@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/core/requests/wildo-http-client-manual-calls.frontend.service.js

@@ -4,7 +4,8 @@
  * Extends base WildoBackendHttpClient with flexibility for non-standard endpoints
  */
 import { ExternalProvider_Connection_OwnerScope } from '@wildo-ai/external-connectors-models';
-import { AuthFactorLevel, AuthMethod, ReAuthenticationPurpose, MAIN_API_BASE_PATH, MANUAL_CONTROLLER_ROUTES_URLS, ManualControllerRouteKey, TokenExchangeRequestSchema, FileUploadGrantStatusSchema, ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH } from '@wildo-ai/saas-models';
+import { buildManualControllerRoutePath, getManualControllerRouteBody, HttpMethod, ManualControllerRouteBodyKind, OAuthConsentRemember, PasskeyAuthenticatorAttachment, } from '@wildo-ai/saas-models';
+import { AuthFactorLevel, AuthMethod, ReAuthenticationPurpose, MAIN_API_BASE_PATH, ManualControllerRouteKey, TokenExchangeRequestSchema, FileUploadGrantStatusSchema, ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH, buildFileUploadGrantStatusRoutePath, } from '@wildo-ai/saas-models';
 import { WildoBackendHttpClient } from './wildo-http-client.frontend.service.js';
 import { isSafeAuthRedirectTarget } from '../../core/security/auth-redirect.frontend.utils.js';
 import { readProviderScopeReauthorizationOffer, recordProviderScopeReauthorizationOffer, } from '../../core/external-providers/provider-scope-reauthorization-offers.frontend.js';
@@ -16,10 +17,69 @@ import { readProviderScopeReauthorizationOffer, recordProviderScopeReauthorizati
 // HTTP server mount and the refresh-token cookie `Path` so the URLs this
 // client builds always hit the same served paths the cookie is scoped to.
 const API_CALL_PREFIX = MAIN_API_BASE_PATH;
+/** A call's query as a string: an array repeats its key, an `undefined` value is left out. */
+function serializeManualRouteQuery(query) {
+    if (query === undefined)
+        return '';
+    if (query instanceof URLSearchParams)
+        return query.toString();
+    const search = new URLSearchParams();
+    for (const [name, value] of Object.entries(query)) {
+        if (value === undefined)
+            continue;
+        for (const item of typeof value === 'string' ? [value] : value)
+            search.append(name, item);
+    }
+    return search.toString();
+}
+/**
+ * A WebAuthn response from the browser library, with its `authenticatorAttachment` read into the contract's vocabulary.
+ * The library types it as WebAuthn's own string union; the route's schema names the same values as
+ * `PasskeyAuthenticatorAttachment`. Matched against the enum rather than cast, so a value outside it is left out, as the
+ * schema would refuse it.
+ */
+function withContractAuthenticatorAttachment(response) {
+    const { authenticatorAttachment, ...rest } = response;
+    const attachment = Object.values(PasskeyAuthenticatorAttachment).find((value) => value === authenticatorAttachment);
+    return { ...rest, ...(attachment === undefined ? {} : { authenticatorAttachment: attachment }) };
+}
 export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
     constructor(config = {}) {
         super(config);
     }
+    /**
+     * Call method `method` of hand-mounted route `key`, FROM ITS CONTRACT (#2834).
+     *
+     * The URL is the route's path with its parameters filled, under the API prefix; the body is typed as the input of the
+     * schema the backend parses it with (`MANUAL_CONTROLLER_ROUTE_CONTRACTS`, `@wildo-ai/saas-models`), and a method the
+     * route does not serve does not compile. So a client cannot send a body the handler would refuse for its shape, and a
+     * change to the schema reaches every caller as a type error instead of a `400`.
+     *
+     * The response is not yet part of the contract: `T` is whatever the caller states, as with `get<T>` and `post<T>`.
+     */
+    async callManualRoute(key, method, ...[call]) {
+        const { params, body, query, options } = (call ?? {});
+        const contractBody = getManualControllerRouteBody(key, method);
+        if (contractBody && contractBody.kind === ManualControllerRouteBodyKind.THIRD_PARTY_POST) {
+            throw new Error(`${method} ${key} is posted by a third party's browser; no client of this application calls it.`);
+        }
+        const queryString = serializeManualRouteQuery(query);
+        const url = `${API_CALL_PREFIX}${buildManualControllerRoutePath(key, params)}${queryString ? `?${queryString}` : ''}`;
+        switch (method) {
+            case HttpMethod.GET:
+                return this.get(url, options);
+            case HttpMethod.DELETE:
+                return this.delete(url, body === undefined ? options : { ...options, data: body });
+            case HttpMethod.POST:
+                return this.post(url, body, options);
+            case HttpMethod.PUT:
+                return this.put(url, body, options);
+            case HttpMethod.PATCH:
+                return this.patch(url, body, options);
+            default:
+                throw new Error(`${String(method)} ${key}: no client call is made with this method.`);
+        }
+    }
     /**
      * Retrieve application configuration from backend
      * @param frontendServiceName Frontend service identity (required)
@@ -27,8 +87,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * @returns Promise<AppConfiguration_FrontendBootstrapResponse> The application configuration plus frontend provider bootstrap data
      */
     async getApplicationConfig(frontendServiceName, options) {
-        const url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.APPLICATION_CONFIG_GET]}?frontendServiceName=${frontendServiceName}`;
-        return this.get(url, options);
+        return this.callManualRoute(ManualControllerRouteKey.APPLICATION_CONFIG_GET, HttpMethod.GET, { query: { frontendServiceName }, options });
     }
     // ── OIDC interactive consent (S1) ─────────────────────────────────────────
     /**
@@ -40,17 +99,17 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * browser there). The Bearer is auto-attached.
      */
     async oauthAuthorizeConsent(params, options) {
-        const url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]}?${params.toString()}`;
-        return this.get(url, options);
+        return this.callManualRoute(ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE, HttpMethod.GET, { query: params, options });
     }
     /**
      * `POST /oauth/authorize/decision` — record the user's approve/deny. `remember` (Item 3) opts into a
      * durable consent grant so a future authorize with covering scopes skips the prompt; sent as the
-     * string `'true'`/`'false'` the backend compares against. Returns `{ redirect_to }`; the caller
-     * navigates the browser there to complete the OAuth redirect to the third-party client.
+     * string the backend compares against. Returns `{ redirect_to }`; the caller navigates the browser there to complete
+     * the OAuth redirect to the third-party client.
      */
     async oauthConsentDecision(consentToken, decision, remember, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT]}`, { consent_token: consentToken, decision, remember: remember ? 'true' : 'false' }, options);
+        const rememberAnswer = remember ? OAuthConsentRemember.REMEMBER : OAuthConsentRemember.ASK_AGAIN;
+        return this.callManualRoute(ManualControllerRouteKey.OAUTH_PROVIDER_CONSENT, HttpMethod.POST, { body: { consent_token: consentToken, decision, remember: rememberAnswer }, options });
     }
     /**
      * `POST /oauth/end-session/confirm` — the OIDC RP-Initiated Logout §6 confirmation decision. Presents the
@@ -59,23 +118,24 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * no Bearer is required (the End-User may be unauthenticated here, having arrived via an RP redirect).
      */
     async oauthEndSessionConfirm(token, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM]}`, { token }, options);
+        return this.callManualRoute(ManualControllerRouteKey.OAUTH_PROVIDER_END_SESSION_CONFIRM, HttpMethod.POST, { body: { token }, options });
     }
     // Authentication manual calls
     async identifyByEmail(email, options) {
         const body = { email };
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTIFY]}`, body, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_IDENTIFY, HttpMethod.POST, { body, options });
     }
     async getSessionState(sessionId, options) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SESSION_STATE];
-        return this.get(`${API_CALL_PREFIX}${routeTemplate.replace(':sessionId', sessionId)}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_SESSION_STATE, HttpMethod.GET, { params: { sessionId }, options });
     }
     async authenticateWithPassword(params, options) {
-        const body = { ...params, method: AuthMethod.PASSWORD, factorLevel: AuthFactorLevel.FIRST };
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD]}`, body, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_AUTHENTICATE_PASSWORD, HttpMethod.POST, {
+            body: { ...params, method: AuthMethod.PASSWORD, factorLevel: AuthFactorLevel.FIRST },
+            options,
+        });
     }
     async authenticate(request, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_AUTHENTICATE]}`, request, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_AUTHENTICATE, HttpMethod.POST, { body: request, options });
     }
     /**
      * Refresh access token. Calls POST /api/v1/auth/token/refresh.
@@ -100,7 +160,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      *   JavaScript here cannot observe it).
      */
     async refreshTokens(options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_REFRESH]}`, {}, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_TOKEN_REFRESH, HttpMethod.POST, { body: {}, options });
     }
     /**
      * Get OAuth2 authorization URL for a given provider.
@@ -112,20 +172,16 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * caller always opens the returned URL via `window.location.href`.
      */
     async getOAuth2AuthorizationUrl(providerRef, returnUrl, options, acceptedGovernedDocumentReleaseIds) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE];
-        const baseUrl = `${API_CALL_PREFIX}${routeTemplate.replace(':providerRef', providerRef)}`;
         /*
          * `acceptedDocument` repeats once per accepted release (#1383). The backend puts the ids into the
          * server-side state token, so this is the LAST point at which they are editable by the browser —
          * they do not travel to the identity provider and cannot come back changed.
          */
-        const query = new URLSearchParams();
-        if (returnUrl)
-            query.set('returnUrl', returnUrl);
-        for (const releaseId of acceptedGovernedDocumentReleaseIds ?? [])
-            query.append('acceptedDocument', releaseId);
-        const url = query.size > 0 ? `${baseUrl}?${query.toString()}` : baseUrl;
-        return this.get(url, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_OAUTH2_AUTHORIZE, HttpMethod.GET, {
+            params: { providerRef },
+            query: { returnUrl: returnUrl || undefined, acceptedDocument: acceptedGovernedDocumentReleaseIds ?? [] },
+            options,
+        });
     }
     /**
      * Exchange a one-time AUTH_CODE_EXCHANGE token for access and refresh tokens.
@@ -158,7 +214,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * a session parked at organization onboarding, and the answer names it (#1103).
      */
     async exchangeAuthCode(code, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE]}`, TokenExchangeRequestSchema.parse({ code }), options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_TOKEN_EXCHANGE, HttpMethod.POST, { body: TokenExchangeRequestSchema.parse({ code }), options });
     }
     /**
      * Logout from the backend by revoking the refresh token AND clearing the
@@ -175,7 +231,18 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * revocation.
      */
     async logoutFromBackend(options) {
-        await this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LOGOUT]}`, {}, options);
+        await this.callManualRoute(ManualControllerRouteKey.AUTH_LOGOUT, HttpMethod.POST, { body: {}, options });
+    }
+    /**
+     * Sign out of every session the account holds (#2317): `POST /auth/logout-all`.
+     *
+     * The account is identified by this tab's refresh cookie, which travels because the URL is under
+     * `/auth/`. The backend fences every token issued to the account up to now, this tab's included,
+     * clears the cookie and answers 204. Unlike {@link logoutFromBackend} a failure is the caller's to
+     * report: if the fence was not written, other devices are still signed in.
+     */
+    async logoutAllFromBackend(options) {
+        await this.callManualRoute(ManualControllerRouteKey.AUTH_LOGOUT_ALL, HttpMethod.POST, { body: {}, options });
     }
     // ─── Password Reset manual calls ───
     /**
@@ -185,7 +252,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * @param email The email address to send the reset link to
      */
     async requestPasswordReset(email, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST]}`, { email }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PASSWORD_RESET_REQUEST, HttpMethod.POST, { body: { email }, options });
     }
     /**
      * Complete a password reset by providing the token and new password.
@@ -194,7 +261,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * @param newPassword The new password
      */
     async completePasswordReset(token, newPassword, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE]}`, { token, newPassword }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PASSWORD_RESET_COMPLETE, HttpMethod.POST, { body: { token, newPassword }, options });
     }
     // ─── Registration manual calls ───
     /**
@@ -208,7 +275,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * @param data Registration form data (email, firstName, lastName, password)
      */
     async register(data, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REGISTER]}`, data, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_REGISTER, HttpMethod.POST, { body: data, options });
     }
     /**
      * Discover the org's SSO/SCIM-aware first-factor auth methods for a PUBLIC
@@ -223,9 +290,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * `firstFactorMethods`, so the login `AUTH_METHOD_COMPONENTS` registry renders them.
      */
     async getInvitationInfo(token, options) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_INVITATION_INFO];
-        const url = `${API_CALL_PREFIX}${routeTemplate}?token=${encodeURIComponent(token)}`;
-        return this.get(url, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_INVITATION_INFO, HttpMethod.GET, { query: { token }, options });
     }
     /**
      * Accept an invitation using a public invitation token.
@@ -247,44 +312,101 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * accept (#1014). Omitted from the request unless it is a same-origin path.
      */
     { redirect, ...acceptance }, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_INVITATION]}`, 
         // `redirect` rides only when it is a same-origin path (#1014); the backend applies the same rule again.
-        isSafeAuthRedirectTarget(redirect) ? { ...acceptance, redirect } : acceptance, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_ACCEPT_INVITATION, HttpMethod.POST, {
+            body: isSafeAuthRedirectTarget(redirect) ? { ...acceptance, redirect } : acceptance,
+            options,
+        });
     }
     /**
      * Reject an invitation using a public invitation token.
      * Calls POST /api/v1/auth/invitation/reject
      */
     async rejectInvitation(data, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_INVITATION]}`, data, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_REJECT_INVITATION, HttpMethod.POST, { body: data, options });
     }
     /**
      * List the authenticated caller's OWN pending invitations across all organizations
      * (Approach P, email-owned — no token). Calls GET /api/v1/auth/invitations/mine.
      */
     async listMyPendingInvitations(options) {
-        return this.get(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS]}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_LIST_MY_INVITATIONS, HttpMethod.GET, { options });
     }
     /**
      * Accept ONE of the caller's own pending invitations in-app — no token, no new session
      * (the caller is already authenticated). Calls POST /api/v1/auth/invitations/accept.
      */
     async acceptMyInvitation(membershipId, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION]}`, { membershipId }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_ACCEPT_MY_INVITATION, HttpMethod.POST, { body: { membershipId }, options });
     }
     /**
      * Decline ONE of the caller's own pending invitations in-app (deletes the INVITED
      * membership row). Calls POST /api/v1/auth/invitations/reject.
      */
     async rejectMyInvitation(membershipId, rejectionReason, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION]}`, { membershipId, rejectionReason }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_REJECT_MY_INVITATION, HttpMethod.POST, { body: { membershipId, rejectionReason }, options });
+    }
+    /**
+     * The representing organizations' invitations to the caller's proven address (#2716), each with the organizations the
+     * caller owns that its representing organization may serve. Calls GET /api/v1/auth/relationship-invitations/mine.
+     */
+    async listMyRelationshipInvitations(options) {
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_LIST_MY_RELATIONSHIP_INVITATIONS, HttpMethod.GET, { options });
+    }
+    /**
+     * Receive one representing organization's invitation into an organization the caller owns (#2716): the representing
+     * organization's proposal then waits there, for the owner to accept or decline.
+     * Calls POST /api/v1/auth/relationship-invitations/receive.
+     */
+    async receiveMyRelationshipInvitation(invitationId, organizationId, options) {
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_RECEIVE_MY_RELATIONSHIP_INVITATION, HttpMethod.POST, { body: { invitationId, organizationId }, options });
     }
     /**
-     * The override rate of an organization's experts on its agents' proposals, per group, over a window (#1599).
+     * Decline one representing organization's invitation (#2716). It is never offered again, and the representing
+     * organization is not told.
+     * Calls POST /api/v1/auth/relationship-invitations/decline.
+     */
+    async declineMyRelationshipInvitation(invitationId, options) {
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_DECLINE_MY_RELATIONSHIP_INVITATION, HttpMethod.POST, { body: { invitationId }, options });
+    }
+    /**
+     * The override rate of an organization's deciders on its agents' proposals, per group, over a window (#1599).
      * Calls POST /api/v1/agent-work/override-rate; an organization administrator must name the organization.
      */
     async summarizeAgentWorkOverrideRate(request, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AGENT_WORK_OVERRIDE_RATE]}`, request, options);
+        return this.callManualRoute(ManualControllerRouteKey.AGENT_WORK_OVERRIDE_RATE, HttpMethod.POST, { body: request, options });
+    }
+    /**
+     * What model calls cost over a window, per case, organization, agent or model, in each currency, with the calls that
+     * could not be attributed or priced counted apart (#1598, #2528). Calls POST /api/v1/model-cost/summary; admitted for
+     * the application's model-cost readers only (super-administrator, billing manager).
+     */
+    async summarizeModelCost(request, options) {
+        return this.callManualRoute(ManualControllerRouteKey.MODEL_COST_SUMMARY, HttpMethod.POST, { body: request, options });
+    }
+    /**
+     * What a representing organization's own people did in the organizations it represents (#2874): one page, newest first,
+     * each row as far as its granting organization discloses it. Calls POST /api/v1/representative-activity; admitted for
+     * an administrator of the representing organization named.
+     */
+    async readRepresentativeActivity(request, options) {
+        return this.callManualRoute(ManualControllerRouteKey.REPRESENTATIVE_ACTIVITY, HttpMethod.POST, { body: request, options });
+    }
+    /**
+     * An organization's autonomous agents: when each runs, its latest runs there and its latest refusals (#2528).
+     * Calls GET /api/v1/flows-actors/autonomous-agents; admitted for the organization's administrator or the application
+     * super-administrator, and the caller must be a member of the organization named.
+     */
+    async readAutonomousAgentsOverview(organizationId, options) {
+        return this.callManualRoute(ManualControllerRouteKey.FLOWS_ACTORS_AUTONOMOUS_AGENTS, HttpMethod.GET, { query: { organizationId }, options });
+    }
+    /**
+     * Export an organization's decisions on one agent's proposals as an evaluation dataset (#2327).
+     * Calls POST /api/v1/agent-work/evaluation-exports; answers with the dataset (JSON Lines) and its ledger entry's id.
+     * Refused, and the refusal recorded, unless the organization holds an active export authorisation.
+     */
+    async exportEvaluationDataset(request, options) {
+        return this.callManualRoute(ManualControllerRouteKey.AGENT_WORK_EVALUATION_EXPORT, HttpMethod.POST, { body: request, options });
     }
     /**
      * Verify an email address using the token and email from the verification link.
@@ -292,47 +414,51 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * On success, returns JWT tokens for auto-login.
      */
     async verifyEmail(token, email, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_VERIFY_EMAIL]}`, { token, email }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_VERIFY_EMAIL, HttpMethod.POST, { body: { token, email }, options });
     }
     /**
      * Name the organization an account parked at onboarding owes, and finish signing it in (#1090).
      * Calls POST /api/v1/auth/onboarding/complete-org with the parked session id.
      */
     async completeOrgOnboarding(sessionId, organizationName, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING]}`, { sessionId, organizationName }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_COMPLETE_ORG_ONBOARDING, HttpMethod.POST, { body: { sessionId, organizationName }, options });
     }
     /**
      * Calls POST /api/v1/auth/onboarding/complete-profile with the parked session id and the person's names (#1374).
      */
     async completeProfileOnboarding(sessionId, firstName, lastName, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_COMPLETE_PROFILE_ONBOARDING]}`, { sessionId, firstName, lastName }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_COMPLETE_PROFILE_ONBOARDING, HttpMethod.POST, { body: { sessionId, firstName, lastName }, options });
     }
     async resendVerificationEmail(email, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_RESEND_VERIFICATION]}`, { email }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_RESEND_VERIFICATION, HttpMethod.POST, { body: { email }, options });
     }
     // ─── MFA: Email OTP ───
     async mfaEmailOTPSend(sessionId, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND]}`, { sessionId }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_SEND, HttpMethod.POST, { body: { sessionId }, options });
     }
     async mfaEmailOTPVerify(sessionId, code, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY]}`, { sessionId, code }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_MFA_EMAIL_OTP_VERIFY, HttpMethod.POST, { body: { sessionId, code }, options });
     }
     // ─── MFA: TOTP ───
     async mfaTOTPSetup(options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP]}`, {}, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_MFA_TOTP_SETUP, HttpMethod.POST, { options });
     }
     async mfaTOTPVerifySetup(code, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP]}`, { code }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY_SETUP, HttpMethod.POST, { body: { code }, options });
     }
     async mfaTOTPVerify(sessionId, code, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY]}`, { sessionId, code }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_MFA_TOTP_VERIFY, HttpMethod.POST, { body: { sessionId, code }, options });
     }
     // ─── WebAuthn/Passkey ───
-    async passkeyRegisterOptions(sessionId, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS]}`, { sessionId }, options);
+    /** The enrollment session, when there is one, rides the session header in `options`; the route reads no body. */
+    async passkeyRegisterOptions(options) {
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_OPTIONS, HttpMethod.POST, { options });
     }
     async passkeyRegisterVerify(credential, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY]}`, credential, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PASSKEY_REGISTER_VERIFY, HttpMethod.POST, {
+            body: { ...credential, response: withContractAuthenticatorAttachment(credential.response) },
+            options,
+        });
     }
     /**
      * Begin a passkey sign-in. Without a `sessionId` the server OPENS the sign-in (passkey autofill, or a
@@ -340,23 +466,26 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * issues options for that session. Either way the verification must present the returned `sessionId`.
      */
     async passkeyAuthOptions(sessionId, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS]}`, sessionId ? { sessionId } : {}, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PASSKEY_AUTH_OPTIONS, HttpMethod.POST, { body: sessionId ? { sessionId } : {}, options });
     }
     /**
      * Completes a passkey sign-in. The body is TYPED so the factor level can only be the wire
      * vocabulary: an untyped record let the UI's `'first'` reach the server and be refused (2026-09-15).
      */
     async passkeyAuthVerify(credential, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY]}`, credential, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PASSKEY_AUTH_VERIFY, HttpMethod.POST, {
+            body: { ...credential, response: withContractAuthenticatorAttachment(credential.response) },
+            options,
+        });
     }
     async passkeyList(options) {
-        return this.get(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_LIST]}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PASSKEY_LIST, HttpMethod.GET, { options });
     }
     async passkeyRemove(credentialId, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_REMOVE]}`, { credentialId }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PASSKEY_REMOVE, HttpMethod.POST, { body: { credentialId }, options });
     }
     async passkeyRename(credentialId, name, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSKEY_RENAME]}`, { credentialId, name }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PASSKEY_RENAME, HttpMethod.POST, { body: { credentialId, name }, options });
     }
     // ─── Magic Link (Phase G2) ───
     /**
@@ -365,45 +494,45 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * applies the same predicate again — it cannot trust a client.
      */
     async magicLinkSend(email, redirect, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND]}`, isSafeAuthRedirectTarget(redirect) ? { email, redirect } : { email }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_MAGIC_LINK_SEND, HttpMethod.POST, { body: isSafeAuthRedirectTarget(redirect) ? { email, redirect } : { email }, options });
     }
     async magicLinkVerify(token, email, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY]}`, { token, email }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_MAGIC_LINK_VERIFY, HttpMethod.POST, { body: { token, email }, options });
     }
     // ─── SMS OTP (Phase G2) ───
     /** The code goes to the account's own verified phone; the destination is never client-supplied (#1211). */
     async smsOTPSend(sessionId, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_SMS_OTP_SEND]}`, { sessionId }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_SMS_OTP_SEND, HttpMethod.POST, { body: { sessionId }, options });
     }
     // ─── Phone Verification (Phase G2) ───
     async phoneVerifySend(phoneNumber, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND]}`, { phoneNumber }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PHONE_VERIFY_SEND, HttpMethod.POST, { body: { phoneNumber }, options });
     }
     async phoneVerifyConfirm(phoneNumber, code, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM]}`, { phoneNumber, code }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PHONE_VERIFY_CONFIRM, HttpMethod.POST, { body: { phoneNumber, code }, options });
     }
     // ─── Method Management (#13f) ───
     async passwordChange(currentPassword, newPassword, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_CHANGE]}`, { currentPassword, newPassword }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PASSWORD_CHANGE, HttpMethod.POST, { body: { currentPassword, newPassword }, options });
     }
     async passwordSet(newPassword, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_PASSWORD_SET]}`, { newPassword }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_PASSWORD_SET, HttpMethod.POST, { body: { newPassword }, options });
     }
     async mfaTOTPDisable(options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE]}`, {}, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_MFA_TOTP_DISABLE, HttpMethod.POST, { options });
     }
     async getMyMethods(options) {
-        return this.get(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_METHODS_MINE]}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_METHODS_MINE, HttpMethod.GET, { options });
     }
     async getIdentityLinks(options) {
-        return this.get(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST]}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_IDENTITY_LINKS_LIST, HttpMethod.GET, { options });
     }
     /**
      * Which governed documents the signed-in person owes an acceptance of (#1258). Empty for an
      * application that asks for no acceptance — the server answers without reading the store.
      */
     async getOwedGovernedDocumentAcceptances(options) {
-        return this.get(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_OWED]}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_OWED, HttpMethod.GET, { options });
     }
     /**
      * Record the signed-in person's acceptance of in-force releases, by id only (#1258). The answer is
@@ -411,14 +540,14 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * on having sent the request.
      */
     async acceptGovernedDocuments(acceptedGovernedDocumentReleaseIds, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT]}`, { acceptedGovernedDocumentReleaseIds: [...acceptedGovernedDocumentReleaseIds] }, options);
+        return this.callManualRoute(ManualControllerRouteKey.GOVERNED_DOCUMENT_ACCEPTANCES_ACCEPT, HttpMethod.POST, { body: { acceptedGovernedDocumentReleaseIds: [...acceptedGovernedDocumentReleaseIds] }, options });
     }
     /**
      * Record that a governed document was delivered to the signed-in caller (#1258 Step 5 / R11). Never
      * throws on a document the release does not permit recording — the recorder is a silent no-op then.
      */
     async recordGovernedDocumentNoticeDelivered(documentRef, options) {
-        await this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.GOVERNED_DOCUMENT_NOTICE_DELIVERED]}`, { documentRef }, options);
+        await this.callManualRoute(ManualControllerRouteKey.GOVERNED_DOCUMENT_NOTICE_DELIVERED, HttpMethod.POST, { body: { documentRef }, options });
     }
     /**
      * Record that a governed document was delivered to a VISITOR — the anonymous-session half of R11
@@ -434,9 +563,20 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
         return this.put(`${API_CALL_PREFIX}${ANONYMOUS_NOTICE_DELIVERED_RECORD_PATH}`, { documentRef }, options);
     }
     async unlinkIdentityLink(linkId, options) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK];
-        const url = `${API_CALL_PREFIX}${routeTemplate.replace(':linkId', linkId)}`;
-        return this.delete(url, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_IDENTITY_LINKS_UNLINK, HttpMethod.DELETE, { params: { linkId }, options });
+    }
+    /**
+     * Where the caller is signed in (#2317): their live sessions, most recently active first. `GET /auth/sessions`.
+     */
+    async listMySessions(options) {
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_SESSIONS_LIST, HttpMethod.GET, { options });
+    }
+    /**
+     * Sign out one of the caller's own sessions (#2317). `DELETE /auth/sessions/:sessionId`; answers 204, or 404 when
+     * the session is not one of the caller's live sessions (already ended, or never theirs).
+     */
+    async revokeMySession(sessionId, options) {
+        await this.callManualRoute(ManualControllerRouteKey.AUTH_SESSION_REVOKE, HttpMethod.DELETE, { params: { sessionId }, options });
     }
     // ─── Connecting a third-party account ───
     /**
@@ -448,7 +588,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * order every credential path uses.
      */
     async listConnectableProviders(options) {
-        return this.get(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE]}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.PROVIDER_CONNECTION_CATALOGUE, HttpMethod.GET, { options });
     }
     /**
      * The connections one owner holds — one entry per CONNECTION (#1727). Calls `GET /api/v1/connections/linked`.
@@ -458,8 +598,21 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * credential resource's own DELETE — this client offers no second delete door.
      */
     async listLinkedProviderConnections(owner, options) {
-        const query = new URLSearchParams({ ownerScope: owner.ownerScope, ...(owner.ownerId === undefined ? {} : { ownerId: owner.ownerId }) });
-        return this.get(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_LIST]}?${query.toString()}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.PROVIDER_CONNECTION_LIST, HttpMethod.GET, { query: { ownerScope: owner.ownerScope, ownerId: owner.ownerId }, options });
+    }
+    /**
+     * What an organization registers at a vendor for an app of its OWN (#2713). Calls
+     * `GET /api/v1/connections/:providerRef/vendor-registration`.
+     *
+     * Offered only where the catalogue entry's `vendorRegistrationOwnerScopes` names the organization, and answered only
+     * for a caller who may list that organization's connections.
+     */
+    async getProviderVendorRegistration(providerRef, owner, options) {
+        return this.callManualRoute(ManualControllerRouteKey.PROVIDER_CONNECTION_VENDOR_REGISTRATION, HttpMethod.GET, {
+            params: { providerRef },
+            query: { ownerScope: owner.ownerScope, ownerId: owner.ownerId },
+            options,
+        });
     }
     /**
      * Begin connecting one account. Calls `POST /api/v1/connections/:providerRef/start`.
@@ -469,9 +622,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * consent screen into a response body nobody ever sees.
      */
     async startProviderConnection(providerRef, body, options) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_START];
-        const url = `${API_CALL_PREFIX}${routeTemplate.replace(':providerRef', encodeURIComponent(providerRef))}`;
-        return this.post(url, body, options);
+        return this.callManualRoute(ManualControllerRouteKey.PROVIDER_CONNECTION_START, HttpMethod.POST, { params: { providerRef }, body, options });
     }
     /**
      * Finish a connection the vendor approved. Calls `POST /api/v1/connections/complete`.
@@ -484,7 +635,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * writes here can decide whose account the grant is stored against.
      */
     async completeProviderConnection(body, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE]}`, body, options);
+        return this.callManualRoute(ManualControllerRouteKey.PROVIDER_CONNECTION_COMPLETE, HttpMethod.POST, { body, options });
     }
     /**
      * Store a credential somebody typed. Calls `POST /api/v1/connections/:providerRef/credential`.
@@ -501,10 +652,8 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * "connect your account first" through `onError`.
      */
     async getProviderConnectionAccessToken(providerRef, options) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN];
-        const url = `${API_CALL_PREFIX}${routeTemplate.replace(':providerRef', encodeURIComponent(providerRef))}`;
         try {
-            return await this.get(url, options);
+            return await this.callManualRoute(ManualControllerRouteKey.PROVIDER_CONNECTION_ACCESS_TOKEN, HttpMethod.GET, { params: { providerRef }, options });
         }
         catch (error) {
             if (isNotConnectedResponse(error))
@@ -513,28 +662,23 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
         }
     }
     async storeProviderCredential(providerRef, body, options) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL];
-        const url = `${API_CALL_PREFIX}${routeTemplate.replace(':providerRef', encodeURIComponent(providerRef))}`;
-        return this.post(url, body, options);
+        return this.callManualRoute(ManualControllerRouteKey.PROVIDER_CONNECTION_STORE_CREDENTIAL, HttpMethod.POST, { params: { providerRef }, body, options });
     }
     /** @wildo_source:part:start saas.frontend.providers.execute-operation facet:layer:frontend facet:audience:app-developer */
     /**
      * Run ONE provider operation the application declared browser-reachable (#367).
      *
      * The operation executes on the backend; the credential never reaches the browser. `connection` names
-     * whose account to spend and is absent for the application's own. A refused request rejects with the
-     * backend's 403, whose body carries `reason` — a component can tell "not enabled" from "not for you".
+     * whose account to spend and is absent for the application's own. A refusal rejects with the framework error body
+     * (#2952): a 403 carries `error.details.reason` — a component can tell "not enabled" from "not for you" — and every
+     * refusal a `customMessageReference` to word it by, with `error.code` on a 400, 409 or 429.
      *
      * `TOutput` is the caller's statement of what the operation's declared output looks like; the backend
      * has already parsed the answer through that operation's schema.
      */
     async executeProviderOperation(providerRef, operationId, body, options) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_OPERATION_EXECUTE];
-        const url = `${API_CALL_PREFIX}${routeTemplate
-            .replace(':providerRef', encodeURIComponent(providerRef))
-            .replace(':operationId', encodeURIComponent(operationId))}`;
         try {
-            return await this.post(url, body, options);
+            return await this.callManualRoute(ManualControllerRouteKey.PROVIDER_OPERATION_EXECUTE, HttpMethod.POST, { params: { providerRef, operationId }, body, options });
         }
         catch (error) {
             // A refusal for a missing scope carries a re-authorization offer (#1671). Recorded here, once, so the
@@ -550,16 +694,16 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * The backend runs the input's declared options operation through the same `connection`, so the list is
      * exactly what that account can see. Both the operation and its options operation must be listed in
      * `providers.browserOperations`. A choice another input depends on must be passed in `input`; without it
-     * the answer is `400 PROVIDER_OPERATION_INPUT_OPTIONS_DEPENDENCY_MISSING` naming it in `dependsOn`.
+     * the answer is a `400` whose `error.code` is `PROVIDER_OPERATION_INPUT_OPTIONS_DEPENDENCY_MISSING`, naming it in
+     * `error.details.dependsOn`.
      */
     async loadProviderOperationInputOptions(providerRef, operationId, inputField, body, options) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROVIDER_OPERATION_INPUT_OPTIONS];
-        const url = `${API_CALL_PREFIX}${routeTemplate
-            .replace(':providerRef', encodeURIComponent(providerRef))
-            .replace(':operationId', encodeURIComponent(operationId))
-            .replace(':inputField', encodeURIComponent(inputField))}`;
         try {
-            return await this.post(url, body, options);
+            return await this.callManualRoute(ManualControllerRouteKey.PROVIDER_OPERATION_INPUT_OPTIONS, HttpMethod.POST, {
+                params: { providerRef, operationId, inputField },
+                body,
+                options,
+            });
         }
         catch (error) {
             // The options operation runs through the same connection and the same door, so it is refused for a missing
@@ -579,7 +723,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
     async reAuthenticate(method, credentials, 
     /** Which proof to mint (#1417): a step-up, or a binding proof for adding a way to sign in. */
     purpose = ReAuthenticationPurpose.STEP_UP, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REAUTH]}`, { method, ...credentials, purpose }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_REAUTH, HttpMethod.POST, { body: { method, ...credentials, purpose }, options });
     }
     /**
      * Which of the signed-in person's own factors can produce a re-authentication proof for `purpose`,
@@ -588,15 +732,14 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * re-authenticate the person (#1441). Both empty means the account must add an accepted factor first.
      */
     async getReAuthenticationMethods(purpose, options) {
-        const query = new URLSearchParams({ purpose }).toString();
-        return this.get(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REAUTH_METHODS]}?${query}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_REAUTH_METHODS, HttpMethod.GET, { query: { purpose }, options });
     }
     /**
      * Begin a passkey step-up: the challenge leg. Take these options to the authenticator, then present
      * the assertion to {@link reAuthenticate} with `AuthMethod.PASSKEY`.
      */
     async reAuthPasskeyOptions(options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS]}`, {}, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_REAUTH_PASSKEY_OPTIONS, HttpMethod.POST, { options });
     }
     /**
      * Start a re-authentication at the provider behind one of the person's own linked identities (#1441).
@@ -604,28 +747,26 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * `REAUTHENTICATION_CALLBACK_PAGE_PATH` with a one-time code for {@link exchangeFederatedReAuthentication}.
      */
     async startFederatedReAuthentication(identityLinkId, purpose, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_AUTHORIZE]}`, { identityLinkId, purpose }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_AUTHORIZE, HttpMethod.POST, { body: { identityLinkId, purpose }, options });
     }
     /** Redeem the one-time code a federated re-authentication returned, with this account's own bearer (#1441). */
     async exchangeFederatedReAuthentication(code, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_EXCHANGE]}`, { code }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_REAUTH_FEDERATED_EXCHANGE, HttpMethod.POST, { body: { code }, options });
     }
     // ─── Enterprise SSO ───
     async getEnterpriseSSOAuthorizationUrl(orgId, connectionId, returnUrl, options) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE];
-        const baseUrl = `${API_CALL_PREFIX}${routeTemplate.replace(':orgId', orgId).replace(':connectionId', connectionId)}`;
-        const url = returnUrl
-            ? `${baseUrl}?returnUrl=${encodeURIComponent(returnUrl)}`
-            : baseUrl;
-        return this.get(url, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_ENTERPRISE_SSO_AUTHORIZE, HttpMethod.GET, {
+            params: { orgId, connectionId },
+            query: { returnUrl: returnUrl || undefined },
+            options,
+        });
     }
     async getAppEnterpriseSSOAuthorizationUrl(connectionId, returnUrl, options) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE];
-        const baseUrl = `${API_CALL_PREFIX}${routeTemplate.replace(':connectionId', connectionId)}`;
-        const url = returnUrl
-            ? `${baseUrl}?returnUrl=${encodeURIComponent(returnUrl)}`
-            : baseUrl;
-        return this.get(url, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_APP_ENTERPRISE_AUTHORIZE, HttpMethod.GET, {
+            params: { connectionId },
+            query: { returnUrl: returnUrl || undefined },
+            options,
+        });
     }
     /**
      * Public status read of a file-upload grant — the drop page's first call.
@@ -635,7 +776,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * server can never reach the page as UI state.
      */
     async readFileUploadGrantStatus(token, options) {
-        return this.get(`${API_CALL_PREFIX}/files/upload-grants/${encodeURIComponent(token)}`, {
+        return this.get(`${API_CALL_PREFIX}${buildFileUploadGrantStatusRoutePath(token)}`, {
             ...options,
             schema: FileUploadGrantStatusSchema,
         });
@@ -659,7 +800,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
         });
     }
     async exchangeOneOffToken(token, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE]}`, { token }, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_ONE_OFF_SESSION_EXCHANGE, HttpMethod.POST, { body: { token }, options });
     }
     /**
      * Request a one-time cross-frontend handoff URL (cross-app-jwt-propagation Step 2 + 3).
@@ -680,11 +821,11 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * defend against header spoofing.
      */
     async crossFrontendHandoff(request, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF]}`, request, options);
+        return this.callManualRoute(ManualControllerRouteKey.AUTH_CROSS_FRONTEND_HANDOFF, HttpMethod.POST, { body: request, options });
     }
     // ─── Features ───
     async getResolvedFeatures(options) {
-        return this.get(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.FEATURES_RESOLVED]}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.FEATURES_RESOLVED, HttpMethod.GET, { options });
     }
     // I18n manual calls
     /**
@@ -695,11 +836,10 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * @returns Promise<I18nLabelsResponseDto> The i18n labels response
      */
     async getI18nLabels(language, sections, options) {
-        let url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.I18N_GET_LABELS]}?language=${language}`;
-        if (sections && sections.length > 0) {
-            url += `&sections=${sections.join(',')}`;
-        }
-        return this.get(url, options);
+        return this.callManualRoute(ManualControllerRouteKey.I18N_GET_LABELS, HttpMethod.GET, {
+            query: { language, sections: sections && sections.length > 0 ? sections.join(',') : undefined },
+            options,
+        });
     }
     /**
      * Load specific translation sub-trees by dot-path keys.
@@ -707,9 +847,7 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * `{ components: { low_level_button: { ... } } }`).
      */
     async getI18nLabelsByKeys(language, keys, options) {
-        let url = `${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.I18N_GET_LABELS]}?language=${language}`;
-        url += `&keys=${keys.map(k => encodeURIComponent(k)).join(',')}`;
-        return this.get(url, options);
+        return this.callManualRoute(ManualControllerRouteKey.I18N_GET_LABELS, HttpMethod.GET, { query: { language, keys: keys.join(',') }, options });
     }
     // Charts manual calls
     /**
@@ -723,41 +861,29 @@ export class WildoBackendHttpClient_ManualCalls extends WildoBackendHttpClient {
      * @returns Promise<AggregationQueryResponse>
      */
     async getChartData(chartRef, body, options, queryParams) {
-        const routeTemplate = MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.CHARTS_DATA];
-        const queryString = queryParams
-            ? new URLSearchParams(Object.entries(queryParams).filter(([, value]) => typeof value === 'string' && value.length > 0)).toString()
-            : '';
-        const url = `${API_CALL_PREFIX}${routeTemplate.replace(':chartRef', chartRef)}${queryString ? `?${queryString}` : ''}`;
-        return this.post(url, body || {}, options);
+        return this.callManualRoute(ManualControllerRouteKey.CHARTS_DATA, HttpMethod.POST, {
+            params: { chartRef },
+            body: body || {},
+            query: Object.fromEntries(Object.entries(queryParams ?? {}).filter(([, value]) => typeof value === 'string' && value.length > 0)),
+            options,
+        });
     }
     // Analytics manual calls
-    /**
-     * Ingest a batch of analytics events.
-     * Calls POST /api/v1/analytics/events
-     */
+    /** Ingest a batch of analytics events: `POST /api/v1/analytics/events`. */
     async postAnalyticsEvents(body, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.ANALYTICS_EVENTS]}`, body, options);
+        return this.callManualRoute(ManualControllerRouteKey.ANALYTICS_EVENTS, HttpMethod.POST, { body, options });
     }
-    /**
-     * Get achieved value moments for the current user.
-     * Calls GET /api/v1/analytics/moments/achieved
-     */
+    /** The value moments the current user has reached: `GET /api/v1/analytics/moments/achieved`. */
     async getAnalyticsMomentsAchieved(options) {
-        return this.get(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED, HttpMethod.GET, { options });
     }
-    /**
-     * Mark a value moment as achieved.
-     * Calls POST /api/v1/analytics/moments/achieved
-     */
+    /** Record that the current user reached a value moment: `POST /api/v1/analytics/moments/achieved`. */
     async postAnalyticsMomentsAchieved(body, options) {
-        return this.post(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED]}`, body, options);
+        return this.callManualRoute(ManualControllerRouteKey.ANALYTICS_MOMENTS_ACHIEVED, HttpMethod.POST, { body, options });
     }
-    /**
-     * Get all registered milestone definitions.
-     * Calls GET /api/v1/progression/milestones
-     */
+    /** Every registered milestone definition: `GET /api/v1/progression/milestones`. */
     async getMilestoneDefinitions(options) {
-        return this.get(`${API_CALL_PREFIX}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.PROGRESSION_MILESTONES]}`, options);
+        return this.callManualRoute(ManualControllerRouteKey.PROGRESSION_MILESTONES, HttpMethod.GET, { options });
     }
 }
 /** The JSON body a refused request answered with, wherever the HTTP layer left it. `undefined` when there is none. */