;
+/** The unit-ref prefix a renderer matches to recognise a generated resource page. */
+export declare const APPLICATION_DOMAIN_RESOURCE_PAGE_UNIT_REF_PREFIX = "technical-documentation:unit/manages/";
+/**
+ * Unit kinds this catalog deliberately produces NO unit for, each with the reason.
+ *
+ * The vocabulary has eight members and, until 2026-09-09, two of them had no producer at all — a
+ * silent gap, because a kind nobody authors looks exactly like a kind nobody needed (#474). RUNBOOK
+ * now has one. CHANGE does not, and the reason is structural rather than editorial:
+ *
+ * A CHANGE unit is a record of what changed in ONE application, so only that application could
+ * author it — and an application-authored unit cannot be routed. `pathForUnit` admits engine-
+ * namespaced slugs and the reserved `unit/manages/` namespace, and refuses everything else with
+ * "has no consumer navigation category". Application material reaches the site only as an ENGINE
+ * unit carrying application-projected facts, never as an application-authored page. So the engine
+ * cannot write a changelog it has no knowledge of, and the party that could has no door.
+ *
+ * The member is therefore kept rather than retired: what is missing is a route for
+ * application-authored units, not the concept. When that route exists, this entry is removed in the
+ * same change — and `technical-documentation-engine-content-bundle.test.ts` fails until it is,
+ * because the partition below is asserted total over the enum.
+ */
+export declare const ENGINE_CONTENT_UNIT_KINDS_WITHOUT_PRODUCER: Readonly<Partial<Record<TechnicalDocumentationUnitKind, string>>>;
 export declare const ENGINE_CONTENT_UNIT_DEFINITIONS: Readonly<Record<string, EngineContentUnitDefinition>>;
 /**
  * The facts only the application knows, which the companion measures and passes in.
@@ -46,6 +105,7 @@ export interface ApplicationDocumentationFacts {
     readonly authentication?: ApplicationAuthenticationDocumentationFact;
     readonly administration?: ApplicationAdministrationDocumentationFact;
     readonly integration?: ApplicationIntegrationDocumentationFact;
+    readonly domain?: ApplicationDomainDocumentationFact;
 }
 /**
  * Compiles verified engine content and the application's own facts (organization roles,

package/dist/esm/companion/application-documentation/technical-documentation-engine-content-bundle.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"technical-documentation-engine-content-bundle.d.ts","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/technical-documentation-engine-content-bundle.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,sCAAsC,EAC5C,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAGL,KAAK,0CAA0C,EAChD,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAGL,KAAK,uCAAuC,EAC7C,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAGL,KAAK,0CAA0C,EAChD,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAEL,iCAAiC,~~EAQjC~~,oCAAoC,~~EAGpC~~,8BAA8B,EAE9B,KAAK,gDAAgD,EACrD,KAAK,0CAA0C,EAG/C,KAAK,4BAA4B,EAClC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAGL,KAAK,yCAAyC,EAC/C,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAAE,qDAAqD,EAAE,MAAM,8DAA8D,CAAC;AAC1I,OAAO,EACL,qEAAqE,EAGtE,MAAM,2EAA2E,CAAC;~~AAEnF~~,OAAO,EAEL,KAAK,qDAAqD,EAC3D,MAAM,wDAAwD,CAAC;AAEhE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,SAAS,oCAAoC,EAAE,CAAC;IAC1E,QAAQ,CAAC,WAAW,EAAE,iCAAiC,CAAC;IACxD,QAAQ,CAAC,yBAAyB,EAAE,SAAS,gDAAgD,EAAE,CAAC;IAChG,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,0CAA0C,CAAA;KAAE,EAAE,CAAC;~~CACnI~~;~~AAsED~~,sFAAsF;AACtF,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,SAAS,EAAE,GAAG,OAAO,qEAAqE,GAAG,MAAM,EAAE,CAAC;IAC/G,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;~~AAoFD~~;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,~~CAm8ChG~~,CAAC;~~AAwWH~~;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,6CAA6C,CAAC;IAC3E,QAAQ,CAAC,yBAAyB,CAAC,EAAE,qDAAqD,CAAC;IAC3F,QAAQ,CAAC,UAAU,CAAC,EAAE,sCAAsC,CAAC;IAC7D,QAAQ,CAAC,cAAc,CAAC,EAAE,0CAA0C,CAAC;IACrE,QAAQ,CAAC,cAAc,CAAC,EAAE,0CAA0C,CAAC;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,uCAAuC,CAAC;~~CAChE~~;AAED;;;GAGG;AACH,wBAAgB,6CAA6C,CAC3D,MAAM,EAAE,qDAAqD,EAC7D,0BAA0B,EAAE,yCAAyC,EACrE,eAAe,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAmC,EACxG,gBAAgB,GAAE,6BAAkC,GACnD,4BAA4B,EAAE,~~CAiIhC~~"}
1	+ {"version":3,"file":"technical-documentation-engine-content-bundle.d.ts","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/technical-documentation-engine-content-bundle.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,sCAAsC,EAC5C,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAGL,KAAK,0CAA0C,EAChD,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAGL,KAAK,uCAAuC,EAC7C,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAGL,KAAK,kCAAkC,EACxC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAGL,KAAK,0CAA0C,EAChD,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAEL,iCAAiC,EAKjC,qCAAqC,EAGrC,oCAAoC,EAEpC,KAAK,oCAAoC,EAEzC,8BAA8B,EAE9B,KAAK,gDAAgD,EACrD,KAAK,0CAA0C,EAG/C,KAAK,4BAA4B,EAClC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAGL,KAAK,yCAAyC,EAC/C,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAAE,qDAAqD,EAAE,MAAM,8DAA8D,CAAC;AAC1I,OAAO,EACL,qEAAqE,EAGtE,MAAM,2EAA2E,CAAC;AAKnF,OAAO,EAEL,KAAK,qDAAqD,EAC3D,MAAM,wDAAwD,CAAC;AAEhE,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,SAAS,oCAAoC,EAAE,CAAC;IAC1E,QAAQ,CAAC,WAAW,EAAE,iCAAiC,CAAC;IACxD,QAAQ,CAAC,yBAAyB,EAAE,SAAS,gDAAgD,EAAE,CAAC;IAChG,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,0CAA0C,CAAA;KAAE,EAAE,CAAC;IAClI;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,qCAAqC,CAAC;IACjE;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,oCAAoC,EAAE,CAAC;CAC1E;AAiED,sFAAsF;AACtF,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,SAAS,EAAE,GAAG,OAAO,qEAAqE,GAAG,MAAM,EAAE,CAAC;IAC/G,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAgFD;;;;;;;GAOG;AACH;;;;;;GAMG;AACH,wBAAgB,oCAAoC,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED,qFAAqF;AACrF,eAAO,MAAM,gDAAgD,0CAA0C,CAAC;AAoCxG;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,0CAA0C,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC,CAIxH,CAAC;AAEF,eAAO,MAAM,+BAA+B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAi2ChG,CAAC;AAyXH;;;;;GAKG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,6CAA6C,CAAC;IAC3E,QAAQ,CAAC,yBAAyB,CAAC,EAAE,qDAAqD,CAAC;IAC3F,QAAQ,CAAC,UAAU,CAAC,EAAE,sCAAsC,CAAC;IAC7D,QAAQ,CAAC,cAAc,CAAC,EAAE,0CAA0C,CAAC;IACrE,QAAQ,CAAC,cAAc,CAAC,EAAE,0CAA0C,CAAC;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,uCAAuC,CAAC;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,kCAAkC,CAAC;CACtD;AAED;;;GAGG;AACH,wBAAgB,6CAA6C,CAC3D,MAAM,EAAE,qDAAqD,EAC7D,0BAA0B,EAAE,yCAAyC,EACrE,eAAe,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAmC,EACxG,gBAAgB,GAAE,6BAAkC,GACnD,4BAA4B,EAAE,CA+LhC"}