@wildo-ai/saas-technical-doc 1.1.4 → 1.1.5

package/dist/esm/companion/application-documentation/technical-documentation-operational-evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"technical-documentation-operational-evidence.d.ts","sourceRoot":"","sources":["../../../../src/companion/application-documentation/technical-documentation-operational-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iDAAiD,EAEjD,KAAK,gDAAgD,EACrD,KAAK,mDAAmD,EAEzD,MAAM,uDAAuD,CAAC;AAE/D,oBAAY,8CAA8C;IACxD,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;CAC5C;AAED,MAAM,WAAW,0CAA0C;IACzD,QAAQ,CAAC,WAAW,EAAE,gDAAgD,CAAC;IACvE,QAAQ,CAAC,WAAW,EAAE,8CAA8C,CAAC;IACrE,QAAQ,CAAC,cAAc,EAAE,iDAAiD,GAAG,IAAI,CAAC;CACnF;AAED,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,0CAA0C,EAAE,CAAC;CAC1E;AAMD;;;;;GAKG;AACH,wBAAgB,2CAA2C,CACzD,YAAY,EAAE,SAAS,gDAAgD,EAAE,EACzE,aAAa,EAAE,mDAAmD,GACjE,6CAA6C,CAgB/C"}
+{"version":3,"file":"technical-documentation-operational-evidence.d.ts","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/technical-documentation-operational-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iDAAiD,EAEjD,KAAK,gDAAgD,EACrD,KAAK,mDAAmD,EAEzD,MAAM,uDAAuD,CAAC;AAE/D,oBAAY,8CAA8C;IACxD,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;CAC5C;AAED,MAAM,WAAW,0CAA0C;IACzD,QAAQ,CAAC,WAAW,EAAE,gDAAgD,CAAC;IACvE,QAAQ,CAAC,WAAW,EAAE,8CAA8C,CAAC;IACrE,QAAQ,CAAC,cAAc,EAAE,iDAAiD,GAAG,IAAI,CAAC;CACnF;AAED,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,0CAA0C,EAAE,CAAC;CAC1E;AAMD;;;;;GAKG;AACH,wBAAgB,2CAA2C,CACzD,YAAY,EAAE,SAAS,gDAAgD,EAAE,EACzE,aAAa,EAAE,mDAAmD,GACjE,6CAA6C,CAgB/C"}

package/dist/esm/companion/application-documentation/technical-documentation-private-derivation.d.ts

@@ -1,4 +1,4 @@
-import { type EngineDocumentationSpecificationCatalogIdentityV1, type TechnicalDocumentationEnvironmentEvidenceSnapshotV1, type TechnicalDocumentationPrivateDerivationManifestV1 } from '@wildo-ai/saas-specifications/technical-documentation';
+import { type EngineDocumentationSpecificationCatalogIdentityV1, type TechnicalDocumentationEnvironmentEvidenceSnapshotV1, type TechnicalDocumentationPrivateDerivationManifestV1, type TechnicalDocumentationUnitV1 } from '@wildo-ai/saas-specifications/technical-documentation';
 import type { EngineDocumentationSpecificationCatalogV1 } from '@wildo-ai/saas-specifications/companion';
 import type { LoadedApplicationConsumerDocumentationContentBundleV1 } from '../content/application-consumer-documentation-content-loader';
 import { type ApplicationOrganizationRolesDocumentationFact } from './technical-documentation-engine-content-bundle';
@@ -25,6 +25,12 @@ export interface CreateTechnicalDocumentationPrivateDerivationInput {
     readonly applicationAdministrationFact: ApplicationAdministrationDocumentationFact;
     readonly applicationIntegrationFact: ApplicationIntegrationDocumentationFact;
     readonly applicationDomainFact: ApplicationDomainDocumentationFact;
+    /**
+     * The chapters the application authored, already joined to its documentation plan by
+     * `projectApplicationDocumentationChapters` (#874). Optional and empty-by-default: an application
+     * that has authored none publishes its derived pages alone.
+     */
+    readonly applicationDocumentationChapterUnits?: readonly TechnicalDocumentationUnitV1[];
     /** This derivation's own identity; the authorized bundle names it. */
     readonly derivationRef: string;
     readonly derivationVersion: number;
@@ -34,8 +40,10 @@ export interface CreateTechnicalDocumentationPrivateDerivationInput {
  * Joins exact framework and environment identities into the private semantic artifact.
  *
  * This reusable function performs no application-design discovery and chooses
- * no output path. Application content remains absent until the app-creator
- * owns an accepted authoring artifact for that later join.
+ * no output path. Application-authored content enters only as units already
+ * joined to the application's accepted documentation plan
+ * (`projectApplicationDocumentationChapters`, #874) — this function never reads
+ * an application file itself.
  */
 export declare function createTechnicalDocumentationPrivateDerivation(input: CreateTechnicalDocumentationPrivateDerivationInput): TechnicalDocumentationPrivateDerivationManifestV1;
 //# sourceMappingURL=technical-documentation-private-derivation.d.ts.map

package/dist/esm/companion/application-documentation/technical-documentation-private-derivation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"technical-documentation-private-derivation.d.ts","sourceRoot":"","sources":["../../../../src/companion/application-documentation/technical-documentation-private-derivation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,iDAAiD,EACtD,KAAK,mDAAmD,EACxD,KAAK,iDAAiD,EAEvD,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,yCAAyC,CAAC;AAEzG,OAAO,KAAK,EAAE,qDAAqD,EAAE,MAAM,8DAA8D,CAAC;AAC1I,OAAO,EAEL,KAAK,6CAA6C,EACnD,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,qDAAqD,EAAE,MAAM,wDAAwD,CAAC;AACpI,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,wCAAwC,CAAC;AACrG,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4CAA4C,CAAC;AAC7G,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4CAA4C,CAAC;AAC7G,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AACvG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AAE7F,eAAO,MAAM,wDAAwD,4DAA4D,CAAC;AAClI,eAAO,MAAM,4DAA4D,IAAI,CAAC;AAE9E,MAAM,WAAW,kDAAkD;IACjE,QAAQ,CAAC,mBAAmB,EAAE,qDAAqD,CAAC;IACpF,QAAQ,CAAC,2BAA2B,EAAE,mDAAmD,CAAC;IAC1F,wEAAwE;IACxE,QAAQ,CAAC,0BAA0B,EAAE,yCAAyC,CAAC;IAC/E,QAAQ,CAAC,kCAAkC,EAAE,iDAAiD,CAAC;IAC/F,0FAA0F;IAC1F,QAAQ,CAAC,gCAAgC,EAAE,6CAA6C,CAAC;IACzF,+FAA+F;IAC/F,QAAQ,CAAC,wCAAwC,EAAE,qDAAqD,CAAC;IACzG,QAAQ,CAAC,yBAAyB,EAAE,sCAAsC,CAAC;IAC3E,QAAQ,CAAC,6BAA6B,EAAE,0CAA0C,CAAC;IACnF,QAAQ,CAAC,6BAA6B,EAAE,0CAA0C,CAAC;IACnF,QAAQ,CAAC,0BAA0B,EAAE,uCAAuC,CAAC;IAC7E,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;IACnE,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,6CAA6C,CAC3D,KAAK,EAAE,kDAAkD,GACxD,iDAAiD,CAiCnD"}
+{"version":3,"file":"technical-documentation-private-derivation.d.ts","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/technical-documentation-private-derivation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,iDAAiD,EACtD,KAAK,mDAAmD,EACxD,KAAK,iDAAiD,EACtD,KAAK,4BAA4B,EAClC,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,yCAAyC,CAAC;AAEzG,OAAO,KAAK,EAAE,qDAAqD,EAAE,MAAM,8DAA8D,CAAC;AAC1I,OAAO,EAEL,KAAK,6CAA6C,EACnD,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAAE,qDAAqD,EAAE,MAAM,wDAAwD,CAAC;AACpI,OAAO,KAAK,EAAE,sCAAsC,EAAE,MAAM,wCAAwC,CAAC;AACrG,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4CAA4C,CAAC;AAC7G,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4CAA4C,CAAC;AAC7G,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,yCAAyC,CAAC;AACvG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,oCAAoC,CAAC;AAE7F,eAAO,MAAM,wDAAwD,4DAA4D,CAAC;AAClI,eAAO,MAAM,4DAA4D,IAAI,CAAC;AAE9E,MAAM,WAAW,kDAAkD;IACjE,QAAQ,CAAC,mBAAmB,EAAE,qDAAqD,CAAC;IACpF,QAAQ,CAAC,2BAA2B,EAAE,mDAAmD,CAAC;IAC1F,wEAAwE;IACxE,QAAQ,CAAC,0BAA0B,EAAE,yCAAyC,CAAC;IAC/E,QAAQ,CAAC,kCAAkC,EAAE,iDAAiD,CAAC;IAC/F,0FAA0F;IAC1F,QAAQ,CAAC,gCAAgC,EAAE,6CAA6C,CAAC;IACzF,+FAA+F;IAC/F,QAAQ,CAAC,wCAAwC,EAAE,qDAAqD,CAAC;IACzG,QAAQ,CAAC,yBAAyB,EAAE,sCAAsC,CAAC;IAC3E,QAAQ,CAAC,6BAA6B,EAAE,0CAA0C,CAAC;IACnF,QAAQ,CAAC,6BAA6B,EAAE,0CAA0C,CAAC;IACnF,QAAQ,CAAC,0BAA0B,EAAE,uCAAuC,CAAC;IAC7E,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;IACnE;;;;OAIG;IACH,QAAQ,CAAC,oCAAoC,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACxF,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,6CAA6C,CAC3D,KAAK,EAAE,kDAAkD,GACxD,iDAAiD,CAqCnD"}

package/dist/esm/companion/application-documentation/technical-documentation-private-derivation.js

@@ -6,8 +6,10 @@ export const TECHNICAL_DOCUMENTATION_PRIVATE_DERIVATION_PROJECTOR_VERSION = 1;
  * Joins exact framework and environment identities into the private semantic artifact.
  *
  * This reusable function performs no application-design discovery and chooses
- * no output path. Application content remains absent until the app-creator
- * owns an accepted authoring artifact for that later join.
+ * no output path. Application-authored content enters only as units already
+ * joined to the application's accepted documentation plan
+ * (`projectApplicationDocumentationChapters`, #874) — this function never reads
+ * an application file itself.
  */
 export function createTechnicalDocumentationPrivateDerivation(input) {
     const engineUnits = projectEngineApplicationConsumerContentBundle(input.engineContentBundle, input.engineSpecificationCatalog, undefined, {
@@ -25,6 +27,11 @@ export function createTechnicalDocumentationPrivateDerivation(input) {
             throw new Error(`duplicate engine technical-documentation unitRef: ${unit.unitRef}`);
         unitsByRef.set(unit.unitRef, unit);
     }
+    for (const unit of input.applicationDocumentationChapterUnits ?? []) {
+        if (unitsByRef.has(unit.unitRef))
+            throw new Error(`application documentation chapter collides with an existing unitRef: ${unit.unitRef}`);
+        unitsByRef.set(unit.unitRef, unit);
+    }
     return createTechnicalDocumentationPrivateDerivationManifestV1({
         schemaVersion: 1,
         engineContentBundleIdentity: input.engineContentBundle.identity,

package/dist/esm/companion/application-documentation/technical-documentation-private-derivation.js.map

@@ -1 +1 @@
-{"version":3,"file":"technical-documentation-private-derivation.js","sourceRoot":"","sources":["../../../../src/companion/application-documentation/technical-documentation-private-derivation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uDAAuD,GAKxD,MAAM,uDAAuD,CAAC;AAI/D,OAAO,EACL,6CAA6C,GAE9C,MAAM,iDAAiD,CAAC;AAQzD,MAAM,CAAC,MAAM,wDAAwD,GAAG,yDAAyD,CAAC;AAClI,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC;AAuB9E;;;;;;GAMG;AACH,MAAM,UAAU,6CAA6C,CAC3D,KAAyD;IAEzD,MAAM,WAAW,GAAG,6CAA6C,CAC/D,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,0BAA0B,EAChC,SAAS,EACT;QACE,iBAAiB,EAAE,KAAK,CAAC,gCAAgC;QACzD,yBAAyB,EAAE,KAAK,CAAC,wCAAwC;QACzE,UAAU,EAAE,KAAK,CAAC,yBAAyB;QAC3C,cAAc,EAAE,KAAK,CAAC,6BAA6B;QACnD,cAAc,EAAE,KAAK,CAAC,6BAA6B;QACnD,WAAW,EAAE,KAAK,CAAC,0BAA0B;QAC7C,MAAM,EAAE,KAAK,CAAC,qBAAqB;KACpC,CACF,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwC,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvH,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,uDAAuD,CAAC;QAC7D,aAAa,EAAE,CAAC;QAChB,2BAA2B,EAAE,KAAK,CAAC,mBAAmB,CAAC,QAAQ;QAC/D,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,kCAAkC,EAAE,KAAK,CAAC,kCAAkC;QAC5E,YAAY,EAAE,wDAAwD;QACtE,gBAAgB,EAAE,4DAA4D;QAC9E,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  createTechnicalDocumentationPrivateDerivationManifestV1,\n  type EngineDocumentationSpecificationCatalogIdentityV1,\n  type TechnicalDocumentationEnvironmentEvidenceSnapshotV1,\n  type TechnicalDocumentationPrivateDerivationManifestV1,\n  type TechnicalDocumentationUnitV1,\n} from '@wildo-ai/saas-specifications/technical-documentation';\nimport type { EngineDocumentationSpecificationCatalogV1 } from '@wildo-ai/saas-specifications/companion';\n\nimport type { LoadedApplicationConsumerDocumentationContentBundleV1 } from '../content/application-consumer-documentation-content-loader';\nimport {\n  projectEngineApplicationConsumerContentBundle,\n  type ApplicationOrganizationRolesDocumentationFact,\n} from './technical-documentation-engine-content-bundle';\nimport type { ApplicationOrganizationUnitResourcesDocumentationFact } from './application-organization-unit-resource-documentation';\nimport type { ApplicationConnectionDocumentationFact } from './application-connection-documentation';\nimport type { ApplicationAuthenticationDocumentationFact } from './application-authentication-documentation';\nimport type { ApplicationAdministrationDocumentationFact } from './application-administration-documentation';\nimport type { ApplicationIntegrationDocumentationFact } from './application-integration-documentation';\nimport type { ApplicationDomainDocumentationFact } from './application-domain-documentation';\n\nexport const TECHNICAL_DOCUMENTATION_PRIVATE_DERIVATION_PROJECTOR_REF = 'technical-documentation:projector/private-derivation-v1';\nexport const TECHNICAL_DOCUMENTATION_PRIVATE_DERIVATION_PROJECTOR_VERSION = 1;\n\nexport interface CreateTechnicalDocumentationPrivateDerivationInput {\n  readonly engineContentBundle: LoadedApplicationConsumerDocumentationContentBundleV1;\n  readonly environmentEvidenceSnapshot: TechnicalDocumentationEnvironmentEvidenceSnapshotV1;\n  /** Exact safe fact catalog used to compose the engine-content units. */\n  readonly engineSpecificationCatalog: EngineDocumentationSpecificationCatalogV1;\n  readonly engineSpecificationCatalogIdentity: EngineDocumentationSpecificationCatalogIdentityV1;\n  /** Resolved organization roles and their application-authored semantic specifications. */\n  readonly applicationOrganizationRolesFact: ApplicationOrganizationRolesDocumentationFact;\n  /** Exact resources opted into organization-unit narrowing by backend startup configuration. */\n  readonly applicationOrganizationUnitResourcesFact: ApplicationOrganizationUnitResourcesDocumentationFact;\n  readonly applicationConnectionFact: ApplicationConnectionDocumentationFact;\n  readonly applicationAuthenticationFact: ApplicationAuthenticationDocumentationFact;\n  readonly applicationAdministrationFact: ApplicationAdministrationDocumentationFact;\n  readonly applicationIntegrationFact: ApplicationIntegrationDocumentationFact;\n  readonly applicationDomainFact: ApplicationDomainDocumentationFact;\n  /** This derivation's own identity; the authorized bundle names it. */\n  readonly derivationRef: string;\n  readonly derivationVersion: number;\n  readonly derivedAt: string;\n}\n\n/**\n * Joins exact framework and environment identities into the private semantic artifact.\n *\n * This reusable function performs no application-design discovery and chooses\n * no output path. Application content remains absent until the app-creator\n * owns an accepted authoring artifact for that later join.\n */\nexport function createTechnicalDocumentationPrivateDerivation(\n  input: CreateTechnicalDocumentationPrivateDerivationInput,\n): TechnicalDocumentationPrivateDerivationManifestV1 {\n  const engineUnits = projectEngineApplicationConsumerContentBundle(\n    input.engineContentBundle,\n    input.engineSpecificationCatalog,\n    undefined,\n    {\n      organizationRoles: input.applicationOrganizationRolesFact,\n      organizationUnitResources: input.applicationOrganizationUnitResourcesFact,\n      connection: input.applicationConnectionFact,\n      authentication: input.applicationAuthenticationFact,\n      administration: input.applicationAdministrationFact,\n      integration: input.applicationIntegrationFact,\n      domain: input.applicationDomainFact,\n    },\n  );\n  const unitsByRef = new Map<string, TechnicalDocumentationUnitV1>();\n  for (const unit of engineUnits) {\n    if (unitsByRef.has(unit.unitRef)) throw new Error(`duplicate engine technical-documentation unitRef: ${unit.unitRef}`);\n    unitsByRef.set(unit.unitRef, unit);\n  }\n\n  return createTechnicalDocumentationPrivateDerivationManifestV1({\n    schemaVersion: 1,\n    engineContentBundleIdentity: input.engineContentBundle.identity,\n    environmentEvidenceSnapshot: input.environmentEvidenceSnapshot,\n    engineSpecificationCatalogIdentity: input.engineSpecificationCatalogIdentity,\n    projectorRef: TECHNICAL_DOCUMENTATION_PRIVATE_DERIVATION_PROJECTOR_REF,\n    projectorVersion: TECHNICAL_DOCUMENTATION_PRIVATE_DERIVATION_PROJECTOR_VERSION,\n    derivationRef: input.derivationRef,\n    derivationVersion: input.derivationVersion,\n    units: [...unitsByRef.values()],\n    derivedAt: input.derivedAt,\n  });\n}\n"]}
+{"version":3,"file":"technical-documentation-private-derivation.js","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/technical-documentation-private-derivation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uDAAuD,GAKxD,MAAM,uDAAuD,CAAC;AAI/D,OAAO,EACL,6CAA6C,GAE9C,MAAM,iDAAiD,CAAC;AAQzD,MAAM,CAAC,MAAM,wDAAwD,GAAG,yDAAyD,CAAC;AAClI,MAAM,CAAC,MAAM,4DAA4D,GAAG,CAAC,CAAC;AA6B9E;;;;;;;;GAQG;AACH,MAAM,UAAU,6CAA6C,CAC3D,KAAyD;IAEzD,MAAM,WAAW,GAAG,6CAA6C,CAC/D,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,0BAA0B,EAChC,SAAS,EACT;QACE,iBAAiB,EAAE,KAAK,CAAC,gCAAgC;QACzD,yBAAyB,EAAE,KAAK,CAAC,wCAAwC;QACzE,UAAU,EAAE,KAAK,CAAC,yBAAyB;QAC3C,cAAc,EAAE,KAAK,CAAC,6BAA6B;QACnD,cAAc,EAAE,KAAK,CAAC,6BAA6B;QACnD,WAAW,EAAE,KAAK,CAAC,0BAA0B;QAC7C,MAAM,EAAE,KAAK,CAAC,qBAAqB;KACpC,CACF,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAwC,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACvH,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,EAAE,CAAC;QACpE,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1I,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,uDAAuD,CAAC;QAC7D,aAAa,EAAE,CAAC;QAChB,2BAA2B,EAAE,KAAK,CAAC,mBAAmB,CAAC,QAAQ;QAC/D,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,kCAAkC,EAAE,KAAK,CAAC,kCAAkC;QAC5E,YAAY,EAAE,wDAAwD;QACtE,gBAAgB,EAAE,4DAA4D;QAC9E,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;QAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  createTechnicalDocumentationPrivateDerivationManifestV1,\n  type EngineDocumentationSpecificationCatalogIdentityV1,\n  type TechnicalDocumentationEnvironmentEvidenceSnapshotV1,\n  type TechnicalDocumentationPrivateDerivationManifestV1,\n  type TechnicalDocumentationUnitV1,\n} from '@wildo-ai/saas-specifications/technical-documentation';\nimport type { EngineDocumentationSpecificationCatalogV1 } from '@wildo-ai/saas-specifications/companion';\n\nimport type { LoadedApplicationConsumerDocumentationContentBundleV1 } from '../content/application-consumer-documentation-content-loader';\nimport {\n  projectEngineApplicationConsumerContentBundle,\n  type ApplicationOrganizationRolesDocumentationFact,\n} from './technical-documentation-engine-content-bundle';\nimport type { ApplicationOrganizationUnitResourcesDocumentationFact } from './application-organization-unit-resource-documentation';\nimport type { ApplicationConnectionDocumentationFact } from './application-connection-documentation';\nimport type { ApplicationAuthenticationDocumentationFact } from './application-authentication-documentation';\nimport type { ApplicationAdministrationDocumentationFact } from './application-administration-documentation';\nimport type { ApplicationIntegrationDocumentationFact } from './application-integration-documentation';\nimport type { ApplicationDomainDocumentationFact } from './application-domain-documentation';\n\nexport const TECHNICAL_DOCUMENTATION_PRIVATE_DERIVATION_PROJECTOR_REF = 'technical-documentation:projector/private-derivation-v1';\nexport const TECHNICAL_DOCUMENTATION_PRIVATE_DERIVATION_PROJECTOR_VERSION = 1;\n\nexport interface CreateTechnicalDocumentationPrivateDerivationInput {\n  readonly engineContentBundle: LoadedApplicationConsumerDocumentationContentBundleV1;\n  readonly environmentEvidenceSnapshot: TechnicalDocumentationEnvironmentEvidenceSnapshotV1;\n  /** Exact safe fact catalog used to compose the engine-content units. */\n  readonly engineSpecificationCatalog: EngineDocumentationSpecificationCatalogV1;\n  readonly engineSpecificationCatalogIdentity: EngineDocumentationSpecificationCatalogIdentityV1;\n  /** Resolved organization roles and their application-authored semantic specifications. */\n  readonly applicationOrganizationRolesFact: ApplicationOrganizationRolesDocumentationFact;\n  /** Exact resources opted into organization-unit narrowing by backend startup configuration. */\n  readonly applicationOrganizationUnitResourcesFact: ApplicationOrganizationUnitResourcesDocumentationFact;\n  readonly applicationConnectionFact: ApplicationConnectionDocumentationFact;\n  readonly applicationAuthenticationFact: ApplicationAuthenticationDocumentationFact;\n  readonly applicationAdministrationFact: ApplicationAdministrationDocumentationFact;\n  readonly applicationIntegrationFact: ApplicationIntegrationDocumentationFact;\n  readonly applicationDomainFact: ApplicationDomainDocumentationFact;\n  /**\n   * The chapters the application authored, already joined to its documentation plan by\n   * `projectApplicationDocumentationChapters` (#874). Optional and empty-by-default: an application\n   * that has authored none publishes its derived pages alone.\n   */\n  readonly applicationDocumentationChapterUnits?: readonly TechnicalDocumentationUnitV1[];\n  /** This derivation's own identity; the authorized bundle names it. */\n  readonly derivationRef: string;\n  readonly derivationVersion: number;\n  readonly derivedAt: string;\n}\n\n/**\n * Joins exact framework and environment identities into the private semantic artifact.\n *\n * This reusable function performs no application-design discovery and chooses\n * no output path. Application-authored content enters only as units already\n * joined to the application's accepted documentation plan\n * (`projectApplicationDocumentationChapters`, #874) — this function never reads\n * an application file itself.\n */\nexport function createTechnicalDocumentationPrivateDerivation(\n  input: CreateTechnicalDocumentationPrivateDerivationInput,\n): TechnicalDocumentationPrivateDerivationManifestV1 {\n  const engineUnits = projectEngineApplicationConsumerContentBundle(\n    input.engineContentBundle,\n    input.engineSpecificationCatalog,\n    undefined,\n    {\n      organizationRoles: input.applicationOrganizationRolesFact,\n      organizationUnitResources: input.applicationOrganizationUnitResourcesFact,\n      connection: input.applicationConnectionFact,\n      authentication: input.applicationAuthenticationFact,\n      administration: input.applicationAdministrationFact,\n      integration: input.applicationIntegrationFact,\n      domain: input.applicationDomainFact,\n    },\n  );\n  const unitsByRef = new Map<string, TechnicalDocumentationUnitV1>();\n  for (const unit of engineUnits) {\n    if (unitsByRef.has(unit.unitRef)) throw new Error(`duplicate engine technical-documentation unitRef: ${unit.unitRef}`);\n    unitsByRef.set(unit.unitRef, unit);\n  }\n  for (const unit of input.applicationDocumentationChapterUnits ?? []) {\n    if (unitsByRef.has(unit.unitRef)) throw new Error(`application documentation chapter collides with an existing unitRef: ${unit.unitRef}`);\n    unitsByRef.set(unit.unitRef, unit);\n  }\n\n  return createTechnicalDocumentationPrivateDerivationManifestV1({\n    schemaVersion: 1,\n    engineContentBundleIdentity: input.engineContentBundle.identity,\n    environmentEvidenceSnapshot: input.environmentEvidenceSnapshot,\n    engineSpecificationCatalogIdentity: input.engineSpecificationCatalogIdentity,\n    projectorRef: TECHNICAL_DOCUMENTATION_PRIVATE_DERIVATION_PROJECTOR_REF,\n    projectorVersion: TECHNICAL_DOCUMENTATION_PRIVATE_DERIVATION_PROJECTOR_VERSION,\n    derivationRef: input.derivationRef,\n    derivationVersion: input.derivationVersion,\n    units: [...unitsByRef.values()],\n    derivedAt: input.derivedAt,\n  });\n}\n"]}

package/dist/esm/companion/application-documentation/technical-documentation-publication-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"technical-documentation-publication-policy.d.ts","sourceRoot":"","sources":["../../../../src/companion/application-documentation/technical-documentation-publication-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,6BAA6B,EAO7B,KAAK,gDAAgD,EACrD,KAAK,iDAAiD,EAGvD,MAAM,uDAAuD,CAAC;AAgE/D,MAAM,WAAW,kDAAkD;IACjE,QAAQ,CAAC,iBAAiB,EAAE,iDAAiD,CAAC;IAC9E,QAAQ,CAAC,OAAO,EAAE,6BAA6B,CAAC,aAAa,CAAC;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,2EAA2E;AAC3E,wBAAgB,6CAA6C,CAC3D,KAAK,EAAE,kDAAkD,GACxD,gDAAgD,CA2ClD"}
+{"version":3,"file":"technical-documentation-publication-policy.d.ts","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/technical-documentation-publication-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,6BAA6B,EAO7B,KAAK,gDAAgD,EACrD,KAAK,iDAAiD,EAGvD,MAAM,uDAAuD,CAAC;AAsE/D,MAAM,WAAW,kDAAkD;IACjE,QAAQ,CAAC,iBAAiB,EAAE,iDAAiD,CAAC;IAC9E,QAAQ,CAAC,OAAO,EAAE,6BAA6B,CAAC,aAAa,CAAC;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,2EAA2E;AAC3E,wBAAgB,6CAA6C,CAC3D,KAAK,EAAE,kDAAkD,GACxD,gDAAgD,CA2ClD"}

package/dist/esm/companion/application-documentation/technical-documentation-publication-policy.js

@@ -4,11 +4,17 @@ function recreateUnit(unit, overrides) {
     return createTechnicalDocumentationUnitV1({ ...unit, ...overrides });
 }
 /**
- * Authorizes one framework unit for the public consumer portal.
+ * Authorizes one unit for the public consumer portal.
  *
- * Application editorial overlays and authenticated/internal publication lanes
- * are intentionally absent. Application-specific authoring will re-enter later
- * through the app-creator acceptance flow, not through this framework policy.
+ * ONE rule set for every tier — engine pages, companion projections and the
+ * chapters an application authors (#874). An authored chapter is withheld by the
+ * same three checks as any other unit: not `APPROVED` (its author marked it a
+ * draft), applicability not proven, or provenance not `PUBLIC` (its author
+ * classified it `RESTRICTED`). There is deliberately no chapter-specific branch
+ * here: a second gate for one tier is a gate that drifts from the first.
+ *
+ * Authenticated/internal publication lanes remain absent; a `RESTRICTED` chapter
+ * is therefore withheld outright rather than routed to a private portal.
  */
 function projectPublicUnit(sourceUnit, manifest) {
     if (sourceUnit.editorialStatus !== TechnicalDocumentationEditorialStatus.APPROVED) {

package/dist/esm/companion/application-documentation/technical-documentation-publication-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"technical-documentation-publication-policy.js","sourceRoot":"","sources":["../../../../src/companion/application-documentation/technical-documentation-publication-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,6BAA6B,EAC7B,qCAAqC,EACrC,yCAAyC,EACzC,uCAAuC,EACvC,0CAA0C,EAC1C,sDAAsD,EACtD,kCAAkC,GAKnC,MAAM,uDAAuD,CAAC;AAE/D,OAAO,EAAE,2CAA2C,EAAE,MAAM,gDAAgD,CAAC;AAS7G,SAAS,YAAY,CACnB,IAAkC,EAClC,SAAgD;IAEhD,OAAO,kCAAkC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,UAAwC,EACxC,QAA2D;IAE3D,IAAI,UAAU,CAAC,eAAe,KAAK,qCAAqC,CAAC,QAAQ,EAAE,CAAC;QAClF,OAAO;YACL,UAAU;YACV,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,yCAAyC,CAAC,QAAQ;YAC5D,MAAM,EAAE,uCAAuC,CAAC,sBAAsB;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2CAA2C,CAAC,UAAU,CAAC,yBAAyB,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAC,UAAU,EAAE,CAAC;QACxI,OAAO;YACL,UAAU;YACV,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,yCAAyC,CAAC,QAAQ;YAC5D,MAAM,EAAE,uCAAuC,CAAC,wBAAwB;SACzE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,0CAA0C,CAAC,MAAM,CAAC,EAAE,CAAC;QACxH,OAAO;YACL,UAAU;YACV,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,yCAAyC,CAAC,QAAQ;YAC5D,MAAM,EAAE,uCAAuC,CAAC,iBAAiB;SAClE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,sCAAsC,CAAC,MAAM,CAAC,CAAC;IACtI,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC;IAC1E,OAAO;QACL,UAAU;QACV,aAAa,EAAE,YAAY,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC;QAC1D,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,yCAAyC,CAAC,MAAM,CAAC,CAAC,CAAC,yCAAyC,CAAC,OAAO;QACzH,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,uCAAuC,CAAC,yBAAyB,CAAC,CAAC,CAAC,uCAAuC,CAAC,kBAAkB;KAClJ,CAAC;AACJ,CAAC;AAYD,2EAA2E;AAC3E,MAAM,UAAU,6CAA6C,CAC3D,KAAyD;IAEzD,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9G,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3I,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC1C,IAAI,SAAS,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACrI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO;YACL,GAAG,SAAS;YACZ,aAAa,EAAE,YAAY,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC;YAC/D,QAAQ,EAAE,yCAAyC,CAAC,MAAM;YAC1D,MAAM,EAAE,uCAAuC,CAAC,qBAAqB;SACtE,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IAClH,MAAM,SAAS,GAAsD,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,OAAO;QACrC,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB;;;;;WAKG;QACH,iBAAiB,EAAE,SAAS,CAAC,UAAU,CAAC,WAAW;QACnD,oBAAoB,EAAE,SAAS,CAAC,aAAa,EAAE,WAAW,IAAI,IAAI;KACnE,CAAC,CAAC,CAAC;IAEJ,OAAO,sDAAsD,CAAC;QAC5D,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,6BAA6B,CAAC,aAAa;QACpD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,kBAAkB,EAAE;YAClB,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,aAAa;YAC1C,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,iBAAiB;SACnD;QACD,KAAK;QACL,SAAS;KACV,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  TechnicalDocumentationAssetAccessClass,\n  TechnicalDocumentationChannel,\n  TechnicalDocumentationEditorialStatus,\n  TechnicalDocumentationPublicationDecision,\n  TechnicalDocumentationPublicationReason,\n  TechnicalDocumentationSourceClassification,\n  createTechnicalDocumentationAuthorizedBundleManifestV1,\n  createTechnicalDocumentationUnitV1,\n  type TechnicalDocumentationAuthorizedBundleManifestV1,\n  type TechnicalDocumentationPrivateDerivationManifestV1,\n  type TechnicalDocumentationUnitPublicationDecisionV1,\n  type TechnicalDocumentationUnitV1,\n} from '@wildo-ai/saas-specifications/technical-documentation';\n\nimport { evaluateTechnicalDocumentationApplicability } from './technical-documentation-operational-evidence';\n\ninterface PolicyProjectionCandidate {\n  readonly sourceUnit: TechnicalDocumentationUnitV1;\n  readonly publishedUnit: TechnicalDocumentationUnitV1 | null;\n  readonly decision: TechnicalDocumentationPublicationDecision;\n  readonly reason: TechnicalDocumentationPublicationReason;\n}\n\nfunction recreateUnit(\n  unit: TechnicalDocumentationUnitV1,\n  overrides: Partial<TechnicalDocumentationUnitV1>,\n): TechnicalDocumentationUnitV1 {\n  return createTechnicalDocumentationUnitV1({ ...unit, ...overrides });\n}\n\n/**\n * Authorizes one framework unit for the public consumer portal.\n *\n * Application editorial overlays and authenticated/internal publication lanes\n * are intentionally absent. Application-specific authoring will re-enter later\n * through the app-creator acceptance flow, not through this framework policy.\n */\nfunction projectPublicUnit(\n  sourceUnit: TechnicalDocumentationUnitV1,\n  manifest: TechnicalDocumentationPrivateDerivationManifestV1,\n): PolicyProjectionCandidate {\n  if (sourceUnit.editorialStatus !== TechnicalDocumentationEditorialStatus.APPROVED) {\n    return {\n      sourceUnit,\n      publishedUnit: null,\n      decision: TechnicalDocumentationPublicationDecision.SUPPRESS,\n      reason: TechnicalDocumentationPublicationReason.EDITORIAL_NOT_APPROVED,\n    };\n  }\n  if (!evaluateTechnicalDocumentationApplicability(sourceUnit.applicabilityRequirements, manifest.environmentEvidenceSnapshot).applicable) {\n    return {\n      sourceUnit,\n      publishedUnit: null,\n      decision: TechnicalDocumentationPublicationDecision.SUPPRESS,\n      reason: TechnicalDocumentationPublicationReason.APPLICABILITY_NOT_PROVEN,\n    };\n  }\n  if (sourceUnit.provenance.some((source) => source.classification !== TechnicalDocumentationSourceClassification.PUBLIC)) {\n    return {\n      sourceUnit,\n      publishedUnit: null,\n      decision: TechnicalDocumentationPublicationDecision.SUPPRESS,\n      reason: TechnicalDocumentationPublicationReason.RESTRICTED_SOURCE,\n    };\n  }\n\n  const assetRequests = sourceUnit.assetRequests.filter((asset) => asset.accessClass === TechnicalDocumentationAssetAccessClass.PUBLIC);\n  const redacted = assetRequests.length !== sourceUnit.assetRequests.length;\n  return {\n    sourceUnit,\n    publishedUnit: recreateUnit(sourceUnit, { assetRequests }),\n    decision: redacted ? TechnicalDocumentationPublicationDecision.REDACT : TechnicalDocumentationPublicationDecision.INCLUDE,\n    reason: redacted ? TechnicalDocumentationPublicationReason.RESTRICTED_ASSET_REDACTED : TechnicalDocumentationPublicationReason.INCLUDED_BY_POLICY,\n  };\n}\n\nexport interface ProjectTechnicalDocumentationAuthorizedBundleInput {\n  readonly privateDerivation: TechnicalDocumentationPrivateDerivationManifestV1;\n  readonly channel: TechnicalDocumentationChannel.PUBLIC_PORTAL;\n  readonly policyRef: string;\n  readonly policyVersion: number;\n  /** This bundle's own identity; the render manifest and the publication pointer name it. */\n  readonly bundleRef: string;\n  readonly bundleVersion: number;\n}\n\n/** Projects and minimizes the public framework bundle before rendering. */\nexport function projectTechnicalDocumentationAuthorizedBundle(\n  input: ProjectTechnicalDocumentationAuthorizedBundleInput,\n): TechnicalDocumentationAuthorizedBundleManifestV1 {\n  const initial = input.privateDerivation.units.map((unit) => projectPublicUnit(unit, input.privateDerivation));\n  const emittedUnitRefs = new Set(initial.flatMap((candidate) => candidate.publishedUnit === null ? [] : [candidate.publishedUnit.unitRef]));\n  const finalized = initial.map((candidate) => {\n    if (candidate.publishedUnit === null) return candidate;\n    const links = candidate.publishedUnit.links.filter((link) => link.targetUnitRef === null || emittedUnitRefs.has(link.targetUnitRef));\n    if (links.length === candidate.publishedUnit.links.length) return candidate;\n    return {\n      ...candidate,\n      publishedUnit: recreateUnit(candidate.publishedUnit, { links }),\n      decision: TechnicalDocumentationPublicationDecision.REDACT,\n      reason: TechnicalDocumentationPublicationReason.ACCESS_CLASS_MISMATCH,\n    };\n  });\n  const units = finalized.flatMap((candidate) => candidate.publishedUnit === null ? [] : [candidate.publishedUnit]);\n  const decisions: TechnicalDocumentationUnitPublicationDecisionV1[] = finalized.map((candidate) => ({\n    unitRef: candidate.sourceUnit.unitRef,\n    decision: candidate.decision,\n    reason: candidate.reason,\n    /*\n     * Both versions name the SAME unit version, and that is correct: a redaction narrows a unit's\n     * content without minting a new authored version. `decision` is what distinguishes INCLUDE\n     * from REDACT — it always was; the digest pair merely made the difference visible as two hex\n     * strings nobody could read.\n     */\n    sourceUnitVersion: candidate.sourceUnit.unitVersion,\n    publishedUnitVersion: candidate.publishedUnit?.unitVersion ?? null,\n  }));\n\n  return createTechnicalDocumentationAuthorizedBundleManifestV1({\n    schemaVersion: 1,\n    channel: TechnicalDocumentationChannel.PUBLIC_PORTAL,\n    policyRef: input.policyRef,\n    policyVersion: input.policyVersion,\n    bundleRef: input.bundleRef,\n    bundleVersion: input.bundleVersion,\n    derivationIdentity: {\n      ref: input.privateDerivation.derivationRef,\n      version: input.privateDerivation.derivationVersion,\n    },\n    units,\n    decisions,\n  });\n}\n"]}
+{"version":3,"file":"technical-documentation-publication-policy.js","sourceRoot":"","sources":["../../../../../src/companion/application-documentation/technical-documentation-publication-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,6BAA6B,EAC7B,qCAAqC,EACrC,yCAAyC,EACzC,uCAAuC,EACvC,0CAA0C,EAC1C,sDAAsD,EACtD,kCAAkC,GAKnC,MAAM,uDAAuD,CAAC;AAE/D,OAAO,EAAE,2CAA2C,EAAE,MAAM,gDAAgD,CAAC;AAS7G,SAAS,YAAY,CACnB,IAAkC,EAClC,SAAgD;IAEhD,OAAO,kCAAkC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,iBAAiB,CACxB,UAAwC,EACxC,QAA2D;IAE3D,IAAI,UAAU,CAAC,eAAe,KAAK,qCAAqC,CAAC,QAAQ,EAAE,CAAC;QAClF,OAAO;YACL,UAAU;YACV,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,yCAAyC,CAAC,QAAQ;YAC5D,MAAM,EAAE,uCAAuC,CAAC,sBAAsB;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,2CAA2C,CAAC,UAAU,CAAC,yBAAyB,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAC,UAAU,EAAE,CAAC;QACxI,OAAO;YACL,UAAU;YACV,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,yCAAyC,CAAC,QAAQ;YAC5D,MAAM,EAAE,uCAAuC,CAAC,wBAAwB;SACzE,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,KAAK,0CAA0C,CAAC,MAAM,CAAC,EAAE,CAAC;QACxH,OAAO;YACL,UAAU;YACV,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,yCAAyC,CAAC,QAAQ;YAC5D,MAAM,EAAE,uCAAuC,CAAC,iBAAiB;SAClE,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,sCAAsC,CAAC,MAAM,CAAC,CAAC;IACtI,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,KAAK,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC;IAC1E,OAAO;QACL,UAAU;QACV,aAAa,EAAE,YAAY,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC;QAC1D,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,yCAAyC,CAAC,MAAM,CAAC,CAAC,CAAC,yCAAyC,CAAC,OAAO;QACzH,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,uCAAuC,CAAC,yBAAyB,CAAC,CAAC,CAAC,uCAAuC,CAAC,kBAAkB;KAClJ,CAAC;AACJ,CAAC;AAYD,2EAA2E;AAC3E,MAAM,UAAU,6CAA6C,CAC3D,KAAyD;IAEzD,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9G,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3I,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC1C,IAAI,SAAS,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QACrI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC5E,OAAO;YACL,GAAG,SAAS;YACZ,aAAa,EAAE,YAAY,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC;YAC/D,QAAQ,EAAE,yCAAyC,CAAC,MAAM;YAC1D,MAAM,EAAE,uCAAuC,CAAC,qBAAqB;SACtE,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IAClH,MAAM,SAAS,GAAsD,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,OAAO;QACrC,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB;;;;;WAKG;QACH,iBAAiB,EAAE,SAAS,CAAC,UAAU,CAAC,WAAW;QACnD,oBAAoB,EAAE,SAAS,CAAC,aAAa,EAAE,WAAW,IAAI,IAAI;KACnE,CAAC,CAAC,CAAC;IAEJ,OAAO,sDAAsD,CAAC;QAC5D,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,6BAA6B,CAAC,aAAa;QACpD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,kBAAkB,EAAE;YAClB,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,aAAa;YAC1C,OAAO,EAAE,KAAK,CAAC,iBAAiB,CAAC,iBAAiB;SACnD;QACD,KAAK;QACL,SAAS;KACV,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n  TechnicalDocumentationAssetAccessClass,\n  TechnicalDocumentationChannel,\n  TechnicalDocumentationEditorialStatus,\n  TechnicalDocumentationPublicationDecision,\n  TechnicalDocumentationPublicationReason,\n  TechnicalDocumentationSourceClassification,\n  createTechnicalDocumentationAuthorizedBundleManifestV1,\n  createTechnicalDocumentationUnitV1,\n  type TechnicalDocumentationAuthorizedBundleManifestV1,\n  type TechnicalDocumentationPrivateDerivationManifestV1,\n  type TechnicalDocumentationUnitPublicationDecisionV1,\n  type TechnicalDocumentationUnitV1,\n} from '@wildo-ai/saas-specifications/technical-documentation';\n\nimport { evaluateTechnicalDocumentationApplicability } from './technical-documentation-operational-evidence';\n\ninterface PolicyProjectionCandidate {\n  readonly sourceUnit: TechnicalDocumentationUnitV1;\n  readonly publishedUnit: TechnicalDocumentationUnitV1 | null;\n  readonly decision: TechnicalDocumentationPublicationDecision;\n  readonly reason: TechnicalDocumentationPublicationReason;\n}\n\nfunction recreateUnit(\n  unit: TechnicalDocumentationUnitV1,\n  overrides: Partial<TechnicalDocumentationUnitV1>,\n): TechnicalDocumentationUnitV1 {\n  return createTechnicalDocumentationUnitV1({ ...unit, ...overrides });\n}\n\n/**\n * Authorizes one unit for the public consumer portal.\n *\n * ONE rule set for every tier — engine pages, companion projections and the\n * chapters an application authors (#874). An authored chapter is withheld by the\n * same three checks as any other unit: not `APPROVED` (its author marked it a\n * draft), applicability not proven, or provenance not `PUBLIC` (its author\n * classified it `RESTRICTED`). There is deliberately no chapter-specific branch\n * here: a second gate for one tier is a gate that drifts from the first.\n *\n * Authenticated/internal publication lanes remain absent; a `RESTRICTED` chapter\n * is therefore withheld outright rather than routed to a private portal.\n */\nfunction projectPublicUnit(\n  sourceUnit: TechnicalDocumentationUnitV1,\n  manifest: TechnicalDocumentationPrivateDerivationManifestV1,\n): PolicyProjectionCandidate {\n  if (sourceUnit.editorialStatus !== TechnicalDocumentationEditorialStatus.APPROVED) {\n    return {\n      sourceUnit,\n      publishedUnit: null,\n      decision: TechnicalDocumentationPublicationDecision.SUPPRESS,\n      reason: TechnicalDocumentationPublicationReason.EDITORIAL_NOT_APPROVED,\n    };\n  }\n  if (!evaluateTechnicalDocumentationApplicability(sourceUnit.applicabilityRequirements, manifest.environmentEvidenceSnapshot).applicable) {\n    return {\n      sourceUnit,\n      publishedUnit: null,\n      decision: TechnicalDocumentationPublicationDecision.SUPPRESS,\n      reason: TechnicalDocumentationPublicationReason.APPLICABILITY_NOT_PROVEN,\n    };\n  }\n  if (sourceUnit.provenance.some((source) => source.classification !== TechnicalDocumentationSourceClassification.PUBLIC)) {\n    return {\n      sourceUnit,\n      publishedUnit: null,\n      decision: TechnicalDocumentationPublicationDecision.SUPPRESS,\n      reason: TechnicalDocumentationPublicationReason.RESTRICTED_SOURCE,\n    };\n  }\n\n  const assetRequests = sourceUnit.assetRequests.filter((asset) => asset.accessClass === TechnicalDocumentationAssetAccessClass.PUBLIC);\n  const redacted = assetRequests.length !== sourceUnit.assetRequests.length;\n  return {\n    sourceUnit,\n    publishedUnit: recreateUnit(sourceUnit, { assetRequests }),\n    decision: redacted ? TechnicalDocumentationPublicationDecision.REDACT : TechnicalDocumentationPublicationDecision.INCLUDE,\n    reason: redacted ? TechnicalDocumentationPublicationReason.RESTRICTED_ASSET_REDACTED : TechnicalDocumentationPublicationReason.INCLUDED_BY_POLICY,\n  };\n}\n\nexport interface ProjectTechnicalDocumentationAuthorizedBundleInput {\n  readonly privateDerivation: TechnicalDocumentationPrivateDerivationManifestV1;\n  readonly channel: TechnicalDocumentationChannel.PUBLIC_PORTAL;\n  readonly policyRef: string;\n  readonly policyVersion: number;\n  /** This bundle's own identity; the render manifest and the publication pointer name it. */\n  readonly bundleRef: string;\n  readonly bundleVersion: number;\n}\n\n/** Projects and minimizes the public framework bundle before rendering. */\nexport function projectTechnicalDocumentationAuthorizedBundle(\n  input: ProjectTechnicalDocumentationAuthorizedBundleInput,\n): TechnicalDocumentationAuthorizedBundleManifestV1 {\n  const initial = input.privateDerivation.units.map((unit) => projectPublicUnit(unit, input.privateDerivation));\n  const emittedUnitRefs = new Set(initial.flatMap((candidate) => candidate.publishedUnit === null ? [] : [candidate.publishedUnit.unitRef]));\n  const finalized = initial.map((candidate) => {\n    if (candidate.publishedUnit === null) return candidate;\n    const links = candidate.publishedUnit.links.filter((link) => link.targetUnitRef === null || emittedUnitRefs.has(link.targetUnitRef));\n    if (links.length === candidate.publishedUnit.links.length) return candidate;\n    return {\n      ...candidate,\n      publishedUnit: recreateUnit(candidate.publishedUnit, { links }),\n      decision: TechnicalDocumentationPublicationDecision.REDACT,\n      reason: TechnicalDocumentationPublicationReason.ACCESS_CLASS_MISMATCH,\n    };\n  });\n  const units = finalized.flatMap((candidate) => candidate.publishedUnit === null ? [] : [candidate.publishedUnit]);\n  const decisions: TechnicalDocumentationUnitPublicationDecisionV1[] = finalized.map((candidate) => ({\n    unitRef: candidate.sourceUnit.unitRef,\n    decision: candidate.decision,\n    reason: candidate.reason,\n    /*\n     * Both versions name the SAME unit version, and that is correct: a redaction narrows a unit's\n     * content without minting a new authored version. `decision` is what distinguishes INCLUDE\n     * from REDACT — it always was; the digest pair merely made the difference visible as two hex\n     * strings nobody could read.\n     */\n    sourceUnitVersion: candidate.sourceUnit.unitVersion,\n    publishedUnitVersion: candidate.publishedUnit?.unitVersion ?? null,\n  }));\n\n  return createTechnicalDocumentationAuthorizedBundleManifestV1({\n    schemaVersion: 1,\n    channel: TechnicalDocumentationChannel.PUBLIC_PORTAL,\n    policyRef: input.policyRef,\n    policyVersion: input.policyVersion,\n    bundleRef: input.bundleRef,\n    bundleVersion: input.bundleVersion,\n    derivationIdentity: {\n      ref: input.privateDerivation.derivationRef,\n      version: input.privateDerivation.derivationVersion,\n    },\n    units,\n    decisions,\n  });\n}\n"]}

package/dist/esm/companion/content/application-consumer-documentation-content-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-consumer-documentation-content-loader.d.ts","sourceRoot":"","sources":["../../../../src/companion/content/application-consumer-documentation-content-loader.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,mDAAmD,EACxD,KAAK,4CAA4C,EACjD,KAAK,yBAAyB,EAC/B,MAAM,uDAAuD,CAAC;AAG/D,OAAO,EAKL,KAAK,iDAAiD,EACtD,KAAK,qDAAqD,EAE1D,gDAAgD,EAChD,KAAK,iDAAiD,EACtD,KAAK,qDAAqD,EAC3D,MAAM,2EAA2E,CAAC;AAoEnF,iGAAiG;AACjG,wBAAgB,uDAAuD,CACrE,eAAe,EAAE,SAAS,iDAAiD,EAAE,EAC7E,WAAW,EAAE,MAAM,EACnB,oBAAoB,SAAI,GACvB,iDAAiD,CA2CnD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sDAAsD;;;;;;;;;;;;;;;;;;CAGlE,CAAC;AAEF,MAAM,WAAW,mDAAmD;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,gDAAgD,CAAC;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,qDAAqD;IACpE,QAAQ,CAAC,QAAQ,EAAE,mDAAmD,CAAC;IACvE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,iDAAiD,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,GAAG;QACxG,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,CAAC,qDAAqD,CAAC,EAAE,CAAC;QAC3F,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,qDAAqD,EAAE,YAAY,GAAG,cAAc,CAAC,CAAC,GAAG;YAC/H,QAAQ,CAAC,UAAU,EAAE,SAAS,yBAAyB,EAAE,CAAC;YAC1D,QAAQ,CAAC,YAAY,EAAE,SAAS,4CAA4C,EAAE,CAAC;SAChF,CAAC,EAAE,CAAC;KACN,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,SAAS,mDAAmD,EAAE,CAAC;IAC/E,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;CACnD;AA4BD,kFAAkF;AAClF,wBAAgB,mDAAmD,CACjE,aAAa,GAAE,OAAgE,EAC/E,oBAAoB,GAAE,SAAS,iDAAiD,EAA2D,GAC1I,qDAAqD,CA0CvD"}
+{"version":3,"file":"application-consumer-documentation-content-loader.d.ts","sourceRoot":"","sources":["../../../../../src/companion/content/application-consumer-documentation-content-loader.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,mDAAmD,EACxD,KAAK,4CAA4C,EACjD,KAAK,yBAAyB,EAC/B,MAAM,uDAAuD,CAAC;AAG/D,OAAO,EAKL,KAAK,iDAAiD,EACtD,KAAK,qDAAqD,EAE1D,gDAAgD,EAChD,KAAK,iDAAiD,EACtD,KAAK,qDAAqD,EAC3D,MAAM,2EAA2E,CAAC;AAoEnF,iGAAiG;AACjG,wBAAgB,uDAAuD,CACrE,eAAe,EAAE,SAAS,iDAAiD,EAAE,EAC7E,WAAW,EAAE,MAAM,EACnB,oBAAoB,SAAI,GACvB,iDAAiD,CA2CnD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sDAAsD;;;;;;;;;;;;;;;;;;CAGlE,CAAC;AAEF,MAAM,WAAW,mDAAmD;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,gDAAgD,CAAC;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,qDAAqD;IACpE,QAAQ,CAAC,QAAQ,EAAE,mDAAmD,CAAC;IACvE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,iDAAiD,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,GAAG;QACxG,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,CAAC,qDAAqD,CAAC,EAAE,CAAC;QAC3F,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,qDAAqD,EAAE,YAAY,GAAG,cAAc,CAAC,CAAC,GAAG;YAC/H,QAAQ,CAAC,UAAU,EAAE,SAAS,yBAAyB,EAAE,CAAC;YAC1D,QAAQ,CAAC,YAAY,EAAE,SAAS,4CAA4C,EAAE,CAAC;SAChF,CAAC,EAAE,CAAC;KACN,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,SAAS,mDAAmD,EAAE,CAAC;IAC/E,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;CACnD;AA4BD,kFAAkF;AAClF,wBAAgB,mDAAmD,CACjE,aAAa,GAAE,OAAgE,EAC/E,oBAAoB,GAAE,SAAS,iDAAiD,EAA2D,GAC1I,qDAAqD,CA0CvD"}

package/dist/esm/companion/index.d.ts

@@ -32,10 +32,12 @@ export * from './rendering/technical-documentation-render-model';
 export * from './rendering/technical-documentation-search-index-renderer';
 export * from './application-documentation/technical-documentation-engine-content-bundle';
 export * from './application-documentation/application-domain-documentation';
+export * from './application-documentation/application-documentation-chapters';
 export * from './application-documentation/application-integration-documentation';
 export * from './application-documentation/application-administration-documentation';
 export * from './application-documentation/application-authentication-documentation';
 export * from './application-documentation/application-connection-documentation';
+export * from './application-documentation/docs-api-origin-substitution';
 export * from './application-documentation/application-organization-role-documentation';
 export * from './application-documentation/application-organization-unit-resource-documentation';
 export * from './application-documentation/technical-documentation-operational-evidence';

package/dist/esm/companion/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/companion/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sCAAsC,CAAC;AACrD,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6DAA6D,CAAC;AAC5E,cAAc,kDAAkD,CAAC;AACjE,cAAc,sCAAsC,CAAC;AACrD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,oDAAoD,CAAC;AACnE,cAAc,8DAA8D,CAAC;AAC7E,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,sDAAsD,CAAC;AACrE,cAAc,kDAAkD,CAAC;AACjE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,2EAA2E,CAAC;AAC1F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,mEAAmE,CAAC;AAClF,cAAc,sEAAsE,CAAC;AACrF,cAAc,sEAAsE,CAAC;AACrF,cAAc,kEAAkE,CAAC;AACjF,cAAc,yEAAyE,CAAC;AACxF,cAAc,kFAAkF,CAAC;AACjG,cAAc,0EAA0E,CAAC;AACzF,cAAc,wEAAwE,CAAC;AACvF,cAAc,wEAAwE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/companion/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sCAAsC,CAAC;AACrD,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6DAA6D,CAAC;AAC5E,cAAc,kDAAkD,CAAC;AACjE,cAAc,sCAAsC,CAAC;AACrD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,oDAAoD,CAAC;AACnE,cAAc,8DAA8D,CAAC;AAC7E,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,sDAAsD,CAAC;AACrE,cAAc,kDAAkD,CAAC;AACjE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,2EAA2E,CAAC;AAC1F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mEAAmE,CAAC;AAClF,cAAc,sEAAsE,CAAC;AACrF,cAAc,sEAAsE,CAAC;AACrF,cAAc,kEAAkE,CAAC;AACjF,cAAc,0DAA0D,CAAC;AACzE,cAAc,yEAAyE,CAAC;AACxF,cAAc,kFAAkF,CAAC;AACjG,cAAc,0EAA0E,CAAC;AACzF,cAAc,wEAAwE,CAAC;AACvF,cAAc,wEAAwE,CAAC"}

package/dist/esm/companion/index.js

@@ -32,10 +32,12 @@ export * from './rendering/technical-documentation-render-model.js';
 export * from './rendering/technical-documentation-search-index-renderer.js';
 export * from './application-documentation/technical-documentation-engine-content-bundle.js';
 export * from './application-documentation/application-domain-documentation.js';
+export * from './application-documentation/application-documentation-chapters.js';
 export * from './application-documentation/application-integration-documentation.js';
 export * from './application-documentation/application-administration-documentation.js';
 export * from './application-documentation/application-authentication-documentation.js';
 export * from './application-documentation/application-connection-documentation.js';
+export * from './application-documentation/docs-api-origin-substitution.js';
 export * from './application-documentation/application-organization-role-documentation.js';
 export * from './application-documentation/application-organization-unit-resource-documentation.js';
 export * from './application-documentation/technical-documentation-operational-evidence.js';

package/dist/esm/companion/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/companion/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sCAAsC,CAAC;AACrD,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6DAA6D,CAAC;AAC5E,cAAc,kDAAkD,CAAC;AACjE,cAAc,sCAAsC,CAAC;AACrD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,oDAAoD,CAAC;AACnE,cAAc,8DAA8D,CAAC;AAC7E,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,sDAAsD,CAAC;AACrE,cAAc,kDAAkD,CAAC;AACjE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,2EAA2E,CAAC;AAC1F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,mEAAmE,CAAC;AAClF,cAAc,sEAAsE,CAAC;AACrF,cAAc,sEAAsE,CAAC;AACrF,cAAc,kEAAkE,CAAC;AACjF,cAAc,yEAAyE,CAAC;AACxF,cAAc,kFAAkF,CAAC;AACjG,cAAc,0EAA0E,CAAC;AACzF,cAAc,wEAAwE,CAAC;AACvF,cAAc,wEAAwE,CAAC","sourcesContent":["/**\n * `@wildo-ai/saas-technical-doc/companion` — implementation surface.\n *\n * Pure-function OpenAPI projection, its input contract, and Node-side verification/materialization utilities for an exact engine-owned\n * application-consumer documentation content bundle. Consumed by:\n *   - `examples/<app>/.wildo-saas/wildo-dev-companion/` controllers\n *     that call `generateOpenApiDocuments(input)` to produce\n *     the normal and application-administration YAML/JSON OpenAPI documents.\n *\n * @wildo-boundary\n *   Re-exports only companion-side OpenAPI and application-consumer content projection surfaces. All are React-free; the content loader is Node-only and\n *   never enters the browser runtime closure. Reusable authored content and portable identities are owned by the separate `./content`\n *   entry point.\n */\n\nexport * from './operation-projection.schemas';\nexport * from './openapi-generator';\nexport * from './manual-controller-route-projection';\nexport * from './publish-result.types';\nexport * from './zod-to-openapi';\nexport * from './spec-to-operation-doc';\nexport * from './content/application-consumer-documentation-content-loader';\nexport * from './technical-documentation-capture-execution-port';\nexport * from './technical-documentation-asset-path';\nexport * from './technical-documentation-diagram-materializer';\nexport * from './technical-documentation-placeholder-materializer';\nexport * from './rendering/technical-documentation-authorized-bundle-reader';\nexport * from './rendering/technical-documentation-docusaurus-renderer';\nexport * from './rendering/technical-documentation-build-measurement';\nexport * from './rendering/technical-documentation-managed-tree-validator';\nexport * from './rendering/technical-documentation-openapi-renderer';\nexport * from './rendering/technical-documentation-render-model';\nexport * from './rendering/technical-documentation-search-index-renderer';\nexport * from './application-documentation/technical-documentation-engine-content-bundle';\nexport * from './application-documentation/application-domain-documentation';\nexport * from './application-documentation/application-integration-documentation';\nexport * from './application-documentation/application-administration-documentation';\nexport * from './application-documentation/application-authentication-documentation';\nexport * from './application-documentation/application-connection-documentation';\nexport * from './application-documentation/application-organization-role-documentation';\nexport * from './application-documentation/application-organization-unit-resource-documentation';\nexport * from './application-documentation/technical-documentation-operational-evidence';\nexport * from './application-documentation/technical-documentation-private-derivation';\nexport * from './application-documentation/technical-documentation-publication-policy';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/companion/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qBAAqB,CAAC;AACpC,cAAc,sCAAsC,CAAC;AACrD,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6DAA6D,CAAC;AAC5E,cAAc,kDAAkD,CAAC;AACjE,cAAc,sCAAsC,CAAC;AACrD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,oDAAoD,CAAC;AACnE,cAAc,8DAA8D,CAAC;AAC7E,cAAc,yDAAyD,CAAC;AACxE,cAAc,uDAAuD,CAAC;AACtE,cAAc,4DAA4D,CAAC;AAC3E,cAAc,sDAAsD,CAAC;AACrE,cAAc,kDAAkD,CAAC;AACjE,cAAc,2DAA2D,CAAC;AAC1E,cAAc,2EAA2E,CAAC;AAC1F,cAAc,8DAA8D,CAAC;AAC7E,cAAc,gEAAgE,CAAC;AAC/E,cAAc,mEAAmE,CAAC;AAClF,cAAc,sEAAsE,CAAC;AACrF,cAAc,sEAAsE,CAAC;AACrF,cAAc,kEAAkE,CAAC;AACjF,cAAc,0DAA0D,CAAC;AACzE,cAAc,yEAAyE,CAAC;AACxF,cAAc,kFAAkF,CAAC;AACjG,cAAc,0EAA0E,CAAC;AACzF,cAAc,wEAAwE,CAAC;AACvF,cAAc,wEAAwE,CAAC","sourcesContent":["/**\n * `@wildo-ai/saas-technical-doc/companion` — implementation surface.\n *\n * Pure-function OpenAPI projection, its input contract, and Node-side verification/materialization utilities for an exact engine-owned\n * application-consumer documentation content bundle. Consumed by:\n *   - `examples/<app>/.wildo-saas/wildo-dev-companion/` controllers\n *     that call `generateOpenApiDocuments(input)` to produce\n *     the normal and application-administration YAML/JSON OpenAPI documents.\n *\n * @wildo-boundary\n *   Re-exports only companion-side OpenAPI and application-consumer content projection surfaces. All are React-free; the content loader is Node-only and\n *   never enters the browser runtime closure. Reusable authored content and portable identities are owned by the separate `./content`\n *   entry point.\n */\n\nexport * from './operation-projection.schemas';\nexport * from './openapi-generator';\nexport * from './manual-controller-route-projection';\nexport * from './publish-result.types';\nexport * from './zod-to-openapi';\nexport * from './spec-to-operation-doc';\nexport * from './content/application-consumer-documentation-content-loader';\nexport * from './technical-documentation-capture-execution-port';\nexport * from './technical-documentation-asset-path';\nexport * from './technical-documentation-diagram-materializer';\nexport * from './technical-documentation-placeholder-materializer';\nexport * from './rendering/technical-documentation-authorized-bundle-reader';\nexport * from './rendering/technical-documentation-docusaurus-renderer';\nexport * from './rendering/technical-documentation-build-measurement';\nexport * from './rendering/technical-documentation-managed-tree-validator';\nexport * from './rendering/technical-documentation-openapi-renderer';\nexport * from './rendering/technical-documentation-render-model';\nexport * from './rendering/technical-documentation-search-index-renderer';\nexport * from './application-documentation/technical-documentation-engine-content-bundle';\nexport * from './application-documentation/application-domain-documentation';\nexport * from './application-documentation/application-documentation-chapters';\nexport * from './application-documentation/application-integration-documentation';\nexport * from './application-documentation/application-administration-documentation';\nexport * from './application-documentation/application-authentication-documentation';\nexport * from './application-documentation/application-connection-documentation';\nexport * from './application-documentation/docs-api-origin-substitution';\nexport * from './application-documentation/application-organization-role-documentation';\nexport * from './application-documentation/application-organization-unit-resource-documentation';\nexport * from './application-documentation/technical-documentation-operational-evidence';\nexport * from './application-documentation/technical-documentation-private-derivation';\nexport * from './application-documentation/technical-documentation-publication-policy';\n"]}

package/dist/esm/companion/manual-controller-route-projection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manual-controller-route-projection.d.ts","sourceRoot":"","sources":["../../../src/companion/manual-controller-route-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAOL,0BAA0B,EAG3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EAOL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,gCAAgC,CAAC;AA0BxC;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,GAAG,MAAM,CAG1G;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,0BAA0B,EAAE,uBAAuB,CAoBtG,CAAC;AAQF;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,IAAI;IACxD,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B,CA4FA"}
+{"version":3,"file":"manual-controller-route-projection.d.ts","sourceRoot":"","sources":["../../../../src/companion/manual-controller-route-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAOL,0BAA0B,EAG3B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,uBAAuB,EACxB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EAOL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,gCAAgC,CAAC;AA0BxC;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,GAAG,MAAM,CAG1G;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,0BAA0B,EAAE,uBAAuB,CAoBtG,CAAC;AAQF;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,IAAI;IACxD,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B,CA4FA"}

package/dist/esm/companion/manual-controller-route-projection.js.map

@@ -1 +1 @@
-{"version":3,"file":"manual-controller-route-projection.js","sourceRoot":"","sources":["../../../src/companion/manual-controller-route-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,qCAAqC,EACrC,0CAA0C,EAC1C,6BAA6B,EAC7B,mCAAmC,EACnC,0BAA0B,EAC1B,wBAAwB,EACxB,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,wCAAwC,EACxC,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EACL,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,GAI/B,MAAM,gCAAgC,CAAC;AAExC,uGAAuG;AACvG,MAAM,iCAAiC,GAAuF;IAC5H,CAAC,mCAAmC,CAAC,MAAM,CAAC,EAAE,qCAAqC,CAAC,MAAM;IAC1F,CAAC,mCAAmC,CAAC,iBAAiB,CAAC,EAAE,qCAAqC,CAAC,iBAAiB;IAChH,CAAC,mCAAmC,CAAC,aAAa,CAAC,EAAE,qCAAqC,CAAC,aAAa;IACxG,CAAC,mCAAmC,CAAC,0BAA0B,CAAC,EAAE,qCAAqC,CAAC,0BAA0B;CACnI,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAiF;IAC5G,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,2BAA2B,CAAC,GAAG;IACjD,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,IAAI;IACnD,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,2BAA2B,CAAC,GAAG;IACjD,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,2BAA2B,CAAC,KAAK;IACrD,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,2BAA2B,CAAC,MAAM;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAgB,EAAE,KAAiC;IAChG,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClF,OAAO,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAgE;IACzG,yEAAyE;IACzE,CAAC,0BAA0B,CAAC,cAAc,CAAC,EAAE,uBAAuB,CAAC,IAAI;IACzE,mGAAmG;IACnG,8FAA8F;IAC9F,gCAAgC;IAChC,CAAC,0BAA0B,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC,IAAI;IAC5E,kGAAkG;IAClG,8BAA8B;IAC9B,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC,IAAI;IAC7E,8FAA8F;IAC9F,iCAAiC;IACjC,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC,YAAY;IACnF,iGAAiG;IACjG,gFAAgF;IAChF,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,uBAAuB,CAAC,KAAK;IACzE,kGAAkG;IAClG,gGAAgG;IAChG,yDAAyD;IACzD,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,EAAE,uBAAuB,CAAC,YAAY;CACvF,CAAC;AAEF,SAAS,wBAAwB,CAAC,KAAiC;IACjE,MAAM,SAAS,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;IAC1E,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC;AAC/F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sCAAsC;IAIpD,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEzD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC/D,MAAM,aAAa,GAAG,qCAAqC,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,aAAa,CAAC,WAAW,KAAK,gCAAgC,CAAC,SAAS;YAAE,SAAS;QACvF,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,GAAG,kBAAkB,GAAG,qBAAqB,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,uBAAuB,GAAG,8BAA8B,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAiC;YAC3C,kBAAkB,EAAE,iCAAiC,CAAC,aAAa,CAAC,cAAc,CAAC;YACnF,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;YAC1D;;;;;eAKG;YACH,gBAAgB,EAAE,EAAE;SACrB,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;YACjD;;;;;eAKG;YACH,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,GAAG,uBAAuB,IAAI,MAAM,EAAE;gBACxC,CAAC,CAAC,uBAAuB,CAAC;YAE5B,UAAU,CAAC,IAAI,CAAC;gBACd,kBAAkB,EAAE,aAAa,CAAC,KAAK;gBACvC,YAAY;gBACZ,uBAAuB;gBACvB,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,8BAA8B,CAAC,QAAQ;gBACpD,QAAQ;gBACR,IAAI;gBACJ;;;;;mBAKG;gBACH,YAAY,EAAE,+BAA+B,CAAC,WAAW;gBACzD;;;;mBAIG;gBACH,kBAAkB,EAAE,cAAc,CAAC,aAAa;gBAChD,QAAQ,EAAE,8BAA8B,CAAC;oBACvC,kBAAkB,EAAE,aAAa,CAAC,KAAK;oBACvC,uBAAuB;oBACvB,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,8BAA8B,CAAC,QAAQ;oBACpD,QAAQ;oBACR,IAAI;iBACL,CAAC;gBACF,KAAK,EAAE,EAAE;gBACT,MAAM;gBACN;;;;mBAIG;gBACH,sBAAsB,EAAE,KAAK;gBAC7B,sFAAsF;gBACtF,cAAc,EAAE,KAAK;gBACrB,OAAO,EAAE,aAAa,CAAC,OAAO;gBAC9B,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,iBAAiB,EAAE,IAAI;gBACvB,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;aAC7G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAkB,CAAC,GAAG,UAAU,CAAC;SAChD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;SACzD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,0CAA0C,CAAC,KAAK,CAAC;QAC9D,QAAQ,EAAE,wBAAwB,CAAC,KAAK,CAAC;KAC1C,CAAC,CAAC,CAAC;IAEN,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACtC,CAAC","sourcesContent":["/**\n * The application's manually mounted controller routes, projected into the same shape the resource\n * registry produces — so they reach the generated API reference through the existing generator with\n * no change to it.\n *\n * ## The gap this closes\n *\n * A Wildo application serves two disjoint families of HTTP routes. The RESOURCE REGISTRY builds one\n * family from the resource configurations, and every mechanism downstream projects that family and\n * only that family. The other family is mounted by hand, controller by controller, from\n * `MANUAL_CONTROLLER_ROUTES_URLS`: sign-in, token refresh, MFA, passkeys, SAML, the OAuth 2.0\n * authorization-server endpoints, the Model Context Protocol and Agent2Agent doors, file transfer,\n * i18n labels, charts.\n *\n * Nothing projected the second family. Measured 2026-09-09 across the four committed documents of\n * the two dogfood applications — 439, 576, 146 and 160 paths — **not one contained a single path\n * under `/auth`**. The reference explained the three credential formats every operation accepts and\n * never published the endpoint that issues one. Worse, four operation-header descriptions in the\n * same document told a reader the step-up token is \"obtained from `POST /api/v1/auth/reauth`\", a\n * path that document does not contain: the reference already pointed at this hole and could not\n * fill it.\n *\n * ## Why this lives HERE and not in the companion projector\n *\n * The companion's `openapi-generation-input` projector walks the APPLICATION's resolved registry, so\n * it must run inside the introspection subprocess with the app's schema graph loaded. This\n * projection needs none of that: the manual routes are the ENGINE's own contract, identical in every\n * generated application, and the catalog that describes them is a static table in\n * `@wildo-ai/saas-models`. Keeping it beside the generator makes it a pure function of framework\n * knowledge — testable on its own, like `SECURITY_SCHEMES` and the API-conventions markdown that\n * already live here — instead of one more thing the subprocess owns.\n *\n * ## Why the generator needed no change\n *\n * `generateOpenApiDocuments` is a pure function over `OpenApiGenerationInput`. It groups by\n * `resourceIdentifier`, keys path items on `path` + `httpVerb`, and emits whatever identity a\n * projection carries; it has no opinion about where a projected operation came from. So a manual\n * route reaches the document as an ordinary `OperationProjection` whose `resourceIdentifier` is its\n * documentation GROUP, accompanied by a matching `ResourceTag` — which is the join the renderer's\n * conservation check makes.\n *\n * ## What a manual projection deliberately does NOT carry\n *\n * `requestBodySchema` and `responseBodySchema` stay `null`. Those bodies are Zod schemas declared\n * inside backend controllers, in a package neither this one nor the introspection subprocess loads;\n * hand-copying them into the catalog would create a second copy of a contract with nothing checking\n * the two agree — the drift this repository refuses everywhere else. Each catalog entry authors a\n * `responseStatuses` row instead (without one the generator emits a bare `204 No Content`, which is\n * wrong for almost every route here) and describes its payload in prose. That is an honest account of\n * what is known, and it is strictly better than a reference in which the endpoint does not exist.\n * Projecting the real schemas is a later, larger change that must first move them into a shared\n * module.\n */\n\nimport {\n  HttpMethod,\n  MAIN_API_BASE_PATH,\n  MANUAL_CONTROLLER_ROUTE_DOCUMENTATION,\n  MANUAL_CONTROLLER_ROUTE_GROUP_DESCRIPTIONS,\n  MANUAL_CONTROLLER_ROUTES_URLS,\n  ManualControllerRouteAuthentication,\n  ManualControllerRouteGroup,\n  ManualControllerRouteKey,\n  ManualControllerRoutePublication,\n} from '@wildo-ai/saas-models';\n\nimport {\n  ENGINE_RESOURCE_SUB_DOMAIN_DOCUMENTATION,\n  EngineResourceSubDomain,\n} from '@wildo-ai/saas-specifications';\n\nimport { OpenApiSection } from '../openapi/openapi-generation-output.schemas';\nimport {\n  createOpenApiOperationIdentity,\n  OperationProjectionAuthenticationMode,\n  OperationProjectionHttpVerb,\n  OperationProjectionPrimaryScope,\n  OperationProjectionVariantType,\n  type OperationAccessDocumentation,\n  type OperationProjection,\n  type ResourceTag,\n} from './operation-projection.schemas';\n\n/** Catalog vocabulary → the projection's own authentication vocabulary. Total over the source enum. */\nconst MANUAL_ROUTE_AUTHENTICATION_MODES: Record<ManualControllerRouteAuthentication, OperationProjectionAuthenticationMode> = {\n  [ManualControllerRouteAuthentication.PUBLIC]: OperationProjectionAuthenticationMode.PUBLIC,\n  [ManualControllerRouteAuthentication.ANONYMOUS_SESSION]: OperationProjectionAuthenticationMode.ANONYMOUS_SESSION,\n  [ManualControllerRouteAuthentication.AUTHENTICATED]: OperationProjectionAuthenticationMode.AUTHENTICATED,\n  [ManualControllerRouteAuthentication.ANONYMOUS_OR_AUTHENTICATED]: OperationProjectionAuthenticationMode.ANONYMOUS_OR_AUTHENTICATED,\n};\n\n/**\n * `HttpMethod` → the OpenAPI path-item key.\n *\n * `HttpMethod.OPTIONS` is deliberately excluded. OpenAPI does define an `options` path-item key, but\n * no manual route mounts one — CORS preflight is answered by middleware rather than by a route — so\n * admitting it here would be inventing a case. A catalog entry that named `OPTIONS` fails to compile\n * against this map, which is the right moment to find out.\n */\nconst MANUAL_ROUTE_HTTP_VERBS: Record<Exclude<HttpMethod, HttpMethod.OPTIONS>, OperationProjectionHttpVerb> = {\n  [HttpMethod.GET]: OperationProjectionHttpVerb.GET,\n  [HttpMethod.POST]: OperationProjectionHttpVerb.POST,\n  [HttpMethod.PUT]: OperationProjectionHttpVerb.PUT,\n  [HttpMethod.PATCH]: OperationProjectionHttpVerb.PATCH,\n  [HttpMethod.DELETE]: OperationProjectionHttpVerb.DELETE,\n};\n\n/**\n * Express `:param` → OpenAPI `{param}`.\n *\n * The resource lane never needs this: its URL builder already emits brace form. The manual registry\n * is the backend's own mount table, written the way Express reads it, so the conversion belongs at\n * this boundary rather than in the registry — which the router consumes verbatim and must not have\n * rewritten under it.\n */\nexport function toOpenApiPathTemplate(expressPath: string): string {\n  return expressPath.replace(/:([A-Za-z0-9_]+)/gu, '{$1}');\n}\n\n/**\n * The operation identifier for one manual route — derived, never authored.\n *\n * `buildOperationId` composes `<verb><Resource>` and drops the resource noun when the verb phrase\n * already contains it. Starting the identifier WITH the group name is what triggers that drop, so\n * `AUTH_IDENTIFY` in the `authentication` group reads `authenticationIdentify` rather than the\n * stuttering `authIdentifyAuthentication`. Derived rather than authored so a route key added\n * tomorrow gets a coherent, stable id without anybody having to think about it.\n */\nexport function manualRouteOperationIdentifier(routeKey: string, group: ManualControllerRouteGroup): string {\n  const words = routeKey.toLowerCase().split('_').filter((word) => word.length > 0);\n  return group + words.map((word) => `${word.charAt(0).toUpperCase()}${word.slice(1)}`).join('');\n}\n\n/**\n * The API-reference group each manual-route group belongs to — the SAME vocabulary the engine's own\n * resources are classified by.\n *\n * ## Why these join the engine's categories instead of forming their own\n *\n * A tag with no category is not merely ungrouped: `applyApiReferenceResourceCategories` REFUSES the\n * publication of any application that declares `apiReferenceResourceCategories` at all, naming every\n * tag no category claims. So six uncategorised groups would have turned \"the auth endpoints are\n * missing from the reference\" into \"the reference does not publish\", for every application with an\n * authored taxonomy — a worse failure than the one this projection fixes.\n *\n * Categorising them as their OWN groups was the alternative and is rejected: the renderer groups by\n * category, so `authentication` (54 routes) would sit as a sibling of `auth` (the SSO, SCIM, session\n * and token RESOURCES), and a reader looking for authentication would find it split across two\n * adjacent headings for no reason they could see. The endpoint that issues a token and the resource\n * that configures how tokens are issued belong under one heading.\n *\n * TOTAL over {@link ManualControllerRouteGroup}: a new group is a compile error until it is placed.\n * That is the same guarantee the route catalog itself carries, and for the same reason — a group\n * that nobody remembered to classify is a publication failure in an application nobody has run yet.\n */\nexport const MANUAL_ROUTE_GROUP_SUB_DOMAINS: Record<ManualControllerRouteGroup, EngineResourceSubDomain> = {\n  // Sessions, MFA, SSO and consumable tokens — the sub-domain's own words.\n  [ManualControllerRouteGroup.AUTHENTICATION]: EngineResourceSubDomain.AUTH,\n  // The application acting as an OAuth 2.0 authorization server. Opposite direction from signing in,\n  // same subject: `auth` names OAuth explicitly, and its OAuth-client resources are the records\n  // these endpoints authenticate.\n  [ManualControllerRouteGroup.IDENTITY_PROVIDER]: EngineResourceSubDomain.AUTH,\n  // \"…and what they may delegate\" is `auth`'s own scope, and the provider-credential resources this\n  // group mints live there too.\n  [ManualControllerRouteGroup.CONNECTED_ACCOUNTS]: EngineResourceSubDomain.AUTH,\n  // MCP and A2A are the doors autonomous software knocks on; `flows-actors` is \"work that runs:\n  // flows, actors, tasks, agents\".\n  [ManualControllerRouteGroup.AGENT_INTERFACES]: EngineResourceSubDomain.FLOWS_ACTORS,\n  // \"Uploaded bytes and the metadata that links them to a domain row\" — and these routes address a\n  // stored file by its own id, so they belong beside the file metadata resources.\n  [ManualControllerRouteGroup.FILE_TRANSFER]: EngineResourceSubDomain.FILES,\n  // Reads a client makes about THIS APPLICATION: its resolved features, its labels, its chart data.\n  // `applications` is the sub-domain whose subject is the application itself; `features` is about\n  // the feature RECORDS, which are resources of their own.\n  [ManualControllerRouteGroup.APPLICATION_RUNTIME]: EngineResourceSubDomain.APPLICATIONS,\n};\n\nfunction manualRouteGroupCategory(group: ManualControllerRouteGroup) {\n  const subDomain = MANUAL_ROUTE_GROUP_SUB_DOMAINS[group];\n  const documentation = ENGINE_RESOURCE_SUB_DOMAIN_DOCUMENTATION[subDomain];\n  return { id: subDomain, label: documentation.label, description: documentation.description };\n}\n\n/**\n * Every PUBLISHED manual route as an `OperationProjection`, plus the `ResourceTag` for each group\n * that contributed one.\n *\n * Pure and argument-free: the manual route table is framework knowledge, identical in every\n * generated application, so there is nothing about a particular application to pass in. Withheld\n * routes are skipped here and nowhere else — the catalog is the single place a publication decision\n * is recorded, and it requires a written reason for each one.\n */\nexport function projectManualControllerRouteOperations(): {\n  operations: OperationProjection[];\n  resourceTags: ResourceTag[];\n} {\n  const operations: OperationProjection[] = [];\n  const usedGroups = new Set<ManualControllerRouteGroup>();\n\n  for (const routeKey of Object.values(ManualControllerRouteKey)) {\n    const documentation = MANUAL_CONTROLLER_ROUTE_DOCUMENTATION[routeKey];\n    if (documentation.publication !== ManualControllerRoutePublication.PUBLISHED) continue;\n    usedGroups.add(documentation.group);\n\n    const path = `${MAIN_API_BASE_PATH}${toOpenApiPathTemplate(MANUAL_CONTROLLER_ROUTES_URLS[routeKey])}`;\n    const baseOperationIdentifier = manualRouteOperationIdentifier(routeKey, documentation.group);\n    const access: OperationAccessDocumentation = {\n      authenticationMode: MANUAL_ROUTE_AUTHENTICATION_MODES[documentation.authentication],\n      authenticationSummary: documentation.authenticationSummary,\n      /*\n       * Empty on purpose. A manual route is not gated by the resource role vocabulary — its\n       * authorization is enforced inside its own handler, and for most of them there is no role at\n       * all because the caller has no session yet. Inventing a role here would put a requirement in\n       * the reference that no role table backs, which is worse than saying nothing.\n       */\n      roleRequirements: [],\n    };\n\n    for (const method of documentation.methods) {\n      const httpVerb = MANUAL_ROUTE_HTTP_VERBS[method];\n      /*\n       * One key can mount several methods — RFC 7592 defines ONE client-configuration endpoint whose\n       * method selects the operation, and `/mcp` answers three. `operationId` must be unique across\n       * the document, so the verb becomes a qualifier exactly when there is more than one method; a\n       * single-method route keeps the clean name.\n       */\n      const operationKey = documentation.methods.length > 1\n        ? `${baseOperationIdentifier}_${method}`\n        : baseOperationIdentifier;\n\n      operations.push({\n        resourceIdentifier: documentation.group,\n        operationKey,\n        baseOperationIdentifier,\n        variantKey: null,\n        variantType: OperationProjectionVariantType.API_CALL,\n        httpVerb,\n        path,\n        /*\n         * Inert in the generator — sectioning is `consumerApiSection` and security is `access` — but\n         * the projection contract requires it. `APPLICATION` is the truthful answer for every manual\n         * route, including the two whose URL carries an organization segment: there the organization\n         * is an argument to the call, not the scope the caller is acting within.\n         */\n        primaryScope: OperationProjectionPrimaryScope.APPLICATION,\n        /*\n         * Never the administration section. These routes are how ANY caller authenticates, connects\n         * or discovers, so filing them under application administration would move sign-in out of\n         * the document integrators actually read.\n         */\n        consumerApiSection: OpenApiSection.API_REFERENCE,\n        identity: createOpenApiOperationIdentity({\n          resourceIdentifier: documentation.group,\n          baseOperationIdentifier,\n          variantKey: null,\n          variantType: OperationProjectionVariantType.API_CALL,\n          httpVerb,\n          path,\n        }),\n        roles: [],\n        access,\n        /*\n         * These surfaces accept an API key wherever they accept a bearer token; nothing narrows any\n         * of them to a bearer-only lane, so removing the API-key alternative would document a\n         * refusal the runtime does not make.\n         */\n        isApiKeyAccessDisabled: false,\n        /* Optimistic locking is a resource-repository capability. No manual route has one. */\n        acceptsIfMatch: false,\n        summary: documentation.summary,\n        description: documentation.description,\n        requestBodySchema: null,\n        responseBodySchema: null,\n        responseStatuses: [{ code: documentation.successStatus.code, meaning: documentation.successStatus.meaning }],\n      });\n    }\n  }\n\n  const resourceTags: ResourceTag[] = [...usedGroups]\n    .sort((left, right) => left.localeCompare(right, 'en-US'))\n    .map((group) => ({\n      name: group,\n      description: MANUAL_CONTROLLER_ROUTE_GROUP_DESCRIPTIONS[group],\n      category: manualRouteGroupCategory(group),\n    }));\n\n  return { operations, resourceTags };\n}\n"]}
+{"version":3,"file":"manual-controller-route-projection.js","sourceRoot":"","sources":["../../../../src/companion/manual-controller-route-projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EACL,UAAU,EACV,kBAAkB,EAClB,qCAAqC,EACrC,0CAA0C,EAC1C,6BAA6B,EAC7B,mCAAmC,EACnC,0BAA0B,EAC1B,wBAAwB,EACxB,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,wCAAwC,EACxC,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EACL,8BAA8B,EAC9B,qCAAqC,EACrC,2BAA2B,EAC3B,+BAA+B,EAC/B,8BAA8B,GAI/B,MAAM,gCAAgC,CAAC;AAExC,uGAAuG;AACvG,MAAM,iCAAiC,GAAuF;IAC5H,CAAC,mCAAmC,CAAC,MAAM,CAAC,EAAE,qCAAqC,CAAC,MAAM;IAC1F,CAAC,mCAAmC,CAAC,iBAAiB,CAAC,EAAE,qCAAqC,CAAC,iBAAiB;IAChH,CAAC,mCAAmC,CAAC,aAAa,CAAC,EAAE,qCAAqC,CAAC,aAAa;IACxG,CAAC,mCAAmC,CAAC,0BAA0B,CAAC,EAAE,qCAAqC,CAAC,0BAA0B;CACnI,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAiF;IAC5G,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,2BAA2B,CAAC,GAAG;IACjD,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,2BAA2B,CAAC,IAAI;IACnD,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,2BAA2B,CAAC,GAAG;IACjD,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,2BAA2B,CAAC,KAAK;IACrD,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,2BAA2B,CAAC,MAAM;CACxD,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,OAAO,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAgB,EAAE,KAAiC;IAChG,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClF,OAAO,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACjG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAgE;IACzG,yEAAyE;IACzE,CAAC,0BAA0B,CAAC,cAAc,CAAC,EAAE,uBAAuB,CAAC,IAAI;IACzE,mGAAmG;IACnG,8FAA8F;IAC9F,gCAAgC;IAChC,CAAC,0BAA0B,CAAC,iBAAiB,CAAC,EAAE,uBAAuB,CAAC,IAAI;IAC5E,kGAAkG;IAClG,8BAA8B;IAC9B,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,EAAE,uBAAuB,CAAC,IAAI;IAC7E,8FAA8F;IAC9F,iCAAiC;IACjC,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC,YAAY;IACnF,iGAAiG;IACjG,gFAAgF;IAChF,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,uBAAuB,CAAC,KAAK;IACzE,kGAAkG;IAClG,gGAAgG;IAChG,yDAAyD;IACzD,CAAC,0BAA0B,CAAC,mBAAmB,CAAC,EAAE,uBAAuB,CAAC,YAAY;CACvF,CAAC;AAEF,SAAS,wBAAwB,CAAC,KAAiC;IACjE,MAAM,SAAS,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;IAC1E,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC;AAC/F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sCAAsC;IAIpD,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEzD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAC/D,MAAM,aAAa,GAAG,qCAAqC,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,aAAa,CAAC,WAAW,KAAK,gCAAgC,CAAC,SAAS;YAAE,SAAS;QACvF,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,GAAG,kBAAkB,GAAG,qBAAqB,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,uBAAuB,GAAG,8BAA8B,CAAC,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAiC;YAC3C,kBAAkB,EAAE,iCAAiC,CAAC,aAAa,CAAC,cAAc,CAAC;YACnF,qBAAqB,EAAE,aAAa,CAAC,qBAAqB;YAC1D;;;;;eAKG;YACH,gBAAgB,EAAE,EAAE;SACrB,CAAC;QAEF,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;YACjD;;;;;eAKG;YACH,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBACnD,CAAC,CAAC,GAAG,uBAAuB,IAAI,MAAM,EAAE;gBACxC,CAAC,CAAC,uBAAuB,CAAC;YAE5B,UAAU,CAAC,IAAI,CAAC;gBACd,kBAAkB,EAAE,aAAa,CAAC,KAAK;gBACvC,YAAY;gBACZ,uBAAuB;gBACvB,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,8BAA8B,CAAC,QAAQ;gBACpD,QAAQ;gBACR,IAAI;gBACJ;;;;;mBAKG;gBACH,YAAY,EAAE,+BAA+B,CAAC,WAAW;gBACzD;;;;mBAIG;gBACH,kBAAkB,EAAE,cAAc,CAAC,aAAa;gBAChD,QAAQ,EAAE,8BAA8B,CAAC;oBACvC,kBAAkB,EAAE,aAAa,CAAC,KAAK;oBACvC,uBAAuB;oBACvB,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,8BAA8B,CAAC,QAAQ;oBACpD,QAAQ;oBACR,IAAI;iBACL,CAAC;gBACF,KAAK,EAAE,EAAE;gBACT,MAAM;gBACN;;;;mBAIG;gBACH,sBAAsB,EAAE,KAAK;gBAC7B,sFAAsF;gBACtF,cAAc,EAAE,KAAK;gBACrB,OAAO,EAAE,aAAa,CAAC,OAAO;gBAC9B,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,iBAAiB,EAAE,IAAI;gBACvB,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;aAC7G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAkB,CAAC,GAAG,UAAU,CAAC;SAChD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;SACzD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACf,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,0CAA0C,CAAC,KAAK,CAAC;QAC9D,QAAQ,EAAE,wBAAwB,CAAC,KAAK,CAAC;KAC1C,CAAC,CAAC,CAAC;IAEN,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACtC,CAAC","sourcesContent":["/**\n * The application's manually mounted controller routes, projected into the same shape the resource\n * registry produces — so they reach the generated API reference through the existing generator with\n * no change to it.\n *\n * ## The gap this closes\n *\n * A Wildo application serves two disjoint families of HTTP routes. The RESOURCE REGISTRY builds one\n * family from the resource configurations, and every mechanism downstream projects that family and\n * only that family. The other family is mounted by hand, controller by controller, from\n * `MANUAL_CONTROLLER_ROUTES_URLS`: sign-in, token refresh, MFA, passkeys, SAML, the OAuth 2.0\n * authorization-server endpoints, the Model Context Protocol and Agent2Agent doors, file transfer,\n * i18n labels, charts.\n *\n * Nothing projected the second family. Measured 2026-09-09 across the four committed documents of\n * the two dogfood applications — 439, 576, 146 and 160 paths — **not one contained a single path\n * under `/auth`**. The reference explained the three credential formats every operation accepts and\n * never published the endpoint that issues one. Worse, four operation-header descriptions in the\n * same document told a reader the step-up token is \"obtained from `POST /api/v1/auth/reauth`\", a\n * path that document does not contain: the reference already pointed at this hole and could not\n * fill it.\n *\n * ## Why this lives HERE and not in the companion projector\n *\n * The companion's `openapi-generation-input` projector walks the APPLICATION's resolved registry, so\n * it must run inside the introspection subprocess with the app's schema graph loaded. This\n * projection needs none of that: the manual routes are the ENGINE's own contract, identical in every\n * generated application, and the catalog that describes them is a static table in\n * `@wildo-ai/saas-models`. Keeping it beside the generator makes it a pure function of framework\n * knowledge — testable on its own, like `SECURITY_SCHEMES` and the API-conventions markdown that\n * already live here — instead of one more thing the subprocess owns.\n *\n * ## Why the generator needed no change\n *\n * `generateOpenApiDocuments` is a pure function over `OpenApiGenerationInput`. It groups by\n * `resourceIdentifier`, keys path items on `path` + `httpVerb`, and emits whatever identity a\n * projection carries; it has no opinion about where a projected operation came from. So a manual\n * route reaches the document as an ordinary `OperationProjection` whose `resourceIdentifier` is its\n * documentation GROUP, accompanied by a matching `ResourceTag` — which is the join the renderer's\n * conservation check makes.\n *\n * ## What a manual projection deliberately does NOT carry\n *\n * `requestBodySchema` and `responseBodySchema` stay `null`. Those bodies are Zod schemas declared\n * inside backend controllers, in a package neither this one nor the introspection subprocess loads;\n * hand-copying them into the catalog would create a second copy of a contract with nothing checking\n * the two agree — the drift this repository refuses everywhere else. Each catalog entry authors a\n * `responseStatuses` row instead (without one the generator emits a bare `204 No Content`, which is\n * wrong for almost every route here) and describes its payload in prose. That is an honest account of\n * what is known, and it is strictly better than a reference in which the endpoint does not exist.\n * Projecting the real schemas is a later, larger change that must first move them into a shared\n * module.\n */\n\nimport {\n  HttpMethod,\n  MAIN_API_BASE_PATH,\n  MANUAL_CONTROLLER_ROUTE_DOCUMENTATION,\n  MANUAL_CONTROLLER_ROUTE_GROUP_DESCRIPTIONS,\n  MANUAL_CONTROLLER_ROUTES_URLS,\n  ManualControllerRouteAuthentication,\n  ManualControllerRouteGroup,\n  ManualControllerRouteKey,\n  ManualControllerRoutePublication,\n} from '@wildo-ai/saas-models';\n\nimport {\n  ENGINE_RESOURCE_SUB_DOMAIN_DOCUMENTATION,\n  EngineResourceSubDomain,\n} from '@wildo-ai/saas-specifications';\n\nimport { OpenApiSection } from '../openapi/openapi-generation-output.schemas';\nimport {\n  createOpenApiOperationIdentity,\n  OperationProjectionAuthenticationMode,\n  OperationProjectionHttpVerb,\n  OperationProjectionPrimaryScope,\n  OperationProjectionVariantType,\n  type OperationAccessDocumentation,\n  type OperationProjection,\n  type ResourceTag,\n} from './operation-projection.schemas';\n\n/** Catalog vocabulary → the projection's own authentication vocabulary. Total over the source enum. */\nconst MANUAL_ROUTE_AUTHENTICATION_MODES: Record<ManualControllerRouteAuthentication, OperationProjectionAuthenticationMode> = {\n  [ManualControllerRouteAuthentication.PUBLIC]: OperationProjectionAuthenticationMode.PUBLIC,\n  [ManualControllerRouteAuthentication.ANONYMOUS_SESSION]: OperationProjectionAuthenticationMode.ANONYMOUS_SESSION,\n  [ManualControllerRouteAuthentication.AUTHENTICATED]: OperationProjectionAuthenticationMode.AUTHENTICATED,\n  [ManualControllerRouteAuthentication.ANONYMOUS_OR_AUTHENTICATED]: OperationProjectionAuthenticationMode.ANONYMOUS_OR_AUTHENTICATED,\n};\n\n/**\n * `HttpMethod` → the OpenAPI path-item key.\n *\n * `HttpMethod.OPTIONS` is deliberately excluded. OpenAPI does define an `options` path-item key, but\n * no manual route mounts one — CORS preflight is answered by middleware rather than by a route — so\n * admitting it here would be inventing a case. A catalog entry that named `OPTIONS` fails to compile\n * against this map, which is the right moment to find out.\n */\nconst MANUAL_ROUTE_HTTP_VERBS: Record<Exclude<HttpMethod, HttpMethod.OPTIONS>, OperationProjectionHttpVerb> = {\n  [HttpMethod.GET]: OperationProjectionHttpVerb.GET,\n  [HttpMethod.POST]: OperationProjectionHttpVerb.POST,\n  [HttpMethod.PUT]: OperationProjectionHttpVerb.PUT,\n  [HttpMethod.PATCH]: OperationProjectionHttpVerb.PATCH,\n  [HttpMethod.DELETE]: OperationProjectionHttpVerb.DELETE,\n};\n\n/**\n * Express `:param` → OpenAPI `{param}`.\n *\n * The resource lane never needs this: its URL builder already emits brace form. The manual registry\n * is the backend's own mount table, written the way Express reads it, so the conversion belongs at\n * this boundary rather than in the registry — which the router consumes verbatim and must not have\n * rewritten under it.\n */\nexport function toOpenApiPathTemplate(expressPath: string): string {\n  return expressPath.replace(/:([A-Za-z0-9_]+)/gu, '{$1}');\n}\n\n/**\n * The operation identifier for one manual route — derived, never authored.\n *\n * `buildOperationId` composes `<verb><Resource>` and drops the resource noun when the verb phrase\n * already contains it. Starting the identifier WITH the group name is what triggers that drop, so\n * `AUTH_IDENTIFY` in the `authentication` group reads `authenticationIdentify` rather than the\n * stuttering `authIdentifyAuthentication`. Derived rather than authored so a route key added\n * tomorrow gets a coherent, stable id without anybody having to think about it.\n */\nexport function manualRouteOperationIdentifier(routeKey: string, group: ManualControllerRouteGroup): string {\n  const words = routeKey.toLowerCase().split('_').filter((word) => word.length > 0);\n  return group + words.map((word) => `${word.charAt(0).toUpperCase()}${word.slice(1)}`).join('');\n}\n\n/**\n * The API-reference group each manual-route group belongs to — the SAME vocabulary the engine's own\n * resources are classified by.\n *\n * ## Why these join the engine's categories instead of forming their own\n *\n * A tag with no category is not merely ungrouped: `applyApiReferenceResourceCategories` REFUSES the\n * publication of any application that declares `apiReferenceResourceCategories` at all, naming every\n * tag no category claims. So six uncategorised groups would have turned \"the auth endpoints are\n * missing from the reference\" into \"the reference does not publish\", for every application with an\n * authored taxonomy — a worse failure than the one this projection fixes.\n *\n * Categorising them as their OWN groups was the alternative and is rejected: the renderer groups by\n * category, so `authentication` (54 routes) would sit as a sibling of `auth` (the SSO, SCIM, session\n * and token RESOURCES), and a reader looking for authentication would find it split across two\n * adjacent headings for no reason they could see. The endpoint that issues a token and the resource\n * that configures how tokens are issued belong under one heading.\n *\n * TOTAL over {@link ManualControllerRouteGroup}: a new group is a compile error until it is placed.\n * That is the same guarantee the route catalog itself carries, and for the same reason — a group\n * that nobody remembered to classify is a publication failure in an application nobody has run yet.\n */\nexport const MANUAL_ROUTE_GROUP_SUB_DOMAINS: Record<ManualControllerRouteGroup, EngineResourceSubDomain> = {\n  // Sessions, MFA, SSO and consumable tokens — the sub-domain's own words.\n  [ManualControllerRouteGroup.AUTHENTICATION]: EngineResourceSubDomain.AUTH,\n  // The application acting as an OAuth 2.0 authorization server. Opposite direction from signing in,\n  // same subject: `auth` names OAuth explicitly, and its OAuth-client resources are the records\n  // these endpoints authenticate.\n  [ManualControllerRouteGroup.IDENTITY_PROVIDER]: EngineResourceSubDomain.AUTH,\n  // \"…and what they may delegate\" is `auth`'s own scope, and the provider-credential resources this\n  // group mints live there too.\n  [ManualControllerRouteGroup.CONNECTED_ACCOUNTS]: EngineResourceSubDomain.AUTH,\n  // MCP and A2A are the doors autonomous software knocks on; `flows-actors` is \"work that runs:\n  // flows, actors, tasks, agents\".\n  [ManualControllerRouteGroup.AGENT_INTERFACES]: EngineResourceSubDomain.FLOWS_ACTORS,\n  // \"Uploaded bytes and the metadata that links them to a domain row\" — and these routes address a\n  // stored file by its own id, so they belong beside the file metadata resources.\n  [ManualControllerRouteGroup.FILE_TRANSFER]: EngineResourceSubDomain.FILES,\n  // Reads a client makes about THIS APPLICATION: its resolved features, its labels, its chart data.\n  // `applications` is the sub-domain whose subject is the application itself; `features` is about\n  // the feature RECORDS, which are resources of their own.\n  [ManualControllerRouteGroup.APPLICATION_RUNTIME]: EngineResourceSubDomain.APPLICATIONS,\n};\n\nfunction manualRouteGroupCategory(group: ManualControllerRouteGroup) {\n  const subDomain = MANUAL_ROUTE_GROUP_SUB_DOMAINS[group];\n  const documentation = ENGINE_RESOURCE_SUB_DOMAIN_DOCUMENTATION[subDomain];\n  return { id: subDomain, label: documentation.label, description: documentation.description };\n}\n\n/**\n * Every PUBLISHED manual route as an `OperationProjection`, plus the `ResourceTag` for each group\n * that contributed one.\n *\n * Pure and argument-free: the manual route table is framework knowledge, identical in every\n * generated application, so there is nothing about a particular application to pass in. Withheld\n * routes are skipped here and nowhere else — the catalog is the single place a publication decision\n * is recorded, and it requires a written reason for each one.\n */\nexport function projectManualControllerRouteOperations(): {\n  operations: OperationProjection[];\n  resourceTags: ResourceTag[];\n} {\n  const operations: OperationProjection[] = [];\n  const usedGroups = new Set<ManualControllerRouteGroup>();\n\n  for (const routeKey of Object.values(ManualControllerRouteKey)) {\n    const documentation = MANUAL_CONTROLLER_ROUTE_DOCUMENTATION[routeKey];\n    if (documentation.publication !== ManualControllerRoutePublication.PUBLISHED) continue;\n    usedGroups.add(documentation.group);\n\n    const path = `${MAIN_API_BASE_PATH}${toOpenApiPathTemplate(MANUAL_CONTROLLER_ROUTES_URLS[routeKey])}`;\n    const baseOperationIdentifier = manualRouteOperationIdentifier(routeKey, documentation.group);\n    const access: OperationAccessDocumentation = {\n      authenticationMode: MANUAL_ROUTE_AUTHENTICATION_MODES[documentation.authentication],\n      authenticationSummary: documentation.authenticationSummary,\n      /*\n       * Empty on purpose. A manual route is not gated by the resource role vocabulary — its\n       * authorization is enforced inside its own handler, and for most of them there is no role at\n       * all because the caller has no session yet. Inventing a role here would put a requirement in\n       * the reference that no role table backs, which is worse than saying nothing.\n       */\n      roleRequirements: [],\n    };\n\n    for (const method of documentation.methods) {\n      const httpVerb = MANUAL_ROUTE_HTTP_VERBS[method];\n      /*\n       * One key can mount several methods — RFC 7592 defines ONE client-configuration endpoint whose\n       * method selects the operation, and `/mcp` answers three. `operationId` must be unique across\n       * the document, so the verb becomes a qualifier exactly when there is more than one method; a\n       * single-method route keeps the clean name.\n       */\n      const operationKey = documentation.methods.length > 1\n        ? `${baseOperationIdentifier}_${method}`\n        : baseOperationIdentifier;\n\n      operations.push({\n        resourceIdentifier: documentation.group,\n        operationKey,\n        baseOperationIdentifier,\n        variantKey: null,\n        variantType: OperationProjectionVariantType.API_CALL,\n        httpVerb,\n        path,\n        /*\n         * Inert in the generator — sectioning is `consumerApiSection` and security is `access` — but\n         * the projection contract requires it. `APPLICATION` is the truthful answer for every manual\n         * route, including the two whose URL carries an organization segment: there the organization\n         * is an argument to the call, not the scope the caller is acting within.\n         */\n        primaryScope: OperationProjectionPrimaryScope.APPLICATION,\n        /*\n         * Never the administration section. These routes are how ANY caller authenticates, connects\n         * or discovers, so filing them under application administration would move sign-in out of\n         * the document integrators actually read.\n         */\n        consumerApiSection: OpenApiSection.API_REFERENCE,\n        identity: createOpenApiOperationIdentity({\n          resourceIdentifier: documentation.group,\n          baseOperationIdentifier,\n          variantKey: null,\n          variantType: OperationProjectionVariantType.API_CALL,\n          httpVerb,\n          path,\n        }),\n        roles: [],\n        access,\n        /*\n         * These surfaces accept an API key wherever they accept a bearer token; nothing narrows any\n         * of them to a bearer-only lane, so removing the API-key alternative would document a\n         * refusal the runtime does not make.\n         */\n        isApiKeyAccessDisabled: false,\n        /* Optimistic locking is a resource-repository capability. No manual route has one. */\n        acceptsIfMatch: false,\n        summary: documentation.summary,\n        description: documentation.description,\n        requestBodySchema: null,\n        responseBodySchema: null,\n        responseStatuses: [{ code: documentation.successStatus.code, meaning: documentation.successStatus.meaning }],\n      });\n    }\n  }\n\n  const resourceTags: ResourceTag[] = [...usedGroups]\n    .sort((left, right) => left.localeCompare(right, 'en-US'))\n    .map((group) => ({\n      name: group,\n      description: MANUAL_CONTROLLER_ROUTE_GROUP_DESCRIPTIONS[group],\n      category: manualRouteGroupCategory(group),\n    }));\n\n  return { operations, resourceTags };\n}\n"]}

package/dist/esm/companion/openapi-generator.d.ts

@@ -35,10 +35,14 @@
  *        cross this contract.
  *
  * @wildo-boundary
- *   Imports only the portable OpenAPI output contract, the local operation
- *   projection contract, the lightweight public runtime constants and
- *   specification-prose cleanup. No serializer, React or saas-models root
- *   barrel enters this semantic generator.
+ *   Imports the portable OpenAPI output contract, the local operation
+ *   projection contract, the lightweight public runtime constants (header
+ *   keys) and specification-prose cleanup. No serializer or React enters this
+ *   semantic generator. The saas-models ROOT barrel does, for the atoms not
+ *   carved into `public-runtime`: the error definitions, collection query
+ *   parameters, pagination request schema, the M2M webhook delivery contract
+ *   and the Idempotency-Key vocabulary. A module has ONE public door, so the
+ *   vocabulary is not re-exported from `public-runtime` as well.
  */
 import { OpenApiSection, type OpenApiGenerationOutput } from '../openapi/openapi-generation-output.schemas';
 import { type OperationProjection } from './operation-projection.schemas';

package/dist/esm/companion/openapi-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi-generator.d.ts","sourceRoot":"","sources":["../../../src/companion/openapi-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAaH,OAAO,EACL,cAAc,EACd,KAAK,uBAAuB,EAE7B,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAOL,KAAK,mBAAmB,EACzB,MAAM,gCAAgC,CAAC;AAIxC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,GAC7C,aAAa,CAAC,mBAAmB,CAAC,CAUpC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,GAC7C,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAqBtE;AAg6CD;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAmkBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,GAAG,uBAAuB,CAyBnF"}
+{"version":3,"file":"openapi-generator.d.ts","sourceRoot":"","sources":["../../../../src/companion/openapi-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAeH,OAAO,EACL,cAAc,EACd,KAAK,uBAAuB,EAE7B,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAOL,KAAK,mBAAmB,EACzB,MAAM,gCAAgC,CAAC;AAIxC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,GAC7C,aAAa,CAAC,mBAAmB,CAAC,CAUpC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CACjD,UAAU,EAAE,aAAa,CAAC,mBAAmB,CAAC,GAC7C,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAqBtE;AAy7CD;;;;;;;;;;;GAWG;AACH,oBAAY,0BAA0B;IACpC,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAmkBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,GAAG,uBAAuB,CAyBnF"}

package/dist/esm/companion/openapi-generator.js

@@ -35,13 +35,17 @@
  *        cross this contract.
  *
  * @wildo-boundary
- *   Imports only the portable OpenAPI output contract, the local operation
- *   projection contract, the lightweight public runtime constants and
- *   specification-prose cleanup. No serializer, React or saas-models root
- *   barrel enters this semantic generator.
+ *   Imports the portable OpenAPI output contract, the local operation
+ *   projection contract, the lightweight public runtime constants (header
+ *   keys) and specification-prose cleanup. No serializer or React enters this
+ *   semantic generator. The saas-models ROOT barrel does, for the atoms not
+ *   carved into `public-runtime`: the error definitions, collection query
+ *   parameters, pagination request schema, the M2M webhook delivery contract
+ *   and the Idempotency-Key vocabulary. A module has ONE public door, so the
+ *   vocabulary is not re-exported from `public-runtime` as well.
  */
 import { WildoHeaderKeys } from '@wildo-ai/saas-models/public-runtime';
-import { COLLECTION_QUERY_PARAMETERS, ERROR_DEFINITIONS, ErrorHandling_Strategy, ErrorSeverity, ErrorType, M2M_WEBHOOK_DELIVERY_CONTRACT, Resources_PaginationRequestSchema, } from '@wildo-ai/saas-models';
+import { COLLECTION_QUERY_PARAMETERS, ERROR_DEFINITIONS, IDEMPOTENCY_KEY_MAX_LENGTH, IdempotencyKeyRefusalCode, ErrorHandling_Strategy, ErrorSeverity, ErrorType, M2M_WEBHOOK_DELIVERY_CONTRACT, Resources_PaginationRequestSchema, } from '@wildo-ai/saas-models';
 import { OpenApiSection, } from '../openapi/openapi-generation-output.schemas.js';
 import { OpenApiGenerationInputSchema, OPENAPI_RESOURCE_IDENTITY_CONTRACT_VERSION, OperationProjectionAuthenticationMode, OperationProjectionVariantType, } from './operation-projection.schemas.js';
 import { stripImplementationNoise } from './spec-to-operation-doc.js';
@@ -836,6 +840,19 @@ function buildOperationObject(op, operationId, errorResponseSchema) {
                 + 'Required for this sensitive operation and consumed when the request is authorized.',
         });
     }
+    if (op.idempotencyKey !== undefined) {
+        parameters.push({
+            name: op.idempotencyKey.headerName,
+            in: 'header',
+            required: op.idempotencyKey.required,
+            schema: { type: 'string', minLength: 1 },
+            examples: { 'One key per intended change': { value: '"8e03978e-40d5-43e8-bc93-6894a57f9324"' } },
+            description: 'Your identity for this one intended change: a quoted string (or a bare token) of 1 to '
+                + `${IDEMPOTENCY_KEY_MAX_LENGTH} printable ASCII characters (a UUID is typical). Send a new key for each new change and `
+                + 'the SAME key when you retry it, so a retry after a lost response receives the first outcome instead of running again.'
+                + (op.idempotencyKey.required ? ' Required: a request without it is refused.' : ' Optional: a request without it runs, but its retries are not deduplicated.'),
+        });
+    }
     if (op.acceptsIfMatch) {
         parameters.push({
             name: WildoHeaderKeys.IF_MATCH,
@@ -1197,19 +1214,24 @@ function buildResponsesObject(op, responseBodySchema, errorResponseSchema) {
             };
         }
     }
-    if (op.acceptsIfMatch) {
-        const mergeFrameworkError = (code, description) => {
-            const existing = responses[code];
-            if (isPlainObject(existing) && typeof existing['description'] === 'string') {
-                existing['description'] = `${existing['description']}\n\n${description}`;
-                existing['content'] = { 'application/json': { schema: errorResponseSchema } };
-                return;
-            }
-            responses[code] = {
-                description,
-                content: { 'application/json': { schema: errorResponseSchema } },
-            };
+    // A framework-owned outcome merged into an operation's response map, beside whatever its specification authored.
+    const mergeFrameworkError = (code, description) => {
+        const existing = responses[code];
+        if (isPlainObject(existing) && typeof existing['description'] === 'string') {
+            existing['description'] = `${existing['description']}\n\n${description}`;
+            existing['content'] = { 'application/json': { schema: errorResponseSchema } };
+            return;
+        }
+        responses[code] = {
+            description,
+            content: { 'application/json': { schema: errorResponseSchema } },
         };
+    };
+    if (op.idempotencyKey !== undefined) {
+        mergeFrameworkError('400', `The \`${op.idempotencyKey.headerName}\` header is malformed (\`error.code\` \`${IdempotencyKeyRefusalCode.MALFORMED}\`)`
+            + (op.idempotencyKey.required ? `, or missing (\`${IdempotencyKeyRefusalCode.REQUIRED}\`).` : '.'));
+    }
+    if (op.acceptsIfMatch) {
         mergeFrameworkError('400', 'The optional `If-Match` header is present but does not contain a non-negative integer resource version.');
         mergeFrameworkError('409', 'The `If-Match` version no longer matches the current resource version, so the mutation was not applied.');
     }