npm - @wildo-ai/saas-frontend-lib - Versions diffs - 1.1.3 → 1.1.5 - Mend

@wildo-ai/saas-frontend-lib 1.1.3 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2521) hide show

package/dist/esm/core/requests/wildo-http-client-manual-calls.frontend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"wildo-http-client-manual-calls.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/requests/wildo-http-client-manual-calls.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAA6F,eAAe,EAA8B,UAAU,EAAyB,kBAAkB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,2BAA2B,EAA8B,MAAM,uBAAuB,CAAC;AACpX,OAAO,EAAkB,sBAAsB,EAAwD,MAAM,sCAAsC,CAAC;AAEpJ;;;GAGG;AAEH,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAqF3C,MAAM,OAAO,kCAAmC,SAAQ,sBAAsB;IAE5E,YAAY,SAAuC,EAAE;QACnD,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,mBAA2B,EAAE,OAAwB;QAC9E,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,wBAAwB,mBAAmB,EAAE,CAAC;QAC7J,OAAO,IAAI,CAAC,GAAG,CAA6C,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,6EAA6E;IAC7E;;;;;;;OAOG;IACH,KAAK,CAAC,qBAAqB,CAAC,MAAuB,EAAE,OAAwB;QAC3E,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACzI,OAAO,IAAI,CAAC,GAAG,CAAyB,GAAG,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,YAAoB,EAAE,QAA4B,EAAE,QAAkB,EAAE,OAAwB;QACzH,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EACrG,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,EAChF,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,OAAwB;QAClE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE,EACjH,EAAE,KAAK,EAAE,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,OAAwB;QAC3D,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAA6B,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5J,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,OAAwB;QAC/D,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC,GAAG,CAAM,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACvG,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAA8D,EAAE,OAAwB;QACrH,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC;QAC5F,OAAO,IAAI,CAAC,IAAI,CAAyB,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrK,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA8B,EAAE,OAAwB;QACzE,OAAO,IAAI,CAAC,IAAI,CAAyB,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/J,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,aAAa,CAAC,OAAwB;QAC1C,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,EACjG,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,yBAAyB,CAC7B,WAAmB,EACnB,SAAkB,EAClB,OAAwB;QAExB,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;QACpG,MAAM,OAAO,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QAC1F,MAAM,GAAG,GAAG,SAAS;YACnB,CAAC,CAAC,GAAG,OAAO,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE;YACzD,CAAC,CAAC,OAAO,CAAC;QACZ,OAAO,IAAI,CAAC,GAAG,CAA+B,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,OAAwB;QAC3D,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,EAClG,0BAA0B,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,EAC1C,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAwB;QAC9C,MAAM,IAAI,CAAC,IAAI,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,EAC1F,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED,sCAAsC;IAEtC;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAAa,EAAE,OAAwB;QAChE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,EAC1G,EAAE,KAAK,EAAE,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAAa,EAAE,WAAmB,EAAE,OAAwB;QACtF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,EAC3G,EAAE,KAAK,EAAE,WAAW,EAAE,EACtB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,oCAAoC;IAEpC;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,IAA0G,EAAE,OAAwB;QACjJ,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,EAC5F,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,OAAwB;QAC7D,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;QACnG,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC,GAAG,CAA6B,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,gBAAgB,CACpB,IAA0H,EAC1H,OAAwB;QA2BxB,OAAO,IAAI,CAAC,IAAI,CAcd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EACrG,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CACpB,IAA2D,EAC3D,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EACrG,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAAwB;QAExB,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,EACvG,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,YAAoB,EACpB,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,EACxG,EAAE,YAAY,EAAE,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,YAAoB,EACpB,eAAwB,EACxB,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,EACxG,EAAE,YAAY,EAAE,eAAe,EAAE,EACjC,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,KAAa,EAAE,OAAwB;QAMtE,OAAO,IAAI,CAAC,IAAI,CAMd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,EAAE,KAAK,EAAE,KAAK,EAAE,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAa,EAAE,OAAwB;QACnE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,EACvG,EAAE,KAAK,EAAE,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED,yBAAyB;IAEzB,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,OAAwB;QAC/D,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,EACtG,EAAE,SAAS,EAAE,EACb,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,IAAY,EAAE,OAAwB;QAC/E,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,EACxG,EAAE,SAAS,EAAE,IAAI,EAAE,EACnB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,oBAAoB;IAEpB,KAAK,CAAC,YAAY,CAAC,OAAwB;QACzC,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,EAClG,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAY,EAAE,OAAwB;QAC7D,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,EACzG,EAAE,IAAI,EAAE,EACR,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,IAAY,EAAE,OAAwB;QAC3E,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,EACnG,EAAE,SAAS,EAAE,IAAI,EAAE,EACnB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,2BAA2B;IAE3B,KAAK,CAAC,sBAAsB,CAAC,SAAkB,EAAE,OAAwB;QACvE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,EAC5G,EAAE,SAAS,EAAE,EACb,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,UAAmC,EAAE,OAAwB;QACvF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,EAC3G,UAAU,EACV,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,OAAwB;QAClE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,EACxG,EAAE,SAAS,EAAE,EACb,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAmC,EAAE,OAAwB;QACnF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,EACvG,UAAU,EACV,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAwB;QACxC,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB,EAAE,OAAwB;QAChE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,EAClG,EAAE,YAAY,EAAE,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB,EAAE,IAAY,EAAE,OAAwB;QAC9E,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,EAClG,EAAE,YAAY,EAAE,IAAI,EAAE,EACtB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,gCAAgC;IAEhC,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,OAAwB;QACzD,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,EACnG,EAAE,KAAK,EAAE,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,KAAa,EAAE,OAAwB;QAC1E,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EACrG,EAAE,KAAK,EAAE,KAAK,EAAE,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,6BAA6B;IAE7B,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,WAAoB,EAAE,OAAwB;QAChF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,EAAE,SAAS,EAAE,WAAW,EAAE,EAC1B,OAAO,CACR,CAAC;IACJ,CAAC;IAED,wCAAwC;IAExC,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,OAAwB;QACjE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EACrG,EAAE,WAAW,EAAE,EACf,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,WAAmB,EAAE,IAAY,EAAE,OAAwB;QAClF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,EACxG,EAAE,WAAW,EAAE,IAAI,EAAE,EACrB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,mCAAmC;IAEnC,KAAK,CAAC,cAAc,CAAC,eAAuB,EAAE,WAAmB,EAAE,OAAwB;QACzF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,EACnG,EAAE,eAAe,EAAE,WAAW,EAAE,EAChC,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,OAAwB;QAC7D,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,EAAE,WAAW,EAAE,EACf,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAwB;QAC3C,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,EACpG,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAwB;QACzC,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAwB;QAC7C,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,EACvG,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,OAAwB;QAC/D,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;QACzG,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,MAAM,CAAwB,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,2CAA2C;IAE3C;;;;;;;OAOG;IACH,KAAK,CAAC,wBAAwB,CAAC,OAAwB;QACrD,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,EAC5G,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,uBAAuB,CAC3B,WAAmB,EACnB,IAIC,EACD,OAAwB;QAExB,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;QACxG,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC1G,OAAO,IAAI,CAAC,IAAI,CAA2B,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAAgD,EAAE,WAA6E,EAAE,OAAwB;QAC5K,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,EAC1F,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,EAC1B,OAAO,CACR,CAAC;IACJ,CAAC;IAED,yBAAyB;IAEzB,KAAK,CAAC,gCAAgC,CACpC,KAAa,EACb,YAAoB,EACpB,SAAkB,EAClB,OAAwB;QAExB,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,CAAC;QAC5G,MAAM,OAAO,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC;QACrH,MAAM,GAAG,GAAG,SAAS;YACnB,CAAC,CAAC,GAAG,OAAO,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE;YACzD,CAAC,CAAC,OAAO,CAAC;QACZ,OAAO,IAAI,CAAC,GAAG,CAA+B,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,mCAAmC,CACvC,YAAoB,EACpB,SAAkB,EAClB,OAAwB;QAExB,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,CAAC;QAC5G,MAAM,OAAO,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5F,MAAM,GAAG,GAAG,SAAS;YACnB,CAAC,CAAC,GAAG,OAAO,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE;YACzD,CAAC,CAAC,OAAO,CAAC;QACZ,OAAO,IAAI,CAAC,GAAG,CAA+B,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,yBAAyB,CAAC,KAAa,EAAE,OAAwB;QACrE,OAAO,IAAI,CAAC,GAAG,CAAwB,GAAG,eAAe,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC5G,GAAG,OAAO;YACV,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,yBAAyB,CAAC,MAA6B,EAAE,KAAa,EAAE,IAAU,EAAE,OAA2B;QACnH,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;QAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE;YACjD,GAAG,OAAO;YACV,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAa,EAAE,OAAwB;QAC/D,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,EAC5G,EAAE,KAAK,EAAE,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC,EAAE,OAAwB;QACvF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,EAC1G,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED,mBAAmB;IAEnB,KAAK,CAAC,mBAAmB,CAAC,OAAwB;QAChD,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,OAAO,CACR,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,QAA2B,EAAE,QAAmB,EAAE,OAAwB;QAC5F,IAAI,GAAG,GAAG,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,aAAa,QAAQ,EAAE,CAAC;QAE9H,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,GAAG,IAAI,aAAa,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAwB,GAAG,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAA2B,EAAE,IAAc,EAAE,OAAwB;QAC7F,IAAI,GAAG,GAAG,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,aAAa,QAAQ,EAAE,CAAC;QAC9H,GAAG,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,CAAwB,GAAG,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,sBAAsB;IACtB;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,IAA2B,EAC3B,OAAwB,EACxB,WAAgD;QAEhD,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;QAC1F,MAAM,WAAW,GAAG,WAAW;YAC7B,CAAC,CAAC,IAAI,eAAe,CACnB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAA4B,CAC5H,CAAC,QAAQ,EAAE;YACZ,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACvH,OAAO,IAAI,CAAC,IAAI,CAA2B,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,yBAAyB;IACzB;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,IAA4C,EAAE,OAAwB;QAC9F,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,EAC/F,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,2BAA2B,CAAC,OAAwB;QACxD,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,EACzG,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,4BAA4B,CAAC,IAAkD,EAAE,OAAwB;QAC7G,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,EACzG,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,OAAwB;QACpD,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EACrG,OAAO,CACR,CAAC;IACJ,CAAC;CAEF;AAED,0FAA0F;AAC1F,IAAI,sBAAsB,GAA8C,IAAI,CAAC;AAE7E,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,sBAAsB,GAAG,IAAI,kCAAkC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC","sourcesContent":["/*\n WildoBackendHttpClient_ManualCalls\n * Specialized HTTP client for manual/custom API calls\n * Extends base WildoBackendHttpClient with flexibility for non-standard endpoints\n /\n\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models';\nimport type {\n AggregationQueryResponse,\n AuthInvitationInfoResponse,\n ChartDataRequestBody,\n CrossFrontendHandoffRequest,\n CrossFrontendHandoffResponse,\n ExternalIdentitySource,\n MilestoneDefinition,\n OneOffTokenExchangeResponse,\n SsoConnectionType,\n TokenExchangeResponse,\n} from '@wildo-ai/saas-models';\nimport { AppConfiguration_FrontendBootstrapResponse, AuthenticationRequest, AuthenticationResponse, AuthFactorLevel, AuthIdentificationResponse, AuthMethod, I18nLabelsResponseDto, MAIN_API_BASE_PATH, MANUAL_CONTROLLER_ROUTES_URLS, ManualControllerRouteKey, TokenExchangeRequestSchema, FileUploadGrantStatusSchema, type FileUploadGrantStatus } from '@wildo-ai/saas-models';\nimport { RequestOptions, WildoBackendHttpClient, WildoBackendHttpClientConfig, type UploadFileOptions } from './wildo-http-client.frontend.service';\n\n/\n Specialized HTTP client for manual/custom API calls\n * Provides methods for application configuration and other manual endpoints\n /\n\n// Single source of truth for the API mount prefix — shared with the backend\n// HTTP server mount and the refresh-token cookie `Path` so the URLs this\n// client builds always hit the same served paths the cookie is scoped to.\nconst API_CALL_PREFIX = MAIN_API_BASE_PATH;\n\n/\n OIDC interactive-consent (S1). `GET /oauth/authorize` for a `requiresConsent` client returns this\n * INSTEAD of a code redirect: the app renders a consent screen from it. `resource` is the A2A/MCP\n * agent endpoint (RFC 8707) the delegated token will be bound to; `null` when the request carried none.\n /\nexport interface OAuthConsentRequiredResponse {\n consent_required: true;\n consent_token: string;\n client: { id: string; name: string };\n scopes: string[];\n resource: string \| null;\n}\n\n/\n Trusted (non-`requiresConsent`) authorize result: the backend already minted the authorization code\n * and returns the redirect target (same `{ redirect_to }` shape as the consent decision, but a distinct\n * event — no user prompt). The SPA navigates the browser there without showing a consent screen.\n /\nexport interface OAuthAuthorizeRedirectResponse {\n redirect_to: string;\n}\n\n/\n `GET /oauth/authorize` result: EITHER a consent prompt (a `requiresConsent` client) OR a direct\n * redirect (a trusted client, code already minted). Discriminated by the presence of `consent_required`.\n /\nexport type OAuthAuthorizeResponse = OAuthConsentRequiredResponse \| OAuthAuthorizeRedirectResponse;\n\n/\n The consent decision result (S1). The app navigates the browser to `redirect_to`\n * (`window.location.assign`) to complete the OAuth redirect back to the third-party client — carrying\n * either the authorization `code` (approve) or `error=access_denied` (deny).\n /\nexport interface OAuthConsentDecisionResponse {\n redirect_to: string;\n}\n\n/\n The OIDC RP-Initiated Logout §6 confirmation result (revocation-C). After the End-User confirms, the\n * backend terminated the session and returns the signed-out page as `redirect_to` (always same-origin\n * `/oauth/logged-out`); the app navigates there. A stale/invalid token yields the same landing WITHOUT\n * terminating, so the caller need not distinguish success from a no-op.\n /\nexport interface OAuthEndSessionConfirmResponse {\n redirect_to: string;\n}\n\n/\n One of the authenticated caller's own pending invitations, as returned by\n * `GET /auth/invitations/mine` (Approach P). Mirrors the backend\n * `listMyPendingInvitations` projection; the invitee is not yet a member, so only\n * the org id/name + granted roles are surfaced for the \"accept/reject\" UI.\n /\nexport interface MyPendingInvitationView {\n /* The INVITED membership row id — the accept/decline target (junction model). /\n membershipId: string;\n organizationId: string;\n organizationName?: string;\n roles: string[];\n createdAt?: string;\n}\n\n/\n One connectable provider, as returned by `GET /connections`.\n \n The CATALOGUE, distinct from the person's stored credential rows: this says what MAY be connected,\n * the `userProviderCredentials` list says what IS. They are two questions and the empty answer to the\n * second — where everybody starts — is exactly when the first one matters.\n /\nexport interface ConnectableProviderView {\n providerRef: string;\n /\n FALSE for a provider whose credential is pasted rather than granted, which is still a real\n * integration — it is authored on the credential screen instead of connected through a vendor.\n /\n connectable: boolean;\n /* The RECORDED decision about which owners may connect this provider, never a derived one. /\n admissibleConnections: Array<{ ownerScope: string; delegation: string }>;\n /* Placeholders the vendor's own URLs carry, which a connection must answer — `{cloud}`, `{tenantId}`. /\n connectionParameters?: string[];\n scopes?: string[];\n}\n\nexport class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {\n\n constructor(config: WildoBackendHttpClientConfig = {}) {\n super(config);\n }\n\n /\n Retrieve application configuration from backend\n * @param frontendServiceName Frontend service identity (required)\n * @param options Optional request options for headers, timeout, etc.\n * @returns Promise<AppConfiguration_FrontendBootstrapResponse> The application configuration plus frontend provider bootstrap data\n /\n async getApplicationConfig(frontendServiceName: string, options?: RequestOptions): Promise<AppConfiguration_FrontendBootstrapResponse> {\n const url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.APPLICATION_CONFIG_GET]}?frontendServiceName=${frontendServiceName}`;\n return this.get<AppConfiguration_FrontendBootstrapResponse>(url, options);\n }\n\n // ── OIDC interactive consent (S1) ─────────────────────────────────────────\n /\n `GET /oauth/authorize` for the browser authorize flow. `params` are the raw authorize query the\n * third-party client redirected with (`response_type=code`, `client_id`, `redirect_uri`,\n * `code_challenge`(+`_method=S256`), optional `scope`/`resource`/`state`/`nonce`). Returns EITHER the\n * `consent_required` payload (a `requiresConsent` client → the SPA renders the consent screen) OR a\n * `{ redirect_to }` payload (a trusted client → the code is already minted; the SPA navigates the\n * browser there). The Bearer is auto-attached.\n /\n async oauthAuthorizeConsent(params: URLSearchParams, options?: RequestOptions): Promise<OAuthAuthorizeResponse> {\n const url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]}?${params.toString()}`;\n return this.get<OAuthAuthorizeResponse>(url, options);\n }\n\n /\n `POST /oauth/authorize/decision` — record the user's approve/deny. `remember` (Item 3) opts into a\n * durable consent grant so a future authorize with covering scopes skips the prompt; sent as the\n * string `'true'`/`'false'` the backend compares against. Returns `{ redirect_to }`; the caller\n * navigates the browser there to complete the OAuth redirect to the third-party client.\n /\n async oauthConsentDecision(consentToken: string, decision: 'approve' \| 'deny', remember?: boolean, options?: RequestOptions): Promise<OAuthConsentDecisionResponse> {\n return this.post<OAuthConsentDecisionResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]}`,\n { consent_token: consentToken, decision, remember: remember ? 'true' : 'false' },\n options,\n );\n }\n\n /\n `POST /oauth/end-session/confirm` — the OIDC RP-Initiated Logout §6 confirmation decision. Presents the\n * single-use `token` the `/oauth/logout-confirm` prompt was redirected with; the backend consumes it,\n * terminates the named session, and returns `{ redirect_to }` (the signed-out page). Token-authorized —\n * no Bearer is required (the End-User may be unauthenticated here, having arrived via an RP redirect).\n /\n async oauthEndSessionConfirm(token: string, options?: RequestOptions): Promise<OAuthEndSessionConfirmResponse> {\n return this.post<OAuthEndSessionConfirmResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]}`,\n { token },\n options,\n );\n }\n\n // Authentication manual calls\n async identifyByEmail(email: string, options?: RequestOptions): Promise<AuthIdentificationResponse> {\n const body = { email };\n return this.post<AuthIdentificationResponse>(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTIFY]}`, body, options);\n }\n\n async getSessionState(sessionId: string, options?: RequestOptions): Promise<any> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SESSION_STATE];\n return this.get<any>(`${API_CALL_PREFIX}${routeTemplate.replace(':sessionId', sessionId)}`, options);\n }\n\n async authenticateWithPassword(params: { sessionId: string; email: string; password: string }, options?: RequestOptions): Promise<AuthenticationResponse> {\n const body = { ...params, method: AuthMethod.PASSWORD, factorLevel: AuthFactorLevel.FIRST };\n return this.post<AuthenticationResponse>(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD]}`, body, options);\n }\n\n async authenticate(request: AuthenticationRequest, options?: RequestOptions): Promise<AuthenticationResponse> {\n return this.post<AuthenticationResponse>(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE]}`, request, options);\n }\n\n /\n Refresh access token. Calls POST /api/v1/auth/token/refresh.\n \n Cookie-only contract (Auth-hardening Slice A Step 6, 2026-04-13).\n * The refresh token travels EXCLUSIVELY via the `__wildo_refresh`\n * `HttpOnly` cookie (set by the backend on every issuance / rotation,\n * scoped `Path=/api/v1/auth`). The browser automatically attaches it because\n * the shared HTTP client's `authCookiesInterceptor` flips\n * `withCredentials: true` on every `/auth/` request. The request body\n is EMPTY and the backend's `RefreshTokenBodySchema` is\n * `z.strictObject({})` — re-introducing a body field here would now\n * fail backend validation with a 400.\n \n History: A-Step 2 (2026-04-13) added the cookie channel; A-Step 3\n * stopped this client from emitting the body field; A-K-5 added a\n * transitional backend dual-read; A-Step 6 dropped the body channel.\n \n @returns Fresh `{ accessToken, expiresIn }`. The refresh token is\n * NOT in the response body — the rotated value lives only in the\n * `Set-Cookie: __wildo_refresh=…` response header (HttpOnly, so\n * JavaScript here cannot observe it).\n /\n async refreshTokens(options?: RequestOptions): Promise<{ accessToken: string; expiresIn?: number }> {\n return this.post<{ accessToken: string; expiresIn?: number }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_REFRESH]}`,\n {},\n options,\n );\n }\n\n /\n Get OAuth2 authorization URL for a given provider.\n * Calls GET /api/v1/auth/oauth2/authorize/:providerRef\n * @param providerRef The SSO provider reference (e.g., 'google', 'microsoft')\n * @returns The authorization URL to redirect the user to\n \n Browser-only — the framework targets web stacks exclusively, so the\n * caller always opens the returned URL via `window.location.href`.\n /\n async getOAuth2AuthorizationUrl(\n providerRef: string,\n returnUrl?: string,\n options?: RequestOptions,\n ): Promise<{ authorizationUrl: string }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE];\n const baseUrl = `${API_CALL_PREFIX}${routeTemplate.replace(':providerRef', providerRef)}`;\n const url = returnUrl\n ? `${baseUrl}?returnUrl=${encodeURIComponent(returnUrl)}`\n : baseUrl;\n return this.get<{ authorizationUrl: string }>(url, options);\n }\n\n /\n Exchange a one-time AUTH_CODE_EXCHANGE token for access and refresh tokens.\n * Calls POST /api/v1/auth/token/exchange.\n \n Two issuers feed this endpoint:\n * - OAuth2 / SAML callback (`auth-code-exchange.md` Step 4) — token carries\n * `accessToken`/`expiresIn` only. Refresh arrives through the\n * HttpOnly cookie channel, and response body omits both `refreshToken` and the\n * `returnPath`/`sourceFrontendServiceName`/`targetServiceKey` fields.\n * - Cross-frontend handoff (`cross-app-jwt-propagation.md` Step 2 + Step 5)\n * — token additionally carries `returnPath`/`sourceFrontendServiceName`/\n * `targetServiceKey`. Response surfaces them so the receiving SPA can\n * navigate to `returnPath` and render telemetry.\n \n Receivers detect \"this came from a cross-frontend handoff\" by checking\n * `typeof returnPath === 'string'`. Renamed from `exchangeOAuth2Code`\n * (cross-app-jwt-propagation Step 5 deferred) — the method now serves\n * BOTH the OAuth2 callback path (`Auth_AuthCallback`) AND the\n * cross-frontend handoff receiver (`Auth_OneOffSession` in\n * `cross-frontend-handoff` mode), so the OAuth2-specific naming was\n * misleading. The docs site's own client (`engine/saas-technical-doc/\n * src/runtime/docs-auth-client.ts`) already uses the same name —\n * single conceptual symbol across both client surfaces.\n \n @param code The one-time AUTH_CODE_EXCHANGE token (from `?code=` query\n * param after either an OAuth2 callback or a cross-frontend handoff redirect).\n /\n async exchangeAuthCode(code: string, options?: RequestOptions): Promise<TokenExchangeResponse> {\n return this.post<TokenExchangeResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]}`,\n TokenExchangeRequestSchema.parse({ code }),\n options,\n );\n }\n\n /\n Logout from the backend by revoking the refresh token AND clearing the\n * `__wildo_refresh` cookie. Calls POST /api/v1/auth/logout.\n \n Cookie-only contract (Auth-hardening Slice A Step 6, 2026-04-13).\n * The refresh token travels EXCLUSIVELY via the cookie (auto-attached\n * by the `authCookiesInterceptor`); the request body is EMPTY and the\n * backend's `LogoutBodySchema` is `z.strictObject({})`. The backend\n * ALWAYS clears the cookie on response, so logout works even when the\n * cookie is present but the JS access token was lost (e.g., after a\n * tab crash). `tokenIssuer.revokeRefreshToken()` is best-effort —\n * clearing the cookie is the user-visible action and never blocks on\n * revocation.\n /\n async logoutFromBackend(options?: RequestOptions): Promise<void> {\n await this.post<void>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LOGOUT]}`,\n {},\n options,\n );\n }\n\n // ─── Password Reset manual calls ───\n\n /\n Request a password reset email.\n * Calls POST /api/v1/auth/password-reset/request\n * The backend always returns success to prevent email enumeration.\n * @param email The email address to send the reset link to\n /\n async requestPasswordReset(email: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]}`,\n { email },\n options,\n );\n }\n\n /\n Complete a password reset by providing the token and new password.\n * Calls POST /api/v1/auth/password-reset/complete\n * @param token The reset token from the email link\n * @param newPassword The new password\n /\n async completePasswordReset(token: string, newPassword: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]}`,\n { token, newPassword },\n options,\n );\n }\n\n // ─── Registration manual calls ───\n\n /\n Register a new user account.\n * Calls POST /api/v1/auth/register\n * The backend always returns a generic success message to prevent email enumeration.\n * @param data Registration form data (email, firstName, lastName, password)\n /\n async register(data: { email: string; firstName: string; lastName: string; password?: string; organizationName?: string }, options?: RequestOptions): Promise<{ message: string; ssoRedirectHint?: boolean }> {\n return this.post<{ message: string; ssoRedirectHint?: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REGISTER]}`,\n data,\n options,\n );\n }\n\n /\n Discover the org's SSO/SCIM-aware first-factor auth methods for a PUBLIC\n * invitation-accept screen, keyed by the invitation token WITHOUT consuming it\n * (unlike accept). Calls GET /api/v1/auth/invitation/info?token=…\n \n Distinct from `identifyByEmail` (email→domain, requires an existing user):\n * this works for a not-yet-activated invitee (INVITED membership, no session) and\n * additionally returns `managementMode` (open/sso/scim) so the chooser can render\n * the SCIM informational state instead of a credential form. The returned\n * `availableFirstFactorMethods` are consumed identically to `identify()`'s\n * `firstFactorMethods`, so the login `AUTH_METHOD_COMPONENTS` registry renders them.\n /\n async getInvitationInfo(token: string, options?: RequestOptions): Promise<AuthInvitationInfoResponse> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_INVITATION_INFO];\n const url = `${API_CALL_PREFIX}${routeTemplate}?token=${encodeURIComponent(token)}`;\n return this.get<AuthInvitationInfoResponse>(url, options);\n }\n\n /\n Accept an invitation using a public invitation token.\n * Calls POST /api/v1/auth/invitation/accept\n \n Two outcomes on the wire (discriminated by `credentialMethod`):\n * - PASSWORD / absent / PASSKEY → a SESSION (`accessToken` when the pipeline completed,\n * else MFA-continuation fields). This is the path `AuthSessionContext.acceptInvitation`\n * drives.\n * - `MAGIC_LINK` → NO session; a link is emailed and the response is the generic\n * `{ messageRef, message }` (\"check your email\", anti-enumeration). The invitation\n * magic-link sub-form calls this directly and ignores the body (success ⇒ link sent).\n /\n async acceptInvitation(\n data: { invitationToken: string; firstName?: string; lastName?: string; password?: string; credentialMethod?: AuthMethod },\n options?: RequestOptions,\n ): Promise<{\n sessionId: string;\n state: string;\n purpose: string;\n nextStep?: string;\n userId?: string;\n accessToken?: string;\n expiresIn?: number;\n requiresMFA?: boolean;\n availableEnrollmentMethods?: AuthMethod[];\n /\n The Wildo refresh token is NEVER on the wire (cookie-only contract, Auth-hardening\n * A-Step 6) — the controller sets it as the `__wildo_refresh` HttpOnly cookie. So this\n * return type intentionally omits `refreshToken`.\n /\n /* Present ONLY on the MAGIC_LINK-at-accept outcome (no session issued). /\n message?: string;\n messageRef?: string;\n /\n Present ONLY on the PASSKEY-at-accept session-issued outcome — the pre-generated WebAuthn\n * registration challenge. The caller runs the browser ceremony and completes it against the\n * authenticated `/auth/passkey/register/verify` route. Shape is the `@simplewebauthn` options\n * JSON (kept as `Record` here to avoid coupling the HTTP client to the browser lib).\n /\n passkeyRegistrationOptions?: Record<string, unknown>;\n }> {\n return this.post<{\n sessionId: string;\n state: string;\n purpose: string;\n nextStep?: string;\n userId?: string;\n accessToken?: string;\n expiresIn?: number;\n requiresMFA?: boolean;\n availableEnrollmentMethods?: AuthMethod[];\n message?: string;\n messageRef?: string;\n passkeyRegistrationOptions?: Record<string, unknown>;\n }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]}`,\n data,\n options,\n );\n }\n\n /\n Reject an invitation using a public invitation token.\n * Calls POST /api/v1/auth/invitation/reject\n /\n async rejectInvitation(\n data: { invitationToken: string; rejectionReason?: string },\n options?: RequestOptions,\n ): Promise<{ rejected: true; status: 'REJECTED' }> {\n return this.post<{ rejected: true; status: 'REJECTED' }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_INVITATION]}`,\n data,\n options,\n );\n }\n\n /\n List the authenticated caller's OWN pending invitations across all organizations\n * (Approach P, email-owned — no token). Calls GET /api/v1/auth/invitations/mine.\n /\n async listMyPendingInvitations(\n options?: RequestOptions,\n ): Promise<{ invitations: MyPendingInvitationView[] }> {\n return this.get<{ invitations: MyPendingInvitationView[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]}`,\n options,\n );\n }\n\n /\n Accept ONE of the caller's own pending invitations in-app — no token, no new session\n * (the caller is already authenticated). Calls POST /api/v1/auth/invitations/accept.\n /\n async acceptMyInvitation(\n membershipId: string,\n options?: RequestOptions,\n ): Promise<{ accepted: true; organizationId: string }> {\n return this.post<{ accepted: true; organizationId: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]}`,\n { membershipId },\n options,\n );\n }\n\n /\n Decline ONE of the caller's own pending invitations in-app (deletes the INVITED\n * membership row). Calls POST /api/v1/auth/invitations/reject.\n /\n async rejectMyInvitation(\n membershipId: string,\n rejectionReason?: string,\n options?: RequestOptions,\n ): Promise<{ rejected: true; organizationId: string }> {\n return this.post<{ rejected: true; organizationId: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]}`,\n { membershipId, rejectionReason },\n options,\n );\n }\n\n /\n Verify an email address using the token and email from the verification link.\n * Calls POST /api/v1/auth/verify-email\n * On success, returns JWT tokens for auto-login.\n /\n async verifyEmail(token: string, email: string, options?: RequestOptions): Promise<{\n accessToken?: string; refreshToken?: string; expiresIn?: number;\n userId?: string; sessionId?: string; state?: string; nextStep?: string;\n requiresMFA?: boolean; availableEnrollmentMethods?: AuthMethod[]; requireStrongMFA?: boolean;\n mfaGraceExpiresAt?: string;\n }> {\n return this.post<{\n accessToken?: string; refreshToken?: string; expiresIn?: number;\n userId?: string; sessionId?: string; state?: string; nextStep?: string;\n requiresMFA?: boolean; availableEnrollmentMethods?: AuthMethod[]; requireStrongMFA?: boolean;\n mfaGraceExpiresAt?: string;\n }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_VERIFY_EMAIL]}`,\n { token, email },\n options,\n );\n }\n\n async resendVerificationEmail(email: string, options?: RequestOptions): Promise<{ messageRef: string; message: string }> {\n return this.post<{ messageRef: string; message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]}`,\n { email },\n options,\n );\n }\n\n // ─── MFA: Email OTP ───\n\n async mfaEmailOTPSend(sessionId: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]}`,\n { sessionId },\n options,\n );\n }\n\n async mfaEmailOTPVerify(sessionId: string, code: string, options?: RequestOptions): Promise<AuthenticationResponse> {\n return this.post<AuthenticationResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]}`,\n { sessionId, code },\n options,\n );\n }\n\n // ─── MFA: TOTP ───\n\n async mfaTOTPSetup(options?: RequestOptions): Promise<{ secret: string; qrCodeUri: string; backupCodes?: string[] }> {\n return this.post<{ secret: string; qrCodeUri: string; backupCodes?: string[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP]}`,\n {},\n options,\n );\n }\n\n async mfaTOTPVerifySetup(code: string, options?: RequestOptions): Promise<{ verified: boolean }> {\n return this.post<{ verified: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP]}`,\n { code },\n options,\n );\n }\n\n async mfaTOTPVerify(sessionId: string, code: string, options?: RequestOptions): Promise<AuthenticationResponse> {\n return this.post<AuthenticationResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY]}`,\n { sessionId, code },\n options,\n );\n }\n\n // ─── WebAuthn/Passkey ───\n\n async passkeyRegisterOptions(sessionId?: string, options?: RequestOptions): Promise<Record<string, unknown>> {\n return this.post<Record<string, unknown>>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS]}`,\n { sessionId },\n options,\n );\n }\n\n async passkeyRegisterVerify(credential: Record<string, unknown>, options?: RequestOptions): Promise<{ registered: boolean }> {\n return this.post<{ registered: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY]}`,\n credential,\n options,\n );\n }\n\n async passkeyAuthOptions(sessionId: string, options?: RequestOptions): Promise<Record<string, unknown>> {\n return this.post<Record<string, unknown>>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS]}`,\n { sessionId },\n options,\n );\n }\n\n async passkeyAuthVerify(credential: Record<string, unknown>, options?: RequestOptions): Promise<AuthenticationResponse> {\n return this.post<AuthenticationResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY]}`,\n credential,\n options,\n );\n }\n\n async passkeyList(options?: RequestOptions): Promise<{ credentials: Array<{ credentialId: string; name: string; createdAt: string }> }> {\n return this.get<{ credentials: Array<{ credentialId: string; name: string; createdAt: string }> }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_LIST]}`,\n options,\n );\n }\n\n async passkeyRemove(credentialId: string, options?: RequestOptions): Promise<{ success: boolean }> {\n return this.post<{ success: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REMOVE]}`,\n { credentialId },\n options,\n );\n }\n\n async passkeyRename(credentialId: string, name: string, options?: RequestOptions): Promise<{ success: boolean }> {\n return this.post<{ success: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_RENAME]}`,\n { credentialId, name },\n options,\n );\n }\n\n // ─── Magic Link (Phase G2) ───\n\n async magicLinkSend(email: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]}`,\n { email },\n options,\n );\n }\n\n async magicLinkVerify(token: string, email: string, options?: RequestOptions): Promise<AuthenticationResponse> {\n return this.post<AuthenticationResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]}`,\n { token, email },\n options,\n );\n }\n\n // ─── SMS OTP (Phase G2) ───\n\n async smsOTPSend(sessionId: string, phoneNumber?: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SMS_OTP_SEND]}`,\n { sessionId, phoneNumber },\n options,\n );\n }\n\n // ─── Phone Verification (Phase G2) ───\n\n async phoneVerifySend(phoneNumber: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND]}`,\n { phoneNumber },\n options,\n );\n }\n\n async phoneVerifyConfirm(phoneNumber: string, code: string, options?: RequestOptions): Promise<{ verified: boolean }> {\n return this.post<{ verified: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM]}`,\n { phoneNumber, code },\n options,\n );\n }\n\n // ─── Method Management (#13f) ───\n\n async passwordChange(currentPassword: string, newPassword: string, options?: RequestOptions): Promise<{ changed: boolean }> {\n return this.post<{ changed: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]}`,\n { currentPassword, newPassword },\n options,\n );\n }\n\n async passwordSet(newPassword: string, options?: RequestOptions): Promise<{ set: boolean }> {\n return this.post<{ set: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_SET]}`,\n { newPassword },\n options,\n );\n }\n\n async mfaTOTPDisable(options?: RequestOptions): Promise<{ disabled: boolean }> {\n return this.post<{ disabled: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE]}`,\n {},\n options,\n );\n }\n\n async getMyMethods(options?: RequestOptions): Promise<{ methods: Array<{ method: string; enrolled: boolean; enrolledAt?: string; details?: Record<string, unknown> }> }> {\n return this.get<{ methods: Array<{ method: string; enrolled: boolean; enrolledAt?: string; details?: Record<string, unknown> }> }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_METHODS_MINE]}`,\n options,\n );\n }\n\n async getIdentityLinks(options?: RequestOptions): Promise<{ links: Array<{ _id: string; connectionType: SsoConnectionType; source: ExternalIdentitySource; providerRef: string; providerEmail: string; linkedAt: string; lastUsedAt: string }> }> {\n return this.get<{ links: Array<{ _id: string; connectionType: SsoConnectionType; source: ExternalIdentitySource; providerRef: string; providerEmail: string; linkedAt: string; lastUsedAt: string }> }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]}`,\n options,\n );\n }\n\n async unlinkIdentityLink(linkId: string, options?: RequestOptions): Promise<{ unlinked: boolean }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK];\n const url = `${API_CALL_PREFIX}${routeTemplate.replace(':linkId', linkId)}`;\n return this.delete<{ unlinked: boolean }>(url, options);\n }\n\n // ─── Connecting a third-party account ───\n\n /\n What this application can connect to. Calls `GET /api/v1/connections`.\n \n Answers admissibility, never authorization: whether the caller may act for a given owner depends\n * on that owner's id, which a catalogue has none of. A screen that offers an owner the caller\n * cannot act for is refused at `startProviderConnection`, which is where both gates run in the\n * order every credential path uses.\n /\n async listConnectableProviders(options?: RequestOptions): Promise<{ providers: ConnectableProviderView[] }> {\n return this.get<{ providers: ConnectableProviderView[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]}`,\n options,\n );\n }\n\n /\n Begin connecting one account. Calls `POST /api/v1/connections/:providerRef/start`.\n \n Returns a URL rather than following a redirect, and the CALLER navigates. A 302 answered here\n * would be followed by this fetch, produce an opaque cross-origin response, and render the vendor's\n * consent screen into a response body nobody ever sees.\n /\n async startProviderConnection(\n providerRef: string,\n body: {\n target: { ownerScope: string; delegation: string; ownerId?: string };\n scopes?: string[];\n connectionParameters?: Record<string, string>;\n },\n options?: RequestOptions,\n ): Promise<{ authorizeUrl: string }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_START];\n const url = `${API_CALL_PREFIX}${routeTemplate.replace(':providerRef', encodeURIComponent(providerRef))}`;\n return this.post<{ authorizeUrl: string }>(url, body, options);\n }\n\n async reAuthenticate(method: AuthMethod.PASSWORD \| AuthMethod.PASSKEY, credentials: { password?: string; passkeyResponse?: Record<string, unknown> }, options?: RequestOptions): Promise<{ reAuthToken: string }> {\n return this.post<{ reAuthToken: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REAUTH]}`,\n { method, ...credentials },\n options,\n );\n }\n\n // ─── Enterprise SSO ───\n\n async getEnterpriseSSOAuthorizationUrl(\n orgId: string,\n connectionId: string,\n returnUrl?: string,\n options?: RequestOptions,\n ): Promise<{ authorizationUrl: string }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE];\n const baseUrl = `${API_CALL_PREFIX}${routeTemplate.replace(':orgId', orgId).replace(':connectionId', connectionId)}`;\n const url = returnUrl\n ? `${baseUrl}?returnUrl=${encodeURIComponent(returnUrl)}`\n : baseUrl;\n return this.get<{ authorizationUrl: string }>(url, options);\n }\n\n async getAppEnterpriseSSOAuthorizationUrl(\n connectionId: string,\n returnUrl?: string,\n options?: RequestOptions,\n ): Promise<{ authorizationUrl: string }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE];\n const baseUrl = `${API_CALL_PREFIX}${routeTemplate.replace(':connectionId', connectionId)}`;\n const url = returnUrl\n ? `${baseUrl}?returnUrl=${encodeURIComponent(returnUrl)}`\n : baseUrl;\n return this.get<{ authorizationUrl: string }>(url, options);\n }\n\n /\n Public status read of a file-upload grant — the drop page's first call.\n \n Authenticated by the token in the URL alone: no bearer is needed, and one the tab happens to\n * hold is irrelevant to the route. The answer is parsed through the shared contract so a drifted\n * server can never reach the page as UI state.\n /\n async readFileUploadGrantStatus(token: string, options?: RequestOptions): Promise<FileUploadGrantStatus> {\n return this.get<FileUploadGrantStatus>(`${API_CALL_PREFIX}/files/upload-grants/${encodeURIComponent(token)}`, {\n ...options,\n schema: FileUploadGrantStatusSchema,\n });\n }\n\n /\n Redeems a file-upload grant with the bytes a visitor chose.\n \n The grant IS the credential: the status names the header (`uploadHeaderName`) and the token is\n * its value, sent on this one request only — never installed on the shared client, which would\n * attach it to every later call. The backend processes an ALTERNATIVE token BEFORE any bearer, so\n * a signed-in visitor's session never claims the upload; it is attributed to the grant's minter.\n * `uploadUrl` is absolute, issued by the API that owns the route, and axios honours an absolute URL\n * over `baseURL`. The multipart field is `file`, the same one the grant's curl example uses.\n /\n async uploadWithFileUploadGrant(status: FileUploadGrantStatus, token: string, file: File, options?: UploadFileOptions): Promise<unknown> {\n const formData = new FormData();\n formData.append('file', file);\n return this.uploadFile(status.uploadUrl, formData, {\n ...options,\n headers: { ...options?.headers, [status.uploadHeaderName]: token },\n });\n }\n\n async exchangeOneOffToken(token: string, options?: RequestOptions): Promise<OneOffTokenExchangeResponse> {\n return this.post<OneOffTokenExchangeResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]}`,\n { token },\n options,\n );\n }\n\n /\n Request a one-time cross-frontend handoff URL (cross-app-jwt-propagation Step 2 + 3).\n \n Calls POST /api/v1/auth/cross-frontend-handoff with the user's bearer token. The\n * backend re-issues a fresh JWT pair, binds it to a single-use AUTH_CODE_EXCHANGE\n * consumable token (60s TTL), and returns `{ handoffUrl, expiresAt }`. The caller\n * decides how to use the URL (`location.assign` to replace, `window.open` for a new\n * tab) — see `requestCrossFrontendHandoff()` /\n * `useCrossFrontendHandoff()` in `core/security/cross-frontend-handoff.frontend.service.ts`\n * for the friendlier wrapper that maps backend error codes onto a typed client error.\n \n Bearer-only — no cookies / `withCredentials`. The base client's authentication\n * interceptor injects `Authorization: Bearer <accessToken>` and\n * `X-Frontend-Service-Name: <envFrontendServiceName>` automatically; the backend uses\n * the latter to (a) scope rate-limiting per `(userId, sourceFrontend)` pair and\n * (b) cross-validate the source identity against the browser's `Origin` header to\n * defend against header spoofing.\n /\n async crossFrontendHandoff(request: CrossFrontendHandoffRequest, options?: RequestOptions): Promise<CrossFrontendHandoffResponse> {\n return this.post<CrossFrontendHandoffResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]}`,\n request,\n options,\n );\n }\n\n // ─── Features ───\n\n async getResolvedFeatures(options?: RequestOptions): Promise<Record<string, unknown>> {\n return this.get<Record<string, unknown>>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.FEATURES_RESOLVED]}`,\n options,\n );\n }\n\n // I18n manual calls\n /\n Retrieve i18n labels from backend\n * @param language The language to retrieve labels for (required)\n * @param sections Optional array of specific sections to retrieve\n * @param options Optional request options for headers, timeout, etc.\n * @returns Promise<I18nLabelsResponseDto> The i18n labels response\n /\n async getI18nLabels(language: AvailableLanguage, sections?: string[], options?: RequestOptions): Promise<I18nLabelsResponseDto> {\n let url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.I18N_GET_LABELS]}?language=${language}`;\n\n if (sections && sections.length > 0) {\n url += `&sections=${sections.join(',')}`;\n }\n\n return this.get<I18nLabelsResponseDto>(url, options);\n }\n\n /\n Load specific translation sub-trees by dot-path keys.\n * Response preserves the nested structure (e.g. `components.low_level_button` →\n * `{ components: { low_level_button: { ... } } }`).\n /\n async getI18nLabelsByKeys(language: AvailableLanguage, keys: string[], options?: RequestOptions): Promise<I18nLabelsResponseDto> {\n let url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.I18N_GET_LABELS]}?language=${language}`;\n url += `&keys=${keys.map(k => encodeURIComponent(k)).join(',')}`;\n return this.get<I18nLabelsResponseDto>(url, options);\n }\n\n // Charts manual calls\n /\n Fetch chart data by chart reference.\n * Calls POST /api/v1/charts/:chartRef/data with optional explicit inputs.\n \n @param chartRef Backend-resolvable chart execution reference\n * @param body Optional body payload (`{ inputs }`)\n * @param options Optional request options (abort signal, timeout, etc.)\n * @param queryParams Optional query parameters (for example validated org scope)\n * @returns Promise<AggregationQueryResponse>\n /\n async getChartData(\n chartRef: string,\n body?: ChartDataRequestBody,\n options?: RequestOptions,\n queryParams?: Record<string, string \| undefined>,\n ): Promise<AggregationQueryResponse> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.CHARTS_DATA];\n const queryString = queryParams\n ? new URLSearchParams(\n Object.entries(queryParams).filter(([, value]) => typeof value === 'string' && value.length > 0) as Array<[string, string]>,\n ).toString()\n : '';\n const url = `${API_CALL_PREFIX}${routeTemplate.replace(':chartRef', chartRef)}${queryString ? `?${queryString}` : ''}`;\n return this.post<AggregationQueryResponse>(url, body \|\| {}, options);\n }\n\n // Analytics manual calls\n /\n Ingest a batch of analytics events.\n * Calls POST /api/v1/analytics/events\n /\n async postAnalyticsEvents(body: { events: unknown[]; userId?: string }, options?: RequestOptions): Promise<{ accepted: number }> {\n return this.post<{ accepted: number }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.ANALYTICS_EVENTS]}`,\n body,\n options,\n );\n }\n\n /\n Get achieved value moments for the current user.\n * Calls GET /api/v1/analytics/moments/achieved\n /\n async getAnalyticsMomentsAchieved(options?: RequestOptions): Promise<{ moments: string[] }> {\n return this.get<{ moments: string[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]}`,\n options,\n );\n }\n\n /\n Mark a value moment as achieved.\n * Calls POST /api/v1/analytics/moments/achieved\n /\n async postAnalyticsMomentsAchieved(body: { momentIdentifier: string; scope?: string }, options?: RequestOptions): Promise<{ success: boolean; momentIdentifier: string }> {\n return this.post<{ success: boolean; momentIdentifier: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]}`,\n body,\n options,\n );\n }\n\n /\n Get all registered milestone definitions.\n * Calls GET /api/v1/progression/milestones\n */\n async getMilestoneDefinitions(options?: RequestOptions): Promise<{ definitions: MilestoneDefinition[] }> {\n return this.get<{ definitions: MilestoneDefinition[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROGRESSION_MILESTONES]}`,\n options,\n );\n }\n\n}\n\n// Lazy singleton instance - created on first access to avoid module initialization issues\nlet _manualCallsHttpClient: WildoBackendHttpClient_ManualCalls \| null = null;\n\nexport function getManualCallsHttpClient(): WildoBackendHttpClient_ManualCalls {\n if (!_manualCallsHttpClient) {\n _manualCallsHttpClient = new WildoBackendHttpClient_ManualCalls();\n }\n return _manualCallsHttpClient;\n}\n"]}
1	+ {"version":3,"file":"wildo-http-client-manual-calls.frontend.service.js","sourceRoot":"","sources":["../../../../../src/core/requests/wildo-http-client-manual-calls.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAsBH,OAAO,EAAmH,eAAe,EAA8B,UAAU,EAAE,uBAAuB,EAA4D,kBAAkB,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,2BAA2B,EAA8B,sCAAsC,EAAE,MAAM,uBAAuB,CAAC;AAC9e,OAAO,EAAkB,sBAAsB,EAAwD,MAAM,sCAAsC,CAAC;AACpJ,OAAO,EAAE,wBAAwB,EAAE,MAAM,gEAAgE,CAAC;AAE1G;;;GAGG;AAEH,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAgQ3C,MAAM,OAAO,kCAAmC,SAAQ,sBAAsB;IAE5E,YAAY,SAAuC,EAAE;QACnD,KAAK,CAAC,MAAM,CAAC,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,mBAA2B,EAAE,OAAwB;QAC9E,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,wBAAwB,mBAAmB,EAAE,CAAC;QAC7J,OAAO,IAAI,CAAC,GAAG,CAA6C,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,6EAA6E;IAC7E;;;;;;;OAOG;IACH,KAAK,CAAC,qBAAqB,CAAC,MAAuB,EAAE,OAAwB;QAC3E,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QACzI,OAAO,IAAI,CAAC,GAAG,CAAyB,GAAG,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,YAAoB,EAAE,QAA4B,EAAE,QAAkB,EAAE,OAAwB;QACzH,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EACrG,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,EAChF,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAAC,KAAa,EAAE,OAAwB;QAClE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE,EACjH,EAAE,KAAK,EAAE,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED,8BAA8B;IAC9B,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,OAAwB;QAC3D,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,IAAI,CAA6B,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5J,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,OAAwB;QAC/D,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC,GAAG,CAAM,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACvG,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,MAA8D,EAAE,OAAwB;QACrH,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC;QAC5F,OAAO,IAAI,CAAC,IAAI,CAAyB,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrK,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAA8B,EAAE,OAAwB;QACzE,OAAO,IAAI,CAAC,IAAI,CAAyB,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/J,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,aAAa,CAAC,OAAwB;QAC1C,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE,EACjG,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,yBAAyB,CAC7B,WAAmB,EACnB,SAAkB,EAClB,OAAwB,EACxB,kCAAsD;QAEtD,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,CAAC;QACpG,MAAM,OAAO,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;QAC1F;;;;WAIG;QACH,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACjD,KAAK,MAAM,SAAS,IAAI,kCAAkC,IAAI,EAAE;YAAE,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAC9G,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,OAAO,IAAI,CAAC,GAAG,CAA+B,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,OAAwB;QAC3D,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,EAClG,0BAA0B,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,EAC1C,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAwB;QAC9C,MAAM,IAAI,CAAC,IAAI,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,EAC1F,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED,sCAAsC;IAEtC;;;;;OAKG;IACH,KAAK,CAAC,oBAAoB,CAAC,KAAa,EAAE,OAAwB;QAChE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,EAC1G,EAAE,KAAK,EAAE,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CAAC,KAAa,EAAE,WAAmB,EAAE,OAAwB;QACtF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,EAC3G,EAAE,KAAK,EAAE,WAAW,EAAE,EACtB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,oCAAoC;IAEpC;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ,CACZ,IAA4B,EAC5B,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,EAC5F,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,OAAwB;QAC7D,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;QACnG,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO,IAAI,CAAC,GAAG,CAA6B,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,gBAAgB;IACpB;;;OAGG;IACH,EAAE,QAAQ,EAAE,GAAG,UAAU,EAA2I,EACpK,OAAwB;QA4BxB,OAAO,IAAI,CAAC,IAAI,CAcd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE;QACrG,wGAAwG;QACxG,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,UAAU,EAC7E,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CACpB,IAA2D,EAC3D,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EACrG,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAC5B,OAAwB;QAExB,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,EACvG,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,YAAoB,EACpB,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,EACxG,EAAE,YAAY,EAAE,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,YAAoB,EACpB,eAAwB,EACxB,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,EACxG,EAAE,YAAY,EAAE,eAAe,EAAE,EACjC,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,KAAa,EAAE,OAAwB;QAMtE,OAAO,IAAI,CAAC,IAAI,CAMd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,EAAE,KAAK,EAAE,KAAK,EAAE,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qBAAqB,CAAC,SAAiB,EAAE,gBAAwB,EAAE,OAAwB;QAC/F,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,EAC3G,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAC/B,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,yBAAyB,CAAC,SAAiB,EAAE,SAAiB,EAAE,QAAgB,EAAE,OAAwB;QAC9G,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,EAAE,EAC/G,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,EAClC,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAa,EAAE,OAAwB;QACnE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,EACvG,EAAE,KAAK,EAAE,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED,yBAAyB;IAEzB,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,OAAwB;QAC/D,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,uBAAuB,CAAC,EAAE,EACtG,EAAE,SAAS,EAAE,EACb,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB,EAAE,IAAY,EAAE,OAAwB;QAC/E,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,EACxG,EAAE,SAAS,EAAE,IAAI,EAAE,EACnB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,oBAAoB;IAEpB,KAAK,CAAC,YAAY,CAAC,OAAwB;QACzC,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,EAClG,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAY,EAAE,OAAwB;QAC7D,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,EACzG,EAAE,IAAI,EAAE,EACR,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,IAAY,EAAE,OAAwB;QAC3E,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,EACnG,EAAE,SAAS,EAAE,IAAI,EAAE,EACnB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,2BAA2B;IAE3B,KAAK,CAAC,sBAAsB,CAAC,SAAkB,EAAE,OAAwB;QACvE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,EAC5G,EAAE,SAAS,EAAE,EACb,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,UAAmC,EAAE,OAAwB;QACvF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,EAC3G,UAAU,EACV,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CACtB,SAAkB,EAClB,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,EACxG,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAC9B,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACrB,UAAqG,EACrG,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,EACvG,UAAU,EACV,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAwB;QACxC,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB,EAAE,OAAwB;QAChE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,EAClG,EAAE,YAAY,EAAE,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB,EAAE,IAAY,EAAE,OAAwB;QAC9E,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,EAAE,EAClG,EAAE,YAAY,EAAE,IAAI,EAAE,EACtB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,gCAAgC;IAEhC;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,QAAiB,EAAE,OAAwB;QAC5E,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,EACnG,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EACpE,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,KAAa,EAAE,OAAwB;QAC1E,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EACrG,EAAE,KAAK,EAAE,KAAK,EAAE,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,6BAA6B;IAE7B,2GAA2G;IAC3G,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAwB;QAC1D,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,EAAE,SAAS,EAAE,EACb,OAAO,CACR,CAAC;IACJ,CAAC;IAED,wCAAwC;IAExC,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,OAAwB;QACjE,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EACrG,EAAE,WAAW,EAAE,EACf,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,WAAmB,EAAE,IAAY,EAAE,OAAwB;QAClF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,EAAE,EACxG,EAAE,WAAW,EAAE,IAAI,EAAE,EACrB,OAAO,CACR,CAAC;IACJ,CAAC;IAED,mCAAmC;IAEnC,KAAK,CAAC,cAAc,CAAC,eAAuB,EAAE,WAAmB,EAAE,OAAwB;QACzF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,EACnG,EAAE,eAAe,EAAE,WAAW,EAAE,EAChC,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,OAAwB;QAC7D,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,EAAE,WAAW,EAAE,EACf,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAwB;QAC3C,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,EAAE,EACpG,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAwB;QACzC,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAwB;QAC7C,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE,EACvG,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kCAAkC,CAAC,OAAwB;QAC/D,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE,EACjH,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,uBAAuB,CAC3B,kCAAqD,EACrD,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,EAAE,EACnH,EAAE,kCAAkC,EAAE,CAAC,GAAG,kCAAkC,CAAC,EAAE,EAC/E,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,qCAAqC,CAAC,WAAmB,EAAE,OAAwB;QACvF,MAAM,IAAI,CAAC,IAAI,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,kCAAkC,CAAC,EAAE,EACjH,EAAE,WAAW,EAAE,EACf,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,8CAA8C,CAAC,WAAmB,EAAE,OAAwB;QAChG,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,sCAAsC,EAAE,EAC7D,EAAE,WAAW,EAAE,EACf,OAAO,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,OAAwB;QAC/D,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;QACzG,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,MAAM,CAAwB,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,2CAA2C;IAE3C;;;;;;;OAOG;IACH,KAAK,CAAC,wBAAwB,CAAC,OAAwB;QACrD,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,EAC5G,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,uBAAuB,CAC3B,WAAmB,EACnB,IAMC,EACD,OAAwB;QAExB,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,CAAC;QACxG,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC1G,OAAO,IAAI,CAAC,IAAI,CAA2B,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,0BAA0B,CAC9B,IAAqC,EACrC,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,4BAA4B,CAAC,EAAE,EAC3G,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH;;;;;OAKG;IACH,KAAK,CAAC,gCAAgC,CACpC,WAAmB,EACnB,OAAwB;QAExB,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,CAAC;QAC/G,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC1G,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,GAAG,CAAiF,GAAG,EAAE,OAAO,CAAC,CAAC;QACtH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,sBAAsB,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACpD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,WAAmB,EACnB,IAOC,EACD,OAAwB;QAExB,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oCAAoC,CAAC,CAAC;QACnH,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,cAAc,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC1G,OAAO,IAAI,CAAC,IAAI,CAAqC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED,2HAA2H;IAC3H;;;;;;;;;OASG;IACH,KAAK,CAAC,wBAAwB,CAC5B,WAAmB,EACnB,WAAmB,EACnB,IAIC,EACD,OAAwB;QAExB,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;QACzG,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa;aAC3C,OAAO,CAAC,cAAc,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;aACxD,OAAO,CAAC,cAAc,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,IAAI,CAAsC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iCAAiC,CACrC,WAAmB,EACnB,WAAmB,EACnB,UAAkB,EAClB,IAIC,EACD,OAAwB;QAExB,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,gCAAgC,CAAC,CAAC;QAC/G,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa;aAC3C,OAAO,CAAC,cAAc,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;aACxD,OAAO,CAAC,cAAc,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;aACxD,OAAO,CAAC,aAAa,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAmF,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzH,CAAC;IACD,uEAAuE;IAEvE;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAClB,MAAkE,EAClE,WAA4F;IAC5F,8FAA8F;IAC9F,UAAmC,uBAAuB,CAAC,OAAO,EAClE,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,EAC1F,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,EACnC,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,0BAA0B,CAC9B,OAAgC,EAChC,OAAwB;QAExB,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,mBAAmB,CAAC,IAAI,KAAK,EAAE,EAC3G,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAwB;QACjD,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,EAC1G,EAAE,EACF,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,8BAA8B,CAClC,cAAsB,EACtB,OAAgC,EAChC,OAAwB;QAExB,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,+BAA+B,CAAC,EAAE,EAC9G,EAAE,cAAc,EAAE,OAAO,EAAE,EAC3B,OAAO,CACR,CAAC;IACJ,CAAC;IAED,+GAA+G;IAC/G,KAAK,CAAC,iCAAiC,CAAC,IAAY,EAAE,OAAwB;QAC5E,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,8BAA8B,CAAC,EAAE,EAC7G,EAAE,IAAI,EAAE,EACR,OAAO,CACR,CAAC;IACJ,CAAC;IAED,yBAAyB;IAEzB,KAAK,CAAC,gCAAgC,CACpC,KAAa,EACb,YAAoB,EACpB,SAAkB,EAClB,OAAwB;QAExB,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,CAAC;QAC5G,MAAM,OAAO,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC;QACrH,MAAM,GAAG,GAAG,SAAS;YACnB,CAAC,CAAC,GAAG,OAAO,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE;YACzD,CAAC,CAAC,OAAO,CAAC;QACZ,OAAO,IAAI,CAAC,GAAG,CAA+B,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,mCAAmC,CACvC,YAAoB,EACpB,SAAkB,EAClB,OAAwB;QAExB,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,CAAC;QAC5G,MAAM,OAAO,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5F,MAAM,GAAG,GAAG,SAAS;YACnB,CAAC,CAAC,GAAG,OAAO,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE;YACzD,CAAC,CAAC,OAAO,CAAC;QACZ,OAAO,IAAI,CAAC,GAAG,CAA+B,GAAG,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,yBAAyB,CAAC,KAAa,EAAE,OAAwB;QACrE,OAAO,IAAI,CAAC,GAAG,CAAwB,GAAG,eAAe,wBAAwB,kBAAkB,CAAC,KAAK,CAAC,EAAE,EAAE;YAC5G,GAAG,OAAO;YACV,MAAM,EAAE,2BAA2B;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,yBAAyB,CAAC,MAA6B,EAAE,KAAa,EAAE,IAAU,EAAE,OAA2B;QACnH,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;QAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE;YACjD,GAAG,OAAO;YACV,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAa,EAAE,OAAwB;QAC/D,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,6BAA6B,CAAC,EAAE,EAC5G,EAAE,KAAK,EAAE,EACT,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAoC,EAAE,OAAwB;QACvF,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE,EAC1G,OAAO,EACP,OAAO,CACR,CAAC;IACJ,CAAC;IAED,mBAAmB;IAEnB,KAAK,CAAC,mBAAmB,CAAC,OAAwB;QAChD,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,EAAE,EAChG,OAAO,CACR,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,QAA2B,EAAE,QAAmB,EAAE,OAAwB;QAC5F,IAAI,GAAG,GAAG,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,aAAa,QAAQ,EAAE,CAAC;QAE9H,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,GAAG,IAAI,aAAa,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAwB,GAAG,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAA2B,EAAE,IAAc,EAAE,OAAwB;QAC7F,IAAI,GAAG,GAAG,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,eAAe,CAAC,aAAa,QAAQ,EAAE,CAAC;QAC9H,GAAG,IAAI,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,CAAwB,GAAG,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,sBAAsB;IACtB;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,IAA2B,EAC3B,OAAwB,EACxB,WAAgD;QAEhD,MAAM,aAAa,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;QAC1F,MAAM,WAAW,GAAG,WAAW;YAC7B,CAAC,CAAC,IAAI,eAAe,CACnB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAA4B,CAC5H,CAAC,QAAQ,EAAE;YACZ,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,GAAG,GAAG,GAAG,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACvH,OAAO,IAAI,CAAC,IAAI,CAA2B,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,yBAAyB;IACzB;;;OAGG;IACH,KAAK,CAAC,mBAAmB,CAAC,IAA4C,EAAE,OAAwB;QAC9F,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,EAC/F,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,2BAA2B,CAAC,OAAwB;QACxD,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,EACzG,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,4BAA4B,CAAC,IAAkD,EAAE,OAAwB;QAC7G,OAAO,IAAI,CAAC,IAAI,CACd,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,0BAA0B,CAAC,EAAE,EACzG,IAAI,EACJ,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,OAAwB;QACpD,OAAO,IAAI,CAAC,GAAG,CACb,GAAG,eAAe,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,sBAAsB,CAAC,EAAE,EACrG,OAAO,CACR,CAAC;IACJ,CAAC;CAEF;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,SAAS,GAAG,KAAqE,CAAC;IACxF,MAAM,MAAM,GAAG,SAAS,EAAE,MAAM,IAAI,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC;IAChE,OAAO,MAAM,KAAK,GAAG,CAAC;AACxB,CAAC;AAED,0FAA0F;AAC1F,IAAI,sBAAsB,GAA8C,IAAI,CAAC;AAE7E,MAAM,UAAU,wBAAwB;IACtC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,sBAAsB,GAAG,IAAI,kCAAkC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC","sourcesContent":["/*\n WildoBackendHttpClient_ManualCalls\n * Specialized HTTP client for manual/custom API calls\n * Extends base WildoBackendHttpClient with flexibility for non-standard endpoints\n /\n\nimport type { AuthenticationResponseJSON, PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/browser';\nimport { AvailableLanguage } from '@wildo-ai/presets-components-models';\nimport type { ProviderOAuth2EndpointPlaceholderPosition } from '@wildo-ai/external-connectors-models';\nimport type {\n AggregationQueryResponse,\n AuthenticationSessionState,\n AuthInvitationInfoResponse,\n AuthNextStep,\n AuthSessionPurpose,\n ChartDataRequestBody,\n CrossFrontendHandoffRequest,\n CrossFrontendHandoffResponse,\n ExternalIdentitySource,\n MilestoneDefinition,\n OneOffTokenExchangeResponse,\n SsoConnectionType,\n TokenExchangeOrganizationOnboardingResponse,\n TokenExchangeResponse,\n GovernedDocumentAcceptanceOwed,\n} from '@wildo-ai/saas-models';\nimport { AppConfiguration_FrontendBootstrapResponse, OnboardingObligation, AuthenticationRequest, AuthenticationResponse, AuthFactorLevel, AuthIdentificationResponse, AuthMethod, ReAuthenticationPurpose, type ReAuthenticationIdentityLink, I18nLabelsResponseDto, MAIN_API_BASE_PATH, MANUAL_CONTROLLER_ROUTES_URLS, ManualControllerRouteKey, TokenExchangeRequestSchema, FileUploadGrantStatusSchema, type FileUploadGrantStatus, ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH } from '@wildo-ai/saas-models';\nimport { RequestOptions, WildoBackendHttpClient, WildoBackendHttpClientConfig, type UploadFileOptions } from './wildo-http-client.frontend.service';\nimport { isSafeAuthRedirectTarget } from '~wildo-frontend-lib/core/security/auth-redirect.frontend.utils';\n\n/\n Specialized HTTP client for manual/custom API calls\n * Provides methods for application configuration and other manual endpoints\n /\n\n// Single source of truth for the API mount prefix — shared with the backend\n// HTTP server mount and the refresh-token cookie `Path` so the URLs this\n// client builds always hit the same served paths the cookie is scoped to.\nconst API_CALL_PREFIX = MAIN_API_BASE_PATH;\n\n/\n What an MFA enrollment ceremony did to the authentication session it was performed on — the\n * `enrollmentSession` member the TOTP verify-setup, passkey register-verify and phone verify-confirm\n * responses carry. Produced by the backend controller's `_settleEnrollmentSession`, which projects the\n * orchestrator's `settleSecondFactorEnrollment` outcome.\n \n ABSENT when no session moved — always for a settings-page enrollment (JWT, no session header).\n * When present, `state` is the session's new `AuthenticationSessionState`:\n * - `MFA_REQUIRED` — a LOGIN session: the enrolled factor must now be presented as a challenge;\n * - `COMPLETED` — a REGISTRATION or INVITATION session finished. `accessToken` is present and the\n * refresh token arrived as the `__wildo_refresh` cookie, so the user is signed in;\n * - `ONBOARDING_PENDING` — the account still owes its organization; `nextStep` is `ONBOARDING` and the session\n * is completed on the organization-onboarding step (#1090). No token yet.\n /\nexport interface EnrollmentSessionSettlementResponse {\n sessionId: string;\n state: AuthenticationSessionState;\n nextStep?: AuthNextStep;\n /* Present only on `COMPLETED`. The refresh token is never in the body. /\n accessToken?: string;\n expiresIn?: number;\n}\n\n/\n The answer to an onboarding completion — `POST /auth/onboarding/complete-org` (#1090) or\n * `/complete-profile` (#1374). Either the account is signed in (`accessToken`; the refresh token arrives only as\n * the `__wildo_refresh` cookie), or the session is still parked on another obligation, named in\n * `pendingObligations`, and no token is issued. A refused completion (a spent or expired session, a policy that\n * no longer allows it) is an error, not an answer.\n /\nexport interface OnboardingCompletionResponse {\n sessionId: string;\n state: AuthenticationSessionState;\n nextStep?: AuthNextStep;\n organizationId?: string;\n /* What the still-parked session owes next, when it did not sign in (#1374). /\n pendingObligations?: OnboardingObligation[];\n userId?: string;\n accessToken?: string;\n expiresIn?: number;\n}\n\n/* The body of `POST /auth/register`. /\nexport interface RegisterAccountRequest {\n email: string;\n /* Absent for a user type that collects the names at onboarding (#1374). /\n firstName?: string;\n lastName?: string;\n password?: string;\n organizationName?: string;\n /\n Release IDS the registrant affirmatively accepted (issue #54). Only ids: the server resolves\n * which releases are in force and matches these against them, so a caller cannot choose a\n * version or invent a release. See `UserRegisterApiDtoSchema`.\n /\n acceptedGovernedDocumentReleaseIds?: string[];\n /\n Answers to the user type's declared sign-up profile questions (#1371), keyed by QUESTION ID.\n \n Ids rather than profile field names, deliberately — the same reasoning as the release ids\n * above. The server re-reads the declaration and decides which field each answer fills, so a\n * caller can neither name a profile field the application never asked about nor invent a\n * question. An undeclared key is REFUSED, not dropped.\n /\n profileAnswers?: Record<string, string \| number \| boolean>;\n /\n How the registrant will authenticate afterwards (#1093): PASSWORD (the default when absent),\n * MAGIC_LINK or PASSKEY. The backend refuses a method the user type's `registration.allowedMethods`\n * does not list, naming the allowed set.\n /\n method?: AuthMethod;\n /\n The deep link the registration screen was opened with, carried into the emailed sign-in link of a\n * password-less sign-up (#1086). The backend keeps it only when same-origin and within bounds.\n /\n redirect?: string;\n}\n\n/\n The answer to `POST /auth/register` — every member `registerUser` can put on the wire (#972).\n \n It used to be typed `{ message; ssoRedirectHint? }`, which is how the registration screen came to\n * ignore everything else: a signed-in answer, and a session parked at a second-factor enrollment, were\n * both invisible to it. Which members are present decides the outcome, and that decision has exactly\n * one home — `classifyRegistrationOutcome`. Read it there rather than branching on these here.\n \n - acknowledgement — an address that already has an account AND a new account awaiting address\n * verification, deliberately identical (#1010): `messageRef` / `message` only;\n * - SSO-enforced domain (whether or not the address has an account): plus `ssoRedirectHint: true`;\n * - password-less (whether or not the address has an account): plus `nextStep` (`MAGIC_LINK_SENT` \|\n * `PASSKEY_ENROLLMENT`), no session;\n * - deferred verification, finished: plus `state` (`COMPLETED` \| `MFA_ENROLLMENT_GRACE`), `userId`,\n * `accessToken`, `expiresIn` — the refresh token is the `__wildo_refresh` cookie, never the body;\n * - deferred verification, enrollment owed: plus `state: MFA_ENROLLMENT_REQUIRED`, `nextStep`,\n * `requiresMFA`, `availableEnrollmentMethods`, `requireStrongMFA`;\n * - deferred verification, organization owed: plus `sessionId`, `state: ONBOARDING_PENDING`,\n * `nextStep: ONBOARDING` (#1011), completed on the organization-onboarding step (#1090).\n \n Deferred verification is distinguishable from an existing address by construction — it signs a new\n * registrant in — and the configuration says so (`EmailVerificationMode.DEFERRED`).\n /\nexport interface RegisterAccountResponse {\n messageRef?: string;\n message: string;\n ssoRedirectHint?: boolean;\n sessionId?: string;\n state?: AuthenticationSessionState;\n purpose?: AuthSessionPurpose;\n nextStep?: AuthNextStep;\n userId?: string;\n accessToken?: string;\n expiresIn?: number;\n requiresMFA?: boolean;\n availableEnrollmentMethods?: AuthMethod[];\n requireStrongMFA?: boolean;\n}\n\n/\n OIDC interactive-consent (S1). `GET /oauth/authorize` for a `requiresConsent` client returns this\n * INSTEAD of a code redirect: the app renders a consent screen from it. `resource` is the A2A/MCP\n * agent endpoint (RFC 8707) the delegated token will be bound to; `null` when the request carried none.\n /\nexport interface OAuthConsentRequiredResponse {\n consent_required: true;\n consent_token: string;\n client: { id: string; name: string };\n scopes: string[];\n resource: string \| null;\n}\n\n/\n Trusted (non-`requiresConsent`) authorize result: the backend already minted the authorization code\n * and returns the redirect target (same `{ redirect_to }` shape as the consent decision, but a distinct\n * event — no user prompt). The SPA navigates the browser there without showing a consent screen.\n /\nexport interface OAuthAuthorizeRedirectResponse {\n redirect_to: string;\n}\n\n/\n `GET /oauth/authorize` result: EITHER a consent prompt (a `requiresConsent` client) OR a direct\n * redirect (a trusted client, code already minted). Discriminated by the presence of `consent_required`.\n /\nexport type OAuthAuthorizeResponse = OAuthConsentRequiredResponse \| OAuthAuthorizeRedirectResponse;\n\n/\n The consent decision result (S1). The app navigates the browser to `redirect_to`\n * (`window.location.assign`) to complete the OAuth redirect back to the third-party client — carrying\n * either the authorization `code` (approve) or `error=access_denied` (deny).\n /\nexport interface OAuthConsentDecisionResponse {\n redirect_to: string;\n}\n\n/\n The OIDC RP-Initiated Logout §6 confirmation result (revocation-C). After the End-User confirms, the\n * backend terminated the session and returns the signed-out page as `redirect_to` (always same-origin\n * `/oauth/logged-out`); the app navigates there. A stale/invalid token yields the same landing WITHOUT\n * terminating, so the caller need not distinguish success from a no-op.\n /\nexport interface OAuthEndSessionConfirmResponse {\n redirect_to: string;\n}\n\n/\n One of the authenticated caller's own pending invitations, as returned by\n * `GET /auth/invitations/mine` (Approach P). Mirrors the backend\n * `listMyPendingInvitations` projection; the invitee is not yet a member, so only\n * the org id/name + granted roles are surfaced for the \"accept/reject\" UI.\n /\nexport interface MyPendingInvitationView {\n /* The INVITED membership row id — the accept/decline target (junction model). /\n membershipId: string;\n organizationId: string;\n organizationName?: string;\n roles: string[];\n createdAt?: string;\n}\n\n/\n One connectable provider, as returned by `GET /connections`.\n \n The CATALOGUE, distinct from the person's stored credential rows: this says what MAY be connected,\n * the `userProviderCredentials` list says what IS. They are two questions and the empty answer to the\n * second — where everybody starts — is exactly when the first one matters.\n /\nexport interface ConnectableProviderView {\n providerRef: string;\n /\n Whether THIS DEPLOYMENT can begin a connection — not whether the vendor supports one.\n \n Those were the same field until pressing Connect on Asana produced a 502: Asana supports OAuth2\n * and this application had simply never registered with it, so the button could only ever fail.\n /\n connectable: boolean;\n /* Why not, when it is not. See `ProviderConnectabilityBlocker`. /\n notConnectableBecause?: string;\n /* HOW this provider is connected — the consent round trip, or a form over declared fields. /\n authMethods?: string[];\n /\n The ACCOUNT-identifying slots the provider declares, so a form names its own fields.\n \n This is what removes the free-text `secretSlug`: a vendor needing three values says which three.\n * Empty for a vendor whose credential is minted by an exchange rather than typed.\n /\n credentialFields?: Array<{\n slug: string;\n envVarName: string;\n required: boolean;\n description: string;\n configured: boolean;\n }>;\n /\n What an OPERATOR must still set for this provider to be connectable at all.\n \n Carries environment variable NAMES, which are not secrets and are the only thing that makes the\n * gap actionable. Reported so a screen can say what is missing rather than hiding the provider.\n /\n missingRegistration?: Array<{ slug: string; envVarName: string; description: string }>;\n /* The RECORDED decision about which owners may connect this provider, never a derived one. /\n admissibleConnections: Array<{ ownerScope: string; delegation: string }>;\n /\n Whether disconnecting ENDS the grant at the vendor, or only deletes this application's copy (#545).\n \n A per-provider fact because RFC 7009 is the only revocation standard and the vendors do not agree\n * with it: Google's endpoint is conformant, Slack's `auth.revoke` is a Web API method and GitHub's\n * is a `DELETE` with basic auth. So a screen that said one thing for everybody was false for some,\n * which is worse than saying nothing — it sends somebody to revoke by hand at a vendor already told.\n \n Optional on the wire so an older backend reads as \"cannot say\" rather than as \"no\".\n /\n revocationTellsVendor?: boolean;\n /\n Placeholders a connection must answer — `{cloud}`, `{tenantId}`: the vendor's endpoint and scope\n * placeholders for an authorization flow, the REST base URL's (`{subdomain}`) for a typed credential (#1097).\n /\n connectionParameters?: string[];\n /\n For a placeholder that forms the vendor's HOST, the values the provider admits (#623). A value\n * outside `values` — and not ending in one of `hostSuffixes` — is refused at start, because the\n * token endpoint receives the application's client secret. Hostnames, not prose.\n /\n connectionParameterChoices?: Record<string, {\n values: string[];\n hostSuffixes?: string[];\n /\n HOST or ORIGIN for a host choice; absent for a scope value (#991). Under an ORIGIN a suffix admits\n * `https://<name><suffix>`, so a screen shows the scheme rather than inviting a bare host it would refuse.\n /\n position?: ProviderOAuth2EndpointPlaceholderPosition;\n }>;\n scopes?: string[];\n}\n\nexport class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {\n\n constructor(config: WildoBackendHttpClientConfig = {}) {\n super(config);\n }\n\n /\n Retrieve application configuration from backend\n * @param frontendServiceName Frontend service identity (required)\n * @param options Optional request options for headers, timeout, etc.\n * @returns Promise<AppConfiguration_FrontendBootstrapResponse> The application configuration plus frontend provider bootstrap data\n /\n async getApplicationConfig(frontendServiceName: string, options?: RequestOptions): Promise<AppConfiguration_FrontendBootstrapResponse> {\n const url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.APPLICATION_CONFIG_GET]}?frontendServiceName=${frontendServiceName}`;\n return this.get<AppConfiguration_FrontendBootstrapResponse>(url, options);\n }\n\n // ── OIDC interactive consent (S1) ─────────────────────────────────────────\n /\n `GET /oauth/authorize` for the browser authorize flow. `params` are the raw authorize query the\n * third-party client redirected with (`response_type=code`, `client_id`, `redirect_uri`,\n * `code_challenge`(+`_method=S256`), optional `scope`/`resource`/`state`/`nonce`). Returns EITHER the\n * `consent_required` payload (a `requiresConsent` client → the SPA renders the consent screen) OR a\n * `{ redirect_to }` payload (a trusted client → the code is already minted; the SPA navigates the\n * browser there). The Bearer is auto-attached.\n /\n async oauthAuthorizeConsent(params: URLSearchParams, options?: RequestOptions): Promise<OAuthAuthorizeResponse> {\n const url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]}?${params.toString()}`;\n return this.get<OAuthAuthorizeResponse>(url, options);\n }\n\n /\n `POST /oauth/authorize/decision` — record the user's approve/deny. `remember` (Item 3) opts into a\n * durable consent grant so a future authorize with covering scopes skips the prompt; sent as the\n * string `'true'`/`'false'` the backend compares against. Returns `{ redirect_to }`; the caller\n * navigates the browser there to complete the OAuth redirect to the third-party client.\n /\n async oauthConsentDecision(consentToken: string, decision: 'approve' \| 'deny', remember?: boolean, options?: RequestOptions): Promise<OAuthConsentDecisionResponse> {\n return this.post<OAuthConsentDecisionResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]}`,\n { consent_token: consentToken, decision, remember: remember ? 'true' : 'false' },\n options,\n );\n }\n\n /\n `POST /oauth/end-session/confirm` — the OIDC RP-Initiated Logout §6 confirmation decision. Presents the\n * single-use `token` the `/oauth/logout-confirm` prompt was redirected with; the backend consumes it,\n * terminates the named session, and returns `{ redirect_to }` (the signed-out page). Token-authorized —\n * no Bearer is required (the End-User may be unauthenticated here, having arrived via an RP redirect).\n /\n async oauthEndSessionConfirm(token: string, options?: RequestOptions): Promise<OAuthEndSessionConfirmResponse> {\n return this.post<OAuthEndSessionConfirmResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]}`,\n { token },\n options,\n );\n }\n\n // Authentication manual calls\n async identifyByEmail(email: string, options?: RequestOptions): Promise<AuthIdentificationResponse> {\n const body = { email };\n return this.post<AuthIdentificationResponse>(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTIFY]}`, body, options);\n }\n\n async getSessionState(sessionId: string, options?: RequestOptions): Promise<any> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SESSION_STATE];\n return this.get<any>(`${API_CALL_PREFIX}${routeTemplate.replace(':sessionId', sessionId)}`, options);\n }\n\n async authenticateWithPassword(params: { sessionId: string; email: string; password: string }, options?: RequestOptions): Promise<AuthenticationResponse> {\n const body = { ...params, method: AuthMethod.PASSWORD, factorLevel: AuthFactorLevel.FIRST };\n return this.post<AuthenticationResponse>(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD]}`, body, options);\n }\n\n async authenticate(request: AuthenticationRequest, options?: RequestOptions): Promise<AuthenticationResponse> {\n return this.post<AuthenticationResponse>(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE]}`, request, options);\n }\n\n /\n Refresh access token. Calls POST /api/v1/auth/token/refresh.\n \n Cookie-only contract (Auth-hardening Slice A Step 6, 2026-04-13).\n * The refresh token travels EXCLUSIVELY via the `__wildo_refresh`\n * `HttpOnly` cookie (set by the backend on every issuance / rotation,\n * scoped `Path=/api/v1/auth`). The browser automatically attaches it because\n * the shared HTTP client's `authCookiesInterceptor` flips\n * `withCredentials: true` on every `/auth/` request. The request body\n is EMPTY and the backend's `RefreshTokenBodySchema` is\n * `z.strictObject({})` — re-introducing a body field here would now\n * fail backend validation with a 400.\n \n History: A-Step 2 (2026-04-13) added the cookie channel; A-Step 3\n * stopped this client from emitting the body field; A-K-5 added a\n * transitional backend dual-read; A-Step 6 dropped the body channel.\n \n @returns Fresh `{ accessToken, expiresIn }`. The refresh token is\n * NOT in the response body — the rotated value lives only in the\n * `Set-Cookie: __wildo_refresh=…` response header (HttpOnly, so\n * JavaScript here cannot observe it).\n /\n async refreshTokens(options?: RequestOptions): Promise<{ accessToken: string; expiresIn?: number }> {\n return this.post<{ accessToken: string; expiresIn?: number }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_REFRESH]}`,\n {},\n options,\n );\n }\n\n /\n Get OAuth2 authorization URL for a given provider.\n * Calls GET /api/v1/auth/oauth2/authorize/:providerRef\n * @param providerRef The SSO provider reference (e.g., 'google', 'microsoft')\n * @returns The authorization URL to redirect the user to\n \n Browser-only — the framework targets web stacks exclusively, so the\n * caller always opens the returned URL via `window.location.href`.\n /\n async getOAuth2AuthorizationUrl(\n providerRef: string,\n returnUrl?: string,\n options?: RequestOptions,\n acceptedGovernedDocumentReleaseIds?: readonly string[],\n ): Promise<{ authorizationUrl: string }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE];\n const baseUrl = `${API_CALL_PREFIX}${routeTemplate.replace(':providerRef', providerRef)}`;\n /\n * `acceptedDocument` repeats once per accepted release (#1383). The backend puts the ids into the\n * server-side state token, so this is the LAST point at which they are editable by the browser —\n * they do not travel to the identity provider and cannot come back changed.\n /\n const query = new URLSearchParams();\n if (returnUrl) query.set('returnUrl', returnUrl);\n for (const releaseId of acceptedGovernedDocumentReleaseIds ?? []) query.append('acceptedDocument', releaseId);\n const url = query.size > 0 ? `${baseUrl}?${query.toString()}` : baseUrl;\n return this.get<{ authorizationUrl: string }>(url, options);\n }\n\n /\n Exchange a one-time AUTH_CODE_EXCHANGE token for access and refresh tokens.\n * Calls POST /api/v1/auth/token/exchange.\n \n Two issuers feed this endpoint:\n * - OAuth2 / SAML callback (`auth-code-exchange.md` Step 4) — token carries\n * `accessToken`/`expiresIn` only. Refresh arrives through the\n * HttpOnly cookie channel, and response body omits both `refreshToken` and the\n * `returnPath`/`sourceFrontendServiceName`/`targetServiceKey` fields.\n * - Cross-frontend handoff (`cross-app-jwt-propagation.md` Step 2 + Step 5)\n * — token additionally carries `returnPath`/`sourceFrontendServiceName`/\n * `targetServiceKey`. Response surfaces them so the receiving SPA can\n * navigate to `returnPath` and render telemetry.\n \n Receivers detect \"this came from a cross-frontend handoff\" by checking\n * `typeof returnPath === 'string'`. Renamed from `exchangeOAuth2Code`\n * (cross-app-jwt-propagation Step 5 deferred) — the method now serves\n * BOTH the OAuth2 callback path (`Auth_AuthCallback`) AND the\n * cross-frontend handoff receiver (`Auth_OneOffSession` in\n * `cross-frontend-handoff` mode), so the OAuth2-specific naming was\n * misleading. The docs site's own client (`engine/saas-technical-doc/\n * src/runtime/docs-auth-client.ts`) already uses the same name —\n * single conceptual symbol across both client surfaces.\n \n @param code The one-time AUTH_CODE_EXCHANGE token (from `?code=` query\n * param after either an OAuth2 callback or a cross-frontend handoff redirect).\n \n A federated sign-in by an account that still owes its organization answers WITHOUT tokens: the code carried\n * a session parked at organization onboarding, and the answer names it (#1103).\n /\n async exchangeAuthCode(code: string, options?: RequestOptions): Promise<TokenExchangeResponse \| TokenExchangeOrganizationOnboardingResponse> {\n return this.post<TokenExchangeResponse \| TokenExchangeOrganizationOnboardingResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]}`,\n TokenExchangeRequestSchema.parse({ code }),\n options,\n );\n }\n\n /\n Logout from the backend by revoking the refresh token AND clearing the\n * `__wildo_refresh` cookie. Calls POST /api/v1/auth/logout.\n \n Cookie-only contract (Auth-hardening Slice A Step 6, 2026-04-13).\n * The refresh token travels EXCLUSIVELY via the cookie (auto-attached\n * by the `authCookiesInterceptor`); the request body is EMPTY and the\n * backend's `LogoutBodySchema` is `z.strictObject({})`. The backend\n * ALWAYS clears the cookie on response, so logout works even when the\n * cookie is present but the JS access token was lost (e.g., after a\n * tab crash). `tokenIssuer.revokeRefreshToken()` is best-effort —\n * clearing the cookie is the user-visible action and never blocks on\n * revocation.\n /\n async logoutFromBackend(options?: RequestOptions): Promise<void> {\n await this.post<void>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LOGOUT]}`,\n {},\n options,\n );\n }\n\n // ─── Password Reset manual calls ───\n\n /\n Request a password reset email.\n * Calls POST /api/v1/auth/password-reset/request\n * The backend always returns success to prevent email enumeration.\n * @param email The email address to send the reset link to\n /\n async requestPasswordReset(email: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]}`,\n { email },\n options,\n );\n }\n\n /\n Complete a password reset by providing the token and new password.\n * Calls POST /api/v1/auth/password-reset/complete\n * @param token The reset token from the email link\n * @param newPassword The new password\n /\n async completePasswordReset(token: string, newPassword: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]}`,\n { token, newPassword },\n options,\n );\n }\n\n // ─── Registration manual calls ───\n\n /\n Register a new user account.\n * Calls POST /api/v1/auth/register\n * An already-registered address gets a bare acknowledgement, which the registration SCREEN renders\n * exactly like a new account awaiting verification. The two answers are NOT identical on the wire —\n * a new account's answer carries a session — so the screen, not the response, is what hides the\n * difference. Every other answer says what the new account must do next — see `RegisterAccountResponse`.\n * Screens call `AuthSessionContext.registerAccount`, which adopts the auth state the answer implies.\n * @param data Registration form data (email, firstName, lastName, password)\n /\n async register(\n data: RegisterAccountRequest,\n options?: RequestOptions,\n ): Promise<RegisterAccountResponse> {\n return this.post<RegisterAccountResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REGISTER]}`,\n data,\n options,\n );\n }\n\n /\n Discover the org's SSO/SCIM-aware first-factor auth methods for a PUBLIC\n * invitation-accept screen, keyed by the invitation token WITHOUT consuming it\n * (unlike accept). Calls GET /api/v1/auth/invitation/info?token=…\n \n Distinct from `identifyByEmail` (email→domain, requires an existing user):\n * this works for a not-yet-activated invitee (INVITED membership, no session) and\n * additionally returns `managementMode` (open/sso/scim) so the chooser can render\n * the SCIM informational state instead of a credential form. The returned\n * `availableFirstFactorMethods` are consumed identically to `identify()`'s\n * `firstFactorMethods`, so the login `AUTH_METHOD_COMPONENTS` registry renders them.\n /\n async getInvitationInfo(token: string, options?: RequestOptions): Promise<AuthInvitationInfoResponse> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_INVITATION_INFO];\n const url = `${API_CALL_PREFIX}${routeTemplate}?token=${encodeURIComponent(token)}`;\n return this.get<AuthInvitationInfoResponse>(url, options);\n }\n\n /\n Accept an invitation using a public invitation token.\n * Calls POST /api/v1/auth/invitation/accept\n \n Three outcomes on the wire:\n * - PASSWORD / absent / PASSKEY → a SESSION (`accessToken` when the pipeline completed,\n * else MFA-continuation fields). This is the path `AuthSessionContext.acceptInvitation`\n * drives.\n * - `MAGIC_LINK` → NO session; a link is emailed and the response is the generic\n * `{ messageRef, message }` (\"check your email\", anti-enumeration). The invitation\n * magic-link sub-form calls this directly and reads only `nextStep` from the body.\n * - an EXISTING user whose effective policy disables email-possession sign-in → NO session and no link;\n * the membership is accepted and the body is `{ nextStep: AuthNextStep.SIGN_IN_REQUIRED }` (#1158).\n /\n async acceptInvitation(\n /\n `redirect` — the deep link the invitation was opened with, carried into the emailed link on the MAGIC_LINK\n * accept (#1014). Omitted from the request unless it is a same-origin path.\n /\n { redirect, ...acceptance }: { invitationToken: string; firstName?: string; lastName?: string; password?: string; credentialMethod?: AuthMethod; redirect?: string },\n options?: RequestOptions,\n ): Promise<{\n /* Absent on both no-session outcomes (magic link sent, sign-in required). /\n sessionId?: string;\n state?: string;\n purpose?: string;\n nextStep?: string;\n userId?: string;\n accessToken?: string;\n expiresIn?: number;\n requiresMFA?: boolean;\n availableEnrollmentMethods?: AuthMethod[];\n /\n The Wildo refresh token is NEVER on the wire (cookie-only contract, Auth-hardening\n * A-Step 6) — the controller sets it as the `__wildo_refresh` HttpOnly cookie. So this\n * return type intentionally omits `refreshToken`.\n /\n /* Present ONLY on the MAGIC_LINK-at-accept outcome (no session issued). /\n message?: string;\n messageRef?: string;\n /\n Present ONLY on the PASSKEY-at-accept session-issued outcome — the pre-generated WebAuthn\n * registration challenge. The caller runs the browser ceremony and completes it against the\n * authenticated `/auth/passkey/register/verify` route. Shape is the `@simplewebauthn` options\n * JSON (kept as `Record` here to avoid coupling the HTTP client to the browser lib).\n /\n passkeyRegistrationOptions?: Record<string, unknown>;\n }> {\n return this.post<{\n sessionId?: string;\n state?: string;\n purpose?: string;\n nextStep?: string;\n userId?: string;\n accessToken?: string;\n expiresIn?: number;\n requiresMFA?: boolean;\n availableEnrollmentMethods?: AuthMethod[];\n message?: string;\n messageRef?: string;\n passkeyRegistrationOptions?: Record<string, unknown>;\n }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]}`,\n // `redirect` rides only when it is a same-origin path (#1014); the backend applies the same rule again.\n isSafeAuthRedirectTarget(redirect) ? { ...acceptance, redirect } : acceptance,\n options,\n );\n }\n\n /\n Reject an invitation using a public invitation token.\n * Calls POST /api/v1/auth/invitation/reject\n /\n async rejectInvitation(\n data: { invitationToken: string; rejectionReason?: string },\n options?: RequestOptions,\n ): Promise<{ rejected: true; status: 'REJECTED' }> {\n return this.post<{ rejected: true; status: 'REJECTED' }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_INVITATION]}`,\n data,\n options,\n );\n }\n\n /\n List the authenticated caller's OWN pending invitations across all organizations\n * (Approach P, email-owned — no token). Calls GET /api/v1/auth/invitations/mine.\n /\n async listMyPendingInvitations(\n options?: RequestOptions,\n ): Promise<{ invitations: MyPendingInvitationView[] }> {\n return this.get<{ invitations: MyPendingInvitationView[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]}`,\n options,\n );\n }\n\n /\n Accept ONE of the caller's own pending invitations in-app — no token, no new session\n * (the caller is already authenticated). Calls POST /api/v1/auth/invitations/accept.\n /\n async acceptMyInvitation(\n membershipId: string,\n options?: RequestOptions,\n ): Promise<{ accepted: true; organizationId: string }> {\n return this.post<{ accepted: true; organizationId: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]}`,\n { membershipId },\n options,\n );\n }\n\n /\n Decline ONE of the caller's own pending invitations in-app (deletes the INVITED\n * membership row). Calls POST /api/v1/auth/invitations/reject.\n /\n async rejectMyInvitation(\n membershipId: string,\n rejectionReason?: string,\n options?: RequestOptions,\n ): Promise<{ rejected: true; organizationId: string }> {\n return this.post<{ rejected: true; organizationId: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]}`,\n { membershipId, rejectionReason },\n options,\n );\n }\n\n /\n Verify an email address using the token and email from the verification link.\n * Calls POST /api/v1/auth/verify-email\n * On success, returns JWT tokens for auto-login.\n /\n async verifyEmail(token: string, email: string, options?: RequestOptions): Promise<{\n accessToken?: string; refreshToken?: string; expiresIn?: number;\n userId?: string; sessionId?: string; state?: string; nextStep?: string;\n requiresMFA?: boolean; availableEnrollmentMethods?: AuthMethod[]; requireStrongMFA?: boolean;\n mfaGraceExpiresAt?: string;\n }> {\n return this.post<{\n accessToken?: string; refreshToken?: string; expiresIn?: number;\n userId?: string; sessionId?: string; state?: string; nextStep?: string;\n requiresMFA?: boolean; availableEnrollmentMethods?: AuthMethod[]; requireStrongMFA?: boolean;\n mfaGraceExpiresAt?: string;\n }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_VERIFY_EMAIL]}`,\n { token, email },\n options,\n );\n }\n\n /\n Name the organization an account parked at onboarding owes, and finish signing it in (#1090).\n * Calls POST /api/v1/auth/onboarding/complete-org with the parked session id.\n /\n async completeOrgOnboarding(sessionId: string, organizationName: string, options?: RequestOptions): Promise<OnboardingCompletionResponse> {\n return this.post<OnboardingCompletionResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]}`,\n { sessionId, organizationName },\n options,\n );\n }\n\n /\n Calls POST /api/v1/auth/onboarding/complete-profile with the parked session id and the person's names (#1374).\n /\n async completeProfileOnboarding(sessionId: string, firstName: string, lastName: string, options?: RequestOptions): Promise<OnboardingCompletionResponse> {\n return this.post<OnboardingCompletionResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_COMPLETE_PROFILE_ONBOARDING]}`,\n { sessionId, firstName, lastName },\n options,\n );\n }\n\n async resendVerificationEmail(email: string, options?: RequestOptions): Promise<{ messageRef: string; message: string }> {\n return this.post<{ messageRef: string; message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]}`,\n { email },\n options,\n );\n }\n\n // ─── MFA: Email OTP ───\n\n async mfaEmailOTPSend(sessionId: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]}`,\n { sessionId },\n options,\n );\n }\n\n async mfaEmailOTPVerify(sessionId: string, code: string, options?: RequestOptions): Promise<AuthenticationResponse> {\n return this.post<AuthenticationResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]}`,\n { sessionId, code },\n options,\n );\n }\n\n // ─── MFA: TOTP ───\n\n async mfaTOTPSetup(options?: RequestOptions): Promise<{ secret: string; qrCodeUri: string; backupCodes?: string[] }> {\n return this.post<{ secret: string; qrCodeUri: string; backupCodes?: string[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP]}`,\n {},\n options,\n );\n }\n\n async mfaTOTPVerifySetup(code: string, options?: RequestOptions): Promise<{ verified: boolean; enrollmentSession?: EnrollmentSessionSettlementResponse }> {\n return this.post<{ verified: boolean; enrollmentSession?: EnrollmentSessionSettlementResponse }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP]}`,\n { code },\n options,\n );\n }\n\n async mfaTOTPVerify(sessionId: string, code: string, options?: RequestOptions): Promise<AuthenticationResponse> {\n return this.post<AuthenticationResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY]}`,\n { sessionId, code },\n options,\n );\n }\n\n // ─── WebAuthn/Passkey ───\n\n async passkeyRegisterOptions(sessionId?: string, options?: RequestOptions): Promise<Record<string, unknown>> {\n return this.post<Record<string, unknown>>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS]}`,\n { sessionId },\n options,\n );\n }\n\n async passkeyRegisterVerify(credential: Record<string, unknown>, options?: RequestOptions): Promise<{ registered: boolean; enrollmentSession?: EnrollmentSessionSettlementResponse }> {\n return this.post<{ registered: boolean; enrollmentSession?: EnrollmentSessionSettlementResponse }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY]}`,\n credential,\n options,\n );\n }\n\n /\n Begin a passkey sign-in. Without a `sessionId` the server OPENS the sign-in (passkey autofill, or a\n * sign-in-with-a-passkey button) and answers the session the challenge is bound to; with one, it\n * issues options for that session. Either way the verification must present the returned `sessionId`.\n /\n async passkeyAuthOptions(\n sessionId?: string,\n options?: RequestOptions,\n ): Promise<{ sessionId: string; options: PublicKeyCredentialRequestOptionsJSON; expiresInSeconds: number }> {\n return this.post<{ sessionId: string; options: PublicKeyCredentialRequestOptionsJSON; expiresInSeconds: number }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS]}`,\n sessionId ? { sessionId } : {},\n options,\n );\n }\n\n /\n Completes a passkey sign-in. The body is TYPED so the factor level can only be the wire\n * vocabulary: an untyped record let the UI's `'first'` reach the server and be refused (2026-09-15).\n /\n async passkeyAuthVerify(\n credential: { sessionId: string; response: AuthenticationResponseJSON; factorLevel: AuthFactorLevel },\n options?: RequestOptions,\n ): Promise<AuthenticationResponse> {\n return this.post<AuthenticationResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY]}`,\n credential,\n options,\n );\n }\n\n async passkeyList(options?: RequestOptions): Promise<{ credentials: Array<{ credentialId: string; name: string; createdAt: string }> }> {\n return this.get<{ credentials: Array<{ credentialId: string; name: string; createdAt: string }> }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_LIST]}`,\n options,\n );\n }\n\n async passkeyRemove(credentialId: string, options?: RequestOptions): Promise<{ success: boolean }> {\n return this.post<{ success: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REMOVE]}`,\n { credentialId },\n options,\n );\n }\n\n async passkeyRename(credentialId: string, name: string, options?: RequestOptions): Promise<{ success: boolean }> {\n return this.post<{ success: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_RENAME]}`,\n { credentialId, name },\n options,\n );\n }\n\n // ─── Magic Link (Phase G2) ───\n\n /\n Ask for a magic sign-in link. `redirect` is the deep link to land on once signed in (#1014); it is sent only\n * when it is a same-origin path, so a crafted `?redirect=` can never be carried into the email. The backend\n * applies the same predicate again — it cannot trust a client.\n /\n async magicLinkSend(email: string, redirect?: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]}`,\n isSafeAuthRedirectTarget(redirect) ? { email, redirect } : { email },\n options,\n );\n }\n\n async magicLinkVerify(token: string, email: string, options?: RequestOptions): Promise<AuthenticationResponse> {\n return this.post<AuthenticationResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]}`,\n { token, email },\n options,\n );\n }\n\n // ─── SMS OTP (Phase G2) ───\n\n /* The code goes to the account's own verified phone; the destination is never client-supplied (#1211). /\n async smsOTPSend(sessionId: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SMS_OTP_SEND]}`,\n { sessionId },\n options,\n );\n }\n\n // ─── Phone Verification (Phase G2) ───\n\n async phoneVerifySend(phoneNumber: string, options?: RequestOptions): Promise<{ message: string }> {\n return this.post<{ message: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND]}`,\n { phoneNumber },\n options,\n );\n }\n\n async phoneVerifyConfirm(phoneNumber: string, code: string, options?: RequestOptions): Promise<{ verified: boolean; enrollmentSession?: EnrollmentSessionSettlementResponse }> {\n return this.post<{ verified: boolean; enrollmentSession?: EnrollmentSessionSettlementResponse }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM]}`,\n { phoneNumber, code },\n options,\n );\n }\n\n // ─── Method Management (#13f) ───\n\n async passwordChange(currentPassword: string, newPassword: string, options?: RequestOptions): Promise<{ changed: boolean }> {\n return this.post<{ changed: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]}`,\n { currentPassword, newPassword },\n options,\n );\n }\n\n async passwordSet(newPassword: string, options?: RequestOptions): Promise<{ set: boolean }> {\n return this.post<{ set: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_SET]}`,\n { newPassword },\n options,\n );\n }\n\n async mfaTOTPDisable(options?: RequestOptions): Promise<{ disabled: boolean }> {\n return this.post<{ disabled: boolean }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE]}`,\n {},\n options,\n );\n }\n\n async getMyMethods(options?: RequestOptions): Promise<{ methods: Array<{ method: string; enrolled: boolean; enrolledAt?: string; details?: Record<string, unknown> }> }> {\n return this.get<{ methods: Array<{ method: string; enrolled: boolean; enrolledAt?: string; details?: Record<string, unknown> }> }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_METHODS_MINE]}`,\n options,\n );\n }\n\n async getIdentityLinks(options?: RequestOptions): Promise<{ links: Array<{ _id: string; connectionType: SsoConnectionType; source: ExternalIdentitySource; providerRef: string; providerEmail: string; linkedAt: string; lastUsedAt: string }> }> {\n return this.get<{ links: Array<{ _id: string; connectionType: SsoConnectionType; source: ExternalIdentitySource; providerRef: string; providerEmail: string; linkedAt: string; lastUsedAt: string }> }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]}`,\n options,\n );\n }\n\n /\n Which governed documents the signed-in person owes an acceptance of (#1258). Empty for an\n * application that asks for no acceptance — the server answers without reading the store.\n /\n async getOwedGovernedDocumentAcceptances(options?: RequestOptions): Promise<{ owed: GovernedDocumentAcceptanceOwed[] }> {\n return this.get<{ owed: GovernedDocumentAcceptanceOwed[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_OWED]}`,\n options,\n );\n }\n\n /\n Record the signed-in person's acceptance of in-force releases, by id only (#1258). The answer is\n * what is STILL owed, read back after the write — the caller lets the person through on that, never\n * on having sent the request.\n /\n async acceptGovernedDocuments(\n acceptedGovernedDocumentReleaseIds: readonly string[],\n options?: RequestOptions,\n ): Promise<{ owed: GovernedDocumentAcceptanceOwed[] }> {\n return this.post<{ owed: GovernedDocumentAcceptanceOwed[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT]}`,\n { acceptedGovernedDocumentReleaseIds: [...acceptedGovernedDocumentReleaseIds] },\n options,\n );\n }\n\n /\n Record that a governed document was delivered to the signed-in caller (#1258 Step 5 / R11). Never\n * throws on a document the release does not permit recording — the recorder is a silent no-op then.\n /\n async recordGovernedDocumentNoticeDelivered(documentRef: string, options?: RequestOptions): Promise<void> {\n await this.post<Record<string, never>>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.GOVERNED_DOCUMENT_NOTICE_DELIVERED]}`,\n { documentRef },\n options,\n );\n }\n\n /\n Record that a governed document was delivered to a VISITOR — the anonymous-session half of R11\n * (#1258 Step 5). Resolves to `ANONYMOUS_USERS.record_notice_delivered`, confined to the caller's\n * own verified session identity exactly like `record_consent`; nothing in the request can name\n * another session. `ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH` is derived from the operation itself\n * (see its own test) rather than hand-typed, for the reason `ANONYMOUS_CONSENT_RECORD_PATH` states.\n \n `PUT`, not `POST` — the operation borrows `UPDATE_MANY` like its consent sibling, and that verb\n * maps to PUT (`ANONYMOUS_NOTICE_DELIVERED_RECORD_METHOD`).\n /\n async recordAnonymousGovernedDocumentNoticeDelivered(documentRef: string, options?: RequestOptions): Promise<{ recorded: boolean }> {\n return this.put<{ recorded: boolean }>(\n `${API_CALL_PREFIX}${ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH}`,\n { documentRef },\n options,\n );\n }\n\n async unlinkIdentityLink(linkId: string, options?: RequestOptions): Promise<{ unlinked: boolean }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK];\n const url = `${API_CALL_PREFIX}${routeTemplate.replace(':linkId', linkId)}`;\n return this.delete<{ unlinked: boolean }>(url, options);\n }\n\n // ─── Connecting a third-party account ───\n\n /\n What this application can connect to. Calls `GET /api/v1/connections`.\n \n Answers admissibility, never authorization: whether the caller may act for a given owner depends\n * on that owner's id, which a catalogue has none of. A screen that offers an owner the caller\n * cannot act for is refused at `startProviderConnection`, which is where both gates run in the\n * order every credential path uses.\n /\n async listConnectableProviders(options?: RequestOptions): Promise<{ providers: ConnectableProviderView[] }> {\n return this.get<{ providers: ConnectableProviderView[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]}`,\n options,\n );\n }\n\n /\n Begin connecting one account. Calls `POST /api/v1/connections/:providerRef/start`.\n \n Returns a URL rather than following a redirect, and the CALLER navigates. A 302 answered here\n * would be followed by this fetch, produce an opaque cross-origin response, and render the vendor's\n * consent screen into a response body nobody ever sees.\n /\n async startProviderConnection(\n providerRef: string,\n body: {\n target: { ownerScope: string; delegation: string; ownerId?: string; actingForUserId?: string };\n scopes?: string[];\n connectionParameters?: Record<string, string>;\n /* Required `true` when the target lends the linking member's account to the organization. /\n acknowledgesOrganizationWideUse?: boolean;\n },\n options?: RequestOptions,\n ): Promise<{ authorizeUrl: string }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_START];\n const url = `${API_CALL_PREFIX}${routeTemplate.replace(':providerRef', encodeURIComponent(providerRef))}`;\n return this.post<{ authorizeUrl: string }>(url, body, options);\n }\n\n /\n Finish a connection the vendor approved. Calls `POST /api/v1/connections/complete`.\n \n The half the callback cannot do. A vendor redirect is a top-level navigation, so it carries no\n * bearer token and cannot say who is finishing the flow; this is a FETCH, so it does. The callback\n * hands `state` and `code` back through the browser and this redeems them as the signed-in person.\n \n Names no owner on purpose — the target lives in the remembered attempt, so nothing a caller\n * writes here can decide whose account the grant is stored against.\n /\n async completeProviderConnection(\n body: { state: string; code: string },\n options?: RequestOptions,\n ): Promise<{ connected: string }> {\n return this.post<{ connected: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE]}`,\n body,\n options,\n );\n }\n\n /\n Store a credential somebody typed. Calls `POST /api/v1/connections/:providerRef/credential`.\n \n Keyed by the slug the PROVIDER declared, never by a name a screen invented — and the route\n * re-checks every key against the contract, so this shape is enforced rather than merely intended.\n * `connectionParameters` answers the REST base URL's placeholders (#1097), which the route admits against\n * the provider's host allowance before anything is written.\n /\n /\n The caller's own short-lived access token for a provider (#394 P4) — what a vendor's picker\n * needs to open as the signed-in user. `undefined` when nothing is connected (the door answers\n * 404), which is a state a surface names rather than an error it reports: the picker itself says\n * \"connect your account first\" through `onError`.\n /\n async getProviderConnectionAccessToken(\n providerRef: string,\n options?: RequestOptions,\n ): Promise<{ accessToken: string; expiresAt?: string; grantedScopes?: readonly string[] } \| undefined> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN];\n const url = `${API_CALL_PREFIX}${routeTemplate.replace(':providerRef', encodeURIComponent(providerRef))}`;\n try {\n return await this.get<{ accessToken: string; expiresAt?: string; grantedScopes?: readonly string[] }>(url, options);\n } catch (error) {\n if (isNotConnectedResponse(error)) return undefined;\n throw error;\n }\n }\n\n async storeProviderCredential(\n providerRef: string,\n body: {\n target: { ownerScope: string; delegation: string; ownerId?: string; actingForUserId?: string };\n values: Record<string, string>;\n /* Answers for the REST base URL's `{placeholders}` — the catalogue entry's `connectionParameters` (#1097). /\n connectionParameters?: Record<string, string>;\n /* Required `true` when the target lends the linking member's account to the organization. /\n acknowledgesOrganizationWideUse?: boolean;\n },\n options?: RequestOptions,\n ): Promise<{ stored: Record<string, string> }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL];\n const url = `${API_CALL_PREFIX}${routeTemplate.replace(':providerRef', encodeURIComponent(providerRef))}`;\n return this.post<{ stored: Record<string, string> }>(url, body, options);\n }\n\n /* @wildo_source:part:start saas.frontend.providers.execute-operation facet:layer:frontend facet:audience:app-developer /\n /\n Run ONE provider operation the application declared browser-reachable (#367).\n \n The operation executes on the backend; the credential never reaches the browser. `connection` names\n * whose account to spend and is absent for the application's own. A refused request rejects with the\n * backend's 403, whose body carries `reason` — a component can tell \"not enabled\" from \"not for you\".\n \n `TOutput` is the caller's statement of what the operation's declared output looks like; the backend\n * has already parsed the answer through that operation's schema.\n /\n async executeProviderOperation<TOutput = unknown>(\n providerRef: string,\n operationId: string,\n body: {\n connection?: { ownerScope: string; delegation: string; ownerId?: string; actingForUserId?: string };\n domain?: string;\n input?: Record<string, unknown>;\n },\n options?: RequestOptions,\n ): Promise<{ status: number; output: TOutput }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_OPERATION_EXECUTE];\n const url = `${API_CALL_PREFIX}${routeTemplate\n .replace(':providerRef', encodeURIComponent(providerRef))\n .replace(':operationId', encodeURIComponent(operationId))}`;\n return this.post<{ status: number; output: TOutput }>(url, body, options);\n }\n\n /\n List the choices for ONE input of a declared provider operation (#333) — a workspace, a project.\n \n The backend runs the input's declared options operation through the same `connection`, so the list is\n * exactly what that account can see. Both the operation and its options operation must be listed in\n * `providers.browserOperations`. A choice another input depends on must be passed in `input`; without it\n * the answer is `400 PROVIDER_OPERATION_INPUT_OPTIONS_DEPENDENCY_MISSING` naming it in `dependsOn`.\n /\n async loadProviderOperationInputOptions(\n providerRef: string,\n operationId: string,\n inputField: string,\n body: {\n connection?: { ownerScope: string; delegation: string; ownerId?: string; actingForUserId?: string };\n domain?: string;\n input?: Record<string, unknown>;\n },\n options?: RequestOptions,\n ): Promise<{ optionsOperationId: string; options: Array<{ value: string; label: string }> }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_OPERATION_INPUT_OPTIONS];\n const url = `${API_CALL_PREFIX}${routeTemplate\n .replace(':providerRef', encodeURIComponent(providerRef))\n .replace(':operationId', encodeURIComponent(operationId))\n .replace(':inputField', encodeURIComponent(inputField))}`;\n return this.post<{ optionsOperationId: string; options: Array<{ value: string; label: string }> }>(url, body, options);\n }\n /* @wildo_source:part:end saas.frontend.providers.execute-operation /\n\n /\n Prove the person at the keyboard is still the account holder; returns a single-use step-up token.\n \n Every method the server accepts is accepted here. This client used to admit PASSWORD and PASSKEY\n * only while the server also took TOTP, so an account whose strongest re-provable authenticator was\n * TOTP had no way to produce the proof from the browser.\n /\n async reAuthenticate(\n method: AuthMethod.PASSWORD \| AuthMethod.PASSKEY \| AuthMethod.TOTP,\n credentials: { password?: string; passkeyResponse?: Record<string, unknown>; code?: string },\n /* Which proof to mint (#1417): a step-up, or a binding proof for adding a way to sign in. /\n purpose: ReAuthenticationPurpose = ReAuthenticationPurpose.STEP_UP,\n options?: RequestOptions,\n ): Promise<{ reAuthToken: string }> {\n return this.post<{ reAuthToken: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REAUTH]}`,\n { method, ...credentials, purpose },\n options,\n );\n }\n\n /\n Which of the signed-in person's own factors can produce a re-authentication proof for `purpose`,\n * strongest first (#1417). Under a step-up policy this is narrower than what the account holds; for a\n * binding it is everything held. `identityLinks` names the linked identities whose provider can\n * re-authenticate the person (#1441). Both empty means the account must add an accepted factor first.\n /\n async getReAuthenticationMethods(\n purpose: ReAuthenticationPurpose,\n options?: RequestOptions,\n ): Promise<{ methods: AuthMethod[]; identityLinks?: ReAuthenticationIdentityLink[] }> {\n const query = new URLSearchParams({ purpose }).toString();\n return this.get<{ methods: AuthMethod[]; identityLinks?: ReAuthenticationIdentityLink[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REAUTH_METHODS]}?${query}`,\n options,\n );\n }\n\n /\n Begin a passkey step-up: the challenge leg. Take these options to the authenticator, then present\n * the assertion to {@link reAuthenticate} with `AuthMethod.PASSKEY`.\n /\n async reAuthPasskeyOptions(options?: RequestOptions): Promise<Record<string, unknown>> {\n return this.post<Record<string, unknown>>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]}`,\n {},\n options,\n );\n }\n\n /\n Start a re-authentication at the provider behind one of the person's own linked identities (#1441).\n * Answers the provider URL, to open in a popup; the popup comes back to\n * `REAUTHENTICATION_CALLBACK_PAGE_PATH` with a one-time code for {@link exchangeFederatedReAuthentication}.\n /\n async startFederatedReAuthentication(\n identityLinkId: string,\n purpose: ReAuthenticationPurpose,\n options?: RequestOptions,\n ): Promise<{ authorizationUrl: string }> {\n return this.post<{ authorizationUrl: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_AUTHORIZE]}`,\n { identityLinkId, purpose },\n options,\n );\n }\n\n /* Redeem the one-time code a federated re-authentication returned, with this account's own bearer (#1441). /\n async exchangeFederatedReAuthentication(code: string, options?: RequestOptions): Promise<{ reAuthToken: string }> {\n return this.post<{ reAuthToken: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_EXCHANGE]}`,\n { code },\n options,\n );\n }\n\n // ─── Enterprise SSO ───\n\n async getEnterpriseSSOAuthorizationUrl(\n orgId: string,\n connectionId: string,\n returnUrl?: string,\n options?: RequestOptions,\n ): Promise<{ authorizationUrl: string }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE];\n const baseUrl = `${API_CALL_PREFIX}${routeTemplate.replace(':orgId', orgId).replace(':connectionId', connectionId)}`;\n const url = returnUrl\n ? `${baseUrl}?returnUrl=${encodeURIComponent(returnUrl)}`\n : baseUrl;\n return this.get<{ authorizationUrl: string }>(url, options);\n }\n\n async getAppEnterpriseSSOAuthorizationUrl(\n connectionId: string,\n returnUrl?: string,\n options?: RequestOptions,\n ): Promise<{ authorizationUrl: string }> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE];\n const baseUrl = `${API_CALL_PREFIX}${routeTemplate.replace(':connectionId', connectionId)}`;\n const url = returnUrl\n ? `${baseUrl}?returnUrl=${encodeURIComponent(returnUrl)}`\n : baseUrl;\n return this.get<{ authorizationUrl: string }>(url, options);\n }\n\n /\n Public status read of a file-upload grant — the drop page's first call.\n \n Authenticated by the token in the URL alone: no bearer is needed, and one the tab happens to\n * hold is irrelevant to the route. The answer is parsed through the shared contract so a drifted\n * server can never reach the page as UI state.\n /\n async readFileUploadGrantStatus(token: string, options?: RequestOptions): Promise<FileUploadGrantStatus> {\n return this.get<FileUploadGrantStatus>(`${API_CALL_PREFIX}/files/upload-grants/${encodeURIComponent(token)}`, {\n ...options,\n schema: FileUploadGrantStatusSchema,\n });\n }\n\n /\n Redeems a file-upload grant with the bytes a visitor chose.\n \n The grant IS the credential: the status names the header (`uploadHeaderName`) and the token is\n * its value, sent on this one request only — never installed on the shared client, which would\n * attach it to every later call. The backend processes an ALTERNATIVE token BEFORE any bearer, so\n * a signed-in visitor's session never claims the upload; it is attributed to the grant's minter.\n * `uploadUrl` is absolute, issued by the API that owns the route, and axios honours an absolute URL\n * over `baseURL`. The multipart field is `file`, the same one the grant's curl example uses.\n /\n async uploadWithFileUploadGrant(status: FileUploadGrantStatus, token: string, file: File, options?: UploadFileOptions): Promise<unknown> {\n const formData = new FormData();\n formData.append('file', file);\n return this.uploadFile(status.uploadUrl, formData, {\n ...options,\n headers: { ...options?.headers, [status.uploadHeaderName]: token },\n });\n }\n\n async exchangeOneOffToken(token: string, options?: RequestOptions): Promise<OneOffTokenExchangeResponse> {\n return this.post<OneOffTokenExchangeResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]}`,\n { token },\n options,\n );\n }\n\n /\n Request a one-time cross-frontend handoff URL (cross-app-jwt-propagation Step 2 + 3).\n \n Calls POST /api/v1/auth/cross-frontend-handoff with the user's bearer token. The\n * backend re-issues a fresh JWT pair, binds it to a single-use AUTH_CODE_EXCHANGE\n * consumable token (60s TTL), and returns `{ handoffUrl, expiresAt }`. The caller\n * decides how to use the URL (`location.assign` to replace, `window.open` for a new\n * tab) — see `requestCrossFrontendHandoff()` /\n * `useCrossFrontendHandoff()` in `core/security/cross-frontend-handoff.frontend.service.ts`\n * for the friendlier wrapper that maps backend error codes onto a typed client error.\n \n Bearer-only — no cookies / `withCredentials`. The base client's authentication\n * interceptor injects `Authorization: Bearer <accessToken>` and\n * `X-Frontend-Service-Name: <envFrontendServiceName>` automatically; the backend uses\n * the latter to (a) scope rate-limiting per `(userId, sourceFrontend)` pair and\n * (b) cross-validate the source identity against the browser's `Origin` header to\n * defend against header spoofing.\n /\n async crossFrontendHandoff(request: CrossFrontendHandoffRequest, options?: RequestOptions): Promise<CrossFrontendHandoffResponse> {\n return this.post<CrossFrontendHandoffResponse>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]}`,\n request,\n options,\n );\n }\n\n // ─── Features ───\n\n async getResolvedFeatures(options?: RequestOptions): Promise<Record<string, unknown>> {\n return this.get<Record<string, unknown>>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.FEATURES_RESOLVED]}`,\n options,\n );\n }\n\n // I18n manual calls\n /\n Retrieve i18n labels from backend\n * @param language The language to retrieve labels for (required)\n * @param sections Optional array of specific sections to retrieve\n * @param options Optional request options for headers, timeout, etc.\n * @returns Promise<I18nLabelsResponseDto> The i18n labels response\n /\n async getI18nLabels(language: AvailableLanguage, sections?: string[], options?: RequestOptions): Promise<I18nLabelsResponseDto> {\n let url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.I18N_GET_LABELS]}?language=${language}`;\n\n if (sections && sections.length > 0) {\n url += `&sections=${sections.join(',')}`;\n }\n\n return this.get<I18nLabelsResponseDto>(url, options);\n }\n\n /\n Load specific translation sub-trees by dot-path keys.\n * Response preserves the nested structure (e.g. `components.low_level_button` →\n * `{ components: { low_level_button: { ... } } }`).\n /\n async getI18nLabelsByKeys(language: AvailableLanguage, keys: string[], options?: RequestOptions): Promise<I18nLabelsResponseDto> {\n let url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.I18N_GET_LABELS]}?language=${language}`;\n url += `&keys=${keys.map(k => encodeURIComponent(k)).join(',')}`;\n return this.get<I18nLabelsResponseDto>(url, options);\n }\n\n // Charts manual calls\n /\n Fetch chart data by chart reference.\n * Calls POST /api/v1/charts/:chartRef/data with optional explicit inputs.\n \n @param chartRef Backend-resolvable chart execution reference\n * @param body Optional body payload (`{ inputs }`)\n * @param options Optional request options (abort signal, timeout, etc.)\n * @param queryParams Optional query parameters (for example validated org scope)\n * @returns Promise<AggregationQueryResponse>\n /\n async getChartData(\n chartRef: string,\n body?: ChartDataRequestBody,\n options?: RequestOptions,\n queryParams?: Record<string, string \| undefined>,\n ): Promise<AggregationQueryResponse> {\n const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.CHARTS_DATA];\n const queryString = queryParams\n ? new URLSearchParams(\n Object.entries(queryParams).filter(([, value]) => typeof value === 'string' && value.length > 0) as Array<[string, string]>,\n ).toString()\n : '';\n const url = `${API_CALL_PREFIX}${routeTemplate.replace(':chartRef', chartRef)}${queryString ? `?${queryString}` : ''}`;\n return this.post<AggregationQueryResponse>(url, body \|\| {}, options);\n }\n\n // Analytics manual calls\n /\n Ingest a batch of analytics events.\n * Calls POST /api/v1/analytics/events\n /\n async postAnalyticsEvents(body: { events: unknown[]; userId?: string }, options?: RequestOptions): Promise<{ accepted: number }> {\n return this.post<{ accepted: number }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.ANALYTICS_EVENTS]}`,\n body,\n options,\n );\n }\n\n /\n Get achieved value moments for the current user.\n * Calls GET /api/v1/analytics/moments/achieved\n /\n async getAnalyticsMomentsAchieved(options?: RequestOptions): Promise<{ moments: string[] }> {\n return this.get<{ moments: string[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]}`,\n options,\n );\n }\n\n /\n Mark a value moment as achieved.\n * Calls POST /api/v1/analytics/moments/achieved\n /\n async postAnalyticsMomentsAchieved(body: { momentIdentifier: string; scope?: string }, options?: RequestOptions): Promise<{ success: boolean; momentIdentifier: string }> {\n return this.post<{ success: boolean; momentIdentifier: string }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]}`,\n body,\n options,\n );\n }\n\n /\n Get all registered milestone definitions.\n * Calls GET /api/v1/progression/milestones\n /\n async getMilestoneDefinitions(options?: RequestOptions): Promise<{ definitions: MilestoneDefinition[] }> {\n return this.get<{ definitions: MilestoneDefinition[] }>(\n `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROGRESSION_MILESTONES]}`,\n options,\n );\n }\n\n}\n\n/\n The access-token door's \"nothing connected\" answer, told apart from every other failure. Keyed on\n * the HTTP status the door documents for it (404) so a surface can treat absence as a state; any\n * other status — 400 not connectable, 409 not admissible, 401 — stays an error the surface sees.\n */\nfunction isNotConnectedResponse(error: unknown): boolean {\n const candidate = error as { status?: unknown; response?: { status?: unknown } } \| null;\n const status = candidate?.status ?? candidate?.response?.status;\n return status === 404;\n}\n\n// Lazy singleton instance - created on first access to avoid module initialization issues\nlet _manualCallsHttpClient: WildoBackendHttpClient_ManualCalls \| null = null;\n\nexport function getManualCallsHttpClient(): WildoBackendHttpClient_ManualCalls {\n if (!_manualCallsHttpClient) {\n _manualCallsHttpClient = new WildoBackendHttpClient_ManualCalls();\n }\n return _manualCallsHttpClient;\n}\n"]}

package/dist/esm/core/requests/wildo-http-client-resources.frontend.service.d.ts CHANGED Viewed

@@ -3,6 +3,7 @@
  * Specialized HTTP client for resource-based operations (CRUD)
  * Extends base WildoBackendHttpClient with resource-specific functionality
  */
+import { ResourceOperationIdempotencyKeyRequirement } from '@wildo-ai/saas-models';
 import { WildoBackendHttpClient, WildoBackendHttpClientConfig, RequestOptions } from './wildo-http-client.frontend.service';
 /**
  * The per-request timeout for one operation dispatch — the ONE seam all three requestOptions
@@ -19,6 +20,21 @@ export declare function resolveOperationRequestTimeout(options: RequestOptions |
 }): {
     timeout: number;
 } | Record<string, never>;
+/**
+ * The `Idempotency-Key` for one operation dispatch (#535), through the same single seam as the timeout above.
+ *
+ * Minted once per CALL for a variant that declares `idempotencyKey`, and placed on the request's own headers. That is what
+ * makes the key useful here: the client's automatic retries (5xx, 408, 429, network loss) re-send this same request
+ * config, so a mutation whose response was lost is retried under the key it was first sent with, and the server answers
+ * with the first outcome. A caller that supplies its own key (for example one minted when the user opened a
+ * confirmation, to cover a double-click) keeps it. A variant that does not declare the header never receives one: the
+ * server refuses an undeclared key on a mutation rather than silently ignoring it (a read ignores one).
+ */
+export declare function resolveOperationIdempotencyHeaders(options: RequestOptions | undefined, operation: {
+    idempotencyKey?: ResourceOperationIdempotencyKeyRequirement;
+}): {
+    headers: Record<string, string>;
+} | Record<string, never>;
 import { DataMode, type Resources_PaginationRequest } from '@wildo-ai/saas-models';
 import type { FrontendResource_ParentResourceRequirement } from '../../core/resources/resource-path.frontend.schemas';
 import type { FrontendResourcesRegistry, FrontendResourceConfiguration_Operation } from '../../core/resources/resources.frontend.schemas';
@@ -93,8 +109,9 @@ export declare class WildoBackendHttpClient_Resources extends WildoBackendHttpCl
     /**
      * The cache identity of a READ, and the scope rooms that would carry its invalidation.
      *
-     * Called only for operations `isCacheableReadOperation` already admitted, so it answers the
-     * narrower question: can this particular CALL be keyed, and what covers it?
+     * Called only for operations `isCacheableReadOperation` already admitted — the two entry points
+     * being `doOperation` and `executeSearchOperation`, which is the whole read family — so it answers
+     * the narrower question: can this particular CALL be keyed, and what covers it?
      *
      * `null` means "run it and cache nothing" — for parameters that cannot be rendered into a stable
      * key (a cycle, a function in a filter), or for an operation carrying no primary scope. Neither is

package/dist/esm/core/requests/wildo-http-client-resources.frontend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"wildo-http-client-resources.frontend.service.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/requests/wildo-http-client-resources.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;~~AAGH~~,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAE5H;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,SAAS,EAAE;IAAE,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAI7C;AACD,OAAO,EASL,QAAQ,EAIR,KAAK,2BAA2B,EAEjC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,mEAAmE,CAAC;AACpI,OAAO,KAAK,EACV,yBAAyB,EAEzB,uCAAuC,EACxC,MAAM,+DAA+D,CAAC;AAKvE,OAAO,EACL,gCAAgC,EAEjC,MAAM,yEAAyE,CAAC;AAIjF;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAQ1E,MAAM,WAAW,+BAA+B;IAC9C,gEAAgE;IAChE,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;IACvE,kDAAkD;IAClD,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,aAAa,GAAG,cAAc,CAAC;IAC1C;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,0CAA0C,EAAE,CAAC;IAC3E;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,+BAA+B;IACnF,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,yBAAyB;IACzB,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,EAAE,CAAC;IACtD,iBAAiB;IACjB,UAAU,CAAC,EAAE,2BAA2B,CAAC;CAE1C;~~AAyBD~~,qBAAa,gCAAiC,SAAQ,sBAAsB;IAC1E,OAAO,CAAC,iBAAiB,CAA4B;IACrD,OAAO,CAAC,YAAY,CAAuB;gBAGzC,iBAAiB,EAAE,yBAAyB,EAC5C,MAAM,GAAE,4BAAiC;IAO3C;;OAEG;IACH,OAAO,CAAC,UAAU;IAelB;;;;;OAKG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0C;IAEpE,+FAA+F;IACxF,YAAY,IAAI,gCAAgC;IAIvD~~;;;;;;;;;;OAUG~~;IACH,OAAO,CAAC,oBAAoB;~~IAuDf~~,WAAW,CAAC,SAAS,GAAG,GAAG,EACtC,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,+BAA+B,EAC3C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,SAAS,CAAC;IAuErB;;;;;OAKG;IACU,sBAAsB,CAAC,SAAS,GAAG,GAAG,EACjD,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,4BAA4B,EACxC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,SAAS,CAAC;~~IA0BrB~~;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;~~IAqC5B~~;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,sBAAsB;IA4BrC;;OAEG;IACH,OAAO,CAAC,aAAa;IAwCrB;;OAEG;YACW,uBAAuB;~~IA2FrC~~;;OAEG;YACW,mCAAmC;~~IA8DjD~~;;;;OAIG;YACW,8BAA8B;IAqG5C;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAkBlC;;OAEG;IACH,OAAO,CAAC,kCAAkC;IA0D1C;;OAEG;IACH,OAAO,CAAC,yBAAyB;IA0BjC;;OAEG;IACI,0BAA0B,IAAI,MAAM,EAAE;IAe7C;;OAEG;IACI,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,uCAAuC,GAAG,IAAI;CAIrG"}
1	+ {"version":3,"file":"wildo-http-client-resources.frontend.service.d.ts","sourceRoot":"","sources":["../../../../../src/core/requests/wildo-http-client-resources.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAA8B,0CAA0C,EAAgD,MAAM,uBAAuB,CAAC;AAE7J,OAAO,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAE5H;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,SAAS,EAAE;IAAE,sBAAsB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAI7C;AAWD;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,cAAc,GAAG,SAAS,EACnC,SAAS,EAAE;IAAE,cAAc,CAAC,EAAE,0CAA0C,CAAA;CAAE,GACzE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAK7D;AACD,OAAO,EASL,QAAQ,EAIR,KAAK,2BAA2B,EAEjC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,mEAAmE,CAAC;AACpI,OAAO,KAAK,EACV,yBAAyB,EAEzB,uCAAuC,EACxC,MAAM,+DAA+D,CAAC;AAKvE,OAAO,EACL,gCAAgC,EAEjC,MAAM,yEAAyE,CAAC;AAIjF;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAQ1E,MAAM,WAAW,+BAA+B;IAC9C,gEAAgE;IAChE,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;IACvE,kDAAkD;IAClD,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,aAAa,GAAG,cAAc,CAAC;IAC1C;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,0CAA0C,EAAE,CAAC;IAC3E;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,4BAA6B,SAAQ,+BAA+B;IACnF,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,yBAAyB;IACzB,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,EAAE,CAAC;IACtD,iBAAiB;IACjB,UAAU,CAAC,EAAE,2BAA2B,CAAC;CAE1C;AAgCD,qBAAa,gCAAiC,SAAQ,sBAAsB;IAC1E,OAAO,CAAC,iBAAiB,CAA4B;IACrD,OAAO,CAAC,YAAY,CAAuB;gBAGzC,iBAAiB,EAAE,yBAAyB,EAC5C,MAAM,GAAE,4BAAiC;IAO3C;;OAEG;IACH,OAAO,CAAC,UAAU;IAelB;;;;;OAKG;IACH;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0C;IAEpE,+FAA+F;IACxF,YAAY,IAAI,gCAAgC;IAIvD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IAsEf,WAAW,CAAC,SAAS,GAAG,GAAG,EACtC,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,+BAA+B,EAC3C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,SAAS,CAAC;IAuErB;;;;;OAKG;IACU,sBAAsB,CAAC,SAAS,GAAG,GAAG,EACjD,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,4BAA4B,EACxC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,SAAS,CAAC;IA4ErB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAezB;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IA8C5B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,sBAAsB;IA4BrC;;OAEG;IACH,OAAO,CAAC,aAAa;IAwCrB;;OAEG;YACW,uBAAuB;IAoGrC;;OAEG;YACW,mCAAmC;IA+DjD;;;;OAIG;YACW,8BAA8B;IAqG5C;;;;;;;;;OASG;IACH,OAAO,CAAC,mBAAmB;IAuC3B;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAkBlC;;OAEG;IACH,OAAO,CAAC,kCAAkC;IA0D1C;;OAEG;IACH,OAAO,CAAC,yBAAyB;IA0BjC;;OAEG;IACI,0BAA0B,IAAI,MAAM,EAAE;IAe7C;;OAEG;IACI,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,uCAAuC,GAAG,IAAI;CAIrG"}