@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/requests/header-keys.shared.d.ts

@@ -15,20 +15,34 @@ export declare const WildoHeaderKeys: {
     readonly ETAG: "etag";
     readonly IF_MATCH: "if-match";
     readonly LAST_MODIFIED: "last-modified";
+    readonly CACHE_CONTROL: "cache-control";
     readonly ORIGIN: "origin";
     readonly LOCATION: "location";
     readonly WWW_AUTHENTICATE: "www-authenticate";
     readonly HOST: "host";
     readonly X_SIGNATURE_256: "x-signature-256";
+    readonly X_WEBHOOK_SIGNATURE: "x-wildo-webhook-signature";
     readonly SERVICE_ID: "x-service-id";
     readonly APPLICATION_ID: "x-application-id";
     readonly PLATFORM_SECRET: "x-platform-secret";
     readonly API_KEY: "x-api-key";
     readonly ORGANIZATION_ID: "x-organization-id";
     readonly LIFECYCLE_SECRET: "x-lifecycle-secret";
+    /**
+     * A short-lived attestation, MINTED BY apps-manager, that the bearer is one
+     * named runtime principal (`minion:<name>`) of one application.
+     *
+     * A separate header from {@link WildoHeaderKeys.AUTHORIZATION} on purpose. The
+     * bearer is not a platform service and must not present itself through
+     * `SERVICE_ID`, and it is not the application backend either — an application
+     * JWT is signed with a key EVERY runtime of that application holds, so a claim
+     * carried there could name any sibling. This header's token is signed by
+     * apps-manager, which is the only party that learns the principal from the
+     * secret PRESENTED rather than from anything the caller asserts.
+     */
+    readonly RUNTIME_PRINCIPAL_TOKEN: "x-wildo-runtime-principal-token";
     readonly TARGET_APP_SLUG: "x-target-app-slug";
     readonly TARGET_APP_ID: "x-target-app-id";
-    readonly REQUEST_UUID: "x-request-uuid";
     readonly CORRELATION_ID: "x-correlation-id";
     readonly RATE_LIMIT_LIMIT: "x-ratelimit-limit";
     readonly RATE_LIMIT_REMAINING: "x-ratelimit-remaining";
@@ -36,11 +50,19 @@ export declare const WildoHeaderKeys: {
     readonly FILE_ID: "x-file-id";
     readonly STORAGE_KEY: "x-storage-key";
     readonly FRONTEND_SERVICE_NAME: "x-frontend-service-name";
+    /**
+     * Which browser/device INSTALL issued the request. Sent ONLY when the application authored a
+     * non-`DISABLED` `compliance.clientInstanceIdScope`, and INGESTED only under that same policy —
+     * the backend fails closed, so an unopted application records nothing even if a client sends it.
+     * See `ClientInstanceIdScope` for the privacy reasoning.
+     */
+    readonly CLIENT_INSTANCE_ID: "x-client-instance-id";
     readonly REAUTH_TOKEN: "x-reauth-token";
     readonly AUTH_SESSION_ID: "x-auth-session-id";
     readonly ANONYMOUS_SESSION_INIT: "x-anonymous-session-init";
     readonly ANONYMOUS_SESSION: "x-anonymous-session";
     readonly ANONYMOUS_SESSION_TOKEN: "x-anonymous-session-token";
+    readonly LANDING_PATH: "x-landing-path";
     readonly CONSUMABLE_TOKEN: "x-consumable-token";
     readonly CONSUMABLE_TOKEN_CONSUMED: "x-consumable-token-consumed";
     readonly X_SERVER_TIME: "x-server-time";

package/dist/esm/requests/header-keys.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"header-keys.shared.d.ts","sourceRoot":"","sources":["../../../src/requests/header-keys.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuElB,CAAC"}
+{"version":3,"file":"header-keys.shared.d.ts","sourceRoot":"","sources":["../../../../src/requests/header-keys.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;IAqC1B;;;;;;;;;;;OAWG;;;;;;;;;;;IAyBH;;;;;OAKG;;;;;;;;;;;;;;;CAuCK,CAAC"}

package/dist/esm/requests/header-keys.shared.js

@@ -16,12 +16,20 @@ export const WildoHeaderKeys = {
     ETAG: 'etag',
     IF_MATCH: 'if-match',
     LAST_MODIFIED: 'last-modified',
+    CACHE_CONTROL: 'cache-control',
     ORIGIN: 'origin',
     LOCATION: 'location',
     WWW_AUTHENTICATE: 'www-authenticate',
     HOST: 'host',
     // ── SIEM webhook (HMAC signature) ───────────────────────────────────
     X_SIGNATURE_256: 'x-signature-256',
+    // ── M2M outbound webhook (JWT signature) ────────────────────────────
+    // Carries the compact-serialized JWT (header.payload.signature) signed
+    // with `JwtPrivateKeys.APPLICATION_WEBHOOK`. Embeds `bodyHash` (sha256
+    // hex of the POST body) as a claim so consumers can verify both
+    // identity AND payload integrity. See
+    // `notifications/webhooks/outbound/` in saas-backend-lib (Phase 3).
+    X_WEBHOOK_SIGNATURE: 'x-wildo-webhook-signature',
     // ── Service identity ───────────────────────────────────────────────
     SERVICE_ID: 'x-service-id',
     APPLICATION_ID: 'x-application-id',
@@ -30,11 +38,27 @@ export const WildoHeaderKeys = {
     API_KEY: 'x-api-key',
     ORGANIZATION_ID: 'x-organization-id',
     LIFECYCLE_SECRET: 'x-lifecycle-secret',
+    /**
+     * A short-lived attestation, MINTED BY apps-manager, that the bearer is one
+     * named runtime principal (`minion:<name>`) of one application.
+     *
+     * A separate header from {@link WildoHeaderKeys.AUTHORIZATION} on purpose. The
+     * bearer is not a platform service and must not present itself through
+     * `SERVICE_ID`, and it is not the application backend either — an application
+     * JWT is signed with a key EVERY runtime of that application holds, so a claim
+     * carried there could name any sibling. This header's token is signed by
+     * apps-manager, which is the only party that learns the principal from the
+     * secret PRESENTED rather than from anything the caller asserts.
+     */
+    RUNTIME_PRINCIPAL_TOKEN: 'x-wildo-runtime-principal-token',
     // ── Target application (cross-app operations) ──────────────────────
     TARGET_APP_SLUG: 'x-target-app-slug',
     TARGET_APP_ID: 'x-target-app-id',
     // ── Observability ──────────────────────────────────────────────────
-    REQUEST_UUID: 'x-request-uuid',
+    // The canonical per-request identifier carried across every service hop. The receiver's
+    // `setupRequestContext` ingests it into the request-scoped ALS frame, so the downstream
+    // request's EC, logs and audit all share one correlationId. (Replaced the former
+    // `x-request-uuid`, which was set on the platform channel but never read back.)
     CORRELATION_ID: 'x-correlation-id',
     // ── Rate limiting (response) ───────────────────────────────────────
     RATE_LIMIT_LIMIT: 'x-ratelimit-limit',
@@ -45,6 +69,13 @@ export const WildoHeaderKeys = {
     STORAGE_KEY: 'x-storage-key',
     // ── Frontend originator ────────────────────────────────────────────
     FRONTEND_SERVICE_NAME: 'x-frontend-service-name',
+    /**
+     * Which browser/device INSTALL issued the request. Sent ONLY when the application authored a
+     * non-`DISABLED` `compliance.clientInstanceIdScope`, and INGESTED only under that same policy —
+     * the backend fails closed, so an unopted application records nothing even if a client sends it.
+     * See `ClientInstanceIdScope` for the privacy reasoning.
+     */
+    CLIENT_INSTANCE_ID: 'x-client-instance-id',
     // ── Step-up re-authentication ──────────────────────────────────────
     REAUTH_TOKEN: 'x-reauth-token',
     // ── MFA enrollment ─────────────────────────────────────────────────
@@ -53,6 +84,18 @@ export const WildoHeaderKeys = {
     ANONYMOUS_SESSION_INIT: 'x-anonymous-session-init',
     ANONYMOUS_SESSION: 'x-anonymous-session',
     ANONYMOUS_SESSION_TOKEN: 'x-anonymous-session-token',
+    // ── Marketing site first-touch attribution (Phase 0.5, Q-D=β) ──────
+    // Sent by the marketing-site bootstrap on the very first request to
+    // the anonymous-session-init endpoint. Carries the path of the
+    // landing page (e.g. `/pricing`, `/blog/post-slug`) — distinct from
+    // `req.path` because the session-init endpoint URL is itself not a
+    // marketing landing page. Stored ONCE on
+    // `AnonymousUser.marketingMetadata.landingPath` (first-touch only).
+    // Carried in the engine CORS `allowedHeaders` floor (framework-universal),
+    // since it travels with `x-anonymous-session-init` on the same preflighted
+    // session-init request — see `engineAllowedHeaders` in saas-backend-lib's
+    // `http-server.backend.service.ts`.
+    LANDING_PATH: 'x-landing-path',
     // ── Consumable tokens (W7.3b) ──────────────────────────────────────
     CONSUMABLE_TOKEN: 'x-consumable-token',
     CONSUMABLE_TOKEN_CONSUMED: 'x-consumable-token-consumed',
@@ -64,4 +107,4 @@ export const WildoHeaderKeys = {
     FORWARDED_HOST: 'x-forwarded-host',
     REAL_IP: 'x-real-ip',
 };
-//# sourceMappingURL=header-keys.shared.js.map
+//# sourceMappingURL=header-keys.shared.js.map

package/dist/esm/requests/header-keys.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"header-keys.shared.js","sourceRoot":"","sources":["../../../src/requests/header-keys.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,sEAAsE;IACtE,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,eAAe;IAC9B,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,gBAAgB,EAAE,kBAAkB;IACpC,IAAI,EAAE,MAAM;IAEZ,uEAAuE;IACvE,eAAe,EAAE,iBAAiB;IAElC,sEAAsE;IACtE,UAAU,EAAE,cAAc;IAC1B,cAAc,EAAE,kBAAkB;IAElC,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IACpC,OAAO,EAAE,WAAW;IACpB,eAAe,EAAE,mBAAmB;IACpC,gBAAgB,EAAE,oBAAoB;IAEtC,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IACpC,aAAa,EAAE,iBAAiB;IAEhC,sEAAsE;IACtE,YAAY,EAAE,gBAAgB;IAC9B,cAAc,EAAE,kBAAkB;IAElC,sEAAsE;IACtE,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,uBAAuB;IAC7C,gBAAgB,EAAE,mBAAmB;IAErC,sEAAsE;IACtE,OAAO,EAAE,WAAW;IACpB,WAAW,EAAE,eAAe;IAE5B,sEAAsE;IACtE,qBAAqB,EAAE,yBAAyB;IAEhD,sEAAsE;IACtE,YAAY,EAAE,gBAAgB;IAE9B,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IAEpC,sEAAsE;IACtE,sBAAsB,EAAE,0BAA0B;IAClD,iBAAiB,EAAE,qBAAqB;IACxC,uBAAuB,EAAE,2BAA2B;IAEpD,sEAAsE;IACtE,gBAAgB,EAAE,oBAAoB;IACtC,yBAAyB,EAAE,6BAA6B;IAExD,uEAAuE;IACvE,aAAa,EAAE,eAAe;IAE9B,sEAAsE;IACtE,aAAa,EAAE,iBAAiB;IAChC,eAAe,EAAE,mBAAmB;IACpC,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,WAAW;CACZ,CAAC"}
+{"version":3,"file":"header-keys.shared.js","sourceRoot":"","sources":["../../../../src/requests/header-keys.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,sEAAsE;IACtE,aAAa,EAAE,eAAe;IAC9B,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,gBAAgB;IAChC,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B,MAAM,EAAE,QAAQ;IAChB,QAAQ,EAAE,UAAU;IACpB,gBAAgB,EAAE,kBAAkB;IACpC,IAAI,EAAE,MAAM;IAEZ,uEAAuE;IACvE,eAAe,EAAE,iBAAiB;IAElC,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,gEAAgE;IAChE,sCAAsC;IACtC,oEAAoE;IACpE,mBAAmB,EAAE,2BAA2B;IAEhD,sEAAsE;IACtE,UAAU,EAAE,cAAc;IAC1B,cAAc,EAAE,kBAAkB;IAElC,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IACpC,OAAO,EAAE,WAAW;IACpB,eAAe,EAAE,mBAAmB;IACpC,gBAAgB,EAAE,oBAAoB;IAEtC;;;;;;;;;;;OAWG;IACH,uBAAuB,EAAE,iCAAiC;IAE1D,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IACpC,aAAa,EAAE,iBAAiB;IAEhC,sEAAsE;IACtE,wFAAwF;IACxF,wFAAwF;IACxF,iFAAiF;IACjF,gFAAgF;IAChF,cAAc,EAAE,kBAAkB;IAElC,sEAAsE;IACtE,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,uBAAuB;IAC7C,gBAAgB,EAAE,mBAAmB;IAErC,sEAAsE;IACtE,OAAO,EAAE,WAAW;IACpB,WAAW,EAAE,eAAe;IAE5B,sEAAsE;IACtE,qBAAqB,EAAE,yBAAyB;IAChD;;;;;OAKG;IACH,kBAAkB,EAAE,sBAAsB;IAE1C,sEAAsE;IACtE,YAAY,EAAE,gBAAgB;IAE9B,sEAAsE;IACtE,eAAe,EAAE,mBAAmB;IAEpC,sEAAsE;IACtE,sBAAsB,EAAE,0BAA0B;IAClD,iBAAiB,EAAE,qBAAqB;IACxC,uBAAuB,EAAE,2BAA2B;IAEpD,sEAAsE;IACtE,oEAAoE;IACpE,+DAA+D;IAC/D,oEAAoE;IACpE,mEAAmE;IACnE,yCAAyC;IACzC,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,oCAAoC;IACpC,YAAY,EAAE,gBAAgB;IAE9B,sEAAsE;IACtE,gBAAgB,EAAE,oBAAoB;IACtC,yBAAyB,EAAE,6BAA6B;IAExD,uEAAuE;IACvE,aAAa,EAAE,eAAe;IAE9B,sEAAsE;IACtE,aAAa,EAAE,iBAAiB;IAChC,eAAe,EAAE,mBAAmB;IACpC,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,WAAW;CACZ,CAAC","sourcesContent":["/**\n * Canonical HTTP header keys for the entire Wildo platform.\n *\n * Single source of truth — imported by backend, frontend, platform, and CLI.\n * All values are lowercase (HTTP/2 canonical form). Express normalizes\n * incoming headers to lowercase automatically, so these work for both\n * reading (req.headers[key]) and writing (res.setHeader(key, value)).\n */\nexport const WildoHeaderKeys = {\n  // ── Standard HTTP ──────────────────────────────────────────────────\n  AUTHORIZATION: 'authorization',\n  CONTENT_TYPE: 'content-type',\n  CONTENT_LENGTH: 'content-length',\n  ACCEPT: 'accept',\n  USER_AGENT: 'user-agent',\n  ETAG: 'etag',\n  IF_MATCH: 'if-match',\n  LAST_MODIFIED: 'last-modified',\n  CACHE_CONTROL: 'cache-control',\n  ORIGIN: 'origin',\n  LOCATION: 'location',\n  WWW_AUTHENTICATE: 'www-authenticate',\n  HOST: 'host',\n\n  // ── SIEM webhook (HMAC signature) ───────────────────────────────────\n  X_SIGNATURE_256: 'x-signature-256',\n\n  // ── M2M outbound webhook (JWT signature) ────────────────────────────\n  // Carries the compact-serialized JWT (header.payload.signature) signed\n  // with `JwtPrivateKeys.APPLICATION_WEBHOOK`. Embeds `bodyHash` (sha256\n  // hex of the POST body) as a claim so consumers can verify both\n  // identity AND payload integrity. See\n  // `notifications/webhooks/outbound/` in saas-backend-lib (Phase 3).\n  X_WEBHOOK_SIGNATURE: 'x-wildo-webhook-signature',\n\n  // ── Service identity ───────────────────────────────────────────────\n  SERVICE_ID: 'x-service-id',\n  APPLICATION_ID: 'x-application-id',\n\n  // ── Authentication ─────────────────────────────────────────────────\n  PLATFORM_SECRET: 'x-platform-secret',\n  API_KEY: 'x-api-key',\n  ORGANIZATION_ID: 'x-organization-id',\n  LIFECYCLE_SECRET: 'x-lifecycle-secret',\n\n  /**\n   * A short-lived attestation, MINTED BY apps-manager, that the bearer is one\n   * named runtime principal (`minion:<name>`) of one application.\n   *\n   * A separate header from {@link WildoHeaderKeys.AUTHORIZATION} on purpose. The\n   * bearer is not a platform service and must not present itself through\n   * `SERVICE_ID`, and it is not the application backend either — an application\n   * JWT is signed with a key EVERY runtime of that application holds, so a claim\n   * carried there could name any sibling. This header's token is signed by\n   * apps-manager, which is the only party that learns the principal from the\n   * secret PRESENTED rather than from anything the caller asserts.\n   */\n  RUNTIME_PRINCIPAL_TOKEN: 'x-wildo-runtime-principal-token',\n\n  // ── Target application (cross-app operations) ──────────────────────\n  TARGET_APP_SLUG: 'x-target-app-slug',\n  TARGET_APP_ID: 'x-target-app-id',\n\n  // ── Observability ──────────────────────────────────────────────────\n  // The canonical per-request identifier carried across every service hop. The receiver's\n  // `setupRequestContext` ingests it into the request-scoped ALS frame, so the downstream\n  // request's EC, logs and audit all share one correlationId. (Replaced the former\n  // `x-request-uuid`, which was set on the platform channel but never read back.)\n  CORRELATION_ID: 'x-correlation-id',\n\n  // ── Rate limiting (response) ───────────────────────────────────────\n  RATE_LIMIT_LIMIT: 'x-ratelimit-limit',\n  RATE_LIMIT_REMAINING: 'x-ratelimit-remaining',\n  RATE_LIMIT_RESET: 'x-ratelimit-reset',\n\n  // ── File transfer (gateway) ────────────────────────────────────────\n  FILE_ID: 'x-file-id',\n  STORAGE_KEY: 'x-storage-key',\n\n  // ── Frontend originator ────────────────────────────────────────────\n  FRONTEND_SERVICE_NAME: 'x-frontend-service-name',\n  /**\n   * Which browser/device INSTALL issued the request. Sent ONLY when the application authored a\n   * non-`DISABLED` `compliance.clientInstanceIdScope`, and INGESTED only under that same policy —\n   * the backend fails closed, so an unopted application records nothing even if a client sends it.\n   * See `ClientInstanceIdScope` for the privacy reasoning.\n   */\n  CLIENT_INSTANCE_ID: 'x-client-instance-id',\n\n  // ── Step-up re-authentication ──────────────────────────────────────\n  REAUTH_TOKEN: 'x-reauth-token',\n\n  // ── MFA enrollment ─────────────────────────────────────────────────\n  AUTH_SESSION_ID: 'x-auth-session-id',\n\n  // ── Anonymous sessions (W7.3a) ─────────────────────────────────────\n  ANONYMOUS_SESSION_INIT: 'x-anonymous-session-init',\n  ANONYMOUS_SESSION: 'x-anonymous-session',\n  ANONYMOUS_SESSION_TOKEN: 'x-anonymous-session-token',\n\n  // ── Marketing site first-touch attribution (Phase 0.5, Q-D=β) ──────\n  // Sent by the marketing-site bootstrap on the very first request to\n  // the anonymous-session-init endpoint. Carries the path of the\n  // landing page (e.g. `/pricing`, `/blog/post-slug`) — distinct from\n  // `req.path` because the session-init endpoint URL is itself not a\n  // marketing landing page. Stored ONCE on\n  // `AnonymousUser.marketingMetadata.landingPath` (first-touch only).\n  // Carried in the engine CORS `allowedHeaders` floor (framework-universal),\n  // since it travels with `x-anonymous-session-init` on the same preflighted\n  // session-init request — see `engineAllowedHeaders` in saas-backend-lib's\n  // `http-server.backend.service.ts`.\n  LANDING_PATH: 'x-landing-path',\n\n  // ── Consumable tokens (W7.3b) ──────────────────────────────────────\n  CONSUMABLE_TOKEN: 'x-consumable-token',\n  CONSUMABLE_TOKEN_CONSUMED: 'x-consumable-token-consumed',\n\n  // ── CRDT time synchronization ───────────────────────────────────────\n  X_SERVER_TIME: 'x-server-time',\n\n  // ── Proxy headers ──────────────────────────────────────────────────\n  FORWARDED_FOR: 'x-forwarded-for',\n  FORWARDED_PROTO: 'x-forwarded-proto',\n  FORWARDED_HOST: 'x-forwarded-host',\n  REAL_IP: 'x-real-ip',\n} as const;\n"]}

package/dist/esm/requests/http-requests.shared.d.ts

@@ -17,6 +17,7 @@ export declare enum HttpStatusCode {
     NOT_FOUND = 404,
     METHOD_NOT_ALLOWED = 405,
     CONFLICT = 409,
+    PAYLOAD_TOO_LARGE = 413,
     UNPROCESSABLE_ENTITY = 422,
     TOO_MANY_REQUESTS = 429,
     INTERNAL_SERVER_ERROR = 500,

package/dist/esm/requests/http-requests.shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-requests.shared.d.ts","sourceRoot":"","sources":["../../../src/requests/http-requests.shared.ts"],"names":[],"mappings":"AAEA,oBAAY,UAAU;IACpB,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,oBAAY,cAAc;IACxB,EAAE,MAAM;IACR,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,YAAY,MAAM;IAClB,SAAS,MAAM;IACf,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,QAAQ,MAAM;IACd,oBAAoB,MAAM;IAC1B,iBAAiB,MAAM;IACvB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;IACzB,eAAe,MAAM;CACtB;AAGD,oBAAY,eAAe;IACzB,IAAI,qBAAqB;IACzB,SAAS,wBAAwB;IACjC,IAAI,6BAA6B;IACjC,IAAI,eAAe;IACnB,IAAI,cAAc;IAClB,GAAG,oBAAoB;IACvB,GAAG,aAAa;IAChB,GAAG,oBAAoB;CACxB"}
+{"version":3,"file":"http-requests.shared.d.ts","sourceRoot":"","sources":["../../../../src/requests/http-requests.shared.ts"],"names":[],"mappings":"AAEA,oBAAY,UAAU;IACpB,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,GAAG,QAAQ;IACX,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,oBAAY,cAAc;IACxB,EAAE,MAAM;IACR,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,UAAU,MAAM;IAChB,WAAW,MAAM;IACjB,YAAY,MAAM;IAClB,SAAS,MAAM;IACf,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,QAAQ,MAAM;IACd,iBAAiB,MAAM;IACvB,oBAAoB,MAAM;IAC1B,iBAAiB,MAAM;IACvB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;IACzB,eAAe,MAAM;CACtB;AAGD,oBAAY,eAAe;IACzB,IAAI,qBAAqB;IACzB,SAAS,wBAAwB;IACjC,IAAI,6BAA6B;IACjC,IAAI,eAAe;IACnB,IAAI,cAAc;IAClB,GAAG,oBAAoB;IACvB,GAAG,aAAa;IAChB,GAAG,oBAAoB;CACxB"}

package/dist/esm/requests/http-requests.shared.js

@@ -19,6 +19,7 @@ export var HttpStatusCode;
     HttpStatusCode[HttpStatusCode["NOT_FOUND"] = 404] = "NOT_FOUND";
     HttpStatusCode[HttpStatusCode["METHOD_NOT_ALLOWED"] = 405] = "METHOD_NOT_ALLOWED";
     HttpStatusCode[HttpStatusCode["CONFLICT"] = 409] = "CONFLICT";
+    HttpStatusCode[HttpStatusCode["PAYLOAD_TOO_LARGE"] = 413] = "PAYLOAD_TOO_LARGE";
     HttpStatusCode[HttpStatusCode["UNPROCESSABLE_ENTITY"] = 422] = "UNPROCESSABLE_ENTITY";
     HttpStatusCode[HttpStatusCode["TOO_MANY_REQUESTS"] = 429] = "TOO_MANY_REQUESTS";
     HttpStatusCode[HttpStatusCode["INTERNAL_SERVER_ERROR"] = 500] = "INTERNAL_SERVER_ERROR";
@@ -37,4 +38,4 @@ export var HttpContentType;
     HttpContentType["CSV"] = "text/csv";
     HttpContentType["PDF"] = "application/pdf";
 })(HttpContentType || (HttpContentType = {}));
-//# sourceMappingURL=http-requests.shared.js.map
+//# sourceMappingURL=http-requests.shared.js.map

package/dist/esm/requests/http-requests.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-requests.shared.js","sourceRoot":"","sources":["../../../src/requests/http-requests.shared.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,yBAAW,CAAA;IACX,2BAAa,CAAA;IACb,yBAAW,CAAA;IACX,6BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED,MAAM,CAAN,IAAY,cAiBX;AAjBD,WAAY,cAAc;IACxB,iDAAQ,CAAA;IACR,2DAAa,CAAA;IACb,6DAAc,CAAA;IACd,iEAAgB,CAAA;IAChB,mEAAiB,CAAA;IACjB,qEAAkB,CAAA;IAClB,+DAAe,CAAA;IACf,+DAAe,CAAA;IACf,iFAAwB,CAAA;IACxB,6DAAc,CAAA;IACd,qFAA0B,CAAA;IAC1B,+EAAuB,CAAA;IACvB,uFAA2B,CAAA;IAC3B,mEAAiB,CAAA;IACjB,mFAAyB,CAAA;IACzB,2EAAqB,CAAA;AACvB,CAAC,EAjBW,cAAc,KAAd,cAAc,QAiBzB;AAGD,MAAM,CAAN,IAAY,eASX;AATD,WAAY,eAAe;IACzB,4CAAyB,CAAA;IACzB,oDAAiC,CAAA;IACjC,oDAAiC,CAAA;IACjC,sCAAmB,CAAA;IACnB,qCAAkB,CAAA;IAClB,0CAAuB,CAAA;IACvB,mCAAgB,CAAA;IAChB,0CAAuB,CAAA;AACzB,CAAC,EATW,eAAe,KAAf,eAAe,QAS1B"}
+{"version":3,"file":"http-requests.shared.js","sourceRoot":"","sources":["../../../../src/requests/http-requests.shared.ts"],"names":[],"mappings":"AAEA,MAAM,CAAN,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,yBAAW,CAAA;IACX,2BAAa,CAAA;IACb,yBAAW,CAAA;IACX,6BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,iCAAmB,CAAA;AACrB,CAAC,EAPW,UAAU,KAAV,UAAU,QAOrB;AAED,MAAM,CAAN,IAAY,cAkBX;AAlBD,WAAY,cAAc;IACxB,iDAAQ,CAAA;IACR,2DAAa,CAAA;IACb,6DAAc,CAAA;IACd,iEAAgB,CAAA;IAChB,mEAAiB,CAAA;IACjB,qEAAkB,CAAA;IAClB,+DAAe,CAAA;IACf,+DAAe,CAAA;IACf,iFAAwB,CAAA;IACxB,6DAAc,CAAA;IACd,+EAAuB,CAAA;IACvB,qFAA0B,CAAA;IAC1B,+EAAuB,CAAA;IACvB,uFAA2B,CAAA;IAC3B,mEAAiB,CAAA;IACjB,mFAAyB,CAAA;IACzB,2EAAqB,CAAA;AACvB,CAAC,EAlBW,cAAc,KAAd,cAAc,QAkBzB;AAGD,MAAM,CAAN,IAAY,eASX;AATD,WAAY,eAAe;IACzB,4CAAyB,CAAA;IACzB,oDAAiC,CAAA;IACjC,oDAAiC,CAAA;IACjC,sCAAmB,CAAA;IACnB,qCAAkB,CAAA;IAClB,0CAAuB,CAAA;IACvB,mCAAgB,CAAA;IAChB,0CAAuB,CAAA;AACzB,CAAC,EATW,eAAe,KAAf,eAAe,QAS1B","sourcesContent":["\n\nexport enum HttpMethod {\n  GET = 'GET',\n  POST = 'POST',\n  PUT = 'PUT',\n  PATCH = 'PATCH',\n  DELETE = 'DELETE',\n  OPTIONS = 'OPTIONS',\n}\n\nexport enum HttpStatusCode {\n  OK = 200,\n  CREATED = 201,\n  ACCEPTED = 202,\n  NO_CONTENT = 204,\n  BAD_REQUEST = 400,\n  UNAUTHORIZED = 401,\n  FORBIDDEN = 403,\n  NOT_FOUND = 404,\n  METHOD_NOT_ALLOWED = 405,\n  CONFLICT = 409,\n  PAYLOAD_TOO_LARGE = 413,\n  UNPROCESSABLE_ENTITY = 422,\n  TOO_MANY_REQUESTS = 429,\n  INTERNAL_SERVER_ERROR = 500,\n  BAD_GATEWAY = 502,\n  SERVICE_UNAVAILABLE = 503,\n  GATEWAY_TIMEOUT = 504\n}\n\n\nexport enum HttpContentType {\n  JSON = 'application/json',\n  FORM_DATA = 'multipart/form-data',\n  FILE = 'application/octet-stream',\n  TEXT = 'text/plain',\n  HTML = 'text/html',\n  XML = 'application/xml',\n  CSV = 'text/csv',\n  PDF = 'application/pdf',\n}"]}

package/dist/esm/requests/manual-controllers-routes-urls.d.ts

@@ -4,9 +4,84 @@
  * Shared between backend and frontend to avoid string duplication.
  *
  * Notes:
- * - These URLs are mounted under the main API base path (e.g. /api/v1)
- * - Keep only path segments here (no /api/v1 prefix)
+ * - These URLs are mounted under {@link MAIN_API_BASE_PATH}
+ * - Keep only path segments here (no `MAIN_API_BASE_PATH` prefix) — the
+ *   prefix is prepended once at each boundary (backend mount / frontend client)
  */
+/**
+ * Main API base path — the mount prefix under which the entire main
+ * controllers registry is served (every resource route AND every
+ * {@link MANUAL_CONTROLLER_ROUTES_URLS} entry).
+ *
+ * This is the SINGLE SOURCE OF TRUTH for the prefix. It is consumed by:
+ *  - the backend HTTP server mount (`app.use(MAIN_API_BASE_PATH, mainRouter)`),
+ *  - the frontend HTTP client when building absolute API URLs
+ *    (`${MAIN_API_BASE_PATH}${MANUAL_CONTROLLER_ROUTES_URLS[...]}`),
+ *  - the refresh-token cookie `Path` scope, which MUST path-match the served
+ *    auth routes (`${MAIN_API_BASE_PATH}/auth/*`) or the browser drops it.
+ *
+ * Why a shared symbol and not a literal: previously `/api/v1` was a literal
+ * duplicated across the mount and the client. The absence of a shared symbol
+ * let the refresh-token cookie `Path` be authored against the bare route
+ * segment (`/auth`, omitting this prefix), so the browser stored the cookie
+ * but never sent it to `/api/v1/auth/token/refresh` — silently breaking token
+ * refresh for every session (forced logout on first refresh). Deriving every
+ * prefix consumer from this constant closes that drift class.
+ *
+ * NOT under this prefix: the root-level engine routes in
+ * {@link ENGINE_ROOT_ROUTES} (health/time probes), mounted at the app root.
+ */
+export declare const MAIN_API_BASE_PATH = "/api/v1";
+/**
+ * Where RFC 8414 authorization-server metadata must be served for an issuer that carries a PATH.
+ *
+ * The rule is counter-intuitive and is the reason this exists as a named derivation rather than a
+ * string built at the call site: the well-known segment goes BETWEEN the host and the issuer path,
+ * not after it.
+ *
+ *   "If the issuer identifier value contains a path component, any terminating "/" MUST be removed
+ *    before inserting "/.well-known/" and the well-known URI suffix between the host component and
+ *    the path component."
+ *
+ * with the RFC's own worked example resolving issuer `https://example.com/issuer1` to
+ * `GET /.well-known/oauth-authorization-server/issuer1`.
+ * spec-cite: RFC 8414 § 3 (Obtaining Authorization Server Metadata), fetched 2026-08-11.
+ *
+ * OIDC Discovery uses the OPPOSITE construction — issuer + `/.well-known/openid-configuration` — so
+ * the two cannot share one path and a server that serves only the OIDC shape fails RFC 8414 discovery
+ * while looking correct. That is exactly what happened here: a real MCP client split our issuer at the
+ * host boundary as the RFC instructs, asked for `/.well-known/oauth-authorization-server/api/v1`,
+ * received the SPA shell, and abandoned authorization without ever opening a browser.
+ *
+ * @param issuerPath the issuer's path component (e.g. {@link MAIN_API_BASE_PATH}); a bare `/` or an
+ *                   empty string yields the origin-root location, which is the path-less issuer case.
+ */
+export declare function rfc8414AuthorizationServerMetadataPath(issuerPath: string): string;
+/**
+ * Where RFC 9728 protected-resource metadata must be served for a resource identifier that carries a
+ * PATH — the same insertion rule as {@link rfc8414AuthorizationServerMetadataPath}, for the other
+ * document.
+ *
+ *   "The protected resource's well-known URI is created by inserting
+ *    /.well-known/oauth-protected-resource between the host component and the path component (if any)
+ *    of the resource identifier."
+ * spec-cite: RFC 9728 § 3 (Protected Resource Metadata Request), fetched 2026-08-12.
+ *
+ * This is a SECOND discovery route, not a replacement for the one the challenge names. RFC 9728 § 5.1
+ * lets a client take `resource_metadata` straight from the `WWW-Authenticate` header, and MCP tells
+ * clients to do exactly that — which is why serving only the header's location worked with a real
+ * client and is a defensible posture. It is nevertheless not the whole contract: a client that derives
+ * the location from the resource identifier, as this section permits, previously received the SPA
+ * shell. Both locations now serve one document.
+ *
+ * Note the asymmetry with RFC 8414, because it explains why that one was a live outage and this one
+ * was latent: an authorization server publishes no equivalent pointer, so derivation is a client's
+ * ONLY route to AS metadata.
+ *
+ * @param resourcePath the resource identifier's path component (e.g. `/api/v1/mcp`); a bare `/` or an
+ *                     empty string yields the origin-root location, which is the path-less case.
+ */
+export declare function rfc9728ProtectedResourceMetadataPath(resourcePath: string): string;
 export declare enum ManualControllerRouteKey {
     APPLICATION_CONFIG_GET = "APPLICATION_CONFIG_GET",
     AUTH_IDENTIFY = "AUTH_IDENTIFY",
@@ -19,16 +94,80 @@ export declare enum ManualControllerRouteKey {
     AUTH_ENTERPRISE_SSO_AUTHORIZE = "AUTH_ENTERPRISE_SSO_AUTHORIZE",
     AUTH_APP_ENTERPRISE_AUTHORIZE = "AUTH_APP_ENTERPRISE_AUTHORIZE",
     AUTH_TOKEN_EXCHANGE = "AUTH_TOKEN_EXCHANGE",
+    /**
+     * OAuth 2.0 Authorization Server token endpoint (Wildo-AS-PROVIDER, distinct from the
+     * RP-side `/auth/*` routes). Serves `grant_type=client_credentials` now; the OIDC branch
+     * adds `authorization_code`. Served at `${MAIN_API_BASE_PATH}/oauth/token`.
+     */
+    OAUTH_PROVIDER_TOKEN = "OAUTH_PROVIDER_TOKEN",
+    /** OIDC discovery document (served at `${issuer}/.well-known/openid-configuration`). */
+    OAUTH_PROVIDER_DISCOVERY = "OAUTH_PROVIDER_DISCOVERY",
+    /**
+     * RFC 8414 Authorization Server Metadata (`${issuer}/.well-known/oauth-authorization-server`) —
+     * the SAME document as {@link OAUTH_PROVIDER_DISCOVERY}, served at the OAuth-2 well-known path that
+     * many OAuth/MCP clients probe FIRST (before the OIDC path). Aliases the discovery handler.
+     */
+    OAUTH_PROVIDER_AS_METADATA = "OAUTH_PROVIDER_AS_METADATA",
+    /** JSON Web Key Set for verifying Wildo-issued tokens (the discovery doc's `jwks_uri`). */
+    OAUTH_PROVIDER_JWKS = "OAUTH_PROVIDER_JWKS",
+    /** OIDC authorization endpoint (authorization_code flow — the caller lands here to consent). */
+    OAUTH_PROVIDER_AUTHORIZE = "OAUTH_PROVIDER_AUTHORIZE",
+    /**
+     * OIDC interactive-consent decision endpoint. When the authorize endpoint returned
+     * `consent_required` for a `requiresConsent` client, the user's approve/deny decision is POSTed
+     * here with the single-use consent-request token; APPROVE mints the authorization code.
+     */
+    OAUTH_PROVIDER_CONSENT = "OAUTH_PROVIDER_CONSENT",
+    /** OIDC UserInfo endpoint (bearer access token → the user's standard claims). */
+    OAUTH_PROVIDER_USERINFO = "OAUTH_PROVIDER_USERINFO",
+    /** OAuth 2.0 token revocation endpoint (RFC 7009). */
+    OAUTH_PROVIDER_REVOKE = "OAUTH_PROVIDER_REVOKE",
+    /**
+     * OIDC RP-Initiated Logout 1.0 `end_session_endpoint` (revocation-C). A relying party redirects the
+     * End-User here (with an `id_token_hint`) to terminate their Wildo OP login session — the exact
+     * session the delegation was authorized from, keyed on the id_token's `sid`. Distinct from
+     * {@link OAUTH_PROVIDER_REVOKE}: revoke kills a TOKEN (RFC 7009); end_session ends a SESSION.
+     */
+    OAUTH_PROVIDER_END_SESSION = "OAUTH_PROVIDER_END_SESSION",
+    /**
+     * OIDC RP-Initiated Logout 1.0 §6 confirmation decision (revocation-C). The `POST` the frontend
+     * `/oauth/logout-confirm` prompt calls to actually terminate the session, presenting the single-use
+     * `OIDC_LOGOUT_CONFIRMATION` token minted by {@link OAUTH_PROVIDER_END_SESSION}. Token-authorized
+     * (no Bearer — the End-User may be unauthenticated in the SPA, having arrived via an RP redirect);
+     * returns `{ redirect_to }` (always the same-origin signed-out page `/oauth/logged-out`; the SPA
+     * navigates there). Only reached for NON-trusted logouts — a trusted RP logout terminates + redirects
+     * inline without a prompt (the Keycloak-style posture).
+     */
+    OAUTH_PROVIDER_END_SESSION_CONFIRM = "OAUTH_PROVIDER_END_SESSION_CONFIRM",
+    /**
+     * RFC 7591 dynamic client registration. Registered UNCONDITIONALLY so the route always exists;
+     * the handler answers 404 unless the application opted in via `auth.dynamicClientRegistration`.
+     * Registering it conditionally would make the route table depend on config, which is far harder
+     * to reason about than one handler that refuses.
+     */
+    OAUTH_PROVIDER_REGISTER = "OAUTH_PROVIDER_REGISTER",
+    /**
+     * Cross-frontend session handoff (cross-app-jwt-propagation Step 2).
+     * Authenticated user requests a one-time AUTH_CODE_EXCHANGE token bound to a
+     * target frontend, then redirects the browser to the target's
+     * /auth/exchange page with the code. Bearer-only; CORS auto-allowed for every
+     * declared frontendService via the existing deriveCorsOrigins() seam.
+     */
+    AUTH_CROSS_FRONTEND_HANDOFF = "AUTH_CROSS_FRONTEND_HANDOFF",
     AUTH_LOGOUT = "AUTH_LOGOUT",
+    /** Sign-out-everywhere: fences the whole user — all access + refresh tokens, every device — via the invalidation fence. */
+    AUTH_LOGOUT_ALL = "AUTH_LOGOUT_ALL",
     AUTH_PASSWORD_RESET_REQUEST = "AUTH_PASSWORD_RESET_REQUEST",
     AUTH_PASSWORD_RESET_COMPLETE = "AUTH_PASSWORD_RESET_COMPLETE",
     AUTH_REGISTER = "AUTH_REGISTER",
     AUTH_ACCEPT_INVITATION = "AUTH_ACCEPT_INVITATION",
+    AUTH_INVITATION_INFO = "AUTH_INVITATION_INFO",
     AUTH_REJECT_INVITATION = "AUTH_REJECT_INVITATION",
+    AUTH_LIST_MY_INVITATIONS = "AUTH_LIST_MY_INVITATIONS",
+    AUTH_ACCEPT_MY_INVITATION = "AUTH_ACCEPT_MY_INVITATION",
+    AUTH_REJECT_MY_INVITATION = "AUTH_REJECT_MY_INVITATION",
     AUTH_VERIFY_EMAIL = "AUTH_VERIFY_EMAIL",
     AUTH_SESSION_STATE = "AUTH_SESSION_STATE",
-    /** [Capacitor] Exchange native Apple/Google SDK identity token for Wildo JWT (F2) */
-    AUTH_NATIVE_TOKEN_EXCHANGE = "AUTH_NATIVE_TOKEN_EXCHANGE",
     AUTH_MFA_EMAIL_OTP_SEND = "AUTH_MFA_EMAIL_OTP_SEND",
     AUTH_MFA_EMAIL_OTP_VERIFY = "AUTH_MFA_EMAIL_OTP_VERIFY",
     AUTH_MFA_TOTP_SETUP = "AUTH_MFA_TOTP_SETUP",
@@ -52,6 +191,8 @@ export declare enum ManualControllerRouteKey {
     AUTH_ONE_OFF_SESSION_CREATE = "AUTH_ONE_OFF_SESSION_CREATE",
     AUTH_ONE_OFF_SESSION_CREATE_ORG = "AUTH_ONE_OFF_SESSION_CREATE_ORG",
     AUTH_ONE_OFF_SESSION_EXCHANGE = "AUTH_ONE_OFF_SESSION_EXCHANGE",
+    AUTH_ONE_OFF_SESSION_REVOKE = "AUTH_ONE_OFF_SESSION_REVOKE",
+    AUTH_ONE_OFF_SESSION_REVOKE_ORG = "AUTH_ONE_OFF_SESSION_REVOKE_ORG",
     AUTH_PASSWORD_CHANGE = "AUTH_PASSWORD_CHANGE",
     AUTH_PASSWORD_SET = "AUTH_PASSWORD_SET",
     AUTH_MFA_TOTP_DISABLE = "AUTH_MFA_TOTP_DISABLE",
@@ -59,16 +200,59 @@ export declare enum ManualControllerRouteKey {
     AUTH_IDENTITY_LINKS_LIST = "AUTH_IDENTITY_LINKS_LIST",
     AUTH_IDENTITY_LINKS_UNLINK = "AUTH_IDENTITY_LINKS_UNLINK",
     AUTH_REAUTH = "AUTH_REAUTH",
+    /** Challenge leg of a PASSKEY step-up: WebAuthn is challenge-response, so re-auth needs two round-trips. */
+    AUTH_REAUTH_PASSKEY_OPTIONS = "AUTH_REAUTH_PASSKEY_OPTIONS",
     AUTH_SAML_LOGIN = "AUTH_SAML_LOGIN",
     AUTH_SAML_ACS = "AUTH_SAML_ACS",
     AUTH_SAML_METADATA = "AUTH_SAML_METADATA",
     AUTH_SAML_SLO = "AUTH_SAML_SLO",
+    /** SP-INITIATED SLO kickoff: the app asks the backend to log the caller out of their SAML session and (when the IdP supports it) redirect to the IdP's SLO endpoint. Distinct from AUTH_SAML_SLO, which is the INBOUND endpoint the IdP calls. */
+    AUTH_SAML_SP_LOGOUT = "AUTH_SAML_SP_LOGOUT",
     I18N_GET_LABELS = "I18N_GET_LABELS",
     CHARTS_DATA = "CHARTS_DATA",
     ANALYTICS_EVENTS = "ANALYTICS_EVENTS",
     ANALYTICS_MOMENTS_ACHIEVED = "ANALYTICS_MOMENTS_ACHIEVED",
     PROGRESSION_MILESTONES = "PROGRESSION_MILESTONES",
-    FEATURES_RESOLVED = "FEATURES_RESOLVED"
+    FEATURES_RESOLVED = "FEATURES_RESOLVED",
+    /** Frontend-visible flow/actor systems (metadata + renderable graph). */
+    FLOWS_ACTORS_FRONTEND_INFO = "FLOWS_ACTORS_FRONTEND_INFO",
+    /** The caller's own conversation history for a flow/actor system. */
+    FLOWS_ACTORS_HISTORY = "FLOWS_ACTORS_HISTORY",
+    /**
+     * A2A agent card (public, CORS-open metadata) advertising this app's exposed
+     * actor systems as A2A skills + the security schemes a caller must satisfy.
+     * Analogous to the OIDC discovery doc; the served path can be reverse-proxy
+     * aliased to a root `/.well-known/agent-card.json`.
+     */
+    A2A_AGENT_CARD = "A2A_AGENT_CARD",
+    /**
+     * A2A JSON-RPC task/message endpoint (`message/send`, `message/stream` via SSE).
+     * Its absolute URL is the agent card's `url` AND the agent's canonical
+     * audience — an inbound access token MUST carry this as its `aud` (RFC 8707 / D7).
+     */
+    A2A_TASKS = "A2A_TASKS",
+    /**
+     * MCP JSON-RPC 2.0 endpoint (Streamable-HTTP transport): `initialize`, `tools/list`,
+     * `tools/call`. A `tools/call` is Bearer-credentialed by a machine OR user-delegated access token
+     * that is resource-server-bound to the MCP audience — NOT the generic API audience, which this
+     * surface rejects since the 2026-07-29 strict flip (RFC 8707 / D7) — validated at auth time; the
+     * server re-runs `authorizeInController` before dispatch (fail-closed).
+     *
+     * Also the base for the R-2 NAMED server instances: `POST /mcp/:instanceRef` serves a declared
+     * instance with its own audience (`…/mcp/<ref>`) and curated catalog.
+     */
+    MCP_ENDPOINT = "MCP_ENDPOINT",
+    /**
+     * MCP OAuth 2.0 Protected Resource Metadata (RFC 9728): advertises this MCP server's
+     * `resource` identifier + the `authorization_servers` (the app's own OIDC provider) an MCP
+     * client uses to obtain a token. Public, CORS-open metadata (like the OIDC discovery doc).
+     *
+     * Mounted TWICE: at the API root for the DEFAULT server, and appended to each named instance
+     * (`/mcp/:instanceRef` + this route) so every instance advertises its OWN audience. A 401 at either
+     * surface points its `WWW-Authenticate: resource_metadata=` at the matching one — the only discovery
+     * route a client has, since this path is non-standard (it is not the RFC's origin-root form).
+     */
+    MCP_PROTECTED_RESOURCE_METADATA = "MCP_PROTECTED_RESOURCE_METADATA"
 }
 export declare const MANUAL_CONTROLLER_ROUTES_URLS: Record<ManualControllerRouteKey, string>;
 export declare enum EngineRootRouteKey {

package/dist/esm/requests/manual-controllers-routes-urls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manual-controllers-routes-urls.d.ts","sourceRoot":"","sources":["../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,oBAAY,wBAAwB;IAClC,sBAAsB,2BAA2B;IAEjD,aAAa,kBAAkB;IAC/B,0BAA0B,+BAA+B;IACzD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,kFAAkF;IAClF,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D,mBAAmB,wBAAwB;IAC3C,WAAW,gBAAgB;IAC3B,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAC7D,aAAa,kBAAkB;IAC/B,sBAAsB,2BAA2B;IACjD,sBAAsB,2BAA2B;IACjD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,qFAAqF;IACrF,0BAA0B,+BAA+B;IAGzD,uBAAuB,4BAA4B;IACnD,yBAAyB,8BAA8B;IAGvD,mBAAmB,wBAAwB;IAC3C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAG7C,6BAA6B,kCAAkC;IAC/D,4BAA4B,iCAAiC;IAC7D,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAG3C,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAG3C,sBAAsB,2BAA2B;IACjD,yBAAyB,8BAA8B;IAGvD,wBAAwB,6BAA6B;IAGrD,4BAA4B,iCAAiC;IAG7D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IACnE,6BAA6B,kCAAkC;IAG/D,oBAAoB,yBAAyB;IAC7C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,0BAA0B,+BAA+B;IACzD,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,aAAa,kBAAkB;IAC/B,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;IAE/B,eAAe,oBAAoB;IAEnC,WAAW,gBAAgB;IAE3B,gBAAgB,qBAAqB;IACrC,0BAA0B,+BAA+B;IAEzD,sBAAsB,2BAA2B;IACjD,iBAAiB,sBAAsB;CACxC;AAED,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAuFlF,CAAC;AAOF,oBAAY,kBAAkB;IAC5B,eAAe,oBAAoB;IACnC,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAIjE,CAAC"}
+{"version":3,"file":"manual-controllers-routes-urls.d.ts","sourceRoot":"","sources":["../../../../src/requests/manual-controllers-routes-urls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sCAAsC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,oCAAoC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEjF;AAeD,oBAAY,wBAAwB;IAClC,sBAAsB,2BAA2B;IAEjD,aAAa,kBAAkB;IAC/B,0BAA0B,+BAA+B;IACzD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IACzC,qBAAqB,0BAA0B;IAC/C,oBAAoB,yBAAyB;IAC7C,kFAAkF;IAClF,6BAA6B,kCAAkC;IAC/D,6BAA6B,kCAAkC;IAC/D,mBAAmB,wBAAwB;IAC3C;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,wFAAwF;IACxF,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,0BAA0B,+BAA+B;IACzD,2FAA2F;IAC3F,mBAAmB,wBAAwB;IAC3C,gGAAgG;IAChG,wBAAwB,6BAA6B;IACrD;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD,iFAAiF;IACjF,uBAAuB,4BAA4B;IACnD,sDAAsD;IACtD,qBAAqB,0BAA0B;IAC/C;;;;;OAKG;IACH,0BAA0B,+BAA+B;IACzD;;;;;;;;OAQG;IACH,kCAAkC,uCAAuC;IACzE;;;;;OAKG;IACH,uBAAuB,4BAA4B;IACnD;;;;;;OAMG;IACH,2BAA2B,gCAAgC;IAC3D,WAAW,gBAAgB;IAC3B,2HAA2H;IAC3H,eAAe,oBAAoB;IACnC,2BAA2B,gCAAgC;IAC3D,4BAA4B,iCAAiC;IAC7D,aAAa,kBAAkB;IAC/B,sBAAsB,2BAA2B;IAIjD,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,wBAAwB,6BAA6B;IACrD,yBAAyB,8BAA8B;IACvD,yBAAyB,8BAA8B;IACvD,iBAAiB,sBAAsB;IACvC,kBAAkB,uBAAuB;IAGzC,uBAAuB,4BAA4B;IACnD,yBAAyB,8BAA8B;IAGvD,mBAAmB,wBAAwB;IAC3C,0BAA0B,+BAA+B;IACzD,oBAAoB,yBAAyB;IAG7C,6BAA6B,kCAAkC;IAC/D,4BAA4B,iCAAiC;IAC7D,yBAAyB,8BAA8B;IACvD,wBAAwB,6BAA6B;IACrD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAC3C,mBAAmB,wBAAwB;IAG3C,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD,iBAAiB,sBAAsB;IACvC,mBAAmB,wBAAwB;IAG3C,sBAAsB,2BAA2B;IACjD,yBAAyB,8BAA8B;IAGvD,wBAAwB,6BAA6B;IAGrD,4BAA4B,iCAAiC;IAG7D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IACnE,6BAA6B,kCAAkC;IAC/D,2BAA2B,gCAAgC;IAC3D,+BAA+B,oCAAoC;IAGnE,oBAAoB,yBAAyB;IAC7C,iBAAiB,sBAAsB;IACvC,qBAAqB,0BAA0B;IAC/C,iBAAiB,sBAAsB;IACvC,wBAAwB,6BAA6B;IACrD,0BAA0B,+BAA+B;IACzD,WAAW,gBAAgB;IAC3B,4GAA4G;IAC5G,2BAA2B,gCAAgC;IAG3D,eAAe,oBAAoB;IACnC,aAAa,kBAAkB;IAC/B,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;IAC/B,kPAAkP;IAClP,mBAAmB,wBAAwB;IAE3C,eAAe,oBAAoB;IAEnC,WAAW,gBAAgB;IAE3B,gBAAgB,qBAAqB;IACrC,0BAA0B,+BAA+B;IAEzD,sBAAsB,2BAA2B;IACjD,iBAAiB,sBAAsB;IAEvC,yEAAyE;IACzE,0BAA0B,+BAA+B;IACzD,qEAAqE;IACrE,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,cAAc,mBAAmB;IACjC;;;;OAIG;IACH,SAAS,cAAc;IAGvB;;;;;;;;;OASG;IACH,YAAY,iBAAiB;IAC7B;;;;;;;;;OASG;IACH,+BAA+B,oCAAoC;CACpE;AAED,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAoIlF,CAAC;AAOF,oBAAY,kBAAkB;IAC5B,eAAe,oBAAoB;IACnC,gBAAgB,qBAAqB;IACrC,WAAW,gBAAgB;CAC5B;AAED,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAIjE,CAAC"}