CMIS domain mapper

docs/cmis-profiled-access-points-implementation.md

@@ -2,7 +2,7 @@
 
 Date: 2026-05-06
 
-Status: first implementation slice started.
+Status: profile and mapper slices implemented.
 
 ## Implemented Slice
 
@@ -14,6 +14,8 @@ boundary used by the future API adapter:
 - `CMISAction`
 - `CMISAccessProfile`
 - `CMISAccessPoint`
+- `CMISDomainMapper`
+- `CMISObjectProjection`
 
 The layer is intentionally small. It decides whether a CMIS action is allowed
 for a profile and whether an engine asset may be exposed through an access
@@ -46,3 +48,20 @@ Decisions return existing `PolicyDecision` objects so later CMIS routes can
 emit compatible diagnostics and audit records without inventing another policy
 model.
 
+## Mapper Slice
+
+`CMISDomainMapper` projects existing engine state into CMIS-shaped envelopes:
+
+- repository info and CMIS 1.1 Browser Binding capability flags,
+- base type definitions for document, folder, relationship, policy, item, and
+  secondary,
+- engine assets as CMIS document projections,
+- representation metadata as content stream descriptors,
+- asset versions as CMIS version properties,
+- relationship primitives as CMIS relationship objects,
+- profile-derived allowable actions.
+
+The mapper returns `None` for assets or relationships that the access-point
+profile must not expose. It does not fetch from repositories directly; callers
+provide the asset, representations, versions, metadata records, and
+relationships they have already authorized or loaded.